AllBridge Malicious DNS Hijack - Revision history

Azoundria: Blackchain analytics links added in.

2023-12-28T18:46:54Z

Blackchain analytics links added in.

← Older revision		Revision as of 12:46, 28 December 2023
Line 35:		Line 35:
	\|-		\|-
	\|June 20th, 2022 3:05:42 AM		\|June 20th, 2022 3:05:42 AM
	\|First Malicious Contract		\|First Malicious Contract Creation
	\|The very first smart contract is created by a wallet controlled from the attacker<ref>[https://etherscan.io/tx/0x50e6924604c8b1e1f8096f01aca0b35836c7d168fc0e99631f43d683717b13b5 First ~~Smart~~ Contract ~~Creation~~ - ~~EtherScan~~] (Feb 23, 2023)</ref>.		\|The very first smart contract is created by a wallet controlled from the attacker<ref name=":03">[https://etherscan.io/tx/0x50e6924604c8b1e1f8096f01aca0b35836c7d168fc0e99631f43d683717b13b5 First Transaction Creating Malicious Contract 0x65a8...3b2f - Etherscan] (Feb 23, 2023)</ref>. Malicious contract 0x65a8...3b2f<ref>[https://etherscan.io/address/0x65a8e56ee6b549456fd8927db3fa526b8d143b2f Unused Contract 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref> was created by wallet 0x5622...781a<ref name=":03" /><ref>[https://etherscan.io/address/0x5622c77e1484840048d2064326ac77ddaad17d1a Wallet Address 0x5622...7d1a Who Created 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref>.
	\|-		\|-
	\|June 20th, 2022 9:01:35 AM		\|June 20th, 2022 9:01:35 AM
Line 177:		Line 177:

	TBD - Sources need to be merged properly.		TBD - Sources need to be merged properly.

			=== Blockchain Analytics ===
			Various notable addresses and transactions from Etherscan for further research/analysis:

			<ref>[https://etherscan.io/address/0x65a8e56ee6b549456fd8927db3fa526b8d143b2f Unused Contract 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref><ref>[https://etherscan.io/tx/0x50e6924604c8b1e1f8096f01aca0b35836c7d168fc0e99631f43d683717b13b5 Transaction Creating Contract 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref><ref>[https://etherscan.io/address/0x5622c77e1484840048d2064326ac77ddaad17d1a Wallet Address 0x5622...7d1a Who Created 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref><ref>[https://etherscan.io/tx/0x4e2973f8ca8038a85b798cc7fa93db62064d6053c757730a5be656c17104d611 Transaction Creating 0xdd49....c82b - Etherscan] (Feb 27, 2023)</ref><ref>[https://etherscan.io/txs?a=0x56d3191ee65f1f76e4e902ec983c6420398d49c8 Transactions By Wallet 0x56d3...49c8 (Fake_Phishing5851) - Etherscan] (Dec 27, 2023)</ref><ref>[https://etherscan.io/address/0x4e1256734882c3deff95e963b6a0a658bb88899a Address 0x4e12...899a Who Created 0xf403...ae31 - Etherscan] (Dec 28, 2023)</ref><ref>[https://etherscan.io/address/0xf403a2c10b0b9fef8f0d4f931df5d86ad187ae31 Vanity Phishing Smart Contract 0xF403...AE31 - Etherscan] (Dec 7, 2o23)</ref><ref name="etherscanattackeraddress1-8877">[https://etherscan.io/address/0xb73261481064f717a63e6f295d917c28385af9aa Address 0xB732...F9Aa (Convex & Ribbon Phisher) - Etherscan] (Aug 23, 2022)</ref><ref>[https://etherscan.io/token/0x4e3fbd56cd56c3e72c1403e103b45db9da5b9d2b?a=0xcdc0f019f0ec0a903ca689e2bced3996efc53939 Convex Finance Tokens Received By Convex & Ribbon Phisher - Etherscan] (Dec 28, 2023)</ref>

	== Total Amount Lost ==		== Total Amount Lost ==
	Cryptonomist reports that as of June 24th, 2023, "the tally of what the hacker managed to steal is about 220 ETH<ref name="cryptonomist-88703">[https://en.cryptonomist.ch/2022/06/24/convex-more-info-on-the-hack/ Convex: more info on the hack - Cryptonomist] (Jul 2, 2022)</ref>" however no further information is provided as to how that number was determined by Cryptonomist. The blockchain records of the attacker's known wallet show significantly fewer tokens being received in total<ref name=":32">[https://etherscan.io/tokentxns?a=0xcdc0f019f0ec0a903ca689e2bced3996efc53939 Token's Received and Sent By The Attacker's Wallet - Etherscan] (Feb 23, 2023)</ref>.		Cryptonomist reports that as of June 24th, 2023, "the tally of what the hacker managed to steal is about 220 ETH<ref name="cryptonomist-88703">[https://en.cryptonomist.ch/2022/06/24/convex-more-info-on-the-hack/ Convex: more info on the hack - Cryptonomist] (Jul 2, 2022)</ref>" however no further information is provided as to how that number was determined by Cryptonomist. The blockchain records of the attacker's known wallet show significantly fewer tokens being received in total<ref name=":32">[https://etherscan.io/tokentxns?a=0xcdc0f019f0ec0a903ca689e2bced3996efc53939 Token's Received and Sent By The Attacker's Wallet - Etherscan] (Feb 23, 2023)</ref>.

Azoundria: Another 30 full minutes. Lots of information integrated.

2023-12-28T00:01:30Z

Another 30 full minutes. Lots of information integrated.

Show changes

Azoundria: Fixing Nalin Gupta, and adding speculation about further domains.

2023-04-02T05:50:29Z

Fixing Nalin Gupta, and adding speculation about further domains.

← Older revision		Revision as of 23:50, 1 April 2023
Line 114:		Line 114:
	\|June 24th, 2022 7:00:00 AM MDT		\|June 24th, 2022 7:00:00 AM MDT
	\|Attacks Reported With Screenshots		\|Attacks Reported With Screenshots
	\|Twitter user ~~Nathan~~ Gupta is the first to publicly provide screenshots of all 4 DNS attacks in a single thread<ref>[https://twitter.com/nalingupta01/status/1540319012067737600 ~~Nathan~~ Gupta - "4 DeFi projects have experienced a DNS hijack attack" - Twitter] (Apr 1, 2023)</ref>.		\|Twitter user Nalin Gupta is the first to publicly provide screenshots of all 4 DNS attacks in a single thread<ref>[https://twitter.com/nalingupta01/status/1540319012067737600 Nalin Gupta - "4 DeFi projects have experienced a DNS hijack attack" - Twitter] (Apr 1, 2023)</ref>.
			\|-
			\|June 24th, 2022 7:24:00 AM MDT
			\|Speculation About Further Domains
			\|Further speculation arises that some other domains may be related<ref>[https://twitter.com/nalingupta01/status/1540325110720380928 <nowiki>Nalin Gupta - "It does seem some others might be affected tho[ugh]" - Twitter</nowiki>] (Apr 1, 2023)</ref>. The list referenced are cryptocurrency phishing websites and it does not appear that any of those domains are related to the DNS attack<ref>[https://twitter.com/idclickthat/status/1540200001112096768 idclickthat - "crypto phish" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 7:29:00 AM		\|June 24th, 2022 7:29:00 AM

Azoundria: nothing to worry about quote

2023-04-02T04:08:55Z

nothing to worry about quote

← Older revision		Revision as of 22:08, 1 April 2023
Line 127:		Line 127:
	\|Free DomainVault Monitoring		\|Free DomainVault Monitoring
	\|NameCheap's CEO expands the original tweet to say that they "would like to offer [affected services their] Domain Vault service for free and [they] will also place all affected domains on the highest security monitoring"<ref>[https://twitter.com/NamecheapCEO/status/1540364947611422722 @NamecheapCEO - "we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring" - Twitter] (Feb 24, 2023)</ref>.		\|NameCheap's CEO expands the original tweet to say that they "would like to offer [affected services their] Domain Vault service for free and [they] will also place all affected domains on the highest security monitoring"<ref>[https://twitter.com/NamecheapCEO/status/1540364947611422722 @NamecheapCEO - "we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring" - Twitter] (Feb 24, 2023)</ref>.
			\|-
			\|June 24th, 2022 10:32:00 AM MDT
			\|Nothing To Worry About
			\|NameCheap assures via Twitter that "[t]here is nothing to worry about" and they will "keep investigating"<ref>[https://twitter.com/Namecheap/status/1540372203627216898 NameCheap - "There is nothing to worry about; we keep investigating" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 11:21:00 AM		\|June 24th, 2022 11:21:00 AM

Azoundria: Tweet used as support for 2FA being employed too.

2023-04-01T20:55:36Z

Tweet used as support for 2FA being employed too.

← Older revision		Revision as of 14:55, 1 April 2023
Line 21:		Line 21:
	The account of a customer support agent for NameCheap was hacked<ref name="namecheapceotwitter3-10566" />.		The account of a customer support agent for NameCheap was hacked<ref name="namecheapceotwitter3-10566" />.

	This allowed the attacker to modify the DNS settings for multiple high profile decentralized protocols with domain names registered there, including [[Convex Finance Malicious DNS Hijack\|Convex Finance]], [[Ribbon Finance Malicious DNS Hijack\|Ribbon Finance]], [[DeFi Saver Malicious DNS Hijack\|Defi Saver]], and AllBridge<ref>[https://www.trustnodes.com/2022/06/25/defi-dapps-dns-attacked DeFi Dapps DNS Attacked - TrustNodes] (Feb 25, 2024)</ref>. The attacker was able to override any 2-factor authentication, passwords, and security alert settings<ref>[https://twitter.com/DeFiSaver/status/1540300789901627392 DeFiSaver - "Same as with others, strong passwords and 2fa were used and we don't recognise security factors on our end that could have led to this." - Twitter] (Mar 23, 2023)</ref><ref>[https://twitter.com/DeFiSaver/status/1540311188462080003 DefiSaver - "We certainly did use 2FA, as mentioned and as did other teams." - Twitter] (Mar 23, 2023)</ref>.		This allowed the attacker to modify the DNS settings for multiple high profile decentralized protocols with domain names registered there, including [[Convex Finance Malicious DNS Hijack\|Convex Finance]], [[Ribbon Finance Malicious DNS Hijack\|Ribbon Finance]], [[DeFi Saver Malicious DNS Hijack\|Defi Saver]], and AllBridge<ref>[https://www.trustnodes.com/2022/06/25/defi-dapps-dns-attacked DeFi Dapps DNS Attacked - TrustNodes] (Feb 25, 2024)</ref>. The attacker was able to override any 2-factor authentication, passwords, and security alert settings<ref>[https://twitter.com/DeFiSaver/status/1540300789901627392 DeFiSaver - "Same as with others, strong passwords and 2fa were used and we don't recognise security factors on our end that could have led to this." - Twitter] (Mar 23, 2023)</ref><ref>[https://twitter.com/DeFiSaver/status/1540311188462080003 DefiSaver - "We certainly did use 2FA, as mentioned and as did other teams." - Twitter] (Mar 23, 2023)</ref><ref name=":5" />.
	{\| class="wikitable"		{\| class="wikitable"
	\|+Key Event Timeline - AllBridge Malicious DNS Hijack		\|+Key Event Timeline - AllBridge Malicious DNS Hijack
Line 110:		Line 110:
	\|June 24th, 2022 6:14:00 AM MDT		\|June 24th, 2022 6:14:00 AM MDT
	\|All Attacks Reported Together		\|All Attacks Reported Together
	\|All 4 "DNS exploit[s]" with "illicit vanity contracts" are reported by Twitter user CryptoCondom. He also mentioned that all protocols were using 2FA<ref>[https://twitter.com/crypto_condom/status/1540307373713129474 CryptoCondom - "A multi-platform DNS exploit appears to have occurred this week w/illicit vanity contracts" - Twitter] (Apr 1, 2023)</ref>.		\|All 4 "DNS exploit[s]" with "illicit vanity contracts" are reported by Twitter user CryptoCondom. He also mentioned that all protocols were using 2FA<ref name=":5">[https://twitter.com/crypto_condom/status/1540307373713129474 CryptoCondom - "A multi-platform DNS exploit appears to have occurred this week w/illicit vanity contracts" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 7:00:00 AM MDT		\|June 24th, 2022 7:00:00 AM MDT

Azoundria: Attacks reported together updated again with another Twitter post.

2023-04-01T20:53:10Z

Attacks reported together updated again with another Twitter post.

← Older revision		Revision as of 14:53, 1 April 2023
Line 107:		Line 107:
	\|Twitter Investigation Results		\|Twitter Investigation Results
	\|AllBridge posts on Twitter to announce that the issue was solved within an hour of discovery. They include details of the attack and that they had "mitigated the issue by restoring DNS records and switching to a new DNS provider".<ref name=":3" /> They also reported that the "customer support team of [NameCheap] refused to provide [them] any details including date and time of logins into our account (protected by two-factor authentication) and changes to the specified IP address"<ref>[https://twitter.com/Allbridge_io/status/1540306254920294400 <nowiki>@Allbridge_io - "[NameCheap] refused to provide us any details including date and time of logins into our account" - Twitter</nowiki>] (Feb 25, 2023)</ref>.		\|AllBridge posts on Twitter to announce that the issue was solved within an hour of discovery. They include details of the attack and that they had "mitigated the issue by restoring DNS records and switching to a new DNS provider".<ref name=":3" /> They also reported that the "customer support team of [NameCheap] refused to provide [them] any details including date and time of logins into our account (protected by two-factor authentication) and changes to the specified IP address"<ref>[https://twitter.com/Allbridge_io/status/1540306254920294400 <nowiki>@Allbridge_io - "[NameCheap] refused to provide us any details including date and time of logins into our account" - Twitter</nowiki>] (Feb 25, 2023)</ref>.
			\|-
			\|June 24th, 2022 6:14:00 AM MDT
			\|All Attacks Reported Together
			\|All 4 "DNS exploit[s]" with "illicit vanity contracts" are reported by Twitter user CryptoCondom. He also mentioned that all protocols were using 2FA<ref>[https://twitter.com/crypto_condom/status/1540307373713129474 CryptoCondom - "A multi-platform DNS exploit appears to have occurred this week w/illicit vanity contracts" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 7:00:00 AM MDT		\|June 24th, 2022 7:00:00 AM MDT
	\|~~All~~ Attacks Reported ~~Together~~		\|Attacks Reported With Screenshots
	\|Twitter user Nathan Gupta is the first to publicly ~~report~~ all 4 DNS attacks in a single thread<ref>[https://twitter.com/nalingupta01/status/1540319012067737600 Nathan Gupta - "4 DeFi projects have experienced a DNS hijack attack" - Twitter] (Apr 1, 2023)</ref>.		\|Twitter user Nathan Gupta is the first to publicly provide screenshots of all 4 DNS attacks in a single thread<ref>[https://twitter.com/nalingupta01/status/1540319012067737600 Nathan Gupta - "4 DeFi projects have experienced a DNS hijack attack" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 7:29:00 AM		\|June 24th, 2022 7:29:00 AM

Azoundria: Attacks Reported Together On All DNS Wiki Pages

2023-04-01T20:45:11Z

Attacks Reported Together On All DNS Wiki Pages

← Older revision		Revision as of 14:45, 1 April 2023
Line 107:		Line 107:
	\|Twitter Investigation Results		\|Twitter Investigation Results
	\|AllBridge posts on Twitter to announce that the issue was solved within an hour of discovery. They include details of the attack and that they had "mitigated the issue by restoring DNS records and switching to a new DNS provider".<ref name=":3" /> They also reported that the "customer support team of [NameCheap] refused to provide [them] any details including date and time of logins into our account (protected by two-factor authentication) and changes to the specified IP address"<ref>[https://twitter.com/Allbridge_io/status/1540306254920294400 <nowiki>@Allbridge_io - "[NameCheap] refused to provide us any details including date and time of logins into our account" - Twitter</nowiki>] (Feb 25, 2023)</ref>.		\|AllBridge posts on Twitter to announce that the issue was solved within an hour of discovery. They include details of the attack and that they had "mitigated the issue by restoring DNS records and switching to a new DNS provider".<ref name=":3" /> They also reported that the "customer support team of [NameCheap] refused to provide [them] any details including date and time of logins into our account (protected by two-factor authentication) and changes to the specified IP address"<ref>[https://twitter.com/Allbridge_io/status/1540306254920294400 <nowiki>@Allbridge_io - "[NameCheap] refused to provide us any details including date and time of logins into our account" - Twitter</nowiki>] (Feb 25, 2023)</ref>.
			\|-
			\|June 24th, 2022 7:00:00 AM MDT
			\|All Attacks Reported Together
			\|Twitter user Nathan Gupta is the first to publicly report all 4 DNS attacks in a single thread<ref>[https://twitter.com/nalingupta01/status/1540319012067737600 Nathan Gupta - "4 DeFi projects have experienced a DNS hijack attack" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 7:29:00 AM		\|June 24th, 2022 7:29:00 AM
	\|~~All~~ Attacks Reported Together		\|Attacks Reported Together Again
	\|Twitter user Tommy Famous reports on all 4 DNS attacks in a single thread<ref>[https://twitter.com/TommyBeFamous/status/1540326185795829765 TommyBeFamous - "So far 4 #ethereum DeFi projects experienced a DNS hijack attack." - Twitter] (Mar 24, 2023)</ref>.		\|Twitter user Tommy Famous also reports on all 4 DNS attacks in a single thread<ref>[https://twitter.com/TommyBeFamous/status/1540326185795829765 TommyBeFamous - "So far 4 #ethereum DeFi projects experienced a DNS hijack attack." - Twitter] (Mar 24, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 10:01:00 AM		\|June 24th, 2022 10:01:00 AM

Azoundria: Twitter user Tommy Famous reports on all 4 DNS attacks in a single thread

2023-03-24T06:07:13Z

Twitter user Tommy Famous reports on all 4 DNS attacks in a single thread

← Older revision		Revision as of 00:07, 24 March 2023
Line 107:		Line 107:
	\|Twitter Investigation Results		\|Twitter Investigation Results
	\|AllBridge posts on Twitter to announce that the issue was solved within an hour of discovery. They include details of the attack and that they had "mitigated the issue by restoring DNS records and switching to a new DNS provider".<ref name=":3" /> They also reported that the "customer support team of [NameCheap] refused to provide [them] any details including date and time of logins into our account (protected by two-factor authentication) and changes to the specified IP address"<ref>[https://twitter.com/Allbridge_io/status/1540306254920294400 <nowiki>@Allbridge_io - "[NameCheap] refused to provide us any details including date and time of logins into our account" - Twitter</nowiki>] (Feb 25, 2023)</ref>.		\|AllBridge posts on Twitter to announce that the issue was solved within an hour of discovery. They include details of the attack and that they had "mitigated the issue by restoring DNS records and switching to a new DNS provider".<ref name=":3" /> They also reported that the "customer support team of [NameCheap] refused to provide [them] any details including date and time of logins into our account (protected by two-factor authentication) and changes to the specified IP address"<ref>[https://twitter.com/Allbridge_io/status/1540306254920294400 <nowiki>@Allbridge_io - "[NameCheap] refused to provide us any details including date and time of logins into our account" - Twitter</nowiki>] (Feb 25, 2023)</ref>.
			\|-
			\|June 24th, 2022 7:29:00 AM
			\|All Attacks Reported Together
			\|Twitter user Tommy Famous reports on all 4 DNS attacks in a single thread<ref>[https://twitter.com/TommyBeFamous/status/1540326185795829765 TommyBeFamous - "So far 4 #ethereum DeFi projects experienced a DNS hijack attack." - Twitter] (Mar 24, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 10:01:00 AM		\|June 24th, 2022 10:01:00 AM

Azoundria: We certainly did use 2FA, as mentioned and as did other teams.

2023-03-24T05:41:34Z

We certainly did use 2FA, as mentioned and as did other teams.

← Older revision		Revision as of 23:41, 23 March 2023
Line 21:		Line 21:
	The account of a customer support agent for NameCheap was hacked<ref name="namecheapceotwitter3-10566" />.		The account of a customer support agent for NameCheap was hacked<ref name="namecheapceotwitter3-10566" />.

	This allowed the attacker to modify the DNS settings for multiple high profile decentralized protocols with domain names registered there, including [[Convex Finance Malicious DNS Hijack\|Convex Finance]], [[Ribbon Finance Malicious DNS Hijack\|Ribbon Finance]], [[DeFi Saver Malicious DNS Hijack\|Defi Saver]], and AllBridge<ref>[https://www.trustnodes.com/2022/06/25/defi-dapps-dns-attacked DeFi Dapps DNS Attacked - TrustNodes] (Feb 25, 2024)</ref>. The attacker was able to override any 2-factor authentication, passwords, and security alert settings.		This allowed the attacker to modify the DNS settings for multiple high profile decentralized protocols with domain names registered there, including [[Convex Finance Malicious DNS Hijack\|Convex Finance]], [[Ribbon Finance Malicious DNS Hijack\|Ribbon Finance]], [[DeFi Saver Malicious DNS Hijack\|Defi Saver]], and AllBridge<ref>[https://www.trustnodes.com/2022/06/25/defi-dapps-dns-attacked DeFi Dapps DNS Attacked - TrustNodes] (Feb 25, 2024)</ref>. The attacker was able to override any 2-factor authentication, passwords, and security alert settings<ref>[https://twitter.com/DeFiSaver/status/1540300789901627392 DeFiSaver - "Same as with others, strong passwords and 2fa were used and we don't recognise security factors on our end that could have led to this." - Twitter] (Mar 23, 2023)</ref><ref>[https://twitter.com/DeFiSaver/status/1540311188462080003 DefiSaver - "We certainly did use 2FA, as mentioned and as did other teams." - Twitter] (Mar 23, 2023)</ref>.
	{\| class="wikitable"		{\| class="wikitable"
	\|+Key Event Timeline - AllBridge Malicious DNS Hijack		\|+Key Event Timeline - AllBridge Malicious DNS Hijack

Azoundria: Fixed links from AllBridge to other similar DNS cases.

2023-03-19T23:37:53Z

Fixed links from AllBridge to other similar DNS cases.

← Older revision		Revision as of 17:37, 19 March 2023
Line 21:		Line 21:
	The account of a customer support agent for NameCheap was hacked<ref name="namecheapceotwitter3-10566" />.		The account of a customer support agent for NameCheap was hacked<ref name="namecheapceotwitter3-10566" />.

	This allowed the attacker to modify the DNS settings for multiple high profile decentralized protocols with domain names registered there, including [~~https://quadrigainitiative.com/cryptocurrencyhackscamfraudwiki/~~Convex~~%20Finance%20Malicious%20DNS%20Hijack~~ Convex Finance], [[Ribbon Finance Malicious DNS Hijack\|Ribbon Finance]], [~~https://quadrigainitiative.com/cryptocurrencyhackscamfraudwiki/~~DeFi~~%20Saver%20Malicious%20DNS%20Hijack~~ Defi Saver], and AllBridge<ref>[https://www.trustnodes.com/2022/06/25/defi-dapps-dns-attacked DeFi Dapps DNS Attacked - TrustNodes] (Feb 25, 2024)</ref>. The attacker was able to override any 2-factor authentication, passwords, and security alert settings.		This allowed the attacker to modify the DNS settings for multiple high profile decentralized protocols with domain names registered there, including [[Convex Finance Malicious DNS Hijack\|Convex Finance]], [[Ribbon Finance Malicious DNS Hijack\|Ribbon Finance]], [[DeFi Saver Malicious DNS Hijack\|Defi Saver]], and AllBridge<ref>[https://www.trustnodes.com/2022/06/25/defi-dapps-dns-attacked DeFi Dapps DNS Attacked - TrustNodes] (Feb 25, 2024)</ref>. The attacker was able to override any 2-factor authentication, passwords, and security alert settings.
	{\| class="wikitable"		{\| class="wikitable"
	\|+Key Event Timeline - AllBridge Malicious DNS Hijack		\|+Key Event Timeline - AllBridge Malicious DNS Hijack