DNS Hijacking
An attack that redirects a legitimate website's domain name to a malicious server, tricking visitors into interacting with a convincing fake version of the real site.
DNS hijacking is an attack in which a domain's DNS records — the system that translates a human-readable website address into the server location it actually points to — are maliciously altered, redirecting visitors who type in the legitimate, correct domain name to an attacker-controlled server instead, without the victim ever typing a wrong address. This can be accomplished by compromising the domain registrar account, the DNS provider, or network infrastructure along the route between the victim and the legitimate server.
For a crypto exchange, wallet provider, or DeFi protocol's front end, a successful DNS hijack can redirect users to a pixel-perfect fake copy of the legitimate site, tricking them into entering credentials, signing malicious transactions, or depositing funds to an attacker-controlled address — a particularly dangerous attack precisely because the victim typed the correct, familiar domain name and may see no obvious warning sign. Protections like DNSSEC (which cryptographically signs DNS records) and multi-factor authentication on domain registrar accounts are among the main defenses projects use to reduce this risk.
Examples
- A DNS hijacking attack against a DeFi protocol's front-end domain redirected users typing the correct, familiar web address to a convincing fake site that drained connected wallets.
- DNS hijacking is especially dangerous because victims type the legitimate domain name themselves, unlike phishing, which typically relies on tricking a victim into clicking a slightly different, fake link.