DeFi Saver Malicious DNS Hijack - Revision history

Azoundria: 30 Minutes. Expanded and rewrote the description of the Defi Saver service. Review and minor revisiont to timeline.

2024-04-17T22:25:55Z

30 Minutes. Expanded and rewrote the description of the Defi Saver service. Review and minor revisiont to timeline.

← Older revision		Revision as of 16:25, 17 April 2024
Line 3:		Line 3:

	== About DeFi Saver ==		== About DeFi Saver ==
	DeFi Saver is a comprehensive management dashboard designed to assist users in managing their assets and positions across various decentralized finance (DeFi) protocols. It offers features such as automatic liquidation protection for MakerDAO Collateralized Debt Positions (CDPs) and supports other protocols like Compound, dYdX, and Fulcrum<ref name="defisaverdefiprime-10525" /><ref name="defisaverwebsite-1807" />. ~~With over 441,000 user transactions and a trade volume exceeding $7.5 billion,~~ DeFi Saver supports 16 networks, 4 protocols, and 13 decentralized exchanges and aggregators<ref name="defisaverwebsite-1807" />. The platform offers essential tools for tracking and managing DeFi portfolios, including features for lending and borrowing, advanced decentralized exchange capabilities, leverage management, and a loan shifter for moving positions between different protocols<ref name="defisaverwebsite-1807" />. Automation options such as stop loss, take profit, trailing stop, and automated leverage management are also available, allowing users to protect their positions and optimize returns. DeFi Saver emphasizes security, with audited smart contracts, battle-tested protocols, bug bounty programs, and a non-custodial, trustless approach to user interactions<ref name="defisaverwebsite-1807" />. The platform allows users to create custom DeFi transactions, combining various actions and executing them in a single transaction<ref name="defisaverwebsite-1807" />.		DeFi Saver is a comprehensive management dashboard designed to assist users in managing their assets and positions across various decentralized finance (DeFi) protocols. It offers features such as automatic liquidation protection for MakerDAO Collateralized Debt Positions (CDPs) and supports other protocols like Compound, dYdX, and Fulcrum<ref name="defisaverdefiprime-10525" /><ref name="defisaverwebsite-1807" />. DeFi Saver supports 16 networks, 4 protocols, and 13 decentralized exchanges and aggregators<ref name="defisaverwebsite-1807" />. The platform offers essential tools for tracking and managing DeFi portfolios, including features for lending and borrowing, advanced decentralized exchange capabilities, leverage management, and a loan shifter for moving positions between different protocols<ref name="defisaverwebsite-1807" />. Automation options such as stop loss, take profit, trailing stop, and automated leverage management are also available, allowing users to protect their positions and optimize returns. DeFi Saver emphasizes security, with audited smart contracts, battle-tested protocols, bug bounty programs, and a non-custodial, trustless approach to user interactions<ref name="defisaverwebsite-1807" />. The platform allows users to create custom DeFi transactions, combining various actions and executing them in a single transaction<ref name="defisaverwebsite-1807" />.

	The system components include Actions (contracts performing specific actions), Triggers (contracts checking conditions), Recipes (series of bundled actions executed in sequence), Strategies (arrays of triggers and recipes executed by bots), Bundles (lists of strategies with similar triggers and different recipes), and Subscriptions (users subscribing to specific strategies with custom data)<ref name="defisaverdocs-10526" />. The platform provides users with a centralized interface to efficiently manage and monitor their activities across various DeFi protocols, enhancing convenience and risk management in the decentralized financial ecosystem<ref name="defisaverdefiprime-10525" />. The platform has received positive feedback from users and is recognized for its ease of use and risk management capabilities<ref name="defisaverwebsite-1807" />.		The system components include Actions (contracts performing specific actions), Triggers (contracts checking conditions), Recipes (series of bundled actions executed in sequence), Strategies (arrays of triggers and recipes executed by bots), Bundles (lists of strategies with similar triggers and different recipes), and Subscriptions (users subscribing to specific strategies with custom data)<ref name="defisaverdocs-10526" />. The platform provides users with a centralized interface to efficiently manage and monitor their activities across various DeFi protocols, enhancing convenience and risk management in the decentralized financial ecosystem<ref name="defisaverdefiprime-10525" />. The platform has gained significant popularity, with over 441,000 user transactions and a trade volume exceeding $7.5 billion<ref name="defisaverwebsite-1807" />. The platform has received positive feedback from users and is recognized for its ease of use and risk management capabilities<ref name="defisaverwebsite-1807" />.
	== The Reality ==		== The Reality ==
	While smart contracts operate in a decentralized "trustless" manner, most users will tend to interact with the contracts using transactions generated by a centralized "trusted" website. When a domain name is accessed on the internet, a service called DNS (Domain Name System) is used to route the user to the appropriate server<ref name="cloudflarewhatisdns-10527" />.		While smart contracts operate in a decentralized "trustless" manner, most users will tend to interact with the contracts using transactions generated by a centralized "trusted" website. When a domain name is accessed on the internet, a service called DNS (Domain Name System) is used to route the user to the appropriate server<ref name="cloudflarewhatisdns-10527" />.

Azoundria: Blackchain analytics links added in.

2023-12-28T18:46:48Z

Blackchain analytics links added in.

← Older revision		Revision as of 12:46, 28 December 2023
Line 26:		Line 26:
	\|-		\|-
	\|June 20th, 2022 3:05:42 AM MDT		\|June 20th, 2022 3:05:42 AM MDT
	\|First Malicious Contract		\|First Malicious Contract Creation
	\|The very first smart contract is created by a wallet controlled from the attacker<ref>[https://etherscan.io/tx/0x50e6924604c8b1e1f8096f01aca0b35836c7d168fc0e99631f43d683717b13b5 First ~~Smart~~ Contract ~~Creation~~ - ~~EtherScan~~] (Feb 23, 2023)</ref>.		\|The very first smart contract is created by a wallet controlled from the attacker<ref name=":03">[https://etherscan.io/tx/0x50e6924604c8b1e1f8096f01aca0b35836c7d168fc0e99631f43d683717b13b5 First Transaction Creating Malicious Contract 0x65a8...3b2f - Etherscan] (Feb 23, 2023)</ref>. Malicious contract 0x65a8...3b2f<ref>[https://etherscan.io/address/0x65a8e56ee6b549456fd8927db3fa526b8d143b2f Unused Contract 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref> was created by wallet 0x5622...781a<ref name=":03" /><ref>[https://etherscan.io/address/0x5622c77e1484840048d2064326ac77ddaad17d1a Wallet Address 0x5622...7d1a Who Created 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref>.
	\|-		\|-
	\|June 20th, 2022		\|June 20th, 2022
Line 117:		Line 117:
	\|NameCheap decides to offer two different Domain Vault services from "Silver" tier at $1.88/mo<ref name="namecheapdomainvault6-10571" /> to "Titanium" tier at $19.88/mo<ref name="namecheapdomainvault7-10572" />.		\|NameCheap decides to offer two different Domain Vault services from "Silver" tier at $1.88/mo<ref name="namecheapdomainvault6-10571" /> to "Titanium" tier at $19.88/mo<ref name="namecheapdomainvault7-10572" />.
	\|}		\|}

			== Technical Details ==

			=== Blockchain Analytics ===
			Various notable addresses and transactions from Etherscan for further research/analysis:

			<ref>[https://etherscan.io/address/0x65a8e56ee6b549456fd8927db3fa526b8d143b2f Unused Contract 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref><ref>[https://etherscan.io/tx/0x50e6924604c8b1e1f8096f01aca0b35836c7d168fc0e99631f43d683717b13b5 Transaction Creating Contract 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref><ref>[https://etherscan.io/address/0x5622c77e1484840048d2064326ac77ddaad17d1a Wallet Address 0x5622...7d1a Who Created 0x65a8...3b2f - Etherscan] (Feb 27, 2023)</ref><ref>[https://etherscan.io/tx/0x4e2973f8ca8038a85b798cc7fa93db62064d6053c757730a5be656c17104d611 Transaction Creating 0xdd49....c82b - Etherscan] (Feb 27, 2023)</ref><ref>[https://etherscan.io/txs?a=0x56d3191ee65f1f76e4e902ec983c6420398d49c8 Transactions By Wallet 0x56d3...49c8 (Fake_Phishing5851) - Etherscan] (Dec 27, 2023)</ref><ref>[https://etherscan.io/address/0x4e1256734882c3deff95e963b6a0a658bb88899a Address 0x4e12...899a Who Created 0xf403...ae31 - Etherscan] (Dec 28, 2023)</ref><ref>[https://etherscan.io/address/0xf403a2c10b0b9fef8f0d4f931df5d86ad187ae31 Vanity Phishing Smart Contract 0xF403...AE31 - Etherscan] (Dec 7, 2o23)</ref><ref name="etherscanattackeraddress1-8877">[https://etherscan.io/address/0xb73261481064f717a63e6f295d917c28385af9aa Address 0xB732...F9Aa (Convex & Ribbon Phisher) - Etherscan] (Aug 23, 2022)</ref><ref>[https://etherscan.io/token/0x4e3fbd56cd56c3e72c1403e103b45db9da5b9d2b?a=0xcdc0f019f0ec0a903ca689e2bced3996efc53939 Convex Finance Tokens Received By Convex & Ribbon Phisher - Etherscan] (Dec 28, 2023)</ref>

	== Total Amount Lost ==		== Total Amount Lost ==

Azoundria: Another 30 minutes complete. Extensive revision of About section. Other focus mainly on sources throughout.

2023-12-19T23:52:03Z

Another 30 minutes complete. Extensive revision of About section. Other focus mainly on sources throughout.

Show changes

Azoundria: Opening description.

2023-04-02T06:03:59Z

Opening description.

← Older revision		Revision as of 00:03, 2 April 2023
Line 1:		Line 1:
	[[File:Defisaver.jpg\|thumb\|DeFi Saver]]		DefiSaver is a tool to track and manage DeFi positions. The service used NameCheap to host their primary domain where customers would interact with the service. On June 23rd, a request was made to change the DNS settings on their domain name, which was believed to be due to a vulnerability in NameCheap. This redirected the website to a phishing version, which looked identical to main version but requested approval on a new smart contract with a similar address. The new smart contract allowed the attacker to steal approved funds and was active on the site for a few hours, plus DNS propagation time. The DefiSaver project has stated that none of their users lost any funds as a result of this exploit.[[File:Defisaver.jpg\|thumb\|DeFi Saver]]

Azoundria: Completion and removed the under construction template.

2023-04-02T06:01:50Z

Completion and removed the under construction template.

← Older revision		Revision as of 00:01, 2 April 2023
Line 1:		Line 1:
	~~{{Case Study Under Construction}}~~[[File:Defisaver.jpg\|thumb\|DeFi Saver]]		[[File:Defisaver.jpg\|thumb\|DeFi Saver]]


Line 83:		Line 83:
	\|Attacks Reported Together Again		\|Attacks Reported Together Again
	\|Twitter user Tommy Famous also reports on all 4 DNS attacks in a single thread<ref>[https://twitter.com/TommyBeFamous/status/1540326185795829765 TommyBeFamous - "So far 4 #ethereum DeFi projects experienced a DNS hijack attack." - Twitter] (Mar 24, 2023)</ref>.		\|Twitter user Tommy Famous also reports on all 4 DNS attacks in a single thread<ref>[https://twitter.com/TommyBeFamous/status/1540326185795829765 TommyBeFamous - "So far 4 #ethereum DeFi projects experienced a DNS hijack attack." - Twitter] (Mar 24, 2023)</ref>.
			\|-
			\|June 24th, 2022 8:34:00 AM
			\|DefiSaver Reports DNS Migration
			\|DefiSaver reports that they have migrated away from NameCheap as their domain registrar<ref name=":3">[https://twitter.com/DeFiSaver/status/1540342499834830849 DefiSaver - "PSA: We have already migrated from Namecheap." - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 10:01:00 AM MDT		\|June 24th, 2022 10:01:00 AM MDT
Line 103:		Line 107:
	\|NameCheap Clarifies Hack		\|NameCheap Clarifies Hack
	\|NameCheap responds that it "[l]ooks more like [their customer support] person was hacked."<ref name="namecheapceotwitter3-10566" />		\|NameCheap responds that it "[l]ooks more like [their customer support] person was hacked."<ref name="namecheapceotwitter3-10566" />
			\|-
			\|June 24th, 2022 5:26:00 PM MDT
			\|DefiSaver Again Confirms Migration
			\|DefiSaver again confirms that they have migrated away from NameCheap for their DNS<ref name=":5">[https://twitter.com/DeFiSaver/status/1540476444786233347 DefiSaver - "this was immediately resolved and we quickly migrated away from Namecheap, too" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 25th, 2022		\|June 25th, 2022
Line 125:		Line 133:
	The common denominator with @ConvexFinance and @RibbonFinance was @Namecheap and we invite other projects to exercise caution.</blockquote>Twitter user @psyOPs_ accused the team of not using two-factor authentication<ref>[https://twitter.com/psyOPs_/status/1540309756178358277 psyOPs_ Accusation - Twitter] (Feb 22, 2023)</ref> and clarification was provided<ref>[https://twitter.com/DeFiSaver/status/1540311188462080003 DefiSaver "We certainly did use 2FA" - Twitter] (Feb 22, 2023)</ref>.<blockquote>hi. namecheap user here. no issues. no news of any data breaches. suspect real common denominator here was accounts not using 2FA security.</blockquote><blockquote>We certainly did use 2FA, as mentioned and as did other teams.		The common denominator with @ConvexFinance and @RibbonFinance was @Namecheap and we invite other projects to exercise caution.</blockquote>Twitter user @psyOPs_ accused the team of not using two-factor authentication<ref>[https://twitter.com/psyOPs_/status/1540309756178358277 psyOPs_ Accusation - Twitter] (Feb 22, 2023)</ref> and clarification was provided<ref>[https://twitter.com/DeFiSaver/status/1540311188462080003 DefiSaver "We certainly did use 2FA" - Twitter] (Feb 22, 2023)</ref>.<blockquote>hi. namecheap user here. no issues. no news of any data breaches. suspect real common denominator here was accounts not using 2FA security.</blockquote><blockquote>We certainly did use 2FA, as mentioned and as did other teams.

	Is there a reason why you would expect your domain to be targe[t]ed in this kind of attack, i.e. is it a domain of a defi protocol which is the other common denominator in this case?</blockquote>Twitter user 0xPooka confirmed they are switching away from NameCheap<ref>[https://twitter.com/0xPooka/status/1540306092474916864 0xPooka - "Just switched all my domains from Namecheap" - Twitter] (Feb 22, 2023)</ref>.<blockquote>Just switched all my domains from Namecheap to AWS Route 53 the other day. Took 15 minutes</blockquote>		Is there a reason why you would expect your domain to be targe[t]ed in this kind of attack, i.e. is it a domain of a defi protocol which is the other common denominator in this case?</blockquote>Both DefiSaver<ref name=":3" /> and Twitter user 0xPooka confirmed they are switching away from NameCheap<ref>[https://twitter.com/0xPooka/status/1540306092474916864 0xPooka - "Just switched all my domains from Namecheap" - Twitter] (Feb 22, 2023)</ref>.<blockquote>Just switched all my domains from Namecheap to AWS Route 53 the other day. Took 15 minutes</blockquote>

	== Ultimate Outcome ==		== Ultimate Outcome ==
Line 132:		Line 140:
	The NameCheap CEO ultimately responded on Twitter to explain that there was a hacked or compromised customer support agent and all access was removed from them<ref name="namecheapceotwitter1-8884" />. He also offered completely free Domain Vault monitoring to all affected services<ref>[https://twitter.com/NamecheapCEO/status/1540364947611422722 @NamecheapCEO - "we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring" - Twitter] (Feb 24, 2023)</ref>.<blockquote>"We've traced this down to a specific [customer support] agent that was either hacked or compromised somehow and have removed all access from this agent. This affected a few targeted domains but we will continue investigating."		The NameCheap CEO ultimately responded on Twitter to explain that there was a hacked or compromised customer support agent and all access was removed from them<ref name="namecheapceotwitter1-8884" />. He also offered completely free Domain Vault monitoring to all affected services<ref>[https://twitter.com/NamecheapCEO/status/1540364947611422722 @NamecheapCEO - "we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring" - Twitter] (Feb 24, 2023)</ref>.<blockquote>"We've traced this down to a specific [customer support] agent that was either hacked or compromised somehow and have removed all access from this agent. This affected a few targeted domains but we will continue investigating."

	"In the meantime we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring."</blockquote>		"In the meantime we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring."</blockquote>DefiSaver is no longer using NameCheap as their domain registrar<ref name=":3" /><ref name=":5" />.

	== Total Amount Recovered ==		== Total Amount Recovered ==
	While funds were lost on other targeted platforms, based on a report by ~~DeFi Saver~~, there do not appear to have been any funds lost from their platform<ref name=":0" />.		While funds were lost on other targeted platforms, based on a report by DeFiSaver, there do not appear to have been any funds lost from their platform<ref name=":0" />.

	== Ongoing Developments ==		== Ongoing Developments ==

Azoundria: Fixing Nalin Gupta, and adding speculation about further domains.

2023-04-02T05:50:31Z

Fixing Nalin Gupta, and adding speculation about further domains.

← Older revision		Revision as of 23:50, 1 April 2023
Line 74:		Line 74:
	\|June 24th, 2022 7:00:00 AM MDT		\|June 24th, 2022 7:00:00 AM MDT
	\|Attacks Reported With Screenshots		\|Attacks Reported With Screenshots
	\|Twitter user ~~Nathan~~ Gupta is the first to publicly provide screenshots of all 4 DNS attacks in a single thread<ref>[https://twitter.com/nalingupta01/status/1540319012067737600 ~~Nathan~~ Gupta - "4 DeFi projects have experienced a DNS hijack attack" - Twitter] (Apr 1, 2023)</ref>.		\|Twitter user Nalin Gupta is the first to publicly provide screenshots of all 4 DNS attacks in a single thread<ref>[https://twitter.com/nalingupta01/status/1540319012067737600 Nalin Gupta - "4 DeFi projects have experienced a DNS hijack attack" - Twitter] (Apr 1, 2023)</ref>.
			\|-
			\|June 24th, 2022 7:24:00 AM MDT
			\|Speculation About Further Domains
			\|Further speculation arises that some other domains may be related<ref>[https://twitter.com/nalingupta01/status/1540325110720380928 <nowiki>Nalin Gupta - "It does seem some others might be affected tho[ugh]" - Twitter</nowiki>] (Apr 1, 2023)</ref>. The list referenced are cryptocurrency phishing websites and it does not appear that any of those domains are related to the DNS attack<ref>[https://twitter.com/idclickthat/status/1540200001112096768 idclickthat - "crypto phish" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 7:29:00 AM MDT		\|June 24th, 2022 7:29:00 AM MDT

Azoundria: nothing to worry about quote

2023-04-02T04:09:09Z

nothing to worry about quote

← Older revision		Revision as of 22:09, 1 April 2023
Line 87:		Line 87:
	\|Free DomainVault Monitoring		\|Free DomainVault Monitoring
	\|NameCheap's CEO expands the original tweet to say that they "would like to offer [affected services their] Domain Vault service for free and [they] will also place all affected domains on the highest security monitoring"<ref>[https://twitter.com/NamecheapCEO/status/1540364947611422722 @NamecheapCEO - "we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring" - Twitter] (Feb 24, 2023)</ref>.		\|NameCheap's CEO expands the original tweet to say that they "would like to offer [affected services their] Domain Vault service for free and [they] will also place all affected domains on the highest security monitoring"<ref>[https://twitter.com/NamecheapCEO/status/1540364947611422722 @NamecheapCEO - "we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring" - Twitter] (Feb 24, 2023)</ref>.
			\|-
			\|June 24th, 2022 10:32:00 AM MDT
			\|Nothing To Worry About
			\|NameCheap assures via Twitter that "[t]here is nothing to worry about" and they will "keep investigating"<ref>[https://twitter.com/Namecheap/status/1540372203627216898 NameCheap - "There is nothing to worry about; we keep investigating" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 11:21:00 AM MDT		\|June 24th, 2022 11:21:00 AM MDT

Azoundria: Tweet used as support for 2FA being employed too.

2023-04-01T20:55:31Z

Tweet used as support for 2FA being employed too.

← Older revision		Revision as of 14:55, 1 April 2023
Line 17:		Line 17:
	The account of a customer support agent for NameCheap was hacked<ref name="namecheapceotwitter3-10566" />.		The account of a customer support agent for NameCheap was hacked<ref name="namecheapceotwitter3-10566" />.

	This allowed the attacker to modify the DNS settings for multiple high profile decentralized protocols with domain names registered there, including [[Convex Finance Malicious DNS Hijack\|Convex Finance]], [[Ribbon Finance Malicious DNS Hijack\|Ribbon Finance]], Defi Saver, and [[AllBridge Malicious DNS Hijack\|AllBridge]]<ref>[https://www.trustnodes.com/2022/06/25/defi-dapps-dns-attacked DeFi Dapps DNS Attacked - TrustNodes] (Feb 25, 2024)</ref>. The attacker was able to override any 2-factor authentication, passwords, and security alert settings<ref name=":1">[https://twitter.com/DeFiSaver/status/1540300789901627392 DeFiSaver - "Same as with others, strong passwords and 2fa were used and we don't recognise security factors on our end that could have led to this." - Twitter] (Mar 23, 2023)</ref><ref>[https://twitter.com/DeFiSaver/status/1540311188462080003 DefiSaver - "We certainly did use 2FA, as mentioned and as did other teams." - Twitter] (Mar 23, 2023)</ref>.		This allowed the attacker to modify the DNS settings for multiple high profile decentralized protocols with domain names registered there, including [[Convex Finance Malicious DNS Hijack\|Convex Finance]], [[Ribbon Finance Malicious DNS Hijack\|Ribbon Finance]], Defi Saver, and [[AllBridge Malicious DNS Hijack\|AllBridge]]<ref>[https://www.trustnodes.com/2022/06/25/defi-dapps-dns-attacked DeFi Dapps DNS Attacked - TrustNodes] (Feb 25, 2024)</ref>. The attacker was able to override any 2-factor authentication, passwords, and security alert settings<ref name=":1">[https://twitter.com/DeFiSaver/status/1540300789901627392 DeFiSaver - "Same as with others, strong passwords and 2fa were used and we don't recognise security factors on our end that could have led to this." - Twitter] (Mar 23, 2023)</ref><ref>[https://twitter.com/DeFiSaver/status/1540311188462080003 DefiSaver - "We certainly did use 2FA, as mentioned and as did other teams." - Twitter] (Mar 23, 2023)</ref><ref name=":2" />.
	{\| class="wikitable"		{\| class="wikitable"
	\|+Key Event Timeline - DeFi Saver Malicious DNS Hijack		\|+Key Event Timeline - DeFi Saver Malicious DNS Hijack
Line 70:		Line 70:
	\|June 24th, 2022 6:14:00 AM MDT		\|June 24th, 2022 6:14:00 AM MDT
	\|All Attacks Reported Together		\|All Attacks Reported Together
	\|All 4 "DNS exploit[s]" with "illicit vanity contracts" are reported by Twitter user CryptoCondom. He also mentioned that all protocols were using 2FA<ref>[https://twitter.com/crypto_condom/status/1540307373713129474 CryptoCondom - "A multi-platform DNS exploit appears to have occurred this week w/illicit vanity contracts" - Twitter] (Apr 1, 2023)</ref>.		\|All 4 "DNS exploit[s]" with "illicit vanity contracts" are reported by Twitter user CryptoCondom. He also mentioned that all protocols were using 2FA<ref name=":2">[https://twitter.com/crypto_condom/status/1540307373713129474 CryptoCondom - "A multi-platform DNS exploit appears to have occurred this week w/illicit vanity contracts" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 7:00:00 AM MDT		\|June 24th, 2022 7:00:00 AM MDT

Azoundria: Attacks reported together updated again with another Twitter post.

2023-04-01T20:53:06Z

Attacks reported together updated again with another Twitter post.

← Older revision		Revision as of 14:53, 1 April 2023
Line 67:		Line 67:
	\|Telegram Group Operating		\|Telegram Group Operating
	\|A Telegram group has reportedly been set up for communication and coordination between the different affected protocols<ref name=":43">[https://twitter.com/0xLlam4/status/1540303906215010304 @0xLlam4 - "on TG, can add you into a group with affected protocols" - Twitter] (Feb 27, 2023)</ref>.		\|A Telegram group has reportedly been set up for communication and coordination between the different affected protocols<ref name=":43">[https://twitter.com/0xLlam4/status/1540303906215010304 @0xLlam4 - "on TG, can add you into a group with affected protocols" - Twitter] (Feb 27, 2023)</ref>.
			\|-
			\|June 24th, 2022 6:14:00 AM MDT
			\|All Attacks Reported Together
			\|All 4 "DNS exploit[s]" with "illicit vanity contracts" are reported by Twitter user CryptoCondom. He also mentioned that all protocols were using 2FA<ref>[https://twitter.com/crypto_condom/status/1540307373713129474 CryptoCondom - "A multi-platform DNS exploit appears to have occurred this week w/illicit vanity contracts" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 7:00:00 AM MDT		\|June 24th, 2022 7:00:00 AM MDT
	\|~~All~~ Attacks Reported ~~Together~~		\|Attacks Reported With Screenshots
	\|Twitter user Nathan Gupta is the first to publicly ~~report~~ all 4 DNS attacks in a single thread<ref>[https://twitter.com/nalingupta01/status/1540319012067737600 Nathan Gupta - "4 DeFi projects have experienced a DNS hijack attack" - Twitter] (Apr 1, 2023)</ref>.		\|Twitter user Nathan Gupta is the first to publicly provide screenshots of all 4 DNS attacks in a single thread<ref>[https://twitter.com/nalingupta01/status/1540319012067737600 Nathan Gupta - "4 DeFi projects have experienced a DNS hijack attack" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 7:29:00 AM MDT		\|June 24th, 2022 7:29:00 AM MDT

Azoundria: Adding timezones, Nathan Gupta timeline entry.

2023-04-01T20:41:45Z

Adding timezones, Nathan Gupta timeline entry.

← Older revision		Revision as of 14:41, 1 April 2023
Line 28:		Line 28:
	\|The first archived appearance of the "Domain Vault" service on NameCheap which costs $19.88/mo and is still "coming soon"<ref name="namecheapdomainvault1-10530" />.		\|The first archived appearance of the "Domain Vault" service on NameCheap which costs $19.88/mo and is still "coming soon"<ref name="namecheapdomainvault1-10530" />.
	\|-		\|-
	\|June 20th, 2022 3:05:42 AM		\|June 20th, 2022 3:05:42 AM MDT
	\|First Malicious Contract		\|First Malicious Contract
	\|The very first smart contract is created by a wallet controlled from the attacker<ref>[https://etherscan.io/tx/0x50e6924604c8b1e1f8096f01aca0b35836c7d168fc0e99631f43d683717b13b5 First Smart Contract Creation - EtherScan] (Feb 23, 2023)</ref>.		\|The very first smart contract is created by a wallet controlled from the attacker<ref>[https://etherscan.io/tx/0x50e6924604c8b1e1f8096f01aca0b35836c7d168fc0e99631f43d683717b13b5 First Smart Contract Creation - EtherScan] (Feb 23, 2023)</ref>.
Line 36:		Line 36:
	\|The NameCheap "Domain Vault" service now switches from "Get early access" to "Get Domain Vault" with the price remaining at $19.88/mo<ref name="namecheapdomainvault2-10567" /><ref name="namecheapdomainvault3-10568" />.		\|The NameCheap "Domain Vault" service now switches from "Get early access" to "Get Domain Vault" with the price remaining at $19.88/mo<ref name="namecheapdomainvault2-10567" /><ref name="namecheapdomainvault3-10568" />.
	\|-		\|-
	\|June 23rd, 2022 6:17:41 AM		\|June 23rd, 2022 6:17:41 AM MDT
	\|Final Malicious Contract		\|Final Malicious Contract
	\|The final malicious smart contract is created by the attacker<ref>[https://etherscan.io/tx/0x4e2973f8ca8038a85b798cc7fa93db62064d6053c757730a5be656c17104d611 Final Malicious Contract Creation - EtherScan] (Feb 23, 2023)</ref>.		\|The final malicious smart contract is created by the attacker<ref>[https://etherscan.io/tx/0x4e2973f8ca8038a85b798cc7fa93db62064d6053c757730a5be656c17104d611 Final Malicious Contract Creation - EtherScan] (Feb 23, 2023)</ref>.
	\|-		\|-
	\|June 23rd, 2022 1:02:00 PM		\|June 23rd, 2022 1:02:00 PM MDT
	\|Alexintosh Convex Finance Tweet		\|Alexintosh Convex Finance Tweet
	\|The Twitter user @alexintosh reported an abnormal approval requested by the similarly affected Convex Finance website, with a similar but not exact smart contract address<ref name="alexintoshtwitter-8874">[https://twitter.com/Alexintosh/status/1540047636467748870 @Alexintosh Twitter] (Aug 23, 2022)</ref><ref name="convexcontractaddresses-8886">[https://docs.convexfinance.fi/convexfinance/faq/contract-addresses Contract Addresses - ConvexFinance] (Aug 24, 2022)</ref><ref name="cryptonomist-8870">https://en.cryptonomist.ch/2022/06/24/convex-more-info-on-the-hack/ (Jul 2, 2022)</ref>.		\|The Twitter user @alexintosh reported an abnormal approval requested by the similarly affected Convex Finance website, with a similar but not exact smart contract address<ref name="alexintoshtwitter-8874">[https://twitter.com/Alexintosh/status/1540047636467748870 @Alexintosh Twitter] (Aug 23, 2022)</ref><ref name="convexcontractaddresses-8886">[https://docs.convexfinance.fi/convexfinance/faq/contract-addresses Contract Addresses - ConvexFinance] (Aug 24, 2022)</ref><ref name="cryptonomist-8870">https://en.cryptonomist.ch/2022/06/24/convex-more-info-on-the-hack/ (Jul 2, 2022)</ref>.
	\|-		\|-
	\|June 23rd, 2022 2:23:00 PM		\|June 23rd, 2022 2:23:00 PM MDT
	\|Please Review Approvals		\|Please Review Approvals
	\|Convex Finance posts their very first announcement on Twitter, requesting users to "[p]lease review approvals while we evaluate a potential front end issue<ref name="convexfinancepleasereviewtwitter-8875">[https://twitter.com/ConvexFinance/status/1540068029920432128 @ConvexFinance - "Please review approvals while we evaluate a potential front end issue." - Twitter] (Aug 23, 2022)</ref>."		\|Convex Finance posts their very first announcement on Twitter, requesting users to "[p]lease review approvals while we evaluate a potential front end issue<ref name="convexfinancepleasereviewtwitter-8875">[https://twitter.com/ConvexFinance/status/1540068029920432128 @ConvexFinance - "Please review approvals while we evaluate a potential front end issue." - Twitter] (Aug 23, 2022)</ref>."
	\|-		\|-
	\|June 23rd, 2022 3:46:00 PM		\|June 23rd, 2022 3:46:00 PM MDT
	\|Additional Malicious Contracts		\|Additional Malicious Contracts
	\|Twitter user @HarukoTech describes several malicious contracts which were created against different protocols and that "[t]he attacker seems to be generating similar addresses to well know[n] protocols"<ref name="harukotechdifferentcontracts-8895">[https://twitter.com/HarukoTech/status/1540088990723969027 @HarukoTech Twitter] (Aug 24, 2022)</ref>.		\|Twitter user @HarukoTech describes several malicious contracts which were created against different protocols and that "[t]he attacker seems to be generating similar addresses to well know[n] protocols"<ref name="harukotechdifferentcontracts-8895">[https://twitter.com/HarukoTech/status/1540088990723969027 @HarukoTech Twitter] (Aug 24, 2022)</ref>.
	\|-		\|-
	\|June 23rd, 2022 3:54:00 PM		\|June 23rd, 2022 3:54:00 PM MDT
	\|Bret Woods Suggestion		\|Bret Woods Suggestion
	\|Twitter user Bret Woods (@fewture) posts that "[w]e're seeing hackers create addresses that match the first 4 and last 4 characters". His suggestion is to run the same transaction with "the gas SUPER LOW. Like 5 gwei. Your transaction won't go through, but it will populate on @etherscan where it is much easier to click through and make sure it's doing what you intended to do"<ref name=":02">[https://twitter.com/fewture/status/1540090921034940416 Bret Woods (@fewture) Guide - Twitter] (Feb 22, 2023)</ref>.		\|Twitter user Bret Woods (@fewture) posts that "[w]e're seeing hackers create addresses that match the first 4 and last 4 characters". His suggestion is to run the same transaction with "the gas SUPER LOW. Like 5 gwei. Your transaction won't go through, but it will populate on @etherscan where it is much easier to click through and make sure it's doing what you intended to do"<ref name=":02">[https://twitter.com/fewture/status/1540090921034940416 Bret Woods (@fewture) Guide - Twitter] (Feb 22, 2023)</ref>.
	\|-		\|-
	\|June 23rd, 2022 4:46:00 PM		\|June 23rd, 2022 4:46:00 PM MDT
	\|Convex Finance DNS Hijack Post		\|Convex Finance DNS Hijack Post
	\|Similarly affected Convex Finance first posts on Twitter to announce the DNS hijacking. They list 5 addresses which are affected, that investigation is still ongoing, and that the issue is "remediated" for their service<ref name="convexannouncesdnshijacktwitter-8893">[https://twitter.com/ConvexFinance/status/1540104036229185536 @ConvexFinance Twitter] (Aug 24, 2022)</ref><ref name="cryptonomist-88702">https://en.cryptonomist.ch/2022/06/24/convex-more-info-on-the-hack/ (Jul 2, 2022)</ref>.		\|Similarly affected Convex Finance first posts on Twitter to announce the DNS hijacking. They list 5 addresses which are affected, that investigation is still ongoing, and that the issue is "remediated" for their service<ref name="convexannouncesdnshijacktwitter-8893">[https://twitter.com/ConvexFinance/status/1540104036229185536 @ConvexFinance Twitter] (Aug 24, 2022)</ref><ref name="cryptonomist-88702">https://en.cryptonomist.ch/2022/06/24/convex-more-info-on-the-hack/ (Jul 2, 2022)</ref>.
	\|-		\|-
	\|June 24th, 2022 5:48:00 AM		\|June 24th, 2022 5:48:00 AM MDT
	\|DeFi Saver Reports Exploit		\|DeFi Saver Reports Exploit
	\|The Defi Saver team publicly acknowledges the incident on Twitter and state that they believe no users were affected<ref name=":0">[https://twitter.com/DeFiSaver/status/1540300787988979713 DefiSaver - "Based on our knowledge and analysis, no users were affected in any way." - Twitter] (Feb 22, 2023)</ref>. They make clear that "strong passwords and 2fa were used and [they] don't recogni[z]e security factors on our end that could have led to this"<ref name=":1" />. Users are requested to verify "on every transaction" that "all token approvals that [they] give at DeFi Saver [are] to [their] DSProxy (smart wallet)"<ref>[https://twitter.com/DeFiSaver/status/1540300791721992192 DefiSaver - "all token approvals that you give at DeFi Saver should be to your DSProxy (smart wallet) - please do verify that on every transaction" - Twitter] (Mar 23, 2023)</ref>.		\|The Defi Saver team publicly acknowledges the incident on Twitter and state that they believe no users were affected<ref name=":0">[https://twitter.com/DeFiSaver/status/1540300787988979713 DefiSaver - "Based on our knowledge and analysis, no users were affected in any way." - Twitter] (Feb 22, 2023)</ref>. They make clear that "strong passwords and 2fa were used and [they] don't recogni[z]e security factors on our end that could have led to this"<ref name=":1" />. Users are requested to verify "on every transaction" that "all token approvals that [they] give at DeFi Saver [are] to [their] DSProxy (smart wallet)"<ref>[https://twitter.com/DeFiSaver/status/1540300791721992192 DefiSaver - "all token approvals that you give at DeFi Saver should be to your DSProxy (smart wallet) - please do verify that on every transaction" - Twitter] (Mar 23, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 6:00:00 AM		\|June 24th, 2022 6:00:00 AM MDT
	\|Telegram Group Operating		\|Telegram Group Operating
	\|A Telegram group has reportedly been set up for communication and coordination between the different affected protocols<ref name=":43">[https://twitter.com/0xLlam4/status/1540303906215010304 @0xLlam4 - "on TG, can add you into a group with affected protocols" - Twitter] (Feb 27, 2023)</ref>.		\|A Telegram group has reportedly been set up for communication and coordination between the different affected protocols<ref name=":43">[https://twitter.com/0xLlam4/status/1540303906215010304 @0xLlam4 - "on TG, can add you into a group with affected protocols" - Twitter] (Feb 27, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 7:29:00 AM		\|June 24th, 2022 7:00:00 AM MDT
	\|All Attacks Reported Together		\|All Attacks Reported Together
	\|Twitter user ~~Tommy Famous reports on~~ all 4 DNS attacks in a single thread<ref>[https://twitter.com/~~TommyBeFamous~~/status/~~1540326185795829765 TommyBeFamous~~ - "~~So far~~ 4 ~~#ethereum~~ DeFi projects experienced a DNS hijack attack." - Twitter] (~~Mar 24~~, 2023)</ref>.		\|Twitter user Nathan Gupta is the first to publicly report all 4 DNS attacks in a single thread<ref>[https://twitter.com/nalingupta01/status/1540319012067737600 Nathan Gupta - "4 DeFi projects have experienced a DNS hijack attack" - Twitter] (Apr 1, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 10:01:00 AM		\|June 24th, 2022 7:29:00 AM MDT
			\|Attacks Reported Together Again
			\|Twitter user Tommy Famous also reports on all 4 DNS attacks in a single thread<ref>[https://twitter.com/TommyBeFamous/status/1540326185795829765 TommyBeFamous - "So far 4 #ethereum DeFi projects experienced a DNS hijack attack." - Twitter] (Mar 24, 2023)</ref>.
			\|-
			\|June 24th, 2022 10:01:00 AM MDT
	\|NameCheap Response		\|NameCheap Response
	\|NameCheap's CEO responds on Twitter that they've "traced this down to a specific [customer support] agent that was either hacked or compromised somehow and have removed all access from this agent. This affected a few targeted domains but we will continue investigating."<ref name="namecheapceotwitter1-88843">[https://twitter.com/NamecheapCEO/status/1540364576151289857 <nowiki>@NamecheapCEO - "traced this down to a specific [customer support] agent that was either hacked or compromised" - Twitter</nowiki>] (Aug 24, 2022)</ref>		\|NameCheap's CEO responds on Twitter that they've "traced this down to a specific [customer support] agent that was either hacked or compromised somehow and have removed all access from this agent. This affected a few targeted domains but we will continue investigating."<ref name="namecheapceotwitter1-88843">[https://twitter.com/NamecheapCEO/status/1540364576151289857 <nowiki>@NamecheapCEO - "traced this down to a specific [customer support] agent that was either hacked or compromised" - Twitter</nowiki>] (Aug 24, 2022)</ref>
	\|-		\|-
	\|June 24th, 2022 10:03:00 AM		\|June 24th, 2022 10:03:00 AM MDT
	\|Free DomainVault Monitoring		\|Free DomainVault Monitoring
	\|NameCheap's CEO expands the original tweet to say that they "would like to offer [affected services their] Domain Vault service for free and [they] will also place all affected domains on the highest security monitoring"<ref>[https://twitter.com/NamecheapCEO/status/1540364947611422722 @NamecheapCEO - "we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring" - Twitter] (Feb 24, 2023)</ref>.		\|NameCheap's CEO expands the original tweet to say that they "would like to offer [affected services their] Domain Vault service for free and [they] will also place all affected domains on the highest security monitoring"<ref>[https://twitter.com/NamecheapCEO/status/1540364947611422722 @NamecheapCEO - "we would like to offer you our Domain Vault service for free and we will also place all affected domains on the highest security monitoring" - Twitter] (Feb 24, 2023)</ref>.
	\|-		\|-
	\|June 24th, 2022 11:21:00 AM		\|June 24th, 2022 11:21:00 AM MDT
	\|NameCheap DomainVault		\|NameCheap DomainVault
	\|"Usually we require a pin code from customer. We also monitor all actions as well a monitor a real time vip list. In the end our [customer support] needs to be able to modify to help customers especially when 99% don't understand [DNS]. If you want complete security use [DomainVault]"<ref name="namecheapceotwitter2-8889" />		\|"Usually we require a pin code from customer. We also monitor all actions as well a monitor a real time vip list. In the end our [customer support] needs to be able to modify to help customers especially when 99% don't understand [DNS]. If you want complete security use [DomainVault]"<ref name="namecheapceotwitter2-8889" />
	\|-		\|-
	\|June 24th, 2022 4:16:00 PM		\|June 24th, 2022 4:16:00 PM MDT
	\|NameCheap Clarifies Hack		\|NameCheap Clarifies Hack
	\|NameCheap responds that it "[l]ooks more like [their customer support] person was hacked."<ref name="namecheapceotwitter3-10566" />		\|NameCheap responds that it "[l]ooks more like [their customer support] person was hacked."<ref name="namecheapceotwitter3-10566" />