Convex Finance Launches Two URLs After Spoofing Exploit

The Domain Name Server (DNS) of the decentralized staking platform, Convex Finance, was targeted in the latest spoofing exploit.

Angel investor Alexintosh first flagged that Convex Finance was asking for user approval to an unverified smart contract address on July 23rd.
This suggested that a malicious entity may have sneaked into Convex Finance’s website to carry out a DNS spoofing attack.
Following the incident, the staking platform confirmed the hijack of its DNS that led users to unassumingly approve malicious contracts for some interactions on the website.
Convex then announced setting up two alternative domain names and asked users to use these URLs to interact with the site while they conduct the investigation.
The platform marked five wallets affected by the exploit. The team, however, revealed that funds on verified contracts were not affected.
The exploiter sent the stolen funds to a “Convex Phisher Deposits” flagged wallet flagged that shows a small amount of crypto from the affected users before moving most of it to the coin mixer, Tornado Cash, to hide the tracks.
Convex Finance said that it will publish a detailed post-mortem report soon.
Furthermore, a crypto tracking and compliance platform MistTrack revealed that Ribbon Finance, a decentralized structured products protocol, also suffered a DNS hijacking attack, wherein a victim reportedly lost 16.5 WBTC. On-chain analysis suggests that it was the same attacker as Convex.