Curve domain hijacked and pointing to a fake website! Do not connect your Wallet or sign any transactions for now.

Coin circle (120btc.cOM): Be careful! The stablecoin exchange protocol Curve Finance has once again been hacked, and it is suspected that the DNS has been hijacked, causing users to be directed to malicious websites. On-chain security company Blockaid also issued a warning, pointing out that this is a “potential front-end attack” and advising users not to interact with the Curve website or sign any transactions for the time being to avoid asset damage.

DNS points to incorrect IP, users browsing face risks

The Curve team issued a warning on X yesterday, stating “The curve.fi DNS may have been hijacked, please do not interact!” Subsequent clarifications indicated that the site currently “points to the wrong IP,” meaning that even if users access the official website, they may connect to a malicious page controlled by hackers.

Although Curve stated that all smart contracts remain secure and that passwords and the two-factor authentication mechanism are unaffected, due to vulnerabilities at the DNS level, users may be redirected to counterfeit websites and have their wallet assets stolen as soon as they interact with the page. The team has currently contacted the domain registrar to investigate the cause and is attempting to regain control.

The on-chain security company Blockaid also detected abnormal requests from curve.fi, initially determining it to be a front-end attack. Hackers may exploit the website’s buttons, forms, or signing interfaces to steal user information. Once a malicious transaction is signed, assets may be stolen.

Blockaid calls: “If connected, please avoid signing transactions and do not interact with dApps. We are working closely with affected partners and will provide ongoing updates.”

Second Attack in a Week, Curve’s Security Mechanism Under Test Again

This is the second attack Curve Finance has encountered this week. On May 6, its official X account was hacked, but at that time the team emphasized that it was limited to community account levels and did not affect other platforms or user funds. However, being attacked twice in just a few days has raised questions in the community about Curve’s resilience in protecting critical infrastructure.

It is worth noting that Curve experienced a similar incident in August 2022, when hackers stole user funds through a phishing website, resulting in losses. Although an incident report was published afterward, and some security mechanisms were strengthened, the platform has fallen into old troubles again, indicating that front-end attacks remain a vulnerability that DeFi protocols cannot fully defend against. Users are reminded to maintain a high level of vigilance regarding the website in addition to contract audits.