DeFi Protocol Curve Finance Loses $570K in a DNS Hack

The suspected hacker appears to have changed the Domain Name System (DNS) entry for the protocol to redirect the DNS point to another IP address which then added approval requests to a malicious smart contract in order to steal user funds.

More specifically, an illicit actor appears to have cloned Curve’s frontend using a DNS spoofing method which resulted in any transactions being made via the site being redirected to the hackers’ wallets. DNS spoofing is a type of attack in which hackers mimic legitimate server destinations by impersonating another service in order to redirect users to the wrong website.

Curve Finance has stated that the hack was a result of their DNS service provider iwantmyname being compromised, however the project has since changed its nameserver. A nameserver is a server in the DNS that translates domain names into IP addresses and routes traffic across the internet. Nameservers also store and organise DNS records, each of which pairs a domain with one or more IP addresses.

Over $570,000 worth of funds were stolen however, the platform’s smart contract remained unaffected as it was under a different domain name.

In response to the hack, the project stated that users should refrain from performing any approvals, swaps or using curve.fi or curve.exchange until the protocol’s operators could locate the source of the exploit.

Curve Resolves Site Exploit

An hour after the initial warning, the protocol’s operators confirmed that they found the source of the problem and reverted the issue, directing users who had approved any contracts on Curve at the time to revoke them “immediately.”