DeFi Protocol's Front-End Compromised, $570,000 Believed To Be Stolen

KEY POINTS

The stolen funds from Curve Finance were transferred to FixedFloat, a cryptocurrency exchange
The issue was 'found and reverted'
Curve Finance said domain registration platform IWantMyName was compromised

The front-end of decentralized finance (DeFi) protocol Curve Finance was compromised and according to an on-chain analyst, over $570,000 were stolen.

The compromise was first pointed out by Sam Sun, a Research Partner and the Head of Security at Paradigm, a crypto and Web3 investment firm, via a Twitter post at 4:25 p.m. ET Tuesday.

🚨🚨🚨@CurveFinance frontend is compromised, do not use it until further notice!
— samczsun (@samczsun) August 9, 2022

This was followed by Curve Finance confirming Sun's statement an hour later via a Twitter post.

Don't use the frontend yet. Investigating! https://t.co/8kmtpGsLQQ
— Curve Finance (@CurveFinance) August 9, 2022

According to ZachXBT, an on-chain analyst, the attackers made away with almost $570,000. He further pointed out that the funds were being directed to FixedFloat, a cryptocurrency exchange.

Looks like $570k stolen

0x50f9202e0f1c1577822BD67193960B213CD2f331 pic.twitter.com/IG6nIKVv59
— ZachXBT (@zachxbt) August 9, 2022

Curve retweeted a post from Lefteris Karapetsas, the founder of Rotkiapp - a crypto analytics platform. According to Karapetsas, the attackers cloned the Curve.fi website and "made the DNS point to their ip where the cloned site is deployed and added approval requests to a malicious contract."

It's DNS spoofing. Cloned the site, made the DNS point to their ip where the cloned site is deployed and added approval requests to a malicious contract.
— Lefteris Karapetsas | Hiring for @rotkiapp (@LefterisJP) August 9, 2022

Steven Ferguson, the founder of TCPShield, a DDoS protection service provider, revealed that systems at IWantMyName, a website domain registration platform, compromised themselves which resulted in the DNS spoofing of Curve.fi.

Upon initial investigation, this did not appear to be a hijack at the registrar level, but rather systems at @iwantmyname compromised themselves.
— Steven Ferguson (@szferguson) August 9, 2022

Curve Finance is one of the vital aspects of DeFi due to its CRV token, which is used to provide rewards to users and hence, is a source of income for many other decentralized protocols. Worried users were asked to use Curve.exchange until Curve.fi was being investigated.

By 5:27 p.m. ET Tuesday, the issue was "found and reverted." "If you have approved any contracts on Curve in the past few hours, please revoke immediately," a Twitter post read.

Curve's operators announced via Telegram that the problem was found and was fixed as well. The firm reached out to IWantMyName to clear things out.

"Dear IWantMyName, looks like something is compromised on your side (most likely, name servers - they seem to override what the UI tells them to serve). Please do something. For everyone else: we switched nameserver, but don't rush to use http://curve.fi - wait a bit," Curve said.

The domain registration platform has yet to give a reply on the same.