DNS Hijack | Curve.Fi on Target!

Curve is a decentralized exchange that is used by millions of crypto investors daily. The platform enables investors to exchange their stablecoins and other cryptocurrencies with their wrapped versions in the liquidity pools.

With Aave, Curve has $6B TVL on several blockchains including Ethereum, Avalanche and Layer 2 Polygon, Arbitrum, and Optimism. Frankly, having Aave and Curve on your L2 or Mainnet makes it a worthy project in the eyes of many people. Both projects are prestigious to collaborate with!

Owning 5th highest TVL on it, Curve suffered a DNS hijack a couple of hours ago. Let's see what happened and why did it take place.

DNS Vulnerability - Frontent Attack

Hackers were able to manipulate the DNS service and they were able to control curve.fi domain. When they were able to manipulate it, the contract address was changed by their own wallet:

As you can see above, this contract address was the one that the hackers gathered the money from investors.

According to Decrypt, so far $570K worth of Ethereum is stolen. Thanks to blockchain, it is relatively easy to track the transactions of the known wallet addresses.

A Twitter user, pepe_de_niro, provided the traffic of the wallet. As you can see above, Tornado Cash, Binance and some personal Ethereum wallets are included.

Yesterday we talked about Tornado Cash Sanctions and Blacklists and the next day it happened 😅 Knowing this fact, Hackers tried to use FixedFloat but the service provider took an immediate action to freeze the funds.

Question: Is it the good side of CeFi?
You decide 😉

Web3 in Under Attack

I coined the word Hackaverse in which blockchain-based projects are hacked or, at least, stress-tested by malicious attacks. Using GoDaddy for DNS, Curve was hunted down from its weak side.

Imagine you lose your money while you are using Curve. Let's be honest, it is gone. While De-Fi services are still dealing with such weaknesses, it is too hard to rely on them.

Mobile Wallets, DNS, Bridges, and Tokenomics... All these cases have one thing in common: Suffering people... What makes Hive unique is the security of the wallet. I do not feel that I need a Ledger to secure my Hive / HBD or Hive tokens. Just count how many Hive private keys you have for your single account and the number of frontends you can use to access your funds.

Hackaverse mode: ON

How many hack, exploit and sanction news have we seen in a month? I think the ecosystem is putting huge efforts to safely pass through the bear market and the depressing atmosphere in cryptoworld.

FUD lost its value as the market does not actually react to it as before. Contrarily, hacking is not something negligible; it is devastating for a blockchain-based ecosystem. During this bear market, I'm not going to dive into newly developed apps, wallets or products that I need to download to access.

Better to stay on the safe side. Even the Curve team (managing $6B TVL) may have hilarious "mistakes". However, tiny mistakes may end up losing your whole savings in a couple of minutes.

Stay Safe ✌🏼

Posted Using LeoFinance ^Beta