What happened
Late on September 19, 2023 (UTC), attackers hijacked the DNS for Balancer's website, balancer.fi, and replaced the site with a phishing copy. Users who connected were asked to approve tokens, and the attackers then moved those tokens with transferFrom. PeckShield estimated about $238K in crypto stolen. Balancer's smart contracts were not affected.
Balancer blamed a social engineering attack on EuroDNS, the registrar it used for the .fi domain. SlowMist, as cited by Cointelegraph, identified Angel Drainer phishing contracts and described the redirection as BGP hijacking. Balancer warned users not to use the site and got the domain back under Balancer DAO control at 17:45 UTC on September 20. It also suggested other projects move off the .fi TLD to a more secure registrar.
The attacker moved funds across chains. About 15 wETH.e was moved on Avalanche, some ETH was bridged to Bitcoin through THORChain, and some was bridged back to Ethereum. PeckShield reported that attacker-related address 0xF99825f51F6D922EBBf1527809e99A4b9F0a29D6 received 1.04 AVAX from MEXC. Snowtrace labels Avalanche address 0x645710af050e26bb96e295bdfb75b4a878088d7e as the Balancer attacker, citing ZachXBT.
How it happened
- The attacker used social engineering against EuroDNS, the .fi registrar, to take control of
balancer.fiand point it at infrastructure the attacker controlled. - Visitors saw a phishing site that used Angel Drainer contracts. It asked them to sign token approvals to attacker addresses.
- The attacker used those approvals to call
transferFromand move victims' tokens, taking about $238K. - The stolen funds were then moved across Avalanche, THORChain and Ethereum.
Protocol details
Security review history
- OpenZeppelin View report
- Trail of Bits View report
Evidence
- report PeckShieldAlert on X: Balancer frontend under attack, ~$238k stolen twitter.com
- report PeckShieldAlert on X: attacker-related address 0xf998 received 1.04 AVAX from MEXC twitter.com
- transaction cchain.explorer.avax.network transaction 0x1299…7e4c cchain.explorer.avax.network
- transaction cchain.explorer.avax.network transaction 0x3bee…597c cchain.explorer.avax.network
- address Snowtrace address 0x645710Af...8d7E snowtrace.io
- address cchain.explorer.avax.network address 0x1c14…294f cchain.explorer.avax.network
- address cchain.explorer.avax.network address 0x6457…8d7e cchain.explorer.avax.network
- address cchain.explorer.avax.network address 0xF998…29D6 cchain.explorer.avax.network
- analysis Web Archive archive.ph
- analysis DeFiLlama defillama.com
- analysis Balancer blames 'social engineering attack' on DNS provider for front-end hijack (Cointelegraph) cointelegraph.com
- analysis Balancer hit by DNS attack on front-end website (The Block) theblock.co
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
