Ether.fi Averts Domain Hijack with Swift Action

Ether.fi, a liquid restaking protocol, recently emerged victorious over an effort to capture its domain on September 24.

Ether.fi, a liquid restaking protocol, recently fended off an attempt to seize its domain on September 24. The attackers tried to capture the platform’s domain through the registrant Gandi net.

Ether.fi responded swiftly, and its security arrangements remained intact to ensure no user funds or services were impacted.

The event unfolded when Ether.fi received an email for domain recovery from Gandi.net. This triggered an immediate security response with SPF, DKIM, and DMARC tests performed on the email. Upon identifying the potential risk, Ether.fi froze its domain account instantly to prevent further manipulation.

Once Ether.fi confirmed the domain’s involvement in the attack, it contacted Gandi.net through multiple channels to secure the domain.

By 7:30 PM UTC, Gandi had successfully locked the domain, preventing any changes. The attack attempt failed, and Ether.fi later clarified that the attack did not penetrate any internal systems and users’ funds were safe.

Ether.fi Averts Domain Hijack with Swift Action

According to Ether.fi, it was able to respond to and avert the attack due to specific security measures, including hardware authentication. These measures helped to protect critical sites during the domain hijacking attempt and were crucial for their defense.

Another key factor in maintaining control over the firm’s infrastructure was its use of strong domain registrar security measures.

Gandi.net’s senior domain administrators detected and handled the threat through internal monitoring tools, which bolstered Ether.fi’s domain protection.

Ether.fi has urged users not to visit the website until all functionality is fully checked and verified. The company has also come out to assure its users that user data or funds were not compromised and that operations have resumed safely.

While Ether.fi investigates, the company is working with Gandi.net to gather more details on the attack. Both parties aim to complete a report in the next 48 hours. Ether.fi’s case serves as a cautionary tale, as the DeFi ecosystem continues to grapple with weak domain security.

DeFi Firms Face Rising Cybersecurity Challenges

Ether.fi’s recent domain takeover is the latest in a string of security incidents at DeFi platforms. These attacks have highlighted several points of weakness across the sector, prompting firms to bolster their protection regimes.

Despite the lack of success in most cases, these attacks threaten the integrity of user data and funds.

For example, Ethena Labs faced a similar incident earlier this month when its domain registrar account was hacked.

However, it’s worth noting that while the Ethena site went down briefly, the users’ funds and the protocol itself remained safe. Ethena Labs warned users to be wary of any site claiming to be affiliated with the company.

On September 19, another suspect cyberattack targeted a cryptocurrency trading bot, Banana Gun. The attackers exploited a code vulnerability in the bot and siphoned off nearly $2 million in crypto coins. Such incidents underscore the need for improved security measures to be implemented and adopted by the DeFi industry.