← Back to Blog

Web3 Security · 8 min read · September 14, 2026

How DeFi Front-End and DNS Hijacking Attacks Drain Wallets in 2026

DeFi front-end attacks skip your smart contracts entirely. Attackers hijack a protocol's DNS records, redirect the legitimate URL to a cloned site, and drain the wallets of users who did nothing wrong. In 2026 that pattern cost CoW Swap users roughly $500,000 in 90 minutes and drained over $1 million from Aerodrome users in an hour. Here is how the attack works, why audits miss it, and what protocols and wallet holders can actually do.

Is DeFi Front-End Security Part of Your Attack Surface?

In April 2026 attackers hijacked swap.cow.fi at the DNS level and served a cloned interface for more than 90 minutes. CoW Protocol's smart contracts were untouched. Its backend APIs were untouched. Roughly $500,000 still left user wallets, because the page people typed in — and trusted — was no longer the real one.

Security researchers call this the presentation layer: the websites, APIs, CDNs, and domain records that sit between a user and the chain. Hacken's 2025 half-year report counted over $3.1 billion lost in six months, with a sharp rise in attacks against exactly that layer. DeFi lost $840M+ between January and May 2026, and 72% of it came from stolen keys and credentials — not flawed Solidity.

What Is a DNS Hijacking Attack?

DNS translates a domain name into a server address. If an attacker can edit a protocol's DNS records, every visitor who types the correct URL lands on a server the attacker controls — while the address bar still shows the legitimate domain and a valid HTTPS padlock.

Attackers rarely break DNSSEC or crack a registrar. They get in the boring way: reused passwords, 2FA that a domain migration silently disabled, password spraying across thousands of accounts, or an insider at the registrar itself. Then they change one A record and let the protocol's own branding do the work.

Four Incidents That Show the Pattern

CoW Swap — 90 minutes, roughly $500,000 (April 2026)

Attackers redirected swap.cow.fi to a phishing page for over 90 minutes. It ran a wallet-drainer script that asked visitors to sign “unlimited spend” permissions disguised as a routine protocol update, targeting USDC and WETH specifically. Blockaid flagged the domain and CoW DAO paused APIs and backend services as a precaution. The contracts were never involved.

Aerodrome Finance — $1M+ in one hour (November 2025)

Base's largest DEX had DNS records for its .box and .finance domains edited at registrar level, reportedly through an insider threat at the registrar. Visitors were prompted to sign what looked like a harmless “1” approval; it was a flood of unlimited approvals. More than $1 million drained within an hour. Aerodrome has since moved to ENS-based mirrors.

The Squarespace wave — Compound, Celer, and dozens more (2024)

After a provider migration left 2FA disabled on many accounts, attackers password-sprayed registrar logins and repointed A records for dozens of Web3 projects, including Compound and Celer Network. The cloned pages ran the Inferno drainer kit against the migrated domains.

Bybit — $1.5 billion through a JavaScript chunk (February 2025)

The largest crypto theft on record never touched a chain directly. Attackers compromised a developer's machine, modified a JavaScript chunk, and swapped transaction data inside the signing interface: signers approved something routine while a delegatecall handed over a cold wallet holding 401,347 ETH. The lesson is blunt — for high-value transactions, never trust the UI alone.

Who Is Actually at Risk?

Every protocol with a hosted front end, every wallet with a download page, and every user who signs transactions in a browser. CertiK has warned that 120+ DeFi front ends could be vulnerable to this same class of DNS attack. If your project owns a domain, you own an attack surface that no smart contract audit will ever see.

How Protocol Teams Should Defend the Front End

• Lock the domain, not just the contract. Enable registry lock and registrar lock on every production domain, and require hardware-key 2FA for registrar and DNS accounts.
• Harden DNS. Turn on DNSSEC, lock down CAA records, and monitor certificate transparency logs for certificates you did not request.
• Protect the front-end build. Pin dependencies with subresource integrity, enforce a strict Content-Security-Policy, and ship signed, immutable deploy artifacts.
• Publish a verifiable mirror before you need it. A signed ENS or IPFS entry point is the difference between a 90-minute outage and a 90-minute theft.
• Monitor from the outside. Continuously check your own domains and pages so a repointed A record is caught in minutes, not by a user on social media.

How Wallet Holders Can Protect Themselves

• Reach DeFi through a verified bookmark or an on-chain name you control — never a search result or an ad.
• Read what you sign. Treat an unlimited approval, or any approval of a token you did not intend to move, as a stop sign.
• Separate your wallets. Use a burner for new or unfamiliar dApps and a hardware wallet for real balances.
• Revoke stale approvals regularly and simulate transactions before signing whenever your wallet supports it.
• Distrust sudden changes. A surprise redesign, a mass “re-approve” prompt, or a “protocol update” signature request means close the tab and verify through a second channel.