Curve Finance has warned users not to interact with its website after its domain was hijacked for the second time in a week. The team says smart contracts remain secure, but the DNS now points to a malicious site that could drain user wallets. Security firm Blockaid suspects a front-end attack and advises users not to sign any transactions.
Late last night, the curve [.] fi domain was compromised at the DNS level. This exploit redirected traffic to a malicious IP not associated with Curve Finance. No smart contracts or internal systems were breached—the protocol itself remains fully operational and secure.
User…
— Curve Finance (@CurveFinance) May 13, 2025
Toncoin 
USDS 
Coinbase Wrapped BTC 
Pepe 
Bittensor