Curve Finance has flagged a Domain Name Service (DNS) attack on its website, days after unknown actors gained access to the protocol’s X account.
Reported late on Monday, Curve said its “curve[.] fi” domain was compromised in an apparent DNS spoofing attack.
In the meantime, users were advised against interacting with the website until further notice. Curve has also switched to its curve[.}finance site, per a tweet from the team. Wallet providers like Phantom have blocked the curve[.] fi domain and displayed a warning message for users.
“The incident has not affected the protocol’s infrastructure and is strictly limited to the DNS layer,” Curve’s team announced on Tuesday, adding that user funds were secure and the protocol remained operational.
The platform said it has opened a full investigation and contacted its domain registrar to resolve the matter. Security partners and industry players were also engaged to help contain the issue, according to the team’s latest update seen on its X page.
Phantom
Phantom Warns Curve Finance Users Amid DNS Exploit
It’s not the first time Curve Finance has suffered a DNS breach. In 2022, hackers compromised the platform’s DNS and hosted a new IP address to steal funds from decentralized finance users.
Last week, scammers also infiltrated the protocol’s X account to promote a wallet-drainer link, but the team regained control shortly after. Curve Finance is the 20th largest DeFi application by total value locked (TVL), holding over $2.3 billion across 22 networks, according to DefiLlama.
© 2025 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.