Curvance domain has been compromised, do not interact!

Blockchain security researcher Patrick Caversaccio reported that the curvance.com domain had been compromised, warning users not to interact with the Curvance front end or any links associated with the site. Curvance later confirmed that its domain registrar account had been accessed without authorization, allowing an attacker to change DNS settings and redirect traffic from the legitimate interface to attacker-controlled infrastructure. This type of incident is a front-end/DNS hijack, targeting the Web2 layer (domain and hosting) rather than Curvance’s underlying smart contracts. According to Curvance’s security update, the compromise was contained and no loss of user funds had occurred, but users were advised to avoid the UI until the team fully restored control and audited the front end. The attack appears linked to a broader campaign in which multiple DeFi protocols’ web front ends were hijacked and injected with the AngelFerno wallet drainer, which presents a normal-looking interface while generating malicious approval or transfer transactions that drain connected wallets. This Curvance domain compromise highlights the growing importance of securing DNS, registrar accounts, and other Web2 infrastructure for DeFi projects, since attackers can steal assets without exploiting on-chain contracts by controlling where users’ browsers are pointed and what front end code they receive.

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• DeFi projects hit by fresh wave of front-end attacks - Cryptonews.net (cryptonews.net)
• curvance[.]com domain is compromised. Please stay away and do ... (x.com)
• Curvance (x.com)
• CRITICAL: Compromised Website Report (shadowserver.org)
• Frontend Hijacking and the Web2 Attack Surface Threatening Web3 ... (blockaid.io)

Explore the topic

• Hacks