dYdX Exchange Recovers from $31K Loss After Squarespace Account Hack

On July 23rd, dYdX, a leading crypto exchange, faced a security incident when its version 3.0 website was compromised. This breach led to a temporary shutdown and a loss of approximately $31,000. Let’s dive into the details of what happened, how dYdX responded, and what measures are being taken to prevent future incidents.

What Happened? The dYdX Squarespace Account Hack

According to dYdX’s detailed postmortem, the breach stemmed from a social engineering attack targeting their Squarespace account. Here’s a breakdown of the timeline:

• Domain Migration: Squarespace acquired domains from Google Domains in 2023, and the dydx.exchange domain was migrated on June 15, 2024.
• Initial Attack (July 9): Attackers gained access and changed DNS nameservers to DDoS-Guard. DNSSEC settings initially mitigated the impact.
• Second Attack (July 23): Attackers bypassed security measures, changed DNS settings, and hosted a malicious site, tricking users into transferring funds.

During the two-hour hijacking, two users lost a combined $31,000. dYdX is actively working to compensate these users.

How Did the Attackers Gain Access?

The postmortem revealed a critical vulnerability: human error during an account recovery process on Squarespace. The attacker, using an email address similar to dYdX’s billing administrator, bypassed 2FA and modified the account email without proper verification. Squarespace customer service failed to contact other listed admins before making these changes, enabling the takeover.

dYdX’s Response and Recovery

dYdX took swift action to address the breach:

• Domain Transfer: They transferred their domain registration to Cloudflare for enhanced security, completing the process within six hours.
• Collaboration: dYdX worked with SEAL and other partners to block malicious sites on popular crypto wallets like Metamask and Phantom.
• User Communication: They advised users to clear their browser cache and restart their browsers to avoid accessing the compromised site.

dYdX confirmed that the incident did not affect their smart contracts, backend systems, or the dYdX Chain.

Lessons Learned and Future Security Measures

The dYdX team is implementing several measures to prevent similar attacks in the future:

• Domain Registrar Change: Switching to Cloudflare is a key step.
• Enhanced Monitoring: Increased vigilance over domain settings and account access.
• Partnerships: Continued collaboration with security firms like SEAL to identify and mitigate threats.

What Can You Do to Stay Safe?

As a user, here are some steps you can take to protect yourself:

• Verify URLs: Always double-check the website address before interacting with any crypto platform.
• Clear Cache: Regularly clear your browser cache to ensure you’re accessing the correct site.
• Enable 2FA: Use two-factor authentication on all your accounts.
• Stay Informed: Keep up-to-date with security alerts from the platforms you use.

In Conclusion: A Wake-Up Call for Crypto Security

The dYdX Squarespace account hack serves as a crucial reminder of the importance of robust security measures in the crypto space. While dYdX acted quickly to contain the damage and is taking steps to prevent future incidents, this event highlights the ongoing need for vigilance and collaboration across the industry to protect users and their assets. Always stay informed, be cautious, and prioritize your online security.