Website of Decentralized Crypto Exchange Curve ‘Compromised’

by Arthur · August 9, 2022

Curve.Exchange uses a different domain name system provider and appears to be unaffected
The Twitter account foobar claimed at approximately 4:30 PM ET that roughly $570,000 worth of tokens had been stolen so far

The main website of decentralized digital asset exchange Curve Finance has been compromised in what appears to be the latest instance of a sinister crypto exploit.

The problem was “found and reverted,” Curve tweeted at 5:28 PM ET, pointing to this address as the contract that users should withdraw.

“If you have approved any contracts on Curve in the last few hours, please cancel immediately,” it wrote.

The firm warned users that it is looking into an apparent name server attack and said its site should be avoided. It was not immediately clear if any funds had been compromised.

“Do not use the site – the name server has been compromised,” the company wrote in a tweet Tuesday. “The investigation is ongoing: NS itself probably has a problem.”

In a subsequent tweet, Curve said that Curve.Exchange uses a different domain name system provider and appears to be unaffected, but noted that users should still “proceed with caution.”

Curve urged domain registrar iwantmyname to “please do something” at 5:22 PM ET.

“We switched name servers, but don’t rush to use – wait a bit,” the decentralized exchange added.

Twitter account Phobar claimed at approximately 4:30 PM ET that roughly $570,000 worth of tokens had been stolen so far, pointing to this address.

When you exchange, it creates a transaction to authorize 0x9Eb5F8e83359Bb5013f3D8eee60bDCe5654e8881 to use the coin you enter

But this is not a curve pool, your money will be manually drained into a malicious EOA instead, 0x50f9202e0f1c1577822bd67193960b213cd2f331 pic.twitter.com/N54sURa55V

— foobar (@0xfoobar) 9 August 2022

The incident comes after a hacker produced a phishing pop-up on Polygon and Fantom last month warning users that their money was at risk and urging them to enter their private account keys.

This hacker gained access to Polygon’s and Fantom’s Remote Procedure Call (RPC) interfaces through the Web3 infrastructure platform Ankr by tricking a third-party domain name system (DNS) provider into giving the hacker access to Polygon’s and Fantom’s domains.

This is a development story.

Updated 9 August 2022 at 17.52

Get today’s best crypto news and insights delivered to your inbox every night. Subscribe to Blockworks’ free newsletter now.

Ben Strack

Ben Strack is a Denver-based reporter covering macro and crypto-based funds, financial advisors, structured products, and the integration of digital assets and decentralized finance (DeFi) into traditional finance. Before joining Blockworks, he covered the asset management industry for Fund Intelligence and was a reporter and editor for various local Long Island newspapers. He graduated from the University of Maryland with a degree in journalism. Contact Ben by email at [email protected]