Ether.fi, a decentralized finance (DeFi) staking protocol, successfully blocked an attempted domain account takeover, preventing any compromise to user funds.
On September 24, Ether.fi faced an attack involving their domain registrar, Gandi.net. Fortunately, the DeFi platform’s security measures thwarted the attack before any significant damage could occur.
Attack Details and Swift Response
The attempted breach began when Ether.fi received a suspicious recovery notification email from Gandi.net at 4:38 PM UTC. Upon investigation, the internal security team discovered the email was part of an attacker’s effort to exploit Gandi’s recovery process to gain control over Ether.fi’s account.
After identifying the breach attempt, Ether.fi acted quickly. They reached out to Gandi.net across multiple platforms, and by 7:30 PM UTC, the situation was under control. Ether.fi confirmed that its account had been secured, preventing any further tampering or malicious activity.
Security Measures in Place
Before the attack, Ether.fi had already implemented several key security upgrades, which played a critical role in defending against the takeover attempt. These measures included enforcing hardware authentication for account recovery and management, a step prompted by rising exploitation of similar vulnerabilities across other platforms.
Ether.fi credited its security partners—Seal911, Doppel, Ethena, and Distrust—for their quick assistance in mitigating the threat.
Ether.fi’s proactive approach to security ensured that the platform’s defenses held strong during the attack. They reaffirmed their commitment to safeguarding user assets and maintaining the integrity of their system through ongoing collaboration with their security partners.
