{"id":253866,"date":"2022-08-09T21:55:07","date_gmt":"2022-08-09T20:55:07","guid":{"rendered":"https:\/\/cryptoslate.com\/?p=253866"},"modified":"2022-08-11T17:11:57","modified_gmt":"2022-08-11T16:11:57","slug":"curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact","status":"publish","type":"post","link":"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/","title":{"rendered":"Curve Finance front end UI compromised following DNS hack &#8211; users advised to exercise caution"},"content":{"rendered":"<p><em>Update: Curve has announced the issue has been fixed and says it is safe to use again. Follow up article can be found <a href=\"https:\/\/cryptoslate.com\/how-to-check-if-youre-safe-on-curve-finance-after-the-recent-dns-exploit\/\">here<\/a>.\u00a0<\/em><\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">The issue has been found and reverted. If you have approved any contracts on Curve in the past few hours, please revoke immediately. Please use <a href=\"https:\/\/t.co\/6ZFhcToWoJ\">https:\/\/t.co\/6ZFhcToWoJ<\/a> for now until the propagation for <a href=\"https:\/\/t.co\/vOeMYOTq0l\">https:\/\/t.co\/vOeMYOTq0l<\/a> reverts to normal<\/p>\n<p>&mdash; Curve Finance (@CurveFinance) <a href=\"https:\/\/twitter.com\/CurveFinance\/status\/1557116419497672711?ref_src=twsrc%5Etfw\">August 9, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Samczsun, a researcher at Paradigm, reported that the Curve Finance front end had been compromised, with over $500k <a href=\"https:\/\/twitter.com\/zachxbt\/status\/1557101229553197057\">stolen<\/a> within a matter of minutes.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">\ud83d\udea8\ud83d\udea8\ud83d\udea8<a href=\"https:\/\/twitter.com\/CurveFinance?ref_src=twsrc%5Etfw\">@CurveFinance<\/a> frontend is compromised, do not use it until further notice!<\/p>\n<p>&mdash; samczsun (@samczsun) <a href=\"https:\/\/twitter.com\/samczsun\/status\/1557100692518473728?ref_src=twsrc%5Etfw\">August 9, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The official Curve Finance Twitter had confirmed the news stating:<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Don&#39;t use the frontend yet. Investigating! <a href=\"https:\/\/t.co\/8kmtpGsLQQ\">https:\/\/t.co\/8kmtpGsLQQ<\/a><\/p>\n<p>&mdash; Curve Finance (@CurveFinance) <a href=\"https:\/\/twitter.com\/CurveFinance\/status\/1557104676830601216?ref_src=twsrc%5Etfw\">August 9, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The founder of Rotkiapp, Lefteris Karapetsas, theorized that &#8220;It's DNS spoofing. Cloned the site, made the DNS point to their ip where the cloned site is deployed and added approval requests to a malicious contract.&#8221; Curve retweeted the theory in apparent support before following up with a further announcement;<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Don&#39;t use <a href=\"https:\/\/t.co\/vOeMYOTq0l\">https:\/\/t.co\/vOeMYOTq0l<\/a> site &#8211; nameserver is compromised. Investigation is ongoing: likely the NS itself has a problem<\/p>\n<p>&mdash; Curve Finance (@CurveFinance) <a href=\"https:\/\/twitter.com\/CurveFinance\/status\/1557107088962224132?ref_src=twsrc%5Etfw\">August 9, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Update: Curve has announced the issue has been fixed and says it is safe to use again. Follow up article can be found here.\u00a0 The issue has been found and reverted. If you have approved any contracts on Curve in the past few hours, please revoke immediately. Please use https:\/\/t.co\/6ZFhcToWoJ for now until the propagation [&hellip;]<\/p>\n","protected":false},"author":1264,"featured_media":253870,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[76799,46940,16041],"tags":[],"post_folder":[],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v21.9 (Yoast SEO v21.9.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Curve Finance front end UI compromised following DNS hack - users advised to exercise caution<\/title>\n<meta name=\"description\" content=\"Over $500k has been stolen from Curve finance as the front end is compromised through an attack taking control of its nameserver.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Curve Finance front end UI compromised following DNS hack - users advised to exercise caution\" \/>\n<meta property=\"og:description\" content=\"Over $500k has been stolen from Curve finance as the front end is compromised through an attack taking control of its nameserver.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/\" \/>\n<meta property=\"og:site_name\" content=\"CryptoSlate\" \/>\n<meta property=\"article:published_time\" content=\"2022-08-09T20:55:07+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-08-11T16:11:57+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2022\/08\/curve-hack.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Liam &#039;Akiba&#039; Wright\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@akibablade\" \/>\n<meta name=\"twitter:site\" content=\"@cryptoslate\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Liam 'Akiba' Wright\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/\"},\"author\":{\"name\":\"Liam 'Akiba' Wright\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/ea2b02b41a7478e18d903ca8eec4979e\"},\"headline\":\"Curve Finance front end UI compromised following DNS hack &#8211; users advised to exercise caution\",\"datePublished\":\"2022-08-09T20:55:07+00:00\",\"dateModified\":\"2022-08-11T16:11:57+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/\"},\"wordCount\":143,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"articleSection\":[\"Crime\",\"DeFi\",\"Hacks\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/#respond\"]}],\"copyrightYear\":\"2022\",\"copyrightHolder\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/\",\"url\":\"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/\",\"name\":\"Curve Finance front end UI compromised following DNS hack - users advised to exercise caution\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/#website\"},\"datePublished\":\"2022-08-09T20:55:07+00:00\",\"dateModified\":\"2022-08-11T16:11:57+00:00\",\"description\":\"Over $500k has been stolen from Curve finance as the front end is compromised through an attack taking control of its nameserver.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptoslate.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Curve Finance front end UI compromised following DNS hack &#8211; users advised to exercise caution\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptoslate.com\/#website\",\"url\":\"https:\/\/cryptoslate.com\/\",\"name\":\"CryptoSlate\",\"description\":\"Cryptocurrency News and Real-time Coin Data\",\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptoslate.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Organization\",\"NewsMediaOrganization\"],\"@id\":\"https:\/\/cryptoslate.com\/#organization\",\"name\":\"CryptoSlate\",\"url\":\"https:\/\/cryptoslate.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"width\":1000,\"height\":1000,\"caption\":\"CryptoSlate\"},\"image\":{\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/twitter.com\/cryptoslate\",\"https:\/\/www.instagram.com\/cryptoslate\/\",\"https:\/\/www.linkedin.com\/company\/cryptoslate\/\",\"https:\/\/www.youtube.com\/c\/cryptoslate\",\"https:\/\/cryptoslate.substack.com\/\",\"https:\/\/t.me\/cryptoslatenews\"],\"publishingPrinciples\":\"https:\/\/cryptoslate.com\/editorial-policy\/\",\"ownershipFundingInfo\":\"https:\/\/cryptoslate.com\/about\/\",\"actionableFeedbackPolicy\":\"https:\/\/cryptoslate.com\/about\/\",\"correctionsPolicy\":\"https:\/\/cryptoslate.com\/about\/\",\"ethicsPolicy\":\"https:\/\/cryptoslate.com\/disclaimers\/\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/ea2b02b41a7478e18d903ca8eec4979e\",\"name\":\"Liam 'Akiba' Wright\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/10\/about-liam-150x150.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/10\/about-liam-150x150.jpg\",\"caption\":\"Liam 'Akiba' Wright\"},\"description\":\"Also known as \\\"Akiba,\\\" Liam Wright is the Editor-in-Chief at CryptoSlate and host of the SlateCast. He believes that decentralized technology has the potential to make widespread positive change.\",\"sameAs\":[\"http:\/\/www.akiba.gg\",\"https:\/\/twitter.com\/akibablade\"],\"url\":\"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Curve Finance front end UI compromised following DNS hack - users advised to exercise caution","description":"Over $500k has been stolen from Curve finance as the front end is compromised through an attack taking control of its nameserver.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/","og_locale":"en_US","og_type":"article","og_title":"Curve Finance front end UI compromised following DNS hack - users advised to exercise caution","og_description":"Over $500k has been stolen from Curve finance as the front end is compromised through an attack taking control of its nameserver.","og_url":"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/","og_site_name":"CryptoSlate","article_published_time":"2022-08-09T20:55:07+00:00","article_modified_time":"2022-08-11T16:11:57+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2022\/08\/curve-hack.jpg","type":"image\/jpeg"}],"author":"Liam 'Akiba' Wright","twitter_card":"summary_large_image","twitter_creator":"@akibablade","twitter_site":"@cryptoslate","twitter_misc":{"Written by":"Liam 'Akiba' Wright","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/#article","isPartOf":{"@id":"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/"},"author":{"name":"Liam 'Akiba' Wright","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/ea2b02b41a7478e18d903ca8eec4979e"},"headline":"Curve Finance front end UI compromised following DNS hack &#8211; users advised to exercise caution","datePublished":"2022-08-09T20:55:07+00:00","dateModified":"2022-08-11T16:11:57+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/"},"wordCount":143,"commentCount":0,"publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"articleSection":["Crime","DeFi","Hacks"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/#respond"]}],"copyrightYear":"2022","copyrightHolder":{"@id":"https:\/\/cryptoslate.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/","url":"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/","name":"Curve Finance front end UI compromised following DNS hack - users advised to exercise caution","isPartOf":{"@id":"https:\/\/cryptoslate.com\/#website"},"datePublished":"2022-08-09T20:55:07+00:00","dateModified":"2022-08-11T16:11:57+00:00","description":"Over $500k has been stolen from Curve finance as the front end is compromised through an attack taking control of its nameserver.","breadcrumb":{"@id":"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/cryptoslate.com\/curve-finance-front-end-ui-compromised-in-dns-hack-users-advised-not-to-interact\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptoslate.com\/"},{"@type":"ListItem","position":2,"name":"Curve Finance front end UI compromised following DNS hack &#8211; users advised to exercise caution"}]},{"@type":"WebSite","@id":"https:\/\/cryptoslate.com\/#website","url":"https:\/\/cryptoslate.com\/","name":"CryptoSlate","description":"Cryptocurrency News and Real-time Coin Data","publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptoslate.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":["Organization","NewsMediaOrganization"],"@id":"https:\/\/cryptoslate.com\/#organization","name":"CryptoSlate","url":"https:\/\/cryptoslate.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","width":1000,"height":1000,"caption":"CryptoSlate"},"image":{"@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/twitter.com\/cryptoslate","https:\/\/www.instagram.com\/cryptoslate\/","https:\/\/www.linkedin.com\/company\/cryptoslate\/","https:\/\/www.youtube.com\/c\/cryptoslate","https:\/\/cryptoslate.substack.com\/","https:\/\/t.me\/cryptoslatenews"],"publishingPrinciples":"https:\/\/cryptoslate.com\/editorial-policy\/","ownershipFundingInfo":"https:\/\/cryptoslate.com\/about\/","actionableFeedbackPolicy":"https:\/\/cryptoslate.com\/about\/","correctionsPolicy":"https:\/\/cryptoslate.com\/about\/","ethicsPolicy":"https:\/\/cryptoslate.com\/disclaimers\/"},{"@type":"Person","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/ea2b02b41a7478e18d903ca8eec4979e","name":"Liam 'Akiba' Wright","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/10\/about-liam-150x150.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/10\/about-liam-150x150.jpg","caption":"Liam 'Akiba' Wright"},"description":"Also known as \"Akiba,\" Liam Wright is the Editor-in-Chief at CryptoSlate and host of the SlateCast. He believes that decentralized technology has the potential to make widespread positive change.","sameAs":["http:\/\/www.akiba.gg","https:\/\/twitter.com\/akibablade"],"url":"https:\/\/cryptoslate.com\/author\/liam-akiba-wright\/"}]}},"_links":{"self":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/253866"}],"collection":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/users\/1264"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/comments?post=253866"}],"version-history":[{"count":13,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/253866\/revisions"}],"predecessor-version":[{"id":254457,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/253866\/revisions\/254457"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media\/253870"}],"wp:attachment":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media?parent=253866"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/categories?post=253866"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/tags?post=253866"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/post_folder?post=253866"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}