What Is DNS Hijacking and How Does It Redirect a Legitimate DeFi Site to a Phishing Page?

05 November 2026

DNS hijacking is a type of attack where a criminal gains control of a domain's DNS settings and silently redirects visitors from the real website to a fake copy. On a DeFi site, this means you type the correct URL, see what looks like the normal interface, connect your wallet, and sign a transaction that drains your funds. The attack works before you ever see a warning because the browser shows the real domain name in the address bar.

How DNS normally works

The Domain Name System (DNS) is the phonebook of the internet. When you type app.uniswap.org into your browser, your device asks a DNS server: "What is the IP address for this domain?" The DNS server replies with a number like 104.16.249.249, and your browser connects there.

DNS hijacking replaces that answer. Your device asks for the IP of the real site, and the compromised DNS server returns the IP of a phishing server instead. Your browser then loads the fake page, but the address bar still shows app.uniswap.org. There is no typo, no suspicious subdomain, and no browser warning.

How attackers gain control of DNS

There are several methods, and they all share one result: the attacker changes the DNS records at the domain registrar or hosting provider.

Compromised Registrar Account

The most common route. The attacker obtains the password to the domain owner's account at the registrar (such as GoDaddy, Namecheap, or Cloudflare). This can happen through: - A phishing email targeting the domain owner or their team - Password reuse from a previous data breach - A SIM swap attack that intercepts password reset codes

Once inside, the attacker changes the "A record" or "nameserver" entries to point the domain to their own server.

Exploited DNS Provider

Less common but more dangerous. The attacker finds a vulnerability in the DNS provider itself - a bug that lets them change records without logging into any account. These are rare but have occurred at major providers.

Man-in-the-Middle on public wi-fi

A local attack. The attacker intercepts DNS queries on an unsecured Wi-Fi network (airport, coffee shop) and returns fake IP addresses. This only affects users on that network, not the entire domain. It is technically DNS spoofing rather than hijacking, but the effect on the victim is identical.

What the victim sees

The victim navigates to the legitimate DeFi site as usual. The page loads, but it is a perfect replica hosted on the attacker's server. The replica includes: - The correct logo, fonts, and layout - A working "Connect Wallet" button - Legitimate-looking transaction prompts

The victim connects their wallet, sees the expected interface, and initiates a transaction. The fake site intercepts this and presents a malicious approval request. If the victim signs it, the attacker gains permission to move tokens from the victim's wallet.

How long the attack lasts

Duration depends on the method:

• Compromised account: The attacker controls the DNS until the domain owner notices and changes the password. This can be hours to days. Some attackers set DNS records with a long TTL (time to live), so even after the records are corrected, cached copies on user devices continue pointing to the phishing site for hours.
• Exploited provider: The provider patches the bug, which may take hours or weeks depending on the severity.
• Local Wi-Fi attack: Ends when the victim leaves the network.

How to detect DNS hijacking

You cannot rely on the address bar. You must verify the connection independently.

Check the SSL certificate

A phishing site may use a valid SSL certificate for the domain if the attacker controls DNS. However, the certificate details may differ. Click the padlock icon in the address bar and view the certificate. If the issuer or subject looks unusual, investigate.

Use a secondary DNS resolution

After connecting to the site, use a different device on a different network to resolve the same domain. Use a command-line tool like nslookup or dig. If the IP addresses differ, something is wrong.

Monitor domain registrar status

Some registrars send email alerts when DNS records change. If you are the domain owner, watch for these. If you are a user, you cannot receive these alerts, but you can check the domain's DNS history using third-party tools that record past DNS resolutions.

Verify the site's smart contract address

Legitimate DeFi sites display their crypto-scams-taxonomy/honeypot-token-unsellable-contract/">smart contract addresses. Cross-reference this address on a block explorer like Etherscan. If the site shows a different address than what appears on the explorer, do not interact with it.

What to do if you suspect hijacking

1. Do not connect your wallet.
2. Close the browser tab.
3. On a different device or network, check the domain's DNS records using a public DNS lookup tool.
4. If the records appear tampered with, contact the domain owner through a channel other than the website - email, social media, or a community forum.
5. If you already connected your wallet and signed any transaction, revoke token approvals immediately using a revoke tool.

Why defi sites are targeted

DeFi sites involve high-value, irreversible transactions. A single successful hijack can drain dozens or hundreds of wallets before the attack is discovered. Unlike a bank website, there is no central authority to reverse the transactions or freeze the funds. The attacker can move stolen tokens through mixers or bridges within minutes.

Prevention for Users

• Use a hardware wallet that displays transaction details on its screen. If the hardware wallet shows a different contract address than what the browser displays, do not sign.
• Bookmark the exact URL of every DeFi site you use. Do not navigate from search results, ads, or links in messages.
• Use a trusted DNS resolver such as Cloudflare's 1.1.1.1 or Google's 8.8.8.8 instead of your ISP's default.
• Avoid conducting DeFi transactions on public Wi-Fi.

Prevention for site owners

• Enable two-factor authentication on your registrar account, using an authenticator app, not SMS.
• Use a registrar that locks DNS records and requires manual unlocking before changes.
• Monitor DNS records with automated tools that alert you to unauthorized changes.
• Set short TTL values on DNS records so that if a hijack occurs, reverting the records takes effect quickly.

Back to crypto scams