DeFi DNS Hijack Prevention: A Checklist for Protocol Teams
Quick answer. Lock critical domains at the registry, keep them at an enterprise registrar with hardware-key logins, and alert on nameserver, registrar and certificate changes. Rehearse the response: site controls like CSP cannot stop a full hijack.
Video transcript
A DeFi domain hijack leaves your contracts intact. Attackers change where the name points, and visitors land on a drainer behind a valid padlock.
In late October 2026, about a dozen DeFi sites were redirected to wallet drainers. The Block traced about one hundred thirty eight thousand dollars stolen.
The public cases follow one pattern. Get into the registrar or the registry above it. Repoint the name, get a fresh certificate, and serve a drainer.
Support desks and a registry were the way in. No affected team reported a smart contract flaw.
Prevention runs in five layers. Lock the domain at the registry, sign DNS and watch certificates, put hardware keys on every login, harden the frontend, then monitor and respond.
Know the limits. In a full hijack, CSP and SRI have zero effect, and DNSSEC and CAA can be worked around. Certificate alerts and an ENS mirror still help.
Hijacks often show early signs. At CoW Swap, the holder email changed about eighty minutes before the phishing site went live.
Write the first hour down now. Warn users off the domain, call your registrar's security team, open a SEAL nine one one ticket, request an emergency lock, and move to a backup domain.
The full checklist and runbook are below. To have Guardian watch your domains, DNS and certificates, talk to us about Managed Security at guardian.security.
On October 30 and 31, 2026, about a dozen DeFi sites registered with Name.com sent visitors to wallet drainers. The Block traced about $138,000 in stolen funds.
The projects' contracts stayed intact, Crypto Briefing reported. The attackers changed where the domains pointed, the same move behind hijacks at Curve, CoW Swap and others since May 2025.
This guide is the prevention checklist, grouped by layer, with the incident pattern behind it. For single incidents, read our Curve and CoW Swap explainers.
How a Domain Hijack Unfolds
The public cases follow the same four steps.
- Get into the registrar. Take over the account, or talk its support desk into a recovery or transfer.
- Or go above it. CoW's attacker sent forged documents to Finland's .fi registry, CoW's post-mortem says.
- Repoint the name. Change the nameservers or records, then get a fresh certificate.
- Serve a drainer. A copy of the site asks visitors to approve transfers or sign messages.
Visitors see the real domain and a valid padlock.
Email goes with the domain. SEAL warns that an attacker can change MX records and receive password resets for accounts tied to it.
The Incident Pattern
Each row comes from the affected team or reputable reporting. Losses are as each source states them.
| Date | Target | Way in | Reported loss |
|---|---|---|---|
| May 12, 2025 | curve.fi | Registrar iwantmyname's systems accessed, Curve says | Not stated by Curve |
| Nov 22, 2025 | Aerodrome, Velodrome | Centralized domains hijacked; cause not named | No confirmed total |
| Feb 16 to 23, 2026 | OpenEden, Curvance, Smithii, Avantis, Nerochain | Registrar support staff socially engineered, per Blockaid | No total published |
| Apr 14, 2026 | cow.fi | .fi registry deceived; transfer key came from registrar Gandi | About 1.2M USDC, CoW estimates |
| Apr 17 to 18, 2026 | eth.limo | Impersonator triggered EasyDNS account recovery | No user impact known, eth.limo said |
| Oct 29, 2026 | Polymarket, via vendor DebugBear | Vendor compromised through its domain registrar, DebugBear says | $3.9M being refunded, Polymarket says |
| Oct 30 to 31, 2026 | About a dozen Name.com domains | Registrar level; way in not yet known | About $138K traced by The Block |
Three patterns stand out.
- People, not code. Support desks and a registry were the way in for the February campaign, CoW and eth.limo.
- A registrar you did not pick. CoW says Route 53 used Gandi. Vercel chose Name.com for its domain service, The Block reported.
- A fresh certificate. CoW's attacker got a wildcard certificate that day. Blockaid saw new wildcards for *.nerochain.io.
None of the affected teams reported a smart contract flaw.
Frontends fail in other ways too: see Bybit's tampered JavaScript, npm supply chain attacks and outdated Next.js versions.
The Prevention Checklist
Five layers, in the order an attacker meets them. Our registrar comparison scores providers on the first.
Registrar and registry
| Control | Detail |
|---|---|
| Use an enterprise-grade registrar | SEAL names MarkMonitor, AWS Route 53 and Cloudflare Registrar |
| Confirm the registrar of record | Route 53 registers some TLDs through Gandi, SEAL notes |
| Request registry lock | Server update, delete and transfer prohibitions, set at the registry |
| Ask how support verifies changes | Turn off self-service account recovery where you can |
For .com and .net, registry lock comes from Verisign, through participating registrars. To unlock, Verisign phones an authorized person at the registrar, who gives a security phrase.
That out-of-band step is the point. CoW adds a caveat: a lock is only as strong as the registry's own checks, and its attacker worked through the .fi registry's dispute process.
DNS and certificates
| Control | Detail |
|---|---|
| Sign the zone with DNSSEC | Resolvers can verify answers (RFC 4033); you set the DS record through your registrar |
| Publish CAA records | Name allowed CAs (RFC 8659); add accounturi to pin your ACME account (RFC 8657) |
| Subscribe to Certificate Transparency alerts | Logs show certificates you did not expect (RFC 6962) |
| Keep a known-good record baseline | Check against it after every change and every recovery |
Know the limits. Whoever controls the delegation can publish their own DNSSEC keys or leave the zone unsigned, CoW's post-mortem notes.
CAA fails the same way. It "only prevents mis-issuance when the attacker does not control the domain's DNS," CoW writes.
DNSSEC still helps in a partial takeover. When eth.limo's nameservers were changed, its DS record stayed, and validating resolvers returned errors instead of the attacker's answers.
Certificate Transparency works either way. Cloudflare's monitor, for example, emails you when a new certificate for your domain is logged.
Accounts and people
| Control | Detail |
|---|---|
| Hardware security keys on every login | CISA: FIDO/WebAuthn is the only widely available phishing-resistant MFA |
| No SMS fallback | SEAL says never use SMS on registrar accounts |
| Recovery email on a separate domain | Registered at a different registrar, as SEAL advises |
| Few named admins | SEAL's checklist asks for documented owners and access reviews |
| Out-of-band confirmation for critical changes | Transfers, deletions and nameserver changes, per SEAL's checklist |
Separate vendors are not separate risk. The Name.com sites used Cloudflare, Vercel and Name.com nameservers, The Block found, and all were redirected at the registrar level.
So split duties, not just vendors. The registrar, the DNS host and the email that recovers them each get their own hardware keys, and none can recover another.
Frontend integrity
| Control | Detail |
|---|---|
| Strict Content Security Policy | Limits what scripts load and where page code connects |
| Subresource Integrity on third-party scripts | The browser refuses a file whose hash no longer matches |
| An ENS and IPFS mirror | ENS contenthash points to an IPFS CID; any site change makes a new one |
| Wallet-side checks | Domain verification and phishing blocklists |
These protect your own site from tampering. In a full hijack, "CSP and SRI on the legitimate site have zero effect," CoW writes, because traffic never reaches the legitimate server.
They do cover a nearby risk. Polymarket's losses came through a vendor script, and Polymarket has since added integrity controls, The Record reported.
A mirror gives users a route around your registrar. Aerodrome and Velodrome sent users to ENS mirrors such as aero-drome.eth.limo, Bitcoin.com News reported.
A gateway brings DNS back, though: eth.limo itself was a target in April. Publish the ENS name, not only a gateway link.
Wallet checks have a blind spot here. Reown's Verify API compares the connecting domain with the app's registered one, and in a hijack the domain is genuine.
Report attacker fallback domains to blocklists such as MetaMask's eth-phishing-detect. CoW's attacker moved to swap.cow-s.fo once cow.fi went on hold.
Monitoring and response
| Alert on | Why |
|---|---|
| Registrar account events | Contact email and recovery changes came before the redirect |
| Nameserver, registrar and lock status | SEAL: nameserver and registrar changes need immediate investigation |
| DS, CAA, A, AAAA and MX records | DS or CAA removal weakens protection; MX changes reroute email |
| New certificates in CT logs | SEAL asks you to flag unexpected wildcards |
| The scripts your site serves | Polymarket added continuous monitoring of the vendor script |
Write the first hour down now. CoW lost its @cow.fi email mid-incident, and none of the registrars, registry or hosts it called had a 24-hour abuse line.
- Warn users on X, Discord, Telegram and a status page hosted off the domain.
- Call the registrar's security team on a number saved in advance.
- Open a ticket with SEAL 911 through its Telegram bot, @seal_911_bot.
- Ask for an emergency registry lock, or a hold on the domain.
- Move users to a backup domain you already own, as Curve did with curve.finance.
- Publish a revoke notice naming the attacker's addresses.
- After recovery, check records against your baseline and remove any admin the attacker added.
SEAL's DNS checklist expects that plan tested at least once a year. Our SEAL 911 guide covers what to send when you open a ticket.
Where Guardian Tests This
Each layer maps to a Guardian engagement, as the service pages describe them.
- Domains, DNS and certificates. In Managed Security, Sentry watches them, and a Guardian engineer responds when something fires.
- Everything facing the internet. Shield, part of Managed Security, covers hosts, services, certificates, edge rules and "the names that lead users to you."
- Frontend integrity. A WebApp Pentest tests the client side: XSS, injection, bundle supply chain and what the frontend trusts from the API.
- Accounts and response. An OpSec audit reviews system access and incident response procedures.
Frequently Asked Questions
How early can a domain hijack be spotted?
Often before the redirect. At eth.limo, an impersonator's account recovery came about seven hours before the nameserver change, per The Block. At cow.fi, the holder email changed about 80 minutes before the phishing site went live.
Can a hijacked frontend take funds without a signature?
Usually it needs one. Blockaid found Step Drainer on the Name.com sites, per The Block: a kit that tricks users into approving transfers. CoW's phishing site later asked for seed phrases, and CoW's grants excluded losses from exposing one.
Who covers user losses after a frontend hijack?
So far, each team has decided. CoW DAO's CIP-86 offered grants of up to 100% of eligible losses, subject to KYC. Polymarket is refunding $3.9M without claims, including $1.2M for its trading pause, The Record reported.
Sources
- The Block: Hackers Hijack a Dozen DeFi Websites, All Registered With Name.com, and Steal About $138,000 (October 31, 2026)
- Crypto Briefing: Name.com Restores Hijacked Domains After Attack Hit at Least 12 DeFi Front Ends (October 31, 2026)
- Curve: Curve Domain Incident (May 19, 2025)
- The Block: Top DEXs Aerodrome, Velodrome Hit With Front-End Compromise, Urge Users to Avoid Main Domains (November 22, 2025)
- Bitcoin.com News: DNS Attack Strikes Aerodrome and Velodrome as Aero Merger Nears (November 23, 2025)
- Blockaid: Frontend Hijacking and the Web2 Attack Surface Threatening Web3 Protocols (March 19, 2026)
- Cryptopolitan: OpenEden Users Face Asset Loss Threat as DNS Attack Hijack Portals (February 16, 2026)
- CoW Swap on X: POST MORTEM, Cow.fi Domain Hijack (April 16, 2026)
- CoW DAO Forum: CIP-86, Discretionary Grants Program for Victims of the cow.fi Domain Hijacking (April 23, 2026)
- Domain Name Wire: Domain Hijack Led to Crypto Heist (April 17, 2026)
- The Block: EasyDNS Accepts Responsibility for eth.limo Hijack, Its First Social Engineering Breach in 28 Years (April 19, 2026)
- The Record: Polymarket Confirms Cyberattack on Third-Party Provider After Outages (October 30, 2026)
- The Record: Polymarket Pledges to Give $3.9 Million Back to Victims After Site Compromise (November 2, 2026)
- SEAL Radar: Secret Backdoor, SEAL Issues Advisory on Domain Hijackings (August 21, 2025)
- SEAL Frameworks: Registrar Security and Registry Locks (accessed November 10, 2026)
- SEAL Frameworks: DNSSEC, CAA, SMTP DANE and Email Security (accessed November 10, 2026)
- SEAL Frameworks: DNS Monitoring and Incident Response (accessed November 10, 2026)
- SEAL: SFC DNS Registrar Checklist, Revision 1.1 (April 17, 2026)
- Security Alliance: SEAL 911 (accessed November 10, 2026)
- Security Alliance: seal-911 README (GitHub)
- ICANN: EPP Status Codes, What Do They Mean, and Why Should I Know?
- Verisign: Registry Lock (accessed November 10, 2026)
- CISA: Implementing Phishing-Resistant MFA (October 2022)
- IETF: RFC 4033, DNS Security Introduction and Requirements (March 2005)
- IETF: RFC 8659, DNS Certification Authority Authorization (CAA) Resource Record (November 2019)
- IETF: RFC 8657, Certification Authority Authorization (CAA) Record Extensions for Account URI and Automatic Certificate Management Environment (ACME) Method Binding (November 2019)
- IETF: RFC 6962, Certificate Transparency (June 2013)
- Cloudflare Docs: DNSSEC
- Cloudflare Docs: Certificate Transparency Monitoring
- MDN: Content Security Policy (CSP)
- MDN: Subresource Integrity
- IPFS Docs: Content Identifiers (CIDs)
- ENS: ENSIP-7, Contenthash Field (November 13, 2018)
- Reown Docs: Domain Verification
- MetaMask: eth-phishing-detect (GitHub)
- Guardian: Managed Security
- Guardian: WebApp Pentest
- Guardian: OpSec Audit
Watch the names that lead users to you
Guardian's Managed Security watches your domains, DNS and certificates around the clock, and an engineer responds when something changes.