{
 "tag": "front-end-hijack",
 "name": "Front-end and DNS hijacks",
 "group": "Drain methods",
 "incidents": [
  {
   "slug": "polymarket-frontend-vendor-compromise-jun-2026",
   "title": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026",
   "json": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "polygon",
    "ethereum"
   ],
   "method": "front-end-hijack",
   "product": "Polymarket web app users",
   "tags": [
    "polygon",
    "ethereum",
    "front-end-hijack",
    "polymarket",
    "supply-chain",
    "third-party-vendor",
    "injected-script",
    "pusd",
    "prediction-market"
   ],
   "amountUsd": 3000000,
   "victims": null,
   "startedAt": "2026-06-25",
   "closedAt": "2026-07-01",
   "updatedAt": "2026-07-01T12:00:00Z",
   "summary": "Polymarket disclosed on 25 June 2026 that a breached third-party vendor let attackers inject malicious code into its website for some users. Users who interacted with the compromised front-end had their pUSD (Polymarket's USDC-backed stablecoin) drained; Bubblemaps estimated about $3M taken from fewer than 15 users, and the funds were converted to ETH. Polymarket removed the code and says it will fully refund affected users."
  },
  {
   "slug": "cow-swap-dns-hijack-apr-2026",
   "title": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals",
   "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026",
   "json": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "front-end-hijack",
   "product": "CoW Swap (swap.cow.fi) users",
   "tags": [
    "ethereum",
    "front-end-hijack",
    "cow-swap",
    "dns-hijack",
    "registrar",
    "social-engineering",
    "approval-phishing",
    "dex"
   ],
   "amountUsd": 1200000,
   "victims": null,
   "startedAt": "2026-04-14",
   "closedAt": "2026-05-13",
   "updatedAt": "2026-05-13T12:00:00Z",
   "summary": "On 14 April 2026 attackers took control of the domain for swap.cow.fi and sent visitors to a cloned CoW Swap interface that asked for malicious token approvals. CoW DAO paused its backend and APIs and told users to revoke approvals made after 14:54 UTC; the protocol's smart contracts were not affected. Early estimates were about $500K drained; Halborn later put user losses at about $1.2M and said the registrar had been social-engineered."
  },
  {
   "slug": "bonk-fun-domain-hijack-drainer-mar-2026",
   "title": "Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt",
   "url": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026",
   "json": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "front-end-hijack",
   "product": "Bonk.fun launchpad users",
   "tags": [
    "solana",
    "front-end-hijack",
    "bonk-fun",
    "launchpad",
    "domain-hijack",
    "fake-tos",
    "signature-phishing",
    "bonk"
   ],
   "amountUsd": 30000,
   "victims": null,
   "startedAt": "2026-03-11",
   "closedAt": "2026-03-12",
   "updatedAt": "2026-03-12T12:00:00Z",
   "summary": "On Mar 11, 2026, attackers who had hijacked a Bonk.fun team account put a wallet drainer on the Solana launchpad's official domain. Visitors were asked to sign a fake terms-of-service message, and those who signed had their wallets drained. The team called losses minimal; SlowMist's database puts them at about $30,000. Only people who signed the fake message on the domain after the hijack were affected. If you signed it, move remaining funds to a new wallet."
  },
  {
   "slug": "aerodrome-velodrome-dns-hijack-nov-2025",
   "title": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025",
   "json": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "base",
    "optimism"
   ],
   "method": "front-end-hijack",
   "product": "Aerodrome (Base) and Velodrome (Optimism) web app users",
   "tags": [
    "base",
    "optimism",
    "front-end-hijack",
    "aerodrome",
    "velodrome",
    "dns-hijack",
    "eleven-drainer",
    "drainer-as-a-service",
    "approval-phishing",
    "dex"
   ],
   "amountUsd": 700000,
   "victims": null,
   "startedAt": "2025-11-21",
   "closedAt": "2025-12-02",
   "updatedAt": "2025-12-02T12:00:00Z",
   "summary": "On 21 November 2025 an attacker changed the DNS records for aerodrome.finance and velodrome.finance, sending visitors to a cloned front-end running 'Eleven Drainer' code. Users who signed on the fake site lost tokens: Blockaid tied about $700K to nine attacker addresses, and Halborn put losses above $1M. The smart contracts were not touched. Anyone who signed on either site that evening should revoke approvals they don't recognise."
  }
 ],
 "changes": [
  {
   "incident": "polymarket-frontend-vendor-compromise-jun-2026",
   "incidentTitle": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-07-01",
   "title": "Halborn's June review listed the vendor-driven front-end attack at about $3M stolen from site visitors.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-june-2026",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026"
  },
  {
   "incident": "polymarket-frontend-vendor-compromise-jun-2026",
   "incidentTitle": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-06-26",
   "title": "Bubblemaps estimated about $3M stolen from fewer than 15 users; PeckShield said victims' pUSD was drained and the funds were converted to ETH.",
   "sourceUrl": "https://unchainedcrypto.com/polymarket-users-lose-estimated-3-million-in-front-end-exploit/",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026"
  },
  {
   "incident": "polymarket-frontend-vendor-compromise-jun-2026",
   "incidentTitle": "Polymarket front-end compromised through third-party vendor; about $3M of users' pUSD drained",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-06-25",
   "title": "Polymarket said a third-party vendor was compromised and malicious code was injected into its website; it removed the code, patched the issue and promised full refunds.",
   "sourceUrl": "https://unchainedcrypto.com/polymarket-users-lose-estimated-3-million-in-front-end-exploit/",
   "url": "https://drains.watch/i/polymarket-frontend-vendor-compromise-jun-2026"
  },
  {
   "incident": "cow-swap-dns-hijack-apr-2026",
   "incidentTitle": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-05-13",
   "title": "Halborn's April review put user losses at about $1.2M and said the DNS registrar had been social-engineered.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-april-2026",
   "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026"
  },
  {
   "incident": "cow-swap-dns-hijack-apr-2026",
   "incidentTitle": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-04-14",
   "title": "CoW DAO said swap.cow.fi had been hit by a DNS hijacking, paused its backend and APIs, and told users to stay away from the site.",
   "sourceUrl": "https://cointelegraph.com/news/cow-swap-dao-domain-hijacking",
   "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026"
  },
  {
   "incident": "cow-swap-dns-hijack-apr-2026",
   "incidentTitle": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-04-14",
   "title": "A researcher estimated about $500K drained from a few addresses; CoW DAO told users to revoke all approvals made on CoW Swap after 14:54 UTC.",
   "sourceUrl": "https://decrypt.co/364377/ethereum-defi-exchange-cow-swap-website-compromise",
   "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026"
  },
  {
   "incident": "bonk-fun-domain-hijack-drainer-mar-2026",
   "incidentTitle": "Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-12",
   "title": "The Block reported the team told users not to interact with the website until it was secured; the operator said losses were minimal.",
   "sourceUrl": "https://www.theblock.co/post/393345/bonk-fun-hijacked",
   "url": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026"
  },
  {
   "incident": "bonk-fun-domain-hijack-drainer-mar-2026",
   "incidentTitle": "Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-11",
   "title": "Bonk.fun's official domain began serving a drainer behind a fake terms-of-service signature after a team account was hijacked.",
   "sourceUrl": "https://www.theblock.co/post/393345/bonk-fun-hijacked",
   "url": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-02",
   "title": "Halborn's November review listed the DNS hijack with over $1M lost through malicious token approvals.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-november-2025",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-24",
   "title": "Blockaid published its analysis: about $700K stolen to nine attacker addresses, about $3.5M in drains blocked, and 408 users warned at connect and 491 at signing.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-21",
   "title": "At 20:11 UTC the attacker changed the SOA, NS and A records so both domains pointed to a cloned front-end running Eleven Drainer code.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-21",
   "title": "Blockaid detected malicious transaction patterns at 21:31 UTC and flagged the domain as malicious a minute later; the first user report came at 22:07 UTC.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-21",
   "title": "Nameservers were replaced at 22:40 UTC as remediation began.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  }
 ]
}