Ribbon Finance Hack

On June 24, 2022, attackers hijacked the DNS records for ribbon.finance and pointed the domain at a fake copy of the Ribbon app. Ribbon later said a Namecheap agent handling its domain had been compromised. CertiK's write-up says the attacker got in despite strong passwords, 2FA and alerts on the account, and suppressed the security notifications.

The fake site kept Ribbon's look but wired its buttons to attacker contracts. Per CertiK, the fake addresses matched the real ones in their first and last four characters. Users who deposited through it sent funds to the attacker, not to Ribbon's vaults. Ribbon's reimbursement proposal (RGP-21, July 13, 2022) counts three affected users and total losses of 16.5 WBTC, 123.7 rETH and 83.1 stETH, about $540,000 at the time of the post. The 16.5 WBTC loss alone was reported at around $400,000 on the day. This was a front-end compromise, not a bug in Ribbon's vault contracts.

Namecheap's CEO declined to compensate the victims, and Ribbon moved the domain to a different provider. RGP-21 asked the DAO to choose between no reimbursement, 50% from the treasury, or 100% from the treasury with half paid in RBN vested over six months. Convex Finance was hit by a DNS hijack through Namecheap the same day.

Previously published on-chain references for the WBTC theft:

• Scammer: 0xb73261481064f717a63e6f295d917c28385af9aa
• Contract creator: 0x47832f5505847b6e1cce802201c55ad885146fc6
• Malicious contract: 0x65a8ec2c367a2d60efc1944c6eab614d73453b2f
• 16.5 WBTC transfer: 0xd09057f1fdb3fa97d0ed7e8ebd8fd31dd9a0b5b61a29a22b46985d6217510850