Galxe, Balancer DNS attacks reveals many crypto enterprises are vulnerable to subdomain/domain hijacking

• A security researcher has indicated that many crypto enterprises are vulnerable to subdomain hijacking.
• The results come after probes into the Balancer incident and the recent attack against Galxe.
• Cryptocurrency projects must be vigilant and choose reputable domain name registrars to prevent attacks.

The cryptocurrency ecosystem has reported multiple attacks over the past few weeks, with some raising speculation of inside jobs while others leaving investors in a state of unrest for being unable to access key services such as deposits and withdrawals.  

Also Read: Stars Arena suffers major security vulnerability on its smart contract, loses $2.9 million

Crypto-related exploits and attacks lead to insightful revelation

On October 7, the Avalanche-based protocol and Friend.tech competitor Stars Arena was exploited for the second time in three days, losing up to $2.9 million while wounds from the previous $1 million loss had not even healed. It added to the list of attacks in the last few months, after Balancer, the Ethereum-based decentralized finance (DeFi) protocol, made headlines.

Balancer domain attack

On September 20, Balancer frontend was attacked, with the bad actor stealing more than $238,125 from the protocol and sending it to this address associated with 'Angel Drainer'. This was a Domain Name System (DNS) attack on the Balancer domain (Balancer.fi), prompting users to approve a malicious contract that will drain their wallets.

This was a month after the August 20 attack on Balancer V2 pools, affecting at least 4% of Balancer Total Value Locked (TVL). In response, the network asked users to withdraw affected LPs immediately amid the deployment of emergency mitigation measures. 

Galxe DNS attack

More recently, web3 community platform Galxe was attacked on October 6, affecting its DNS record through the Dynadot account. With the website going down, the Galxe asked users not to connect their wallets to the platform, sign any transaction, or disconnect their wallets until the situation was resolved.

The platform’s co-founder Charles Wayn also asked users “[ not to] click on phishing links as it takes time to refresh the cache of DNS.” This was also a DNS attack, with the network indicating that “As long as you did not approve any transaction of the connected wallets on Galxe after 6am PST, October 6th, your funds and info are all secure.”

The latest on the matter is that anyone still encountering the phishing site when accessing the website, should attribute it to DNS propagation. This means the time taken to update DNS records on individual users’ local servers, which varies from place to place.

Crypto enterprises are vulnerable to subdomain/domain  hijacking

A security researcher with expertise in web3 has attributed the incidences of DNS attacks to organizations being vulnerable to subdomain hijacking.  

The report comes after a deep dive into millions of DNS records and cloud infrastructure of enterprises, revealing chunks of “unresolved content.” This, according to the sleuth, leaves companies vulnerable to subdomain/domain name hijacking.

DNS, short for Domain Name Server, defines the automated system translating internet addresses to the numeric machine addresses used by computers. A DNS attack is, therefore, a cyberattack where the exploiter capitalizes on vulnerabilities in the Domain Name System. They try to deny the DNS service by bypassing the protocol standard function or using bug exploits and taking advantage of flaws.

It is therefore a call to action for cryptocurrency-related firms to exercise vigilance and choose reputable domain name registrars to prevent attacks.

---