Multiple decentralized finance (DeFi) apps were targeted in a domain registry attack on July 11, according to an X post from blockchain security platform Blockaid. The attacker has taken control of the DNS registry for Compound Finance and has attempted — but failed — to take control of Celer Network’s registry. 

After a preliminary investigation, Blockaid concluded that the attacker is targeting domain names provided by Squarespace, potentially putting any DeFi app with a Squarespace domain at risk.

Source: Blockaid

Security researchers first became aware of the attack when the Compound interface at compound.finance began redirecting to a malicious website. The malicious site was equipped with a drainer app that attempted to steal users’ tokens.

Related: Compound Finance site potentially breached — ZachXBT

At 1:38 pm UTC, Celer network announced that it, too, had been attacked. However, in this case, Celer stated that its domain monitoring system had detected the takeover and intercepted it before it could succeed.

At 3:38 pm UTC, Blockaid announced that “multiple DeFi front ends are at risk of hijacking, with a few incidents already taking place[.]” “From initial assessment, it appears that the attackers are operating by hijacking DNS records of projects hosted on SquareSpace,” it stated.

0xngmi, a developer at the blockchain analytics platform DefiLlama,  posted a list of domains that may be affected by the attack. The list includes more than 100 DeFi protocols, including Pendle Finance, dYdX, Polymarket, Satoshi Protocol, Nirvana, LooksRare and many others.

Web3 wallet MetaMask announced that it is attempting to warn users of possibly compromised apps associated with the attack. “For those of you using MetaMask, you’ll see a warning provided by @blockaid_ if you attempt to transact on any known site that’s involved in this current attack,” it stated.

Source: MetaMask

Domain name hijacking has been one of several attacks against the Web3 industry over the past year. In December, an attacker injected malicious code into the Ledger Connect library that most Web3 apps use for wallet connections, affecting nearly the entire Ethereum Virtual Machine ecosystem.

Magazine:  Crypto-Sec: Phishing scammer goes after Hedera users, address poisoner gets $70K