Which crypto projects lost users to DNS hijacking?

What happened to Curve Finance in 2022 and 2025?

Curve lost users to a registrar-side DNS hijack twice, nearly three years apart. On 9 August 2022 users were redirected to a clone that asked for wallet signatures; outlets reported between roughly $530,000 and $573,000 in losses and the figures differ. On 12 May 2025 at about 20:55 UTC the delegation of curve.fi was changed at the registrar, and Curve found out at 21:20 UTC. Users reached a static decoy that copied the home page and asked for signatures.

Curve's notice says the contracts were unaffected, no user data was compromised, and more than $400 million of on-chain volume was processed during the outage. The team moved users to curve.finance as the interim official address and described the registrar's response as slow. The notice reports no loss. The lesson is about the registrar: when delegation changes there, every DNS record you hold becomes irrelevant until you get the domain back.

What was the July 2024 Squarespace wave?

Between 9 and 12 July 2024, at least a dozen organisations, mostly crypto businesses, had domains taken over after a registrar migration. Squarespace had bought about 10 million domains from Google Domains in June 2023 and was moving customers across. Researchers at MetaMask and Paradigm said an attacker could create an account with an email tied to a migrated domain before the owner did. Squarespace's post-mortem of 23 July blamed a weakness in OAuth logins that it fixed within hours, and disputed the researchers' reading, saying no unverified email-login accounts were involved.

Named victims in Krebs on Security's report include Celer Network, Compound Finance, Pendle Finance and Unstoppable Domains. In some cases the hijacked domains redirected visitors to phishing sites aimed at stealing cryptocurrency. The lesson: during any registrar migration, create and secure the account on the new side yourself, with two-factor authentication on, before anyone else can.

What did the 2026 hijacks show?

The 2026 cases show attackers going after registrar accounts and registrar staff, not the protocol. Between 16 and 23 February 2026 Blockaid tracked five front-end compromises that delivered the AngelFerno drainer. OpenEden and Curvance were hit through a registrar transfer from GoDaddy to Namecheap. Avantis lost its Squarespace account after attackers obtained billing details in a support call. Nerochain users were sent to mainnet.live-nerochain.io, with wildcard certificates issued for nerochain.io. In several cases certificates were issued on the day of the DNS change.

On 30 October 2026, domains of a dozen DeFi sites registered with Name.com were redirected in the evening and loaded with the Step Drainer kit, The Block reported. Ten domains were suspended at 8:32 a.m. ET on 31 October, and Name.com said it restored all affected domains and counted 15 customer domains, not 12. About $138,000 was traced to three EVM wallets, without Solana and Aptos losses. Vercel tied ten of the domains to its platform; Kintsu and Origami pointed at Vercel, and the cause remains disputed.

A same-day certificate is why monitoring certificate transparency for your brand is part of the defence, next to locks and account security.

What do these incidents have in common?

In every case from 2022 on, the weak point was the domain account, the DNS provider or the registrar process, not the smart contracts. Curve, Kintsu, Origami, FluxBeam and StonkFun all said their on-chain contracts were untouched. A hijack changes where the name points, so users who type the correct address still reach the attacker.

Four measures answer these cases directly. The first is an account that cannot be talked into a reset: see how to protect your registrar account from takeover. The second is a lock that blocks transfers and, where the registry supports it, changes made with credentials alone: registry lock and registrar lock differ in who can lift them. The third is certificate and DNS monitoring. The fourth is a written plan for the first hour, in how to secure your domain against DNS hijacking.

Wardmint offers a transfer lock you switch on or off for each domain in the client area; the transfer (EPP) code is requested there too. It does not offer registry lock.

How many cases are in the table?

According to Wardmint's count of 12 November 2026, the table lists 8 incident entries from April 2018 to October 2026, and 7 of them happened since August 2022.

We left out March and April 2026 cases (Neutrl, BonkFun, CoW Swap, eth.limo) because we could not open their sources, and a Trezor and Ledger mail-phishing campaign because it did not involve a hijack of a project's own domain.