Bessie Liu


<p>The Domain Name System (DNS) of NFT infrastructure company Galxe has been compromised, with the attacker’s address currently holding $75,000 in digital assets.&nbsp;</p>



<p>In a <a href="https://twitter.com/zachxbt/status/1710308430991286513">post</a> on X, Galxe noted that its website was down and the team is currently working on a resolution. The company also urged users not to connect their wallet addresses to Galxe in the meantime.&nbsp;</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">Dear Galxe Community,<br><br>We recognize the impact that recent events have had upon our users and are quickly working to take remedial action. The Galxe security team continues to take an aggressive approach to protect your data, funds and digital assets.<br><br>Steps You Should Take:<br>❗️Do…</p>&mdash; Galxe (@Galxe) <a href="https://twitter.com/Galxe/status/1710338105939521880?ref_src=twsrc%5Etfw">October 6, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>A separate <a href="https://twitter.com/polkastarter/status/1710327209569796461">post</a> by Polkastarter, a Web3 fundraising platform, advised users to revoke permissions that had been given to Galxe.&nbsp;</p>



<p>“We suggest removing all other spending permissions as well to improve the safety of your funds,” the company said on <a href="https://twitter.com/polkastarter/status/1710327209569796461">X</a>.</p>



<p>According to the pseudonymous on-chain investigator <a href="https://twitter.com/zachxbt/status/1710308430991286513">ZachXBT,</a> the Galxe attacker could be the same entity as the attacker who drained approximately <a href="https://blockworks.co/news/balancer-website-hijack-puts-users-at-risk">$238,000</a> from DeFi liquidity protocol Balancer last month.&nbsp;</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">Stolen funds are being directed to here<br><br>0x4103baBcFA68E97b4a29fa0b3C94D66afCF6163d<br><br>It seems to likely be the same scammer who did the Balance frontend attack recently. <a href="https://t.co/SovOGGn8GE">pic.twitter.com/SovOGGn8GE</a></p>&mdash; ZachXBT (@zachxbt) <a href="https://twitter.com/zachxbt/status/1710308430991286513?ref_src=twsrc%5Etfw">October 6, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>Stolen funds have been directed to an <a href="https://etherscan.io/address/0x4103babcfa68e97b4a29fa0b3c94d66afcf6163d#tokentxns">Ethereum address</a>, which, at the time of writing, holds almost $75,000. The attack appears to be ongoing, with the last token transfer taking place at 12:30 pm ET.</p>



<p>The hacker appears to be using the same smart contract to execute his hacks across the different networks, X user <a href="https://twitter.com/FIP_Crypto">FIP Crypto</a> wrote.&nbsp;</p>



<p>FIP Crypto also recommended that users should revoke the smart contract on the 10 different chains that Galxe is deployed on, including Ethereum, Optimism, Arbitrum, BNB Chain, Base, Polygon, Avalanche, Fantom, Celo and Cronos.</p>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<p><strong>Get the news in your inbox. Explore Blockworks newsletters:</strong></p>



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown"><strong>The Breakdown</strong></a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch"><strong>0xResearch</strong></a>: Alpha in your inbox. Think like an analyst. </li>
</ul>


Data breach

Galxe front-end compromised in possible ongoing attack

Sebastian Sinclair


<p>Decentralized finance liquidity protocol Balancer said Wednesday it has regained control over its domain after a DNS attack on Tuesday left its user interface compromised.&nbsp;</p>



<p>Balancer, in a statement on social media, said its “domain is now secure and back under the control of the Balancer DAO.”</p>



<p>The attack prompted the Balancer team <a href="https://blockworks.co/news/balancer-website-hijack-puts-users-at-risk">to issue a public notice</a> advising users not to interact with the platform&#8217;s user interface while they continued to investigate the incident.&nbsp;</p>



<p>Balancer <a href="http://x.com/Balancer/status/1704552285395894422?s=20">attributed</a> the attack to social engineering tactics executed on EuroDNS, a domain registrar for the .fi top-level domain (TLD). Balancer is exploring the deprecation of the .fi TLD in favor of a more secure domain registrar, and is recommending others follow suit.</p>



<p>The &#8220;.fi&#8221; TLD is the country code specifically designated for Finland. Like other country-code TLDs such as &#8220;.uk&#8221; for the United Kingdom or &#8220;.au&#8221; for Australia, &#8220;.fi&#8221; is primarily intended for entities located within or associated with the designated country.</p>



<p>Blockworks has reached out to learn more, but has yet to receive a response.</p>



<p>Crypto analyst ZachXBT on Tuesday disclosed that stolen funds from the platform were being routed to a specific <a href="https://etherscan.io/address/0x645710Af050E26bB96e295bdfB75B4a878088d7E#tokentxns">Ethereum address</a>. The theft reportedly totaled approximately $238,000.&nbsp;</p>



<p>The attack also triggered fluctuations in the value of Balancer’s native token (<a href="https://blockworks.co/price/bal">BAL</a>), sending the token down by 3.2% from a daily high of $3.44 to $3.27 on Tuesday. The asset has since fallen a further 1.2% to $3.23 on the day.</p>



<p>Balancer’s security incident is the latest in a <a href="https://blockworks.co/news/hackers-targeting-abandoned-tokens">series of setbacks</a> for the protocol. The platform faced a similar exploit targeting its <a href="https://blockworks.co/news/balancer-exploit-vulnerability">liquidity pools</a> last month.&nbsp;</p>



<p>Constructed on the Ethereum blockchain network, Balancer serves dual roles as an automated market maker and a liquidity facilitator. This enables users to conduct token trades directly through its liquidity pools, eliminating the necessity for a conventional order book.</p>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<p><strong>Get the news in your inbox. Explore Blockworks newsletters:</strong></p>



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown"><strong>The Breakdown</strong></a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch"><strong>0xResearch</strong></a>: Alpha in your inbox. Think like an analyst. </li>
</ul>


Balancer

Balancer regains domain control after DNS attack, weighs registrar switch

Jack Kubinec

<div id="highlights-block_62bf46e463b31" class="highlights">
        <ul>
                <li>The companies assert no funds were stolen, though they cannot tell for sure</li>
                <li>The hack comes as Polygon announced a partnership with Meta to bring NFTs to Facebook</li>
            </ul>
    
</div>



<p>A hacker produced a phishing pop-up on Polygon and Fantom this morning warning users their funds were at risk and urging them to enter their private account keys.&nbsp;</p>



<p>The hacker accessed Polygon and Fantom’s remote procedure call (RPC) interfaces through the Web3 infrastructure platform Ankr by tricking a third party domain name system (DNS) provider into giving the hacker access to Polygon and Fantom’s domains.</p>



<p>Ankr’s DNS is hosted on a web service named Gandi, and its customer support has a section for clients who want to change the administrator’s email for a domain.</p>


<div class="wp-block-image">
<figure class="aligncenter is-resized"><img loading="lazy" decoding="async" src="https://lh6.googleusercontent.com/1o_R5kAc11QEYSiJNBjnVw8H47zLNZwxe6yLZgnvQBcc_s_X2ZYYZjkAM5UrsuYD_Nt0IPLrT2iV6cjO2-aJby895yT0tzUKO1XZvn5sGPZTw7vuFb3LlHIB5_maJPr40CCpRLZONbepryvVA5c" alt="" width="492" height="160"/><figcaption>Customer service communication at Gandi | Source: Ankr</figcaption></figure></div>


<p>Posing as an Ankr employee, the hacker sent Gandi a fake identity card and convinced the platform’s customer support service to change the email address for the domain registrar account from Ankr’s to the hacker’s Hotmail account.</p>



<p>Ankr is “still trying to understand what [Gandi] accepted as proof for this change,” Peter Stewart, integration manager at Ankr, said.</p>



<p>Ankr was able to regain control of the DNS within six hours of the attack. Sources at Polygon and Ankr told Blockworks that no user funds were compromised, but also conceded they cannot conclusively determine whether any users fell victim to the phishing attack.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">Attention please, attack on <a href="https://twitter.com/0xPolygon?ref_src=twsrc%5Etfw">@0xPolygon</a> is ongoing right now!<br><br>Users see an RPC error asking users to urgently reset their seed on polygonapp net (looks like this is wether DNS hijack or a form of a supply chain attack).<br><br>Just a scam popup to bring you to a page to put your seed. <a href="https://t.co/fZxtlkKeDN">pic.twitter.com/fZxtlkKeDN</a></p>&mdash; CIA Officer (@officer_cia) <a href="https://twitter.com/officer_cia/status/1542829400143568897?ref_src=twsrc%5Etfw">July 1, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>“DNS is unfortunately still a centralized point of failure in the internet,” Ankr co-founder Ryan Fang told Blockworks via Telegram.&nbsp;</p>



<p>Fang said Ankr will continue to work with Gandi, but it will ask its DNS providers to use two-factor authentication moving forward.</p>



<p>The phishing attack comes as Polygon announced a partnership with Meta to bring NFTs to Facebook — and as NFT (non-fungible token) sales reach their lowest point in a year, according to the blockchain research platform Dune.</p>



<p>“It was a third party outage that does not affect Polygon in any way. Meta is not using that third party either,” <a href="https://www.linkedin.com/in/mudit4/?originalSubdomain=in" target="_blank" rel="noreferrer noopener">Mudit Gupta</a>, chief information security officer at Polygon, told Blockworks.</p>



<p>Meta did not immediately respond to a request for comment.</p>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<p><strong>Get the news in your inbox. Explore Blockworks newsletters:</strong></p>



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown"><strong>The Breakdown</strong></a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch"><strong>0xResearch</strong></a>: Alpha in your inbox. Think like an analyst. </li>
</ul>


Ankr

Hacker Posed as Ankr Employee To Phish Polygon and Fantom Users

Luke Conway


<h2 class="wp-block-heading"><strong>What is the Ethereum Name Service?</strong></h2>



<p>Crypto addresses are long strings of numbers and letters designed to be read by computers. These long addresses have led to confusion and even loss of funds.&nbsp;</p>



<p>The Ethereum Name Service, or ENS, is a distributed technology based on the Ethereum blockchain that provides an elegant solution to long and confusing crypto addresses: one URL, just like a website name or email, that represents a crypto address.</p>





<p>ENS maps the long public address crypto users are familiar with and replaces it with a simple name that is easy to read and easy to remember. Something cumbersome like, “0xDC25EF3F5B8A186998338A2ADA83795FBA2D695E” becomes as simple as “Alice.eth.”</p>



<p>ENS takes the same concept of the Domain Name Service (DNS), which mapped simple website names to their IP addresses, to make crypto addresses easy to read and share.</p>



<h3 class="wp-block-heading"><strong>Quick facts</strong></h3>



<ul class="wp-block-list"><li>ENS is composed of two Ethereum smart contracts: the ENS registry, which records domain names, and the Resolver, which translates domain names to machine-readable addresses and vice-versa.</li><li>Like in the early days of DNS names, users are rushing to secure their ENS domains before they become unavailable.</li><li>ENS supports .com, .org, .io, .app and more.</li><li>Browsers currently supporting ENS include Brave, Opera, Status (mobile), MetaMask Mobile (mobile) and Puma.<strong> </strong>ENS will not work on a browser such as Chrome or Safari.</li></ul>



<h2 class="wp-block-heading"><strong>ENS vs. DNS</strong></h2>



<p>The Domain Name System and the Ethereum Name Service are both protocols that dictate how certain operations, either on Web2 or Web3, are resolved. The DNS converts the IP address of the web server into a human-readable string called a URL.</p>



<p>The Ethereum Name Service converts an Ethereum address into a human-readable string formatted like a URL. In this way, they both function similarly to a phonebook. You can look up a name in a phone book and get the number that will allow you to reach that person.</p>



<p>The DNS is part of a system of internet protocols that allow Web2 to work seamlessly. Web3, a concept describing the new decentralized version of the internet, is still a developing field and has issues that hinder adoption, such as long addresses.</p>



<p>Right now, the primary purpose of ENS is to give people and applications an easy way to read and share crypto addresses and make Web3 more digestible. As Web3 matures, it is likely more protocols will be built around ENS.</p>



<h2 class="wp-block-heading"><strong>How to get an ENS domain</strong></h2>



<p>Those who want to create a new ENS domain will need a crypto wallet, such as MetaMask, Torus or MEW, and some ether (ETH). From there, users can search for the domain of their choosing on <a href="https://app.ens.domains/">https://app.ens.domains/</a>.</p>



<p>The cost of a new ENS domain is at least $5, but users should expect to pay fees for the Ethereum transaction.</p>



<h2 class="wp-block-heading"><strong>ENS DAO&nbsp; </strong></h2>



<p>The ENS is operated by a decentralized autonomous organization (DAO), essentially an organization with no centralized leadership. The DAO governs itself through the ENS token — holders of the token submit proposals and cast votes for future development.</p>



<h2 class="wp-block-heading"><strong>What is the ENS governance token?&nbsp;</strong></h2>



<p>The ENS governance token is a token created on the Ethereum blockchain. They are traded by speculators, as are most crypto tokens, but the token also serves a specific role in the ENS community. ENS community members — as members of the DAO — use their tokens to communicate changes they wish to see in the organization.</p>



<p>For instance, later this year, the ENS community will <a href="https://docs.ens.domains/v/governance/ens-dao-constitution">vote</a> on the ENS Constitution — a set of rules and guidelines for how ENS should be governed. Each token can cast one vote. If 67% of votes cast on a particular article of the constitution are “yes” votes, then the article passes.</p>



<p>If a user wants to submit a proposal to the ENS community, they will need the support of 100,000 tokens for it to go to a vote.</p>



<p><strong>Users can vote on many things in the DAO, including:</strong></p>



<ul class="wp-block-list"><li>Executable proposals for a series of smart contract operations, such as allocating a portion of the liquid token pool to fund a grant for Web3 development.</li><li>Social proposals, carried out off-chain, such as appointing or removing a director, member or supervisor.</li><li>Constitutional amendments, which alter how ENS conducts its mission.</li></ul>



<h2 class="wp-block-heading"><strong>ENS token distribution&nbsp;</strong></h2>



<p>To <a href="https://ens.mirror.xyz/-eaqMv7XPikvXhvjbjzzPNLS4wzcQ8vdOgi9eNXeUuY">distribute</a> ENS tokens to the community, the developers allocated 25% of the ENS Token supply to users who had already signed up for an ENS domain by Oct. 31, 2021.</p>



<p>Token distribution:</p>



<ul class="wp-block-list"><li>Community treasury: 50%</li><li>Airdrop to .eth holders: 25%&nbsp;</li><li>ENS contributors: 25%</li></ul>



<p>The developers then airdropped these tokens to wallets connected to the ENS domains. Fractions of the ENS token pool were distributed based on how long a given user owned an ENS domain.</p>



<p>In practice, this means that many casual users received tens of thousands of dollars of tokens in the airdrop — while people who have held domains for many years received even more generous allocations.</p>



<h2 class="wp-block-heading"><strong>ENS foundation</strong></h2>



<p>The ENS Foundation is a legal entity that represents the DAO. This way the foundation can provide legal support to DAO participants.</p>



<p>The foundation has three directors — Nick Johnson, Brantly Millegan and Kevin Gaspar — who are also ENS core team members.</p>



<p>The ENS Foundation is a foundation company limited by guarantee and is incorporated in the Cayman Islands. It is a nonprofit and cannot pay out dividends to its directors or members. The Foundation itself has one supervisor, filled by a Cayman Islands firm, DS Limited.</p>



<p>For more transparency, a list of documents related to the ENS Foundation can be found <a href="https://docs.ens.domains/v/governance/the-ens-foundation">here.</a></p>



<h2 class="wp-block-heading"><strong>Ethereum Name Service vs. Unstoppable Domains</strong></h2>



<p>ENS is not the only domain name service provider competing for supremacy on Web3. There are several competitors, including Unstoppable Domains. Both Unstoppable and ENS are built on top of Ethereum and both allow users to create and register a human-readable address for crypto addresses.</p>



<p>However, there are some big differences in the philosophy underlying these projects. ENS is an open and public protocol developed by a nonprofit that is heavily focused on decentralization and community decision making.</p>



<p>Unstoppable Domains operates as a for-profit company, and many of its domains have been “brand protected” to prevent individuals from owning certain names, words or phrases. This practice has led to complaints where people have been unable to buy a domain with their name, despite the fact it is not in use, such as JohnSmith.domain.</p>



<h2 class="wp-block-heading"><strong>How to buy ENS</strong></h2>



<p>ENS tokens can be purchased at the following exchanges:</p>



<p><strong>Centralized</strong></p>



<ul class="wp-block-list"><li>Binance</li><li>Okex</li><li>FTX</li><li>ByBit</li></ul>



<p><strong>Decentralized</strong></p>



<ul class="wp-block-list"><li>Uniswap</li><li>SushiSwap</li><li>1Inch</li></ul>



<h2 class="wp-block-heading"><strong>Frequently asked questions</strong></h2>



<h4 class="wp-block-heading"><strong>What is the ethereum name service (ENS)?</strong></h4>



<p>Ethereum name service is a protocol that maps long crypto addresses to simple URLs. Instead of copying long crypto addresses, users can simply send crypto to domains such as “Alice.eth.”</p>



<h4 class="wp-block-heading"><strong>How much does an ENS domain cost?</strong></h4>



<p>ENS domains cost as little as $5 before ethereum transactions fees.&nbsp;</p>



<h4 class="wp-block-heading"><strong>Where can you buy ENS tokens?</strong></h4>



<p>ENS tokens can be bought at a number of different exchanges such as Binance, FTX and more.</p>



<h4 class="wp-block-heading"><strong>How much are ENS tokens?</strong></h4>


<p>[stock_market_widget type=&#8221;accordion&#8221; template=&#8221;chart&#8221; color=&#8221;#5B35D5&#8243; assets=&#8221;ENS-USD&#8221; start_expanded=&#8221;true&#8221; display_currency_symbol=&#8221;true&#8221; api=&#8221;yf&#8221; chart_range=&#8221;1mo&#8221; chart_interval=&#8221;1d&#8221;]</p>


DNS

Newsletter

Blockworks Research