May 2022 - QuickSwap GoDaddy DNS Compromise - $108k (Global)
"On Friday, May 14th at approximately 12 am UTC, hijackers gained access to QuickSwap’s DNS through a vulnerability in GoDaddy - where QuickSwap’s domain was hosted. Before QuickSwap was able to regain control of our domain, several DEX users lost money by swapping through the platform. What follows is a more detailed explanation of what happened, what we’ve done to ensure something like this doesn’t happen again, and a governance proposal about whether QuickSwap should use funds from our treasury to issue an endowment to those who were affected."
"QuickSwap’s co-founder and lead developer Sameep Singhania was on the phone with GoDaddy Support trying to figure out what happened and regain access to our domain. After several hours of arguing and going through multiple GoDaddy representatives, Sameep finally convinced someone on the support team to change the email address back to one that is in QuickSwap’s control. This helpful GoDaddy associate also reset the 2-factor authentication to Sameep’s control. This was all done without GoDaddy’s support staff taking a single measure to confirm Sameep’s identity or ensure that he was the rightful owner of the QuickSwap domain."
"From the GoDaddy logs, we can see that someone was able to change the email address QuickSwap provided to his or her personal address. From our own experience getting the email address reset, we know how easily this can be accomplished with GoDaddy support. After gaining access to the email and 2FA, the attacker changed the password and was then able to change the DNS settings. S/he pulled the code from the beta version of our UI from GitHub and the phishing attack began. All in, approximately $107,600 USD was traded on QuickSwap during the phishing attack and lost to the attacker."
Further Analysis
Decentralized exchange QuickSwap used and trusted GoDaddy for their domain name services. One day, an attacker managed to convince GoDaddy to modify the hostnames of the domain, directing the domain name to their own server, where they hosted a malicious replica of the QuickSwap website. Users who tried to interact with the QuickSwap website would be interacting with the malicious version, which routed their funds to the attacker's wallet. In total, the attacker was able to take $108,000 worth of funds before the domain could be fully rerouted back to the proper server. The QuickSwap team has put together a reimbursement fund for all affected users.
How Could This Have Been Prevented?
More Cryptocurrency Exchange Hacks/Scams/Frauds
DEI Stablecoin Depegging > > < < SpiritSwap GoDaddy DNS Compromise
Sources/Further Reading
BlockThreat - Week 25, 2022 - by Peter Kacherginsky (Dec 31)
Post Mortem on This Weekends Dns Event (Dec 31)
QuickSwap’s GoDaddy Domain Hijack: How it Happened & Our Proposal to Restore the Community - QuickSwap Blog (Dec 31)
QuickSwap - Leading DEX on Polygon (Dec 31)
QuickSwap’s GoDaddy Domain Hijack: How it Happened & Our Proposal to Restore the Community | by QuickSwap Official | Medium (Dec 31)
@Mudit__Gupta Twitter (Dec 31)
BlockThreat - Week 19, 2022 - by Peter Kacherginsky (Dec 31)
@QuickswapDEX Twitter (Dec 31)
Telegram: Contact @QuickSwapAnnouncements (Dec 31)
 t.me/QuadrigaInitiative
|
 /r/QuadrigaInitiative
|
 @QuadrigaInit
|
 info@quadrigainitiative.com
|