What happened
On May 14, 2022, around 00:00 UTC, attackers took over the domain of QuickSwap, a DEX on Polygon, through its registrar GoDaddy. They served a modified copy of QuickSwap's interface that sent users' trades to an attacker wallet. QuickSwap counted $107,600.68 traded on the fake site and lost to the attacker from the start of the attack until 04:00 UTC on May 18. No QuickSwap smart contract was exploited.
The attackers social-engineered GoDaddy support into changing the domain account's email to one they controlled, which let them reset the 2FA and password and control the domain's DNS. QuickSwap believes support made the change without checking the caller's identity, based on how easily its own team got the email reset during the recovery. QuickSwap warned users on Twitter and Telegram at about 01:45 UTC, recovered the domain at about 07:00 UTC and moved its DNS to another provider.
QuickSwap proposed repaying affected users from its treasury, about 1,397 old QUICK (valued at $77 each), and put the proposal to a governance vote.
**Block data**
- Attacker wallet: 0x83927acf1a3f69f9fd2ed055fff424a49cda0c5d
How it happened
- The attackers contacted GoDaddy support and got the email on QuickSwap's domain account changed to one they controlled. QuickSwap believes, from its own recovery call, that support did not verify identity.
- Using that email, they reset the account's 2FA and password and took control of the domain's DNS.
- They pointed the domain at a copy of QuickSwap's beta interface, modified so that trades and token approvals went to the attacker's wallet instead of QuickSwap's contracts.
- Users trading through the hijacked site sent or approved funds to
0x83927acf1a3f69f9fd2ed055fff424a49cda0c5d, for a loss QuickSwap put at $107,600.68, counted through 04:00 UTC on May 18. - QuickSwap warned users at about 01:45 UTC, regained the domain at about 07:00 UTC and moved DNS hosting to a new provider.
Protocol details
Evidence
- report Report quickswap-layer2.medium.com
- address polygonscan.com address 0x8392…0c5d polygonscan.com
- analysis Web Archive web.archive.org
- analysis DeFiLlama defillama.com
- analysis QuickSwap's GoDaddy Domain Hijack: How it Happened & Our Proposal to Restore the Community blog.quickswap.exchange
- analysis How Hackers Use DNS Hijacking Attacks to Steal Funds and Clone Websites (CertiK) certik.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
