Balancer blames ‘social engineering attack’ on DNS provider for website hijack

Blockchain security firms SlowMist and CertiK also believe the crypto wallet drainer Angel Drainer was involved in the estimated $238,000 exploit.

Balancer Blames ‘social Engineering Attack’ On Dns Provider For Website Hijack_65b96d1f9a8d0.jpeg

The team behind Balancer, an Ethereum-based automated market maker, believes a social engineering attack on its DNS service provider was what led to its website’s frontend being compromised on Sept. 19, leading to an estimated $238,000 in crypto stolen.

“After investigation, it is clear that this was a social engineering attack on EuroDNS, the domain registrar used for .fi TLDs,” the firm explained in a Sept. 20 X post.

Approximately 8 hours after the first warning of the attack, Balancer said its decentralized autonomous organization (DAO) was actively addressing the DNS attack and was working to recover the Balancer UI.

At 5:45 pm UTC on Sept. 20, Balancer said it was successful in securing the domain and bringing it back under the control of Balancer DAO. It also confirmed its subdomains “app.balancer.fi” and other “balancer.fi” are safe to use again.

balancer blames social engineering attack on dns provider for website hijack 65b96d1f9d194

However, it suggested any other projects using the same top-level domain should consider moving to a more secure registrar.

EuroDNS is a Luxembourg-based domain name registrar and DNS service provider. Cointelegraph has reached out to EuroDNS for comment.

Angel Drainer involved

Blockchain security firms SlowMist and CertiK reported that the attacker employed Angel Drainer phishing contracts.

SlowMist said the exploiters attacked the Balancer’s website via Border Gateway Protocol hijacking — a process where hackers take control of IP addresses by corrupting internet routing tables.

The hackers then induced users to “approve” and transfer funds via the “transferFrom” function to the Balancer exploiter, it explained.

Related: Binance CEO refutes report on $250M loan to BAM Management

The hacker, whom SlowMist believes may be related to Russia, has already bridged some of the stolen Ether (ETH) to Bitcoin (BTC) addresses via THORChain before eventually being bridging the ETH back to Ethereum, blockchain security firm SlowMist explained on Sept. 20.

SlowMist stated in an earlier post that the hacker transferred about 15 wrapped-Ether (wETH.e) on the Avalanche blockchain.

balancer blames social engineering attack on dns provider for website hijack 65b96d20339ec

Meanwhile, despite Balancer confirming its subdomains, balancer.fi to now be safe, visits to the website still shows “Deceptive site ahead” warning when attempting to access the Balancer’s website.

Balancer’s website as of Sept. 20 at 10:22 pm UTC. Source: Balancer.

AZC News reached out to Balancer to confirm the amount of funds lost but did not receive an immediate response.

5.0/5

(100 votes)

Latest

Azcnews El Salvador To Mine $3 Trillion In Gold To Buy Bitcoin

News | Bitcoin | Editor Choice

El Salvador to Mine $3 Trillion in Gold to Buy Bitcoin

El Salvador has $3 trillion in gold reserves, and analysts suggest they should use this money to buy more Bitcoin.

Solana Launches Hackathon Competition For Ai Agents

News | AI | Altcoin | Editor Choice

Solana Launches Hackathon Competition for AI Agents

The Solana Foundation, in collaboration with a16z, is hosting an AI Hackathon for AI agent developers, offering prizes of up to $185,000.

Azcnews Xrp Surges Following Approval Of Stablecoin Rlusd

News | Altcoin | Editor Choice | Policy & Regulations

XRP Surges Following Approval of Stablecoin RLUSD

Ripple's stablecoin RLUSD has received approval from the New York Department of Financial Services (NYDFS), sending XRP soaring in price.

Azcnews Bitcoin Signals Point To A Potential Rise To $105k

News | Analytics | Bitcoin | Editor Choice

Bitcoin Signals Point to a Potential Rise to $105K

The recent price correction has caused Bitcoin to liquidate a large amount of leverage, creating a cushion for the price to possibly rise to $105K.

Microsoft Refuses To Buy Bitcoin As Reserve Asset

Bitcoin | Editor Choice | News

Microsoft Refuses to Buy Bitcoin as Reserve Asset

Microsoft shareholders have decided to reject the purchase of Bitcoin as a reserve asset due to its high volatility.