Neutrl DeFi DNS Frontend Hijack (March 2026)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·58rsAP…PxebSummary
On March 19, 2026, DeFi protocol Neutrl experienced a suspected DNS hijack of its frontend domain, in which attackers allegedly social-engineered the protocol's DNS provider to redirect user traffic to a malicious interface targeting Permit2 wallet approvals. Neutrl paused its smart contracts as a precaution, migrated to new infrastructure by March 21, and confirmed all user funds remained safe via the protocol's custodial isolation framework. This incident is considered the earliest confirmed event in a six-week cluster of DeFi frontend hijacks in early 2026 that also struck HypurrFi (April 3) and CoW Swap (April 14).
Connected Entities
6 entities · 60 linked investigations- Ethena→mentioned with→Ethereum(75%)
- Chainlink→mentioned with→Ethereum(65%)
- Neutrl→mentioned with→Chainlink(60%)
- Neutrl→mentioned with→Ethena(65%)
- Neutrl DeFi DNS Frontend Hijack (March 2026)→mentioned with→CoW Swap (CoW Protocol)(80%)
- Neutrl DeFi DNS Frontend Hijack (March 2026)→mentioned with→Chainlink(60%)
- Neutrl DeFi DNS Frontend Hijack (March 2026)→mentioned with→Ethena(65%)
- Neutrl DeFi DNS Frontend Hijack (March 2026)→mentioned with→Neutrl(80%)
- Neutrl DeFi DNS Frontend Hijack (March 2026)→mentioned with→Ethereum(65%)
- CoW Swap (CoW Protocol)→mentioned with→Ethereum(65%)
Timeline(8 events)
16 April 2025
Neutrl raises $5 million in seed funding led by STIX and Accomplice, with participation from Amber Group, SCB Limited, Figment Capital, Nascent, Guy Young (Ethena founder), and Joshua Lim (Arbelos Markets).
CoinDeskNovember 2025
Neutrl opens to the public following completion of a $75 million pre-deposit vault campaign; NUSD becomes broadly accessible.
IQ.wiki19 March 2026
Neutrl DeFi detects a malicious event affecting its frontend, attributed to a suspected DNS hijack via social engineering of the protocol's DNS provider. Smart contracts are paused as a precaution. Users warned not to interact with the website. Investigation launched with external collaborator 0xGroomLake. Malicious contract addresses 0x23f2741EaA0045038e9b52100CdcC890163dE53F and 0xa0Adf074056E41dfB892aFC69881E15073b384b9 flagged publicly.
Crypto Times21 March 2026
Neutrl completes DNS migration to new domain (neutrl.finance / app.neutrl.finance), switches to a new DNS provider, unsuspends smart contracts, and confirms all user funds are safe. Original domain (neutrl.fi) begins gradual phase-out.
PANews / WEEX Crypto News3 April 2026
HypurrFi reports a domain hijack of hypurr.fi attributed to social engineering at registrar Openprovider — the second confirmed event in the 2026 DeFi frontend hijack cluster.
The Block14 April 2026
CoW Swap's cow.fi domain is hijacked at 14:54 UTC via social engineering of registrar Gandi through Traficom (Finland's .fi TLD authority). Approximately $1.2 million in user losses reported.
The Block15 April 2026
Web3SecNews publishes "The .fi Files" field report characterizing the Neutrl, HypurrFi, CoW Swap, and Steakhouse incidents as a coordinated campaign rather than isolated events.
Web3SecNews (Substack)12 May 2026
CoW DAO passes CIP-86, authorizing compensation for users who lost funds in the April 14 DNS hijack. No comparable compensation proposal recorded for the Neutrl incident, consistent with reports of no confirmed user losses.
Crypto TimesDecision Log
- slot 451894744 · hash H9kgem8jUuvgSYEEUCjqL7eRzty72BDLoeSR4cN8tA5E
- slot 424513241 · hash 8FtBxQZSnaUACf6eoXTpXPtkpXn1sZbeh8qubjELzjQS
- slot 424513237 · hash GzHVWRoAWpvPnxtamaU7f5ZyL6dySN91W81c2WsxtjdB
- slot 423881784 · hash 6sPTVaAtnCf5j5UCc2iDuCnDNuepwKrea6SbM2MJ5Cuf
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 17 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/2/2026, 8:26:13 PM
last updated: 6/2/2026, 8:26:14 PM
11 viewsavoid.net — verified advice for a post-truth world