Front-end and DNS hijacks
The real website of a dapp you trust is taken over (DNS, hosting or a script it loads) and starts serving a drainer.
How it works
Attackers hijack a project's domain at the registrar, its DNS, its hosting account, or a third-party script the site loads.
Visitors land on the correct address, so bookmarks and typing the URL don't help. The page asks for approvals or transactions that drain them.
These hijacks are usually caught within hours, but the first hours can be costly.
Red flags
- A familiar dapp suddenly asking for new approvals or extra signatures
- Your wallet warning about a site you've used safely before
- Project accounts warning 'do not interact with the site'
Protect yourself
- Never ignore wallet warnings, even on a site you know
- Watch the project's official X account before signing anything unusual
- Keep approvals small and short-lived
If you already signed
- Revoke approvals made during the hijack window
- Move funds to a fresh wallet if you signed anything unusual
Incidents using it 4
-
Critical✓Contained
Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained
Polymarket disclosed on 25 June 2026 that a breached third-party vendor let attackers inject malicious code into its website for some users. Users who interacted with the compromised front-end had their pUSD (Polymarket's USDC-backed stablecoin) drained; Bubblemaps estimated about $3M taken from fewer than 15 users, and the funds were converted to ETH. Polymarket removed the code and says it will fully refund affected users.
Polymarket web app users·Polygon, Ethereum·$3.0M stolen·Since Jun 25, 2026·
-
Critical✓Contained
CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals
On 14 April 2026 attackers took control of the domain for swap.cow.fi and sent visitors to a cloned CoW Swap interface that asked for malicious token approvals. CoW DAO paused its backend and APIs and told users to revoke approvals made after 14:54 UTC; the protocol's smart contracts were not affected. Early estimates were about $500K drained; Halborn later put user losses at about $1.2M and said the registrar had been social-engineered.
CoW Swap (swap.cow.fi) users·Ethereum·$1.2M stolen·Since Apr 14, 2026·
-
High◐Partly contained
Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt
On Mar 11, 2026, attackers who had hijacked a Bonk.fun team account put a wallet drainer on the Solana launchpad's official domain. Visitors were asked to sign a fake terms-of-service message, and those who signed had their wallets drained. The team called losses minimal; SlowMist's database puts them at about $30,000. Only people who signed the fake message on the domain after the hijack were affected. If you signed it, move remaining funds to a new wallet.
Bonk.fun launchpad users·Solana·$30K stolen·Since Mar 11, 2026·
-
Critical✓Contained
Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer
On 21 November 2025 an attacker changed the DNS records for aerodrome.finance and velodrome.finance, sending visitors to a cloned front-end running 'Eleven Drainer' code. Users who signed on the fake site lost tokens: Blockaid tied about $700K to nine attacker addresses, and Halborn put losses above $1M. The smart contracts were not touched. Anyone who signed on either site that evening should revoke approvals they don't recognise.
Aerodrome (Base) and Velodrome (Optimism) web app users·Base, Optimism·$700K stolen·Since Nov 21, 2025·