Following recent domain hijacking incidents affecting several decentralized finance (DeFi) protocols due to vulnerabilities on Squarespace domains, key figures in the crypto community have issued warnings and advice to mitigate risks:
Incident Overview:
- Initial Attack: On July 11, security investigator ZachXBT alerted the community to a phishing attack targeting the Compound Finance website, which was compromised due to vulnerabilities in Squarespace’s domain registrar.
- Subsequent Incidents: Other DeFi protocols, including Celer Network, also reported attempted attacks but managed to prevent them.
- Vulnerable Domains: A list shared by DefiLlama developer “0xngmi” identified over 100 protocols vulnerable to similar attacks, impacting platforms like Polymarket, dYdX, and Pendle Finance.
Recommendations from Crypto Executives:
- Avoid Interactions: Bobby Ong, founder of CoinGecko, advised users not to interact with crypto platforms until the issue is resolved. He highlighted that the removal of two-factor authentication (2FA) during Google’s domain business migration to Squarespace had left domains vulnerable.
- Consider Domain Transfers: Security researcher Samzsun suggested that affected parties should consider transferring their domains to alternative providers known for better security practices. Recommendations included Cloudflare, Amazon Web Services (AWS) Route 53, MarkMonitor, and CSC DBS.
- Advantages of Web3 Domains: Matthew Gould, CEO of Unstoppable Domains (UD), emphasized the benefits of Web3 domains in mitigating such attacks. He explained that using onchain records for domain verification adds an extra layer of protection. With verified onchain signatures, DNS records can be configured not to update unless authorized, reducing the risk of unauthorized changes.
- Enhanced Security Measures: Gould proposed further security enhancements, such as disallowing record updates without signatures from authenticated wallets. This would require attackers to compromise both the registrar and the user’s wallet, thus increasing the security threshold against domain hijacking attempts.
Conclusion:
The recent domain hijacking incidents underscore the critical need for robust cybersecurity measures within the DeFi space. As the community awaits resolutions from affected platforms and domain providers, adhering to precautionary measures and leveraging secure domain services like Web3 domains can help mitigate future risks associated with domain vulnerabilities in the crypto ecosystem.
