A large-scale wave of infrastructure compromise has been recorded in the decentralized finance sector: attackers seized control of the domains of 15 cryptocurrency projects, redirecting visitors of their official websites to fake pages. The goal of the attack is to steal digital assets from unsuspecting users.
The incident was identified by cybersecurity specialists at Blockaid during threat monitoring. The attack mechanics are built around manipulation of DNS records: traffic from legitimate resources is redirected to phishing clones that are externally indistinguishable from the original interfaces. Victims are induced to connect wallets and sign malicious transactions or enter seed phrases, which gives attackers direct access to funds.
Why this is dangerous for the entire sector
Domain compromise is one of the most insidious attack vectors, since users trust the familiar address and do not verify the source of the transition. Even experienced market participants risk signing a transaction on a fake page without noticing the substitution. The scale — 15 projects simultaneously — indicates a coordinated campaign rather than a single hack.
Such incidents undermine trust in DeFi infrastructure as a whole. Reputational losses are incurred not only by the affected protocols but by the entire segment: investors begin to treat any links and interfaces with caution, which reduces conversion and activity in the ecosystem.
The key takeaway for crypto asset holders is the need to verify domains through official project channels and to categorically refuse to sign transactions via links from unverified sources. Projects, in turn, should strengthen control over DNS infrastructure and implement additional levels of verification.
Cryptalist analysis: The attack demonstrates the systemic vulnerability of the DeFi sector at the level of basic infrastructure rather than smart contracts, which shifts the focus of risks toward operational security. The market should perceive such campaigns as a signal to tighten standards for domain protection and user hygiene. Until projects build multi-layered perimeter protection, waves of phishing through DNS compromise will remain a recurring threat with direct financial losses for retail investors.