Quick answer
How do you protect your registrar account from takeover?
Protect a registrar account with a long random password used nowhere else, two-factor authentication, as few users as possible, and a recovery path that a support call cannot get around. Wardmint counted two incidents in its table, in July 2024 and February 2026, where the weak point was a registrar or platform login or support flow, not the DNS records.
Account controls and the incident each one answers
| Control | What it prevents | Public case it answers |
|---|---|---|
| Claim every migrated domain's account yourself | An attacker creating the account first | Squarespace migrations, 9 to 12 July 2024 (OAuth weakness) |
| Support-call rule: no changes on a voice request | Social engineering of a support agent | Avantis, February 2026 (account taken over after a support call) |
| Two-factor authentication on the account | Login with a stolen password | Name.com advice after the 30 to 31 October 2026 redirects |
| Unique long password in a vault | Credential reuse and guessing | General practice |
| Few named users, removed on departure | Insider and ex-member access | DAO and contributor turnover |
| Bookmarked login address | Phishing of registrar logins | General practice |
Why is the registrar account the target?
Because it can change the name servers, the DS record and the owner, and no code on your chain can undo that. A hijacker who signs in as you can point the domain wherever they like and then request a certificate for the new destination.
The public record shows the pattern. Krebs on Security reported in July 2024 that domains migrated from Google Domains to Squarespace were open to an attacker who created an account with the email tied to a domain before the owner did, and Squarespace attributed this to a weakness related to OAuth logins. Blockaid wrote in February 2026 that Avantis was compromised through a Squarespace account taken over after billing details were extracted in a support call. On 30 and 31 October 2026, domains of a dozen DeFi sites registered at one registrar were redirected; the registrar restored them and urged DNS checks and two-factor authentication.
According to Wardmint's count of 12 November 2026, two of the seven incidents in its table (the July 2024 wave and the Avantis case in February 2026) pivot on a login or support flow at a registrar or platform. The full set is in which crypto projects lost users to DNS hijacking.
What password and login setup should you use?
Use a random password of at least 20 characters, generated and stored by a password manager, and never reuse it. A shared chat message or a spreadsheet is not a vault. If more than one person needs access, use a team vault with an audit trail, and record who has seen the secret.
Turn on two-factor authentication for the account. A hardware security key is the strongest common second factor, because it does not hand a code to a phishing page. An authenticator app is the next choice; a code sent by text message is the weakest. Store recovery codes offline, in two places, and write down who can reach them.
On Wardmint, you sign in with an account number and password, and you can turn on two-factor authentication in the client area; email replies within 12 hours, 7 days a week, including help with DNSSEC, CAA records and abuse reports. Because only one verified email per domain is needed for the registration itself, keep the account email on a mailbox you control and protect that mailbox as strictly as the account.
Who should have access, and how do you handle a support call?
Name one owner and one backup, document both, and write a rule that no change is made on the strength of a call. The Avantis case shows why. If support can change an account after a phone conversation, then the strength of your password no longer matters.
For a DAO or foundation, decide in advance who holds the credentials, how the treasury tops up the balance and how access changes when a contributor leaves. The practices for shared custody are in how should a DAO hold and pay for its domains. Remove access the same day someone leaves the team, and change the shared password then.
For the most important domains, consider Domain protection at +$29/year per domain: the domain is registered in the name of DomaineGoat LLC, you remain the beneficiary with a free hand-back to your own name, a transfer lock is on, and every complaint is read by a person before any action. The option is described in what is Domain protection. It reduces what the account holds, and it does not replace a strong login.
How to protect a registrar account in seven steps
Inventory every account and domain
List each registrar account, the domains in it and the people who can sign in. Include accounts inherited from migrations.
Claim migrated accounts
If a registrar absorbed your old one, sign in and confirm that you, not a stranger, hold the account for each domain.
Replace the password
Generate a random password of 20 characters or more in a vault and use it only for this account.
Turn on two-factor authentication
Prefer a hardware key, then an authenticator app. Store recovery codes offline in two places.
Reduce and record access
Name one owner and one backup, remove everyone else and note the date and reason for each change.
Write the support-call rule
Agree that nobody changes DNS, owner or contacts on the strength of a call or chat, and tell your team.
Bookmark the login and watch for phishing
Open the registrar only from your bookmark. Treat any email asking you to log in to a registrar as a possible phishing attempt.
How do you spot a phishing page that copies your registrar?
Check the address before you type anything, and never follow a login link from an email. Registrar phishing relies on urgency: a message says the domain is about to expire or has a complaint. Open the registrar from your bookmark and look for the same notice in the account.
Use a password manager that fills credentials only on the exact saved address, so a look-alike login page gets nothing. Hardware keys add the same protection to the second factor. If you ever enter a password on a doubtful page, change it at once, end all sessions and review the DNS records and the contact email.
A second layer is expiry. A domain that lapses can be taken by anyone, and the renewal duty is covered in how to stop your domains from expiring. The wider hardening plan is in how to secure your domain against DNS hijacking.
Questions about registrar account security
Is two-factor authentication enough?
It is necessary but not enough alone. The Avantis case went through a support call. Add a no-changes-by-call rule and few users.
Does a transfer lock protect the account?
No. It stops transfers to another registrar. It does not stop someone with the login from changing name servers or records.
Should the account use a shared team email?
Use a mailbox the team controls, protected with two-factor authentication, not a personal address of one member. Each domain also needs one verified email for its registration.
What if a contributor with access leaves?
Change the password, remove their access, rotate recovery codes and review the DNS records, all on the same day.
Can Domain protection replace a strong login?
No. It puts the domain in the name of the company and adds human review of complaints, and the account still needs a strong login.
In summary
- The registrar account can change name servers, DS records and the owner.
- Public hijacks of 2024 and 2026 went through a login weakness or a support call.
- Use a random password of 20 characters or more, in a vault, used nowhere else.
- Turn on two-factor authentication, preferably with a hardware key.
- Name one owner and one backup; remove leavers the same day.
- Write a rule that no change is made on a call alone.
- Domain protection costs +$29/year and does not replace a strong login.
Sources (3)
- Researchers: weak security defaults enabled Squarespace domains hijacks — Krebs on Security (read 2026-11-12)
- Frontend hijacking and the Web2 attack surface threatening Web3 protocols — Blockaid (read 2026-11-12)
- Hackers hijack a dozen DeFi websites registered with Name.com — The Block (read 2026-11-12)