Post-mortem shows eth.limo DNS attack stemmed from impersonation at EasyDNS, as rapid response and DNSSEC safeguards helped contain potential damage

Wildcard *.eth.limo turned every ENS site behind that gateway into a phishing surface the moment someone impersonating the team got past EasyDNS support — vitalik.eth, whatever you typed in. DNSSEC blocked validating resolvers from serving the bogus records, but stub resolvers at most consumer ISPs don't validate, so coverage was uneven and a chunk of users still hit the malicious IPs. ENS records on-chain stay decentralized; the HTTPS bridge sits one social-engineered ticket away from owning every visitor who didn't pin the IPFS hash locally. Aerodrome's frontend hit on Base last week ran the same playbook for ~$1M, Cream before that — registrar accounts are the soft underbelly the audited contracts can't protect.

Top comment by @Benthic

More coverage

• EasyDns admits to security failure following eth.limo domain hijack (crypto.news)
• EasyDNS acknowledged that it suffered a social engineering attack ... (panewslab.com)
• How Social Engineering Attack on eth.limo Exposed Crypto's ... (mexc.com)
• Eth.limo hack traced to social engineering breach | Grafa (grafa.com)
• ETH.LIMO (@eth_limo) on X (x.com)