Curve Finance Curve.Fi DNS Hijack Malicious Frontend - Revision history

Azoundria at 23:59, 29 July 2025

2025-07-29T23:59:50Z

@@ Line 2: / Line 2: @@
 {{Unattributed Sources}}
-[[File:Curvefinance.jpg|thumb|Curve Finance Logo/Homepage]]Curve Finance, a major decentralized exchange with $1.67 billion in total value locked, recently experienced a DNS-level attack that compromised its curve.fi domain. The exploit, linked to a lower-tier domain registrar, redirected users to a malicious IP, though no smart contracts or internal systems were breached. While user funds within the protocol remain secure, some users reported losses due to the incident. Curve swiftly responded by isolating the issue, launching an investigation, and migrating operations to curve.finance. The attack reflects a broader trend of infrastructure-targeted threats in crypto. Recovery efforts and potential user assistance are still under review.<ref name="curvefinancetweet1-19544" /><ref name="blockaidtweet-19545" /><ref name="curvefinancetweet2-19546" /><ref name="curvefinancetweet3-19547" /><ref name="curvefinancetweet4-19548" /><ref name="coinspecttweet2-19549" /><ref name="curvefinancetweet5-19550" /><ref name="curvefinancetweet6-19551" /><ref name="lamntt08tweet-19552" /><ref name="getclavetwitter-19553" /><ref name="poorbrahtwitter-19554" />
+[[File:Curvefinance.jpg|thumb|Curve Finance Logo/Homepage]]Curve Finance, a major decentralized exchange with $1.67 billion in total value locked, recently experienced a DNS-level attack that compromised its curve.fi domain. The exploit, linked to a lower-tier domain registrar, redirected users to a malicious IP, though no smart contracts or internal systems were breached. While user funds within the protocol remain secure, some users reported losses due to the incident. Curve swiftly responded by isolating the issue, launching an investigation, and migrating operations to curve.finance. The attack reflects a broader trend of infrastructure-targeted threats in crypto. Recovery efforts and potential user assistance are still under review.<ref name="curvefinancetweet1-19544" /><ref name="blockaidtweet-19545" /><ref name="curvefinancetweet2-19546" /><ref name="curvefinancetweet3-19547" /><ref name="curvefinancetweet4-19548" /><ref name="coinspecttweet2-19549" /><ref name="curvefinancetweet5-19550" /><ref name="curvefinancetweet6-19551" /><ref name="lamntt08tweet-19552" /><ref name="getclavetwitter-19553" /><ref name="poorbrahtwitter-19554" /><ref name="cointelegraph1-20001" /><ref name="web3isgoinggreat-20020" /><ref name="web3isgoinggreat-20021" /><ref name="returnfinanceblog-20022" /><ref name="oslcom-20023" /><ref name="coin98net-20024" /><ref name="binanceacademy-20025" />
 == About Curve Finance ==
-"Curve is one of the largest decentralized exchanges (DEX) in the crypto market today, with about $1.67 billion in total value locked (TVL), according to data on DeFi TVL aggregator DeFiLlama."
+Curve Finance has established itself as a leading platform in the decentralized finance (DeFi) ecosystem, offering efficient stablecoin trading, liquidity provision opportunities, and innovative financial products.
 == The Reality ==
@@ Line 132: / Line 140: @@
 <ref name="getclavetwitter-19553">[https://twitter.com/getclave/status/1922232285346271561 @getclave Twitter] (Accessed May 13, 2025)</ref>
-<ref name="poorbrahtwitter-19554">[https://twitter.com/poorbrah/status/1922210334846161303 @poorbrah Twitter] (Accessed May 13, 2025)</ref></references>
+<ref name="poorbrahtwitter-19554">[https://twitter.com/poorbrah/status/1922210334846161303 @poorbrah Twitter] (Accessed May 13, 2025)</ref>

Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/curvefinancecurvefidnshijackmaliciousfrontend.php}} {{Unattributed Sources}} Curve Finance Logo/HomepageCurve Finance, a major decentralized exchange with $1.67 billion in total value locked, recently experienced a DNS-level attack that compromised its curve.fi domain. The exploit, linked to a lower-tier domain registrar, redirected users to a malicious I..."

2025-05-14T21:50:08Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/curvefinancecurvefidnshijackmaliciousfrontend.php}} {{Unattributed Sources}} thumb|Curve Finance Logo/HomepageCurve Finance, a major decentralized exchange with $1.67 billion in total value locked, recently experienced a DNS-level attack that compromised its curve.fi domain. The exploit, linked to a lower-tier domain registrar, redirected users to a malicious I..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/curvefinancecurvefidnshijackmaliciousfrontend.php}}
{{Unattributed Sources}}

[[File:Curvefinance.jpg|thumb|Curve Finance Logo/Homepage]]Curve Finance, a major decentralized exchange with $1.67 billion in total value locked, recently experienced a DNS-level attack that compromised its curve.fi domain. The exploit, linked to a lower-tier domain registrar, redirected users to a malicious IP, though no smart contracts or internal systems were breached. While user funds within the protocol remain secure, some users reported losses due to the incident. Curve swiftly responded by isolating the issue, launching an investigation, and migrating operations to curve.finance. The attack reflects a broader trend of infrastructure-targeted threats in crypto. Recovery efforts and potential user assistance are still under review.<ref name="curvefinancetweet1-19544" /><ref name="blockaidtweet-19545" /><ref name="curvefinancetweet2-19546" /><ref name="curvefinancetweet3-19547" /><ref name="curvefinancetweet4-19548" /><ref name="coinspecttweet2-19549" /><ref name="curvefinancetweet5-19550" /><ref name="curvefinancetweet6-19551" /><ref name="lamntt08tweet-19552" /><ref name="getclavetwitter-19553" /><ref name="poorbrahtwitter-19554" />

== About Curve Finance ==
"Curve is one of the largest decentralized exchanges (DEX) in the crypto market today, with about $1.67 billion in total value locked (TVL), according to data on DeFi TVL aggregator DeFiLlama."

== The Reality ==
Unfortunately, Curve Finance was using a lower-end domain registrar named "iwantmyname" to manage their .fi extension domain name.

== What Happened ==
The Curve Finance curve.fi domain was hijacked and directed to a malicious website. The website looks identical but requests permissions and drains connected wallets.
{| class="wikitable"
|+Key Event Timeline - Curve Finance Curve.Fi DNS Hijack Malicious Frontend
!Date
!Event
!Description
|-
|May 12th, 2025 9:00:00 AM MDT
|Last Legitimate Front-End Update
|The last known legitimate update to the Curve Finance front-end, according to Coinspect security.
|-
|May 12th, 2025 3:00:00 PM MDT
|Untitled Event
|The DNS is changed over to Cloudflare IPs 104.21.67.209 and 172.67.181.32.
|-
|May 12th, 2025 3:25:00 PM MDT
|Curve Finance Reports Hijack
|Curve Finance reports on Twitter/X that their DNS may be hijacked and recommends users "[d]on't interact".
|-
|May 12th, 2025 4:07:00 PM MDT
|Blockaid Report Tweet
|Blockaid posts to report they "have detected a potential frontend attack targeting" Curve Finance and recommends users to "please refrain from signing transactions and avoid interactions with the dApp until the issue is resolved".
|-
|May 12th, 2025 5:27:00 PM MDT
|Curve Finance Confirms Security
|Curve Finance confirms that "every password is random and secure" and that "2FA [has been] set up everywhere".
|-
|May 12th, 2025 5:30:00 PM MDT
|Coinspect Security Analysis Thread
|CoinSpect Security starts a thread and reports that "[u]sers visiting the Curve frontend are being served malicious JavaScript wallet drainer code."
|-
|May 13th, 2025 2:32:00 AM MDT
|Response Time Is Unacceptable
|Curve Finance mentions the registrar is iwantmyname and publicly calls out that their response time is "totally unsacceptable(sic)". The domain reportedly still directs to a wallet drainer at this time.
|-
|May 13th, 2025 5:51:00 AM MDT
|Curve Finance Being Ignored
|Curve Finance reports that "[r]egistrar support is ignoring the requests, too".
|-
|May 13th, 2025 8:24:00 AM MDT
|Cloudflare Blocked Malicious Content
|Coinspect Security is now reporting that Cloudflare has finally blocked the malicious Curve Finance front-end.
|}

== Technical Details ==
"Late last night, the curve [.] fi domain was compromised at the DNS level. This exploit redirected traffic to a malicious IP not associated with Curve Finance. No smart contracts or internal systems were breached—the protocol itself remains fully operational and secure.

User funds are safe. Curve smart contracts remain secure.

The incident has not affected the protocol’s infrastructure and is strictly limited to the DNS layer."

== Total Amount Lost ==
Several users reported losing funds. However, no specific tally of funds was located yet.

The total amount lost is unknown.

== Immediate Reactions ==
"As soon as the exploit was detected, we’ve immediately taken the following steps:
Isolated the issue to the DNS layer
Initiated a full investigation
Engaged with our domain registrar and security partners
Reinforced all operational security protocols

We are actively working with the domain registrar to resolve the issue and restore normal operations as soon as possible.

This incident is not related to any breach of internal systems. Curve maintains a robust and industry standard security framework including password protection and two-factor authentication (2FA), etc, implemented long before the incident, none of which were bypassed.

The DNS incident involving curve [.] fi reflects a broader issue across the industry. In recent weeks, there has been a noticeable increase in attacks targeting the infrastructure of various crypto projects. Such incidents affect the entire market and highlight the importance of a systematic approach to protection. Curve Finance is taking all necessary measures to ensure the safety of user funds and restore the stable operation of the service.

In the meantime, avoid interacting with the curve [.] fi domain until an official update is shared through Curve Finance’s verified communication channels.

We understand the seriousness of the situation and are committed to full transparency. Our top priority is user safety and maintaining trust in Curve as public infrastructure for DeFi.

Thank you for your continued support."

== Ultimate Outcome ==
Cloudflare eventually disabled the malicious front-end. Curve Finance has migrated their services to a curve.finance domain name.

== Total Amount Recovered ==
It is unknown yet if Curve Finance will do anything to assist affected users.

There do not appear to have been any funds recovered in this case.

== Ongoing Developments ==
Any investigation and potential recovery are still ongoing.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="curvefinancetweet1-19544">[https://twitter.com/CurveFinance/status/1922040492121829678 Curve Finance - "Seems like http://curve.fi DNS might be hijacked. Don't interact!" - Twitter/X] (Accessed May 13, 2025)</ref>

<ref name="blockaidtweet-19545">[https://twitter.com/blockaid_/status/1922050920315052433 Blockaid - "URGENT: We have detected a potential frontend attack targeting @CurveFinance. If you're connected, please refrain from signing transactions and avoid interactions with the dApp until the issue is resolved. We’re working closely with affected partners. More updates soon." - Twitter/X] (Accessed May 13, 2025)</ref>

<ref name="curvefinancetweet2-19546">[https://twitter.com/CurveFinance/status/1922258474974560731 Curve Finance - "Registrar support is ignoring the requests, too" - Twitter/X] (Accessed May 13, 2025)</ref>

<ref name="curvefinancetweet3-19547">[https://twitter.com/CurveFinance/status/1922071061669056949 Curve Finance - "Nope, every password is random and secure, 2FA set up everywhere" - Twitter/X] (Accessed May 13, 2025)</ref>

<ref name="curvefinancetweet4-19548">[https://twitter.com/CurveFinance/status/1922069785795342654 Curve Finance - "While all smart contracts are safe, the domain name points to a malicious site which can drain your wallet! We are investigating and working on recovering the access. No sign of a compromise on our side." - Twitter/X] (Accessed May 13, 2025)</ref>

<ref name="coinspecttweet2-19549">[https://twitter.com/coinspect/status/1922296775739596939 Coinspect Security - "Cloudflare (@Cloudflare) has finally blocked the compromised Curve fi frontend." - Twitter/X] (Accessed May 13, 2025)</ref>

<ref name="curvefinancetweet5-19550">[https://twitter.com/CurveFinance/status/1922199907269501130 <nowiki>"Late last night, the curve [.] fi domain was compromised at the DNS level. This exploit redirected traffic to a malicious IP not associated with Curve Finance. No smart contracts or internal systems were breached—the protocol itself remains fully operational and secure." - Twitter/X</nowiki>] (Accessed May 13, 2025)</ref>

<ref name="curvefinancetweet6-19551">[https://twitter.com/CurveFinance/status/1922208277036712431 <nowiki>Curve Finance - "Dear @iwantmyname. Your response time is totally unsacceptable: we need access to curve [.] fi taken away from hackers and the incident to be investigated. As of now, DNS still points to a drainer which can lead users to lose millions if they interact with it!" - Twitter/X</nowiki>] (Accessed May 13, 2025)</ref>

<ref name="lamntt08tweet-19552">[https://twitter.com/lamntt08/status/1922125340576547047 Lamntt08 - "@CurveFinance Connect to Curve and got hacked, please help" - Twitter/X] (Accessed May 13, 2025)</ref>

<ref name="getclavetwitter-19553">[https://twitter.com/getclave/status/1922232285346271561 @getclave Twitter] (Accessed May 13, 2025)</ref>

<ref name="poorbrahtwitter-19554">[https://twitter.com/poorbrah/status/1922210334846161303 @poorbrah Twitter] (Accessed May 13, 2025)</ref></references>