At Curve Finance triggers wallet drains, registrar intervenes — Domain exploit
It’s the second time the firm has faced an issue like this.
Cryptocurrency trading platform Curve Finance is blaming a DNS issue for an imposter site that was able to drain wallets.
The platform has been using the domain name curve .fi for its website. .Fi is the country code for Finland, and .fi domains are commonly used by DeFi firms.
Overnight, the firm noted on social media that “the curve [.] fi domain was compromised at the DNS level. This exploit redirected traffic to a malicious IP not associated with Curve Finance.”
Historical Whois records show that the Cloudflare nameservers for the domain recently changed from kinsley.ns.cloudflare.com and major.ns.cloudflare.com
to jerry.ns.cloudflare.com ursula.ns.cloudflare.com.
People who visited the impostor site could have items withdrawn from their wallets. Still, the firm stated no internal systems or smart contracts were breached.
Curve Finance wrote:
The DNS incident involving curve [.] fi reflects a broader issue across the industry. In recent weeks, there has been a noticeable increase in attacks targeting the infrastructure of various crypto projects. Such incidents affect the entire market and highlight the importance of a systematic approach to protection. Curve Finance is taking all necessary measures to ensure the safety of user funds and restore the stable operation of the service.
The firm stated it worked with its domain registrar, IWantMyName, to recover its DNS settings. The registrar has added suspension nameservers, so the domain doesn’t resolve.
Amazingly, this isn’t the first time the firm has experienced an exploit of this nature.
During this incident, the firm encouraged clients to visit its site at the alternative domain curve.finance, and it is considering permanently moving to this domain. Curve.finance is registered at GoDaddy.
