Sebastian Sinclair

Decentralized finance liquidity protocol Balancer said Wednesday it has regained control over its domain after a DNS attack on Tuesday left its user interface compromised.&nbsp;



Balancer, in a statement on social media, said its “domain is now secure and back under the control of the Balancer DAO.”



The attack prompted the Balancer team <a href="https://blockworks.co/news/balancer-website-hijack-puts-users-at-risk">to issue a public notice</a> advising users not to interact with the platform&#8217;s user interface while they continued to investigate the incident.&nbsp;



Balancer <a href="http://x.com/Balancer/status/1704552285395894422?s=20">attributed</a> the attack to social engineering tactics executed on EuroDNS, a domain registrar for the .fi top-level domain (TLD). Balancer is exploring the deprecation of the .fi TLD in favor of a more secure domain registrar, and is recommending others follow suit.



The &#8220;.fi&#8221; TLD is the country code specifically designated for Finland. Like other country-code TLDs such as &#8220;.uk&#8221; for the United Kingdom or &#8220;.au&#8221; for Australia, &#8220;.fi&#8221; is primarily intended for entities located within or associated with the designated country.



Blockworks has reached out to learn more, but has yet to receive a response.



Crypto analyst ZachXBT on Tuesday disclosed that stolen funds from the platform were being routed to a specific <a href="https://etherscan.io/address/0x645710Af050E26bB96e295bdfB75B4a878088d7E#tokentxns">Ethereum address</a>. The theft reportedly totaled approximately $238,000.&nbsp;



The attack also triggered fluctuations in the value of Balancer’s native token (<a href="https://blockworks.co/price/bal">BAL</a>), sending the token down by 3.2% from a daily high of $3.44 to $3.27 on Tuesday. The asset has since fallen a further 1.2% to $3.23 on the day.



Balancer’s security incident is the latest in a <a href="https://blockworks.co/news/hackers-targeting-abandoned-tokens">series of setbacks</a> for the protocol. The platform faced a similar exploit targeting its <a href="https://blockworks.co/news/balancer-exploit-vulnerability">liquidity pools</a> last month.&nbsp;



Constructed on the Ethereum blockchain network, Balancer serves dual roles as an automated market maker and a liquidity facilitator. This enables users to conduct token trades directly through its liquidity pools, eliminating the necessity for a conventional order book.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.



Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. <a href="https://blockworks.co/newsletter/onthemargin">Subscribe to the Forward Guidance newsletter</a>.



Get alpha directly in your inbox with the <a href="https://blockworks.co/newsletter/research">0xResearch newsletter</a> — market highlights, charts, degen trade ideas, governance updates, and more.



The Lightspeed newsletter is all things Solana, in your inbox, every day. <a href="https://blockworks.co/newsletter/lightspeed">Subscribe to daily Solana news</a> from Jack Kubinec and Jeff Albus.

Balancer regains domain control after DNS attack, weighs registrar switch

DeFi liquidity protocol Balancer is staring down yet another security vulnerability, this time targeting its user interface.&nbsp;



The platform issued a notice on <a href="https://x.com/Balancer/status/1704281611326357567?s=20">social media</a> Tuesday evening, urging users not to interact with the main Balancer UI until further notice as they investigate. Investors and users of Balancer are advised to remain vigilant and await further updates.



Crypto sleuth <a href="https://x.com/zachxbt/status/1704286832844828914?s=20">ZachXBT</a>, revealed on X, formerly Twitter, that the stolen funds are being funneled into a specific Ethereum address. Approximately $238,000 has reportedly been pilfered so far.&nbsp;



Analysis of the <a href="https://etherscan.io/address/0x645710Af050E26bB96e295bdfB75B4a878088d7E#tokentxns">address</a> shows it currently holds 68 ether (<a href="https://blockworks.co/price/eth">ETH</a>) valued at more than $111,000, based on the current ETH price of $1,636.



In the last eight hours, a series of ERC-20 token transfers involving the address labeled &#8220;Balancer Attacker&#8221; can be viewed from Etherscan, a popular analytics tool.&nbsp;



Tokens, including Balancer&#8217;s native BAL token, liquid staked ether, Aave&#8217;s wrapped tokens, and several others, have so far been transferred in and out of the address.



The developments Wednesday follow a <a href="https://blockworks.co/news/hackers-targeting-abandoned-tokens">series of assaults</a> against the protocol in recent weeks including an exploit of a <a href="https://blockworks.co/news/balancer-exploit-vulnerability">critical vulnerability</a> in its v2 pools late last month.



Built on the Ethereum blockchain, Balancer functions as both an automated market maker and a liquidity protocol, allowing users to trade tokens directly from its liquidity pools, without the need for a traditional order book.



In recent hours, Balancer&#8217;s native token (BAL) has experienced some volatility, though the full extent of the financial fallout remains to be seen. BAL is down 3.2% on the day from a top of $3.44 to $3.27, exchange data shows.



Balancer is not the first DeFi platform to fall victim to a cyber-attack this year. There has been a <a href="https://blockworks.co/news/defi-exploits-top-1-8b-ytd-though-security-getting-better-immunefi-says">noticeable uptick</a> in security breaches targeting DeFi projects in recent months, leading to a broader conversation in the industry about the need for <a href="https://blockworks.co/news/defi-circuit-breaker-stop-hacks">enhanced security measures</a>.



The Balancer team said it is currently investigating the issue, and it&#8217;s yet unclear how the attackers managed to exploit the system. Blockworks has reached out to learn more.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.



Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. <a href="https://blockworks.co/newsletter/onthemargin">Subscribe to the Forward Guidance newsletter</a>.



Get alpha directly in your inbox with the <a href="https://blockworks.co/newsletter/research">0xResearch newsletter</a> — market highlights, charts, degen trade ideas, governance updates, and more.



The Lightspeed newsletter is all things Solana, in your inbox, every day. <a href="https://blockworks.co/newsletter/lightspeed">Subscribe to daily Solana news</a> from Jack Kubinec and Jeff Albus.