The platform has been targeted at least twice in recent years
Curve Finance is once again dealing with a security issue after its domain name system (DNS) was hijacked, sending users to a malicious website. The team behind the decentralized finance (DeFi) platform issued a warning on May 12 through its official X account, urging users not to interact with the site while the problem is being investigated.
According to Curve, the website is currently pointing to the wrong IP address. That means users who try to visit curve.fi could unknowingly land on a site designed to steal their funds. Although the platform confirmed that its smart contracts remain safe and unaffected, the team emphasized that the domain redirect is dangerous and could lead to wallet drains.
The DNS hijack marks the second time Curve has faced this kind of threat in the span of a week. On May 5, a separate incident saw its official X account taken over by a hacker. In that case, Curve stated that no user funds were compromised and that the issue was limited to the social media platform. The account was recovered shortly afterward.
While all smart contracts are safe, the domain name points to a malicious site which can drain your wallet!
We are investigating and working on recovering the access.
No sign of a compromise on our side https://t.co/YUmwtwt5PH
— Curve Finance (@CurveFinance) May 12, 2025
Security experts have flagged the current issue as a possible front-end attack, where hackers target the user interface of a website to capture sensitive data like wallet keys or approval signatures. Blockchain security firm Blockaid detected suspicious behavior from the site and advised users to disconnect and avoid any transactions until the matter is resolved.
This is not the first time Curve has experienced a DNS-related issue. In August 2022, attackers were able to reroute traffic to a fake site, leading to stolen funds from unsuspecting users. With this latest incident, Curve is once again working to restore control and ensure that users can safely interact with its platform. Updates are expected as the investigation continues.
