How do I secure the domains of a DeFi protocol?

What goes wrong at the domain level in DeFi?

An attacker who controls the domain controls what every user signs. The contracts stay intact, so audits and bug bounties do not catch it.

The pattern is consistent in the incidents above. Curve's notice of 12 May 2025 says users were redirected to a static decoy copying the homepage and asking for signatures, with contracts and user data not compromised. Blockaid, which tracked the February 2026 cluster, reported that the attackers obtained SSL certificates the same day as the DNS change, and that Nerochain users were sent to a look-alike host with wildcard certificates issued for the real name.

According to Wardmint's index of 12 November 2026, 3 of the 7 domain-level incidents in its table since 2022 are dated since May 2025, so the risk is not receding. Wardmint sells registrations, not monitoring, and cannot stop an account takeover at another registrar; it supplies the names and the free tools and procedures to harden them.

Which controls does a protocol need on its main domain?

Four controls cover the failures above: account security, a lock, DNSSEC and CAA records.

• Account: use a role-based mailbox, a long unique password, two-factor authentication and no shared login. See the guide to securing a domain against DNS hijacking.
• Lock: a transfer lock stops a move to another registrar. A registry lock, which Verisign offers for .com and .net through participating registrars, also blocks DNS and ownership changes made with credentials alone. Wardmint does not offer registry lock; a team that needs it for its main .com should hold that name at a registrar that does.
• DNSSEC: enable DNSSEC so resolvers can detect forged answers. It does not help if the registrar account itself is compromised.
• CAA: set up CAA records so only your chosen certificate authority can issue for the domain.

Wardmint provides free DNS hosting with A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV and CAA records, managed DNSSEC, and your own nameservers if you prefer (2 to 13) for the zone.

Which variants should a DeFi protocol register?

Register your exact name on the extensions your users might try, plus the typos and finance words that fit your product. For a protocol the useful sets are the core set (.com, .net, .org, .io, .xyz, .app, $128.94 a year), the launch set (.com, .io, .xyz, .app, .finance, .network, $195.94 a year) and the finance words (.finance, .exchange, .money, .cash, .capital, .fund, $296.94 a year).

Point every variant to the main site with free URL forwarding, and apply the no-email DNS template to unused names so they cannot send mail as your brand. Wardmint registers a protocol's own variants for that protocol; it does not register look-alikes of another project's name. The timeline for a launch is in which domains to register before a token launch.

What should the protocol prepare before an incident?

Prepare an interim address, a status channel and a contact at the registrar before you need them. After the 12 May 2025 hijack, Curve moved users to curve.finance as an interim official access point. An interim address is only possible when a second domain is already registered, which is what a defensive set provides.

Write the runbook now: who can change DNS, who can reach the registrar's support, how users are told to stop signing, and how revoking approvals is explained. The list of past cases and what each taught is in Which crypto projects lost users to DNS hijacking?.