DeFi DNS Hijack vs. Smart Contract Hack: What to Know

DeFi DNS Hijack vs Smart Contract Hack: Wallet Checklist

A protocol posts "do not use our site," and the timeline fills with panic. Is it a DeFi DNS hijack or a smart contract hack? Most people can't tell in the first hour, and the right response is different for each. In one case the code is broken. 

In the other, the code is fine, and the door to it has been swapped. Knowing which one you're facing decides whether you revoke approvals, withdraw funds, or just stay off a website.

In a smart contract hack, an attacker exploits a flaw in the code that holds the funds. 

In a DeFi DNS hijack, the attacker takes over the domain or its DNS records and points visitors at a copy of the site. The contracts are untouched. Users get tricked into signing something harmful.

Hijacks are nasty because they get around the habits we're taught. The address bar looks right, the padlock is there, and the page looks familiar. 

Security firm Blockaid noted that in its write-up of a February 2026 campaign, the attackers even issued fresh SSL certificates so the fake pages kept valid HTTPS.

How the Two Attacks Differ in Practice

A smart contract hack is a code problem. Think of a bank vault with a flaw in its lock design. Balancer showed the pattern in August 2023, when a vulnerability in some V2 pools led to a loss that was reported as roughly $1 million, with estimates varying by outlet. Funds sit in the contract, so the people at risk are the ones with money in the affected pools.

A DeFi DNS hijack is signpost problem. The vault is fine, but someone has changed the street signs so you walk into a fake branch. Nothing on-chain is broken. The damage happens when a user connects a wallet and approves something on the copy.

Often the approval itself is the weapon. Many drainer kits ask for token approvals or permit-style signatures. Once you sign, the attacker can move your tokens later, even after the fake site is gone.

Four Incidents Worth Knowing

These are the cases security researchers keep returning to, and they show the pattern.

Curve Finance, August 2022. Attackers redirected curve.fi to a cloned site, and users lost roughly $570,000 according to most reports. 

The cause was disputed. Curve first pointed at a compromised nameserver, but the registrar's report described DNS cache poisoning rather than a nameserver compromise. Either way, the audited contracts were never the weak point.

Balancer, September 2023. Balancer's team blamed a social engineering attack on its DNS provider, and reports put the theft at around $238,000. 

The site pushed users to approve a malicious contract, and security firms linked the drainer to Angel Drainer. 

It landed about a month after Balancer's separate pool vulnerability, which shows a protocol can face both kinds of attack in quick succession.

Squarespace registrations, July 2024. Between July 9 and 12, domains belonging to Compound, Celer, Pendle, and Unstoppable Domains were hijacked, according to Krebs on Security. 

The domains had moved from Google Domains to Squarespace, and reporting at the time said weak authentication made takeover easy. 

Celer caught its attempt through domain monitoring and recovered its records. The compound's main domain showed a phishing page.

CoW Swap, April 2026. The team paused the protocol on April 14 after DNS settings for swap.cow.fi were compromised. 

A KuCoin explainer put preliminary user losses near $1.2 million and said the domain was recovered and locked with a registry lock within roughly 26 hours. 

Treat the loss figure as an early estimate from an exchange blog, not a final post-mortem.

The thread through all four: the code was fine, and the weak spot was somewhere in the registrar and DNS chain .

How to Tell Which One You're Dealing With

You won't always know right away, but a few signals help:

• Wording from the team. "Frontend," "domain," "DNS," or "do not visit the website" points to a hijack. "Pause deposits," "withdraw from pool X," or "vulnerability in contract Y" points to a contract problem.

• Who is exposed. If people who merely connected a wallet and signed are losing funds, think hijack. If depositors lose money without doing anything new, think contract exploit.

• Security alerts. Firms like Blockaid and PeckShield often flag a domain as malicious within hours.

• Wait for confirmation. Early reports are often wrong, and both types can be happening at once. Don't act on one anonymous post.

Wallet Checklist

Before you use any DeFi app

• Bookmark the official site once, from a source you trust, and use the bookmark instead of searching or clicking links. A saved bookmark is your simplest shield against a DeFi DNS hijack.
• Keep a small “spending” wallet for daily DeFi and a separate wallet for long-term holdings.
• Use a hardware wallet if you hold meaningful value, and read what the device screen shows, not only what the webpage says.
• Be suspicious of any prompt that asks for a signature to “verify” or “upgrade.” Legitimate swaps rarely need that.
• Follow the project’s official account for security notices, so you hear about a problem before you sign.

When a protocol warns of an attack

• Stop connecting your wallet and stop signing. Close the tab.
• Don’t click links in replies or direct messages. Scammers love these moments.
• Wait for the team to confirm whether it’s a DeFi DNS hijack or a contract issue.
• If funds are in a contract with a confirmed code flaw, follow the team’s guidance on withdrawing.

If you may have signed something on a fake site

• Review your token approvals on the affected chain with a tool such as Revoke.cash or the Etherscan approval checker. Type the address yourself, because phishing copies of these tools exist too.
• Look for unlimited approvals and contracts you don’t recognize, then revoke them. Disconnecting a wallet from a site doesn’t cancel an approval, which is why a DeFi DNS hijack can still cost you money after you’ve left the page.
• Move remaining funds to a fresh wallet if you suspect the seed phrase itself was exposed.
• Keep a record of transaction hashes and times in case the team or security researchers ask.

Every few months

• Audit your approvals and remove ones for apps you no longer use.
• Re-check that your bookmarks still point to the right addresses.

What Protocols Can Do

Users can only do so much against a DeFi DNS hijack, and much of the fix lies with project teams: multi-factor authentication on registrar accounts, registry locks, domain monitoring, and careful migration when a registrar changes hands.

Curve’s team publicly said that attack suggested moving toward ENS, while others have argued for hosting front ends on decentralized storage. None of these is a complete answer, so users should stay careful either way.

Final Take

A smart contract hack affects you, and a DeFi DNS hijack tricks you into handing over the key.

Audits help with the first and do little for the second, so your own habits matter. Use bookmarks, read what you sign, keep a separate wallet for experiments, and clean up approvals regularly. When a protocol sounds the alarm, pause first and diagnose second.

Disclaimer: This article is for information only and is not financial, legal, or investment advice. Crypto assets are highly volatile and can lose all value. Loss figures cited come from public reports and may be revised. Verify details on official sources and consult a qualified advisor before acting.