What happened
Neutrl suffered a suspected DNS hijack of its frontend on March 18, 2026. The incident redirected users to a malicious domain; the protocol paused contracts and warned users to revoke Permit2 approvals while it investigated. The team later said protocol reserves and user funds remained safe.
The incident was an infrastructure/frontend compromise at the DNS routing layer rather than a smart-contract exploit: control of the protocol's domain path allowed an attacker-controlled frontend to be presented under the expected site address.
How it happened
The attacker compromised DNS/domain routing for Neutrl's frontend, allowing the legitimate site address to serve attacker-controlled content. Neutrl paused its smart contracts, migrated to a new domain and DNS provider, and instructed anyone who interacted with the old domain to revoke suspicious permissions.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
