Official Website of Popular Protocol Compromised in DNS Hijacking Attack

Multiple security monitoring sources reported that on October 31st, the official website of a notable protocol within the crypto community fell victim to a severe DNS hijacking attack. Exploiting a vulnerability at the domain registrar level, attackers altered the domain's resolution records, redirecting all visitors to a sophisticatedly disguised malicious site.

Protocol Team Issues Urgent Security Advisory

Following the incident, the protocol team promptly issued a highest-level security alert via its verified social media channels. The alert explicitly stated that its primary domain (kintsu.xyz) had been fully compromised, with the currently displayed page being a phishing site deployed by the attackers.

The team provided the following critical warnings and recommendations to users:

  • Cease Access Immediately: Do not visit the domain under any circumstances until further official security confirmation is provided.
  • Halt Wallet Interactions: Never connect your cryptocurrency wallet (e.g., MetaMask, WalletConnect) on the website interface.
  • Avoid Signing Transactions: Any signature requests popping up on this site are highly likely traps designed to steal assets or approvals.
  • Review and Revoke Approvals: Users who connected their wallets or performed signatures around 08:00 Beijing Time on October 31st are strongly advised to immediately check and revoke related approvals via a trusted tool (e.g., revoke.cash) and move funds to a new, secure address.

Situation Update: Risk Persists

Several hours into the event, the protocol team updated the status, indicating they had regained control of the domain from the registrar and redirected it to their legitimate infrastructure.

However, due to the caching mechanisms of the global DNS system, the risk has not been instantly eliminated. The team explained that DNS server update speeds vary across different regions and internet service providers worldwide. Some users may still be directed to the phishing site by old, malicious DNS records for several hours or even longer.

Consequently, the team reiterated that until an official, clear security announcement confirming the website's full restoration is published, all users must remain on high alert and continue adhering to the access and interaction ban.

DNS Hijacking: An Attack on the Foundation of Trust

This incident highlights the significant threat DNS hijacking poses to Web3 projects. Unlike direct attacks on smart contracts or servers, DNS hijacking targets the most fundamental trust link between users and a project—the official domain. Users habitually visiting a trusted website can unwittingly fall into a hacker's trap.

Such attacks are notoriously difficult to prevent as they occur at the level of internet infrastructure, making detection and defense challenging for both average users and project teams in the short term. It serves as a reminder that in the blockchain space, security extends beyond smart contract code audits to include traditional cybersecurity and domain management.

For users, the safest course of action upon receiving such alerts is to strictly follow instructions published by the team via verified social media accounts (not the compromised website itself) and cultivate the habit of regularly reviewing and managing wallet approvals.