What happened
On July 23, 2024, attackers took over the dydx.exchange domain that served the dYdX v3 trading website and pointed it to a phishing page. They got in by social engineering Squarespace's customer support into changing the domain's admin email to an attacker-controlled Outlook address, then removed DNSSEC and moved the nameservers from Cloudflare to DDoS-Guard. The fake site asked visitors with connected wallets to send ETH or ERC-20 tokens to the attacker's Ethereum address. dYdX said two users lost about $31,000. The v3 smart contracts, backend systems and dYdX Chain were not affected.
Squarespace support restored the domain within a couple of hours. dYdX worked with SEAL so MetaMask and Phantom would block the phishing site, moved the domain to Cloudflare on July 24, and said it was helping the two affected users secure their wallets and recover funds. Two weeks earlier, on July 9, attackers had already changed the domain's nameservers through a Squarespace OAuth login flaw, but DNSSEC stopped that attempt.
How it happened
- The dydx.exchange domain had been migrated from Google Domains to Squarespace, whose support desk handled account recovery.
- The attacker convinced Squarespace support to change the domain's admin email to an Outlook address with a username resembling the billing administrator's legal name, without valid credentials, email access or 2FA codes.
- With control of the registrar account, the attacker removed DNSSEC and switched the nameservers from Cloudflare to DDoS-Guard, so dydx.exchange resolved to an attacker-hosted site.
- The phishing site asked connected wallets to transfer ETH or ERC-20 tokens to the attacker. Two users did, losing about $31,000, before the domain was recovered.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
