dYdX Post-Mortem Reveals Two Users Lost Approximately $31,000 in Recent DNS Hijack

According to dYdX, on July 23, 2024, the "dYdX.exchange" domain was compromised when an attacker changed the DNS nameservers and removed the DNSSEC

Two users lost approximately $31,000 in a recent DNS (Domain Name System) hijack of dYdX, according to a post-mortem analysis published by the decentralized exchange (DEX).

The incident occurred on July 23, 2024, when an attacker compromised the "dYdX.exchange" domain and changed the DNS nameservers, according to dYdX. The attacker also removed the DNSSEC, which is supposed to add a layer of trust to the DNS by providing authentication.

After discovering the attack, dYdX said it immediately contacted Squarespace's customer support, who began working to restore domain possession and fix the DNS nameserver resolution, which was completed within a few hours. However, there was a 30-minute delay in Squarespace's response due to third-party vendor maintenance.

During this delay, the attacker reportedly hosted a malicious site, which requested connected wallets to send ETH or any ERC20 token to the attacker's address. At the same time, dYdXs worked with SEAL to blacklist the site from crypto wallets such as Metamask and Phantom.

"2 users were affected with approximately $31,000 in lost funds due to this attack. dYdX trading is in contact with both affected users and is assisting in securing their wallets and is committed to recovering funds," dYdX explained in the post-mortem analysis.

The identity of the attacker is still unknown, but they appear to be a fairly skilled actor, according to the post-mortem analysis, which raises the possibility of a social engineering attack, considering that the perpetrator deliberately chose a human-believable email address.

Earlier this month, several decentralized finance (DeFi) applications were impacted by a large DNS hijacking incident, which also targeted multiple DEXs.

The attack, which was later traced back to a vulnerability in Squarespace's domain registry, also compromised several other DeFi platforms, including Compound Finance and Pendle Finance.