Website of Decentralized Crypto Exchange Curve ‘Compromised’

Curve.Exchange uses a different domain name system provider and seems to be unaffected
Twitter account foobar claimed at about 4:30 pm ET that roughly $570,000 worth of tokens had been stolen so far

The main website of decentralized digital asset exchange Curve Finance has been compromised in what appears to be the latest instance of a nefarious crypto exploit.

The issue was “found and reverted,” Curve tweeted at 5:28 pm ET, pointing to this address as the contract that users should revoke.

“If you have approved any contracts on Curve in the past few hours, please revoke immediately,” it wrote.

The firm warned users it’s looking into an apparent nameserver attack, saying its website should be avoided. It wasn’t immediately clear whether any funds had been compromised.

“Don’t use http://curve.fi site – nameserver is compromised,” the company wrote in a tweet Tuesday. “Investigation is ongoing: likely the NS itself has a problem.”

In a subsequent tweet, Curve said that Curve.Exchange uses a different domain name system provider and seems to be unaffected, though noted that users still “need to proceed with caution.”

Curve urged domain registrar iwantmyname to “please do something” at 5:22 pm ET.

“We switched nameserver, but don’t rush to use http://curve.fi – wait a bit,” the decentralized exchange added.

Twitter account foobar claimed at about 4:30 pm ET that roughly $570,000 worth of tokens had been stolen so far, pointing to this address.

When you make a swap it creates a transaction to approve 0x9Eb5F8e83359Bb5013f3D8eee60bDCe5654e8881 to spend whichever coin you’re inputting
But this is not a Curve pool, your funds will be manually drained into a malicious EOA instead, 0x50f9202e0f1c1577822bd67193960b213cd2f331 pic.twitter.com/N54sURa55V
— foobar (@0xfoobar) August 9, 2022

The incident comes after a hacker produced a phishing pop-up on Polygon and Fantom last month warning users their funds were at risk and urging them to enter their private account keys.

That hacker accessed Polygon and Fantom’s remote procedure call (RPC) interfaces through the Web3 infrastructure platform Ankr by tricking a third party domain name system (DNS) provider into giving the hacker access to Polygon and Fantom’s domains.

This is a developing story.

Updated Aug. 9, 2022, 5:52 pm

Get the day’s top crypto news and insights delivered to your inbox every evening. Subscribe to Blockworks’ free newsletter now.

Ben Strack
Ben Strack is a Denver-based reporter covering macro and crypto-native funds, financial advisors, structured products, and the integration of digital assets and decentralized finance (DeFi) into traditional finance. Prior to joining Blockworks, he covered the asset management industry for Fund Intelligence and was a reporter and editor for various local newspapers on Long Island. He graduated from the University of Maryland with a degree in journalism.
Contact Ben via email at [email protected]

Source: https://blockworks.co/website-of-decentralized-crypto-exchange-curve-compromised/