Quick answer
How do you secure a DeFi frontend domain?
Secure a DeFi frontend by protecting every layer between the user and the page: the registrar account, DNS, certificates, hosting and the CDN, plus a pre-announced fallback on a second domain or an ENS name. Wardmint read six public hijack incidents between October 2023 and October 2026; each one worked through the domain or DNS layer, not the contracts.
Six documented front-end hijacks, 2023 to 2026
| Date | Project | Layer reported | Reported outcome |
|---|---|---|---|
| 6 October 2023 | Galxe | DNS hijack; site redirected to a phishing page | Over 980 users refunded just over $396,000 plus 10% from the treasury |
| 9 to 12 July 2024 | Compound, Celer, Pendle and others | Registrar accounts on domains migrated to Squarespace; OAuth weakness | At least a dozen organisations hit; some domains showed phishing pages |
| 12 May 2025 | Curve Finance | Delegation of curve.fi changed at the registrar | Decoy site asking for signatures; contracts and data not compromised |
| 16 to 23 February 2026 | OpenEden, Curvance, Smithii, Avantis, Nerochain | Registrar transfer, support-call account takeover, DNS redirection | AngelFerno drainer; same-day SSL certificates; no contract compromise |
| April 2026 | eth.limo | Social engineering of the registrar and DNS provider | DNSSEC rejected forged answers; no user impact known at the postmortem |
| 30 to 31 October 2026 | Flap, Kintsu, Origami Finance and others | Domains at one registrar redirected; cause disputed with the hosting platform | Step Drainer; about $138,000 traced to three EVM wallets |
Last checked on ; older figures carry their own date
Which layers sit between a user and a DeFi frontend?
Five layers, and an attacker needs only one of them. The registrar holds the registration and the name server delegation. The DNS provider answers where the name points. The certificate authority issues the padlock. The hosting platform or CDN serves the files. Finally the user's own resolver and wallet decide what to trust.
The incident reports line up with these layers. Curve's notice of 12 May 2025 describes a change of DNS delegation at the registrar. The July 2024 Squarespace cases, reported by Krebs on Security on 15 July 2024, were account takeovers at a registrar. Blockaid's analysis of the February 2026 cluster adds the certificate layer: the attackers obtained SSL certificates on the day of the DNS change. The October 2026 wave brings in the hosting layer, because Vercel's bulletin tied ten affected domains to its platform while Name.com, the registrar, restored them.
How should the registrar account be set up?
Treat the registrar login as production infrastructure. Use a unique long password, two-factor authentication, a small and recorded list of users, and a recovery process that a stranger cannot talk their way through. Blockaid reports that Avantis was taken after an attacker obtained billing details in a support call, and Cointelegraph reports that the eth.limo attacker impersonated a team member to start an account recovery. Both cases defeat a good password because they go through a person.
Switch on the transfer lock for every domain. For a main .com or .net, consider registry lock where a registrar sells it; registry lock vs registrar lock sets out what each blocks. Wardmint offers the transfer lock and the Domain protection option, not registry lock. The full routine is in how to protect your registrar account from takeover.
What should DNS and certificates look like?
Sign the zone, restrict certificate issuance and watch the logs. DNSSEC made the difference in the eth.limo case: Cointelegraph reported that it was enabled, that the attacker had no signing keys, and that validating resolvers rejected the forged answers. It is not a defence against an attacker who holds the registrar account, since that person can replace the DS record, so it complements the account controls. See how to enable DNSSEC on your domain.
Add a CAA record that names only your certificate authority, as in how to set up CAA records, and watch Certificate Transparency for your name, as in how to monitor certificate transparency for your brand. A hijacker who must also change a CAA record, and who produces a visible log entry, is easier to catch. Wardmint includes free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13).
How do hosting and the CDN fit in?
Give the hosting platform and the CDN their own accounts, owners and two-factor authentication, and list every domain attached to them. The October 2026 reports show why. The Block recorded that Kintsu and Origami Finance blamed Vercel, that Vercel's bulletin tied ten affected domains to its platform, and that Name.com said it had restored all affected domains and urged customers to check DNS records and enable two-factor authentication. The sources leave the cause disputed, so the lesson is about coverage: a domain is secure only if each platform that can change what it serves is secured.
On the hosting side, keep a list of the domains and subdomains each project on the platform may serve, remove ones you no longer use, and keep deployment tokens in a vault. Check from outside, too: a scheduled job that resolves your name servers and A records and compares them with the expected values catches a redirect in minutes rather than hours.
Should a DeFi frontend have an ENS or IPFS fallback?
Yes: a second way to reach the interface limits the harm while the main domain is recovered. Curve gave users curve.finance as an interim access point on 12 May 2025, and its notice called for wider adoption of ENS across the industry. ENSIP-7 defines a contenthash field for ENS resolvers, which lets a name point to content on IPFS or Swarm, so an .eth name can serve as an alternative address for a front end published to IPFS.
A fallback only works if users already know it. Announce the official alternatives before an incident, on the website footer, the docs and the verified social channels, and state that no other address is official. The trade-offs between onchain names and DNS names are in ENS name or DNS domain for a crypto project. A second DNS domain is part of the same plan, and Wardmint's core set of six extensions is $128.94 a year.
How many of the documented hijacks went through the domain layer?
According to Wardmint's survey of 12 November 2026, five of the six incidents in the table above sent users of the real domain to a clone or phishing page, and in the sixth, eth.limo, DNSSEC rejected the forged answers. In all six the entry point reported was a registrar, a DNS provider or the registrar account, or, for October 2026, a disputed split between registrar and hosting platform. No source read reports a flaw in a smart contract as the entry.
Two citable sentences: a DeFi protocol is only as hard to hijack as the account that holds its domain, and a fallback address announced in advance is the cheapest recovery tool a project owns. The wider list of cases is in which crypto projects lost users to DNS hijacking, and the sector view is in domain security for DeFi protocols.
Seven steps to secure a DeFi frontend domain
Map every layer
List the registrar account, DNS provider, certificate authority, hosting platform and CDN for each domain, and name an owner for each.
Lock the registrar account
Use a unique password, two-factor authentication, few users and a strict recovery path.
Turn on the transfer lock
Lock every domain against transfer, and decide on registry lock for a critical .com or .net.
Sign and restrict
Enable DNSSEC and publish a CAA record that names only your certificate authority.
Secure hosting and the CDN
Apply two-factor authentication, remove unused domains and keep deployment tokens in a vault.
Monitor
Watch Certificate Transparency and compare name servers and A records with the expected values on a schedule.
Publish a fallback
Register a second domain or an ENS name, announce it in advance and rehearse switching to it.
Securing a DeFi frontend: questions
Are smart contracts at risk in a frontend hijack?
In the incidents read, no. Curve and the February 2026 projects reported that contracts were not compromised. Users lose funds by signing on the cloned page.
Does DNSSEC protect a DeFi frontend?
It protects answers in transit and limited the eth.limo takeover of April 2026. It does not stop an attacker who controls the registrar account, so use it with account security and a transfer lock.
Is registry lock available for every extension?
No. Verisign offers it for .com, .net, .cc and .name through participating registrars. Wardmint does not offer registry lock; it offers a transfer lock and Domain protection.
What should a protocol do in the first hour of a hijack?
Contact the registrar and the DNS provider, tell users to stop signing on the main domain, point them to the pre-announced fallback and save evidence. Curve followed this pattern on 12 May 2025.
Can a DAO treasury pay for a fallback domain?
Yes. Wardmint takes BTC, USDT, USDC, ETH, SOL, LTC into a prepaid balance with a $25 minimum top-up, with one verified email per domain and no identity documents.
In summary
- Five layers reach the user: registrar, DNS, certificates, hosting or CDN, and the user's resolver.
- Six documented hijacks from October 2023 to October 2026 worked through the domain layer, not the contracts.
- Galxe refunded just over $396,000 to over 980 users; the October 2026 wave traced about $138,000 to three EVM wallets.
- Lock the registrar account, turn on the transfer lock, sign with DNSSEC and restrict issuance with CAA.
- DNSSEC limited the eth.limo takeover but does not stop an account holder.
- Announce a fallback, a second domain or an ENS name, before an incident.
- Wardmint offers transfer lock, managed DNSSEC and CAA; it does not offer registry lock or monitoring.
Sources (7)
- Curve domain incident — Curve Finance (read 2026-11-12)
- Galxe announces $396,000 refund to affected users following DNS attack — The Block, 11 October 2023 (read 2026-11-12)
- Researchers: weak security defaults enabled Squarespace domains hijacks — Krebs on Security, 15 July 2024 (read 2026-11-12)
- Frontend hijacking and the Web2 attack surface threatening Web3 protocols — Blockaid, 19 March 2026 (read 2026-11-12)
- eth.limo domain hijack, DNSSEC and social engineering — Cointelegraph, 20 April 2026 (read 2026-11-12)
- Hackers hijack a dozen DeFi websites registered with Name.com — The Block, 31 October 2026 (read 2026-11-12)
- ENSIP-7: Contenthash field — ENS documentation (read 2026-11-12)