Quick answer
How should a DAO hold and pay for its domains?
A DAO should hold its domains in one account run by a role, not a person, protect that login with a long password and two-factor authentication, and pay from a treasury-funded prepaid balance. At Wardmint the balance starts at $25, auto-renews each domain, and the Domain protection option costs +$29/year.
Who does what for a DAO's domains
| Duty | Who should own it | Control to use |
|---|---|---|
| Registrar login | A named role (operations steward), with a backup holder | Account number, long unique password, two-factor authentication |
| Recovery email | A mailbox the DAO controls, used for nothing else | Shared by two signers, never a personal inbox |
| Top-ups | The treasury multisig | Exact-amount payment in BTC, USDT, USDC, ETH, SOL, LTC |
| Renewal | Automatic from the balance; a steward watches it | automatic renewal from your balance, switched on or off for each domain |
| Ownership name | The contributor, or the company of record with Domain protection | Free hand-back to your own name |
| Complaints and legal notices | The steward, with the abuse mailbox monitored | Human review of every complaint with Domain protection |
Why is a DAO's domain account a bigger risk than its contracts?
The account that controls the domain can redirect every user to a copy of your front end without touching a single contract. Curve Finance said its contracts and user data were not compromised in the registrar-level hijack of 12 May 2025, yet users were sent to a decoy page that asked for signatures.
According to Wardmint's index, its table of incidents since 2022 holds seven incidents where the attack went through a registrar or DNS account rather than a smart contract: Curve Finance in August 2022 and May 2025, Balancer in September 2023, Galxe in October 2023, the Squarespace wave of July 2024, a cluster of five front ends in February 2026, and a dozen DeFi sites registered with Name.com on 30 October 2026 (the cause of that last one is disputed between Name.com's customers and Vercel). In the Name.com case, The Block traced about $138,000 to three EVM wallets.
For a DAO the exposure is sharper, because the person who set up the account may have left, and nobody remembers which email holds the recovery link.
Who should hold the registrar account?
A role should hold the account, with two people able to act for it. Create the account with a mailbox that the DAO controls, not a contributor's personal address, and record in the DAO's handbook who holds which credential.
Wardmint signs in with an account number, a password and two-factor authentication. Use a password generator, store the secret in the same vault the DAO uses for other infrastructure, and rotate access when a steward leaves. The method is in how to protect your registrar account from takeover.
No identity document is requested at Wardmint. The only contact data collected is one email address per domain, required and verified as ICANN rules demand, and kept private. We release the data we hold only when Panamanian law requires it (a Panamanian court or prosecutor's order), or in a UDRP case.
Should a DAO use Domain protection?
Use Domain protection when no contributor wants to be the registrant of record. With the option, the domain is registered in the name of DomaineGoat LLC, a company registered in Panama. The DAO stays the beneficiary and can take the domain back in its own name, free. A transfer lock is on, and the data held is minimal.
It also adds a human reading of every complaint before any action on the domain. That review exists only with the option. The cost is +$29/year per domain, on top of the domain price. Without the option the domain is in the customer's name and the usual abuse rules apply.
Domain protection is not a shield against phishing or fraud reports: abuse that takes money from victims is acted on within 24 hours of a well-documented report, with or without the option. Read the full terms on the Domain protection page.
How does the treasury pay, and who watches renewals?
The treasury tops up a prepaid balance once, and automatic renewal draws from it. The minimum top-up is $25. Send the exact amount shown, click that you have sent the payment, and the top-up is matched by its exact amount and credited once confirmed. The part of a top-up added only to reach the minimum is refundable on request within 30 days in USDT or USDC if unspent; the rest of the balance never expires and is not paid back.
Assign one steward to check the balance each quarter against the renewals due, because a domain with no funds behind it still lapses. A lapsed crypto domain can be picked up by someone else. How to stop your domains from expiring covers grace periods and the checks to run.
The multisig flow, networks and receipts are in how to pay for domains from a DAO treasury in USDC or USDT. For the wider plan, see how to protect a crypto project from phishing domains.
DAO domain security: questions
Can a DAO register domains without a legal entity?
Yes at Wardmint: the domain is registered in the name of the customer, with one verified email and no identity document. If no contributor wants to be the registrant, Domain protection places the registration in DomaineGoat LLC's name, with free hand-back.
What happens if the person with the login leaves?
Access follows the mailbox and vault the DAO controls, so a role holder can change. Support: email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports. Keep a second holder so that a lost credential never blocks a renewal.
Can the treasury multisig pay directly?
Yes. Any wallet or multisig can send the exact amount shown in BTC, USDT, USDC, ETH, SOL, LTC. The top-up is matched by its exact amount and credited once confirmed.
Does auto-renew need a signature each year?
No. automatic renewal from your balance, switched on or off for each domain, so the balance pays the renewal without a new transaction. The balance must still hold enough funds.
Is the registry lock available for a DAO's main domain?
Not at Wardmint. Registry lock is offered by Verisign for .com and .net through participating registrars. Wardmint offers a transfer lock and Domain protection.
In summary
- Hold the account with a role and a backup, not one person.
- Wardmint login: account number, password and two-factor authentication.
- Minimum top-up $25; any wallet or multisig can pay in BTC, USDT, USDC, ETH, SOL, LTC.
- Auto-renew draws from the balance; a steward checks it each quarter.
- Domain protection: +$29/year, registered in DomaineGoat LLC's name, free hand-back, human review of complaints.
- One verified email per domain, no ID; data released only under Panamanian law or in a UDRP case.
- Wardmint counted seven registrar-level or DNS-provider incidents since 2022 in its table.
Sources (7)
- Curve Finance domain incident notice, 12 May 2025 — Curve Finance (read 2026-11-12)
- Hackers hijack a dozen DeFi websites, all registered with Name.com, and steal about $138,000 — The Block (read 2026-11-12)
- Researchers: weak security defaults enabled Squarespace domains hijacks — Krebs on Security (read 2026-11-12)
- Frontend hijacking and the Web2 attack surface — Blockaid (read 2026-11-12)
- Galxe announces $396,000 refund after DNS attack — The Block (read 2026-11-12)
- Galxe and Balancer DNS attacks — FXStreet (read 2026-11-12)
- Curve Finance users lose $573,000 in front-end attack — ForkLog (read 2026-11-12)