Curve Finance permanently moved its website from Curve.fi to Curve.finance after a May 2025 DNS hijacking exposed users to a malicious copy of its interface. The attack targeted the domain registrar rather than Curve’s smart contracts or internal protocol infrastructure.
On May 12, attackers changed the DNS settings for Curve.fi after gaining access to systems at registrar. Visitors were redirected to a fraudulent website that attempted to trick users into signing malicious wallet transactions. Curve said its contracts, backend systems, and user data were not compromised.
The incident also highlighted a security weakness outside the blockchain itself. Although the protocol remained operational, control over its traditional web address was enough to put users at risk.
We will very likely switch to https://t.co/qumQTcqJhU domain permanently
— Curve Finance (@CurveFinance) May 13, 2025
The attack exposed DeFi’s Web2 dependency
Curve’s response showed why frontend security remains important even when smart contracts are functioning normally. During the incident, Curve said its contracts continued operating and processed more than $400 million in on-chain volume while the frontend was unavailable.
The team subsequently moved users to Curve.finance and said it was reviewing registrar security, considering alternative registrar arrangements, and exploring decentralized frontend infrastructure. Curve also promoted Ethereum Name Service (ENS) as a potential way to reduce reliance on traditional DNS.
The issue was not entirely new. Curve had experienced another DNS-related incident in 2022, while its official X account was compromised shortly before the May 2025 domain attack. Together, the incidents showed that centralized Web2 services can remain an attack surface around decentralized applications.
Don’t use the frontend yet. Investigating!
— Curve Finance (@CurveFinance) August 9, 2022
Curve’s activity also continued despite the security setback. The protocol expanded to additional networks during 2025, including TAC, an EVM network built on TON, where Curve launched a Telegram Mini-App for swaps and liquidity provision.
Also Read: Crypto Security Has Come a Long Way, So Have the People Trying to Break It
Compensation remains part of the aftermath
The consequences of the DNS incident have continued beyond the original domain migration. In February 2026, a Curve governance proposal sought to establish a verification and reimbursement process for affected users. The proposal identified 17 participating victims with combined losses of about $182,575 and said Curve’s internal assessment indicated roughly 21 affected wallets overall.
The proposal does not guarantee reimbursement. It calls for verification of affected users and losses before any DAO-funded compensation, making the incident an ongoing governance issue rather than a closed security story.
Curve therefore remains operational, but the DNS attack has become a broader case study in DeFi security: decentralizing financial contracts does not automatically decentralize the websites and infrastructure users rely on to access them.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
