Web3 credential and loyalty platform Galxe reported that its frontend was compromised via a DNS hijacking attack on October 6, 2023, warning users on X (Twitter) to avoid interacting with its website while the incident was ongoing. Attackers gained control over the galxe.com domain at the registrar level by impersonating an authorized Galxe team member and supplying falsified documents to domain provider Dynadot, allowing them to redirect traffic from the official site to a phishing page that prompted users to sign malicious transactions. The attack targeted users’ wallets rather than Galxe’s core infrastructure, with the phishing frontend designed to drain funds once victims approved the malicious contract calls. According to Galxe’s post‑incident statement, only users who visited galxe.com and signed transactions between approximately 06:02 AM and 11:23 AM PDT on October 6 were affected, while smart contracts, backend systems, and stored user data remained intact. Galxe initially estimated over $160,000 in stolen assets, later updating the figure to around $270,000 taken from roughly 1,120 users, with efforts underway to work with law enforcement and third‑party experts to trace and recover funds. The attacker’s address was also linked by on‑chain investigators to a similar DNS-based frontend attack on DeFi protocol Balancer weeks earlier, highlighting a broader pattern of Web3 projects being compromised at the domain/DNS layer rather than through contract exploits. Galxe has since restored its domain, implemented additional security measures at the registrar level, and published guidance urging users to clear DNS caches, verify URLs, and use tools such as revoke.cash to revoke any suspicious approvals granted during the attack window.

AI-generated background, compiled from web sources — not editorial content.

More coverage

Loading related coverage…

Explore the full feed

Comments

Loading comments…