Crypto glossary
Front-end and DNS hijack
A front-end or DNS hijack lets attackers take over a dApp's website or domain and serve malicious transactions to users while the smart contracts stay intact.
A dApp has two layers: smart contracts on chain and a website that builds the transactions users sign. Attackers who cannot break the contracts go after the website. In a DNS hijack, they take control of the domain through the registrar or DNS provider, often by social engineering support staff, and point it to a cloned site. In other cases they compromise the hosting account, a content delivery network or an injected script.
Because users visit the real address and see the familiar interface, the malicious approval or transfer looks routine. In December 2021, BadgerDAO lost around 120 million dollars after a compromised Cloudflare API key let attackers inject a script requesting token approvals. Curve Finance's DNS was hijacked in August 2022, and several DeFi sites have suffered similar registrar attacks since.
Protocols defend with registrar locks, DNSSEC, strict content security policies, monitoring and decentralized or IPFS-hosted front ends. Users have their own layer: wallets that simulate transactions and flag unknown spenders, hardware screens showing what is actually being approved, and a habit of pausing when a familiar site suddenly asks for unlimited approvals.
Example
After a DeFi protocol's domain is hijacked, its usual swap page asks visitors to approve all their USDC to an unknown contract; the team posts a warning on X while users revoke approvals.