The Curve Finance DNS Hijack Explained

Video transcript

On August 9, 2022, Curve users typing the right address landed on a cloned site. The contracts were never touched.

The domain was redirected to the attacker's server, which served the clone. It asked users to approve a malicious contract, and those who did lost funds.

Accounts differ. Founder Michael Egorov said the registrar's nameservers were compromised, with no account hack. The registrar's report pointed to DNS cache poisoning. Neither account has been settled publicly.

Rekt News put the loss at 340 ETH, about 575,000 dollars. Of 292 ETH sent to the FixedFloat exchange, 112 ETH was frozen.

Users had no easy way to tell, because the address in the browser was the real one. A well-tested app cannot help if its name leads somewhere else.

Curve told users who had recently approved contracts to revoke immediately. The next day, it urged a move to ENS instead of DNS.

Lock the domain and protect registrar accounts with hardware-key MFA. Use DNSSEC where supported. Check resolution from several networks, monitor the scripts users receive, and keep a backup domain ready.

Guardian's WebApp Pentest tests the interface between a user and their funds. The name in front needs watching too, through Shield and Sentry in Managed Security.

Read the full article for the timeline and sources, or talk to Guardian about the surface your users land on.

The Curve Finance DNS hijack did not touch Curve's contracts. The attacker changed where curve.fi pointed.

Users who typed the right address landed on a copy of the site. The copy asked them to approve a contract the attacker controlled.

Here is what Curve, its registrar and reporters said at the time.

What Happened

On August 9, 2022, a Paradigm researcher tweeted that Curve's front end had been compromised, The Block reported.

Curve warned: "We are becoming aware of a potential front end issue that is approving a bad contract." It told users: "For now, please do not perform any approvals or swaps," CoinDesk reported.

It pointed users to its alternate interface, curve.exchange, where the exploit was not active, rekt.news reported.

The same day, Curve said the source had been found and reverted. "If you have approved any contracts on Curve in the past few hours, please revoke immediately," it said.

The cloned site was "taken down quickly," rekt wrote on August 10. Some nameservers were still to be updated.

How the Attack Worked

The DNS for curve.fi was redirected to the attacker's IP address, which served a clone of the site, The Block reported.

The clone added approval requests for a malicious contract. Users who approved it lost funds to the attacker.

CoinDesk reported that Curve's contracts were not compromised.

What Curve and the registrar said

Two accounts of the mechanism were published. Neither has been settled publicly.

Curve founder Michael Egorov told rekt.news: "dns registrar iwantmyname had their ns compromised." He added: "No account hack."

iwantmyname's status report on the August 9 outage does not name Curve. Curve shared a report from the registrar on August 10, Decrypt's Spanish edition reported.

The status report says one customer's domain was targeted, and its DNS records were changed to point to a cloned web server.

It says its investigation with its DNS provider "indicates that it was DNS Cache poisoning rather than any nameservers compromised."

It adds: "We are still looking into the root cause and the full timeline."

Curve summed up the registrar's report: "In brief: DNS cache poisoning, not nameserver compromise." We found no fuller public root cause.

Timeline and Loss

rekt.news put the loss at 340 ETH, about $575,000. CoinDesk and The Block reported about $570,000; The Block credited onchain investigator ZachXBT.

Where the funds went, per rekt:

• 292 ETH to the FixedFloat exchange, of which 112 ETH was frozen.
• 20 ETH to Binance.
• 27.7 ETH to Tornado Cash.

The Block put the amount FixedFloat froze at roughly $200,000. Egorov pointed to "a good bunch of hacked money frozen by centralized services."

What It Shows

DNS and the registrar are part of the web surface. A well-tested app does not help users if its name leads somewhere else.

Users had no easy way to tell. The address in the browser was the real one.

Curve drew its own lesson on August 10: "What has happened STRONGLY suggests to start moving to ENS instead of DNS."

Checks for any team with a web front end:

• Lock the domain at the registrar, and use registry lock where offered.
• Protect registrar and DNS accounts with hardware-key MFA and few admins.
• Sign zones with DNSSEC where your registrar and DNS host support it.
• Check what your domain resolves to from several networks, and alert on changes you did not make.
• Monitor the page and scripts users receive, not just uptime.
• Keep a backup domain ready, as Curve had curve.exchange, and draft a revoke notice.

Our comparison of the most secure domain registrars covers the account controls.

For a 2026 case, read the CoW Swap DNS hijack explained.

What Guardian Tests and Watches

Guardian's WebApp Pentest is built for "the interface between a user and their funds."

It tests the client-side surface: XSS, injection, CSRF, bundle supply chain, and what the frontend trusts from the API.

Guardian maps the application function by function at every privilege level, then tests each one. Frontend-only and backend-only scopes are available.

The WebApp Pentest tests the app. The name in front of it needs watching, which sits in Guardian's Managed Security.

There, Shield covers "the names that lead users to you," and "Sentry watches your domains, DNS, certificates, cloud and code host."

Frequently Asked Questions

How was Curve Finance's DNS hijacked?

Accounts differ. Founder Michael Egorov told rekt.news that registrar iwantmyname had its nameservers compromised, with no account hack. The registrar's report, which Curve shared, pointed to DNS cache poisoning and said the root cause was still under investigation.

How much was lost in the Curve DNS hijack?

rekt.news put it at 340 ETH, about $575,000. CoinDesk and The Block reported about $570,000. Of the 292 ETH sent to FixedFloat, 112 ETH was frozen, per rekt.

Were Curve's smart contracts hacked?

No. CoinDesk reported the contracts were not compromised. The attacker changed where curve.fi pointed, and the cloned site asked users to approve a malicious contract.

What should users do after approving a malicious contract?

Revoke the approval at once. Curve told anyone who had approved a contract on Curve in the past few hours to revoke immediately, and rekt.news pointed users to revoke.cash.

Sources

• rekt.news: Curve Finance, Rekt (August 10, 2022)
• CoinDesk: DeFi Protocol Curve.Finance Gets Hacked and $570K Is Stolen (August 9, 2022)
• The Block: Curve Finance resolves hack from earlier today (August 9, 2022)
• iwantmyname: DNS Outage Investigation, 9th August (August 9, 2022)
• Decrypt (Spanish edition): Curve Sugiere Migrar a Servicio de Nombres en Ethereum Tras Hack Que Involucró su DNS (August 11, 2022)