Background

In 2023, Squarespace acquired the rights to all domains from the now-defunct Google Domains. All domains were migrated over a period of months. The domain dydx.exchange, owned by dYdX Trading, was migrated from Google Domains to Squarespace on June 15, 2024.

OAuth Weakness

On July 9, while registered with Squarespace, attackers gained access to the dydx.exchange domain, and modified the the DNS Nameservers from Cloudflare to DDoS-Guard. This attack was mitigated by DNSSEC settings that remained set on the registrar. This resulted in would-be-visitors’ browsers failing to authenticate the DNS changes, and correctly blocking users from viewing the page.

dYdX promptly contacted Squarespace customer service during this incident and they restored access to the account quickly according to their account-recovery policies. dYdX ensured that all passwords and 2FA were rotated on Squarespace accounts and that the attacker’s access was fully removed. The attack was completely mitigated and fixed within a couple of hours.

Two days later on July 11, several additional reports of targeted attacks on crypto-specific domains — which had been migrated from Google Domains to Squarespace — were reported. As a result, SEAL, a crypto-focused security team, put together an incident-response team to figure out what was going on, how the attack could be mitigated, and how to get any relevant information to Squarespace itself. At this point, dYdX realized that the earlier incident was likely part of a broader attack against crypto domains, and assisted the investigators. At this time, dYdX also continued to monitor the dydx.exchange domain for any suspicious activity.

On July 14, SEAL published a postmortem on the issue based on their findings, but without much direct information from Squarespace. This postmortem suggested that there were one-or-more technical vulnerabilities in Squarespace that allowed for these attacks to happen.

On July 18, Squarespace posted a longer postmortem which confirmed an exploited security issue with OAuth logins on their site. It included information that the issue was fixed on July 12.

While dYdX decided to change domain registrars, dYdX believed that Squarespace had successfully mitigated the attack and fixed the vulnerability.

Account-Recovery Attack

On July 23, it was discovered that the dydx.exchange domain was compromised. The attacker changed the DNS Nameservers from Cloudflare to DDoS-Guard. The attacker also successfully removed the DNSSEC settings on the domain. dYdX immediately contacted Squarespace customer support. Squarespace was able to return possession of the domain as well as fix the DNS Nameserver resolution within a couple of hours. The recovery process was delayed for over 30 minutes due to maintenance from one of Squarespace’s third-party vendors which prevented changing the DNS Nameservers back to Cloudflare.

The attacker hosted a malicious site which requested that any connected wallets transfer ETH and other ERC20 tokens to the attacker’s Ethereum address. During this time, dYdX also worked with SEAL and other partners to ensure that popular crypto wallets like Metamask and Phantom would block the site for the duration of the attack. To our knowledge at the time of publishing, 2 users were affected with approximately $31,000 in lost funds due to this attack. dYdX trading is in contact with both affected users and is assisting in securing their wallets and is committed to recovering funds.

Upon recovery, it was noted that the new email admin of the domain had somehow been set to the attacker’s email address, ending in outlook.com. All other admin accounts had been removed by the attacker. We noted that the attacker’s email address has a username similar to the legal name of the billing administrator on dYdX’s Squarespace account. This tipped dYdX off to the possibility of a social-engineering attack since the attacker chose specifically to use a human-believable email address.

In communications with Squarespace, it was revealed that the cause of the takeover was due to a human-initiated reset by Squarespace’s customer service, confirming our suspicions of a social-engineering attack. Each of the domain admin accounts were secured with 2FA, however this control was bypassed by Squarespace’s account-recovery process. Before removing 2FA and modifying the account’s email to that of the attacker, Squarespace customer service did not attempt to reach out to any other listed admins on the dydx.exchange domain.

Based on the information provided to us by Squarespace, we don’t believe that the attacker provided customer service with any valid security credentials. The attacker did not have access to any current or previous domain admin email, password, or 2FA.

Securing the Domain

As a result of Squarespace’s OAuth vulnerability, as well as their account-recovery protocols, two separate domain takeovers with different attack vectors were carried out against the dydx.exchange domain.

As a security measure, dYdX moved the domain registration to Cloudflare on July 24. While Squarespace documentation notes that domain transfers may take up to 15 days, we worked directly with Squarespace to accelerate this process and completed the transfer within 6 hours.

For clarity, no security issues with smart contracts, backend systems, or other company-associated accounts were found as a result of either incident. No issues with dYdX Chain were created by either incident.