Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #12[disputed][awaiting moderator]in the summary

   “This incident is considered the earliest confirmed event in a six-week cluster of DeFi frontend hijacks in early 2026 that also struck HypurrFi (April 3) and CoW Swap (April 14).”

   reviewerThe Neutrl incident is the earliest confirmed event in a SIX-WEEK cluster of DeFi frontend hijacks, which also struck HypurrFi (April 3) and CoW Swap (April 14)The named endpoints in this sentence (Neutrl March 19 to CoW Swap April 14) span under four weeks. 'Six-week' appears to be an overstatement not supported by the cited field report or by the dates the page itself gives; 'four-week' is the figure actually supported by the named events.
   Proposed correction (not yet applied)

   This incident is considered the earliest confirmed event in a four-week cluster of DeFi frontend hijacks in early 2026 that also struck HypurrFi (April 3) and CoW Swap (April 14).
   citedweb3secnews.substack.com/p/the-fi-files-…ld-report-on-dns
2. #13[disputed][awaiting moderator]in section: Broader 2026 DeFi Frontend Hijack Cluster

   “Security researchers characterize the Neutrl incident as the earliest confirmed event in a six-week campaign targeting DeFi protocols through their web-layer infrastructure.”

   reviewerSecurity researchers characterize the Neutrl incident as the earliest confirmed event in a SIX-WEEK campaignSame underlying error as the summary occurrence; grouped under defect_group neutrl-cluster-duration.
   Proposed correction (not yet applied)

   Security researchers characterize the Neutrl incident as the earliest confirmed event in a four-week campaign targeting DeFi protocols through their web-layer infrastructure.
   citedweb3secnews.substack.com/p/the-fi-files-…ld-report-on-dns

No source the reviewer could reach confirms or contradicts the claim.

1. #3[unverifiable][awaiting moderator]in section: Incident Overview

   “The Neutrl team posted on X: "Out of an abundance of caution, please do not interact with the website until further updates are provided."”

   reviewerNeutrl's team posted on X: "Out of an abundance of caution, please do not interact with the website until further updates are provided."The general advisory (avoid interacting with the site) is corroborated across sources, but this specific verbatim quote could not be independently located; the primary cryptotimes.io article could not be fetched directly (anti-bot interstitial).
   citedwww.cryptotimes.io/2026/03/19/neutrl-def…frontend-hijack/

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in the summary

   “On March 19, 2026, DeFi protocol Neutrl experienced a suspected DNS hijack of its frontend domain, in which attackers allegedly social-engineered the protocol's DNS provider to redirect user traffic to a malicious interface targeting Permit2 wallet approvals.”

   reviewerThe Neutrl DNS hijack occurred on March 19, 2026Confirmed by three independent contemporaneous outlets dated/timestamped March 19, 2026. One aggregator site (smartcontractshacking.com) lists March 18, likely an off-by-one error on their part; the page's date is the better-supported one.
   citedwww.cryptotimes.io/2026/03/19/neutrl-def…frontend-hijack/www.cryptonewsz.com/neutrl-front-end-att…urgent-security/phemex.com/news/article/defi-protocol-ne…end-attack-67486
2. #2[confirmed][no action needed]in section: Incident Overview

   “approximately $170 million in TVL at the time”

   reviewerNeutrl had approximately $170 million in TVL at the time of the incidentMatches the TVL figure independently reported in Hypernative's protocol writeup.
   citedwww.cryptotimes.io/2026/03/19/neutrl-def…frontend-hijack/
3. #4[confirmed][no action needed]in section: Attack Vector: DNS Provider Social Engineering

   “the alleged attack method involved social engineering Neutrl's DNS provider rather than exploiting any technical software vulnerability”

   reviewerThe attack vector was social engineering of Neutrl's DNS provider, not a smart-contract exploitConsistent across all sources reviewed; infrastructure-layer compromise, no on-chain vulnerability implicated.
   citedwww.cryptonewsz.com/neutrl-front-end-att…urgent-security/web3secnews.substack.com/p/the-fi-files-…ld-report-on-dns
4. #5[confirmed][no action needed]in section: Attack Vector: DNS Provider Social Engineering

   “Independent security researcher 0xGroomLake was cited as collaborating with the Neutrl team on the investigation.”

   reviewerIndependent security researcher 0xGroomLake collaborated with the Neutrl team on the investigationCorroborated; not a fabricated attribution.
   citedwww.cryptonewsz.com/neutrl-front-end-att…urgent-security/www.cryptotimes.io/2026/03/19/neutrl-def…frontend-hijack/
5. #6[confirmed][no action needed]in section: Attack Vector: DNS Provider Social Engineering

   “Security commentator YAM, cited in reporting, recommended that DeFi protocols adopt enterprise-grade registrars such as Cloudflare, MarkMonitor, or AWS Route53, enable DNSSEC, and enforce hardware security key access locks on registrar accounts to prevent recurrence.”

   reviewerSecurity commentator YAM recommended Cloudflare, MarkMonitor, AWS Route53, DNSSEC, and hardware security keysConfirmed via search-indexed content of the cited article; direct fetch of the article was blocked by an anti-bot interstitial.
   citedwww.cryptotimes.io/2026/03/19/neutrl-def…frontend-hijack/
6. #7[confirmed][no action needed]in section: Attack Vector: DNS Provider Social Engineering

   “Two specific contract addresses were flagged as malicious by the team: 0x23f2741EaA0045038e9b52100CdcC890163dE53F and 0xa0Adf074056E41dfB892aFC69881E15073b384b9.”

   reviewerTwo malicious contract addresses were publicly flagged: 0x23f2741EaA0045038e9b52100CdcC890163dE53F and 0xa0Adf074056E41dfB892aFC69881E15073b384b9Confirmed at moderate confidence; could not do a byte-for-byte diff against the primary article due to an anti-bot block, but corroborating search snippets reproduce the same two addresses.
   citedwww.cryptonewsz.com/neutrl-front-end-att…urgent-security/
7. #8[confirmed][no action needed]in section: Immediate Response and Recovery

   “By March 21, 2026 — approximately two days after initial disclosure — Neutrl had completed a domain migration to new infrastructure (neutrl.finance for the landing page; app.neutrl.finance for the application), switched to a new DNS service provider, and unsuspended smart contracts.”

   reviewerBy March 21, 2026 Neutrl completed migration to neutrl.finance/app.neutrl.finance, switched DNS providers, and unsuspended contractsTimeline and substance confirmed by two independent outlets.
   citedphemex.com/news/article/neutrl-resumes-o…thijacking-68032www.panewslab.com/en/articles/019d0f98-3…ed3-35fdc6ef1292
8. #9[confirmed][no action needed]in section: Immediate Response and Recovery

   “The team confirmed that the protocol's net asset value and reserve assets are held in custodial wallets isolated via a custodial framework and over-the-counter settlement mechanism, which structurally insulated funds from the frontend compromise.”

   reviewerNeutrl's NAV/reserve assets are held in custodial wallets isolated via a custodial framework and OTC settlement mechanism, structurally insulating funds from the frontend compromiseThe page's phrasing matches its cited sources closely, including the sources' own inconsistent expansion of 'OES.' This is a source-level naming quirk, not a page-introduced error.
   citedwww.weex.com/news/detail/neutrl-dns-migr…hased-out-393585
9. #10[confirmed][no action needed]in section: Immediate Response and Recovery

   “the incident was classified among "non-financial" infrastructure attacks in a March 2026 crypto security summary by Cryip”

   reviewerCryip's March 2026 security report classified the Neutrl incident among 'non-financial' infrastructure attacksDirectly confirmed by the cited report's own section heading and text.
   citedcryip.co/march-2026-crypto-security-repo…orted-incidents/
10. #11[confirmed][no action needed]in section: Victim Framing and Attribution

    “Neutrl's NUSD is built on a deterministic, fully on-chain settlement design with Chainlink oracle integration, and Hypernative served as a real-time monitoring and automated pausing layer — a security posture independent of frontend DNS infrastructure.”

    reviewerNUSD uses a deterministic, fully on-chain settlement design with Chainlink oracle integration, and Hypernative provided real-time monitoring/automated pausingConfirmed via search-cached content; direct WebFetch of the URL intermittently 404'd, likely bot protection rather than a dead page (see coverage note in evidence_review/link handling).
    citedwww.hypernative.io/blog/how-neutrl-built…nitor-and-pauser
11. #14[confirmed][no action needed]in section: Broader 2026 DeFi Frontend Hijack Cluster

    “HypurrFi attributed its compromise to a social engineering attack on registrar Openprovider.”

    reviewerHypurrFi attributed its compromise to social engineering of registrar OpenproviderConfirmed; The Block's own article did not name the registrar, but corroborating outlets (Phemex, additional search-indexed coverage) do.
    citedphemex.com/news/article/hypurrfi-domain-…ing-attack-70843www.theblock.co/post/396336/hypurrfi-inv…lending-protocol
12. #15[confirmed][no action needed]in section: Broader 2026 DeFi Frontend Hijack Cluster

    “CoW Swap's post-mortem identified the attacker as having impersonated a senior CoW DAO contributor and submitted falsified identification to Traficom (Finland's .fi TLD authority), ultimately obtaining domain control through registrar Gandi; reported user losses from CoW Swap reached approximately $1.2 million.”

    reviewerCoW Swap's post-mortem: attacker impersonated a senior CoW DAO contributor, submitted falsified ID to Traficom, obtained control via registrar Gandi; ~$1.2M in user lossesFully corroborated by independent reporting.
    citedbingx.com/en/flash-news/post/cow-swap-re…ed-user-losses-mwww.theblock.co/post/397432/cow-swap-pau…domain-hijacking
13. #16[confirmed][no action needed]in the timeline

    “Web3SecNews publishes "The .fi Files" field report characterizing the Neutrl, HypurrFi, CoW Swap, and Steakhouse incidents as a coordinated campaign rather than isolated events.”

    reviewerWeb3SecNews published "The .fi Files" characterizing Neutrl, HypurrFi, CoW Swap, and Steakhouse as a coordinated campaignConfirmed, including publication date.
    citedweb3secnews.substack.com/p/the-fi-files-…ld-report-on-dns
14. #17[confirmed][no action needed]in the timeline

    “CoW DAO passes CIP-86, authorizing compensation for users who lost funds in the April 14 DNS hijack. No comparable compensation proposal recorded for the Neutrl incident, consistent with reports of no confirmed user losses.”

    reviewerCoW DAO passed CIP-86 on May 12, 2026 authorizing compensation for April 14 hijack victims; no comparable proposal exists for NeutrlFully confirmed by both the cited secondary source and the primary CoW DAO governance forum post.
    citedwww.cryptotimes.io/2026/05/12/cip-86-pas…or-april-attack/
15. #18[confirmed][no action needed]in section: Protocol Background

    “Neutrl raised $5 million in seed funding in April 2025, led by STIX and Accomplice, with participation from Amber Group, SCB Limited, Figment Capital, Nascent, and angel investors including Ethena founder Guy Young and derivatives trader Joshua Lim of Arbelos Markets.”

    reviewerNeutrl raised $5M seed funding in April 2025 led by STIX and Accomplice, with named participants and angelsFully and precisely confirmed by the primary CoinDesk article.
    citedwww.coindesk.com/business/2025/04/16/neu…nd-altcoin-trade
16. #19[confirmed][no action needed]in section: Protocol Background

    “Neutrl is a DeFi protocol launched publicly in November 2025 following a $75 million pre-deposit vault campaign.”

    reviewerNeutrl launched publicly in November 2025 following a $75 million pre-deposit vault campaignConfirmed via an independent source; the cited IQ.wiki page itself did not contain these specific figures when fetched, but the underlying fact is independently verified elsewhere. Note post-launch deposits grew further to ~$125M after caps were removed — not a contradiction, since the page's claim is specifically about the pre-deposit vault stage.
    citediq.wiki/wiki/neutrl
17. #20[confirmed][no action needed]in section: Protocol Background

    “CEO and co-founder Behrin Naidoo has a background in investment banking and digital assets, with prior positions at J.P. Morgan, RMI, and RMH, and holds a Master's in Finance from London Business School.”

    reviewerCEO Behrin Naidoo had prior positions at J.P. Morgan, RMI, and RMH, and holds a Master's in Finance from London Business SchoolConfirmed; 'RMH' is a legitimate market abbreviation for RMB Holdings, not an error. The cited IQ.wiki page itself did not contain bio detail when fetched, but the underlying facts are independently corroborated.
    citediq.wiki/wiki/neutrl
18. #21[confirmed][no action needed]in section: Protocol Background

    “Neutrl targeted $2 billion in assets under management within two years of its 2025 launch.”

    reviewerNeutrl targeted $2 billion in AUM within two years of its 2025 launchConfirmed via independent source; not directly verifiable on the cited IQ.wiki page as fetched, but corroborated elsewhere.
    citediq.wiki/wiki/neutrl
19. #22[confirmed][no action needed]in the timeline

    “Neutrl opens to the public following completion of a $75 million pre-deposit vault campaign; NUSD becomes broadly accessible.”

    reviewerNeutrl opened to the public in November 2025 (timeline entry)Consistent with independent reporting; exact day (Nov 10) is more precise than the stored month-level date, which is not an error, just lower precision.
    citediq.wiki/wiki/neutrl
20. #23[confirmed][no action needed]in the timeline

    “HypurrFi reports a domain hijack of hypurr.fi attributed to social engineering at registrar Openprovider — the second confirmed event in the 2026 DeFi frontend hijack cluster.”

    reviewerHypurrFi's hypurr.fi hijack occurred April 3, 2026 (second confirmed cluster event)Date and characterization confirmed.
    citedwww.theblock.co/post/396336/hypurrfi-inv…lending-protocol
21. #24[confirmed][no action needed]in the timeline

    “CoW Swap's cow.fi domain is hijacked at 14:54 UTC via social engineering of registrar Gandi through Traficom (Finland's .fi TLD authority). Approximately $1.2 million in user losses reported.”

    reviewerCoW Swap's cow.fi domain was hijacked April 14, 2026 at 14:54 UTC via Gandi/Traficom social engineering, ~$1.2M lostTime, mechanism, and loss figure all independently confirmed.
    citedwww.theblock.co/post/397432/cow-swap-pau…domain-hijacking