Convex Finance Hack

On June 23, 2022, attackers hijacked the DNS records for Convex Finance's website and pointed visitors to a copy of the site. The copy looked like the real frontend, but its buttons asked users to approve attacker-controlled contracts instead of Convex's own. The domain was registered at Namecheap, and the same wave of DNS hijacks hit Ribbon Finance, DeFi Saver and Allbridge. In its post-mortem Convex said its Namecheap account had 2FA, a strong password and security alerts, yet the DNS was changed and alerts were switched off; Namecheap's CEO confirmed that a customer support agent altered the records.

The fake staking contract 0xF403a2c10B0B9feF8f0d4F931df5d86aD187AE31 was built to resemble the real one, 0xF403C135812408BFbE8713b5A23a04b3D48AAE31, sharing the same first four and last four characters. A user who checked only the start and end of the address in their wallet prompt would not notice the swap. Cryptonomist reported that at least 10 more malicious contracts were found as the investigation widened.

Convex said funds in its verified contracts were never at risk. It set up convexfinance.fi and frax.convexfinance.fi as temporary alternative domains and told anyone who used convexfinance.com from June 20 to June 23 to review their token approvals. Its post-mortem counted 40 addresses that approved malicious contracts, of which only 3 had funds taken, with an estimated 15,968 cvxCRV and 433 CRV suspected stolen. Convex said it would compensate those losses from its treasury in CVX at the USD value at the time of loss, paid once the affected address had revoked the malicious approvals. CoinDesk reported that a wallet Etherscan labeled "Convex Phisher Deposits" (0xcdc0f019f0ec0a903ca689e2bced3996efc53939) swapped just under $1,000 of USDC and CRV on Uniswap.

Addresses reported early (AMBCrypto) as having approved the malicious contract:

• 0x496e53c32a69a79a82ed85d2913010dd2f9d1b4f
• 0x4ffc5f22770ab6046c8d66dabae3a9cd1e7a03e7
• 0x5b186c93a50d3cb435fe2933427d36e6dc688e4b
• 0x624301090700ea1e3c5b5224f89adfae405412c1
• 0x92557b6ffa116b53cf2c3bc1d6d33f78d97ed4c9