Decentralized finance (DeFi) protocol Curve Finance has warned that a hacker has again hijacked its domain name system (DNS), sending users to a malicious website.  

In the second attack on its infrastructure in a week, the “curve.fi DNS might be hijacked. Don’t interact!” the team said in a May 12 warning to X.

In a follow-up post to a user asking whether it was a hack or a hijack, the Curve Team said the website “Points to the wrong IP” when users try to visit. A DNS works like a directory that translates domain names into IP addresses. 

Source: Curve Finance

The team also said in another update that the “Password is secure,” its two-factor authentication was set up a “long time ago,” and a question has been sent to the “registrar now.”

”While all smart contracts are safe, the domain name points to a malicious site which can drain your wallet! We are investigating and working on recovering the access. No sign of a compromise on our side,” Curve said.

Curve Finance was hit with a similar front end attack in August 2022. In a post-mortem,  the consensus was that the attackers managed to clone the Curve Finance website and reroute the DNS server to the fake page.

Users who attempted to use the platform had their funds drained into a pool operated by the attackers.

Cointelegraph has contacted Curve Finance for comment.

Curve Finance potential front-end attack

Onchain security firm Blockaid also detected unusual activity from the Curve website recently, warning users to stay away and avoid interacting for now.

It could be a case of a “potential frontend attack,” according to the security firm, which is when hackers target the part of the website users interact with, such as the buttons, forms, or text on the site, to steal sensitive data.

Source: Blockaid

“If you’re connected, please refrain from signing transactions and avoid interactions with the DApp until the issue is resolved. We’re working closely with affected partners. More updates soon,” Blockaid said.

Related: Crypto hackers hit DeFi for $92M in April as attacks double from March

Second attack in a week

This is the second time Curve Finance has been targeted in the last week. On May 5, a hacker took over its official X handle.

“To clarify: the incident was limited strictly to the X account. No other Curve accounts were affected. No security issues were found on our side, no user funds were impacted, and there were no victims of phishing links that the hacker posted,” the team said in a follow-up May 6 post. 

Source: Curve Finance

Access to the Curve Finance X account was restored quickly, and the cause is still under investigation.

A slew of other high-profile X accounts have also been taken over by bad actors this year. On May 2, the Tron DAO account was hijacked; meanwhile, on April 15, a member of the UK’s Parliament, Lucy Powell, had her account taken over to promote a scam crypto token called the House of Commons Coin (HOC).

Magazine: Financial nihilism in crypto is over — It’s time to dream big again

The list of the top holders of US President Donald Trump’s memecoin has been finalized ahead of background checks to apply for a dinner and “VIP tour” with the president on May 22.

In a May 12 X post, the TRUMP memecoin project said it would stop considering additional purchases for a dinner with the president, adding that the top tokenholders had been notified to apply for background checks if they wanted to attend.

According to data provided on the project’s leaderboard, the top 220 wallets held more than 13.7 million tokens as of May 12, worth roughly $174 million at the time of publication.

Top 10 TRUMP memecoin holders as of May 12. Source: TRUMP memecoin project

It’s unclear who, if any, of the wallet holders will choose to apply for and attend the dinner with Trump, or the “exclusive reception” expected to be in the White House for the top 25 holders, on May 22. A May 7 Bloomberg report suggested that the majority of tokenholders were based outside of the United States, leading to potential security concerns and conflicts of interest.

Many US lawmakers and figures in the crypto industry criticized the president for launching the memecoin just days before taking office on Jan. 20. In the wake of his dinner announcement on April 23, the calls for congressional oversight and allegations of corruption have intensified, with one senator calling for Trump’s impeachment and other representatives refusing to consider crypto-related legislation until their concerns were addressed.

Related: FT report suggests advance knowledge of Melania Trump memecoin launch

Companies also apparently seeking influence over Trump’s policies have invested in the memecoin. In April, Freight Technologies said it would invest $20 million in the token, suggesting that it could affect the president’s trade war between the US and Mexico, where the firm conducts some of its business. As of May 12, the company had not announced whether it qualified to send a representative to the dinner.

Not Trump’s first appeal to crypto users

During his 2024 campaign, Trump hosted a dinner with supporters who purchased his “mugshot” non-fungible tokens, which featured a picture of the then-presidential candidate at his surrender to authorities on charges he attempted to overturn the 2020 election.

Many of the “mugshot” attendees publicly shared their identities on social media ahead of and during the event, but at the time of publication, no one appeared to be claiming they would apply for the memecoin dinner. Wallets with the usernames “Sun” and “elon” have led to speculation that Tron founder Justin Sun and Tesla CEO Elon Musk — both Trump supporters who have financial interests tied to Trump’s presidency — could be among the attendees.

Magazine: Trump’s crypto ventures raise conflict of interest, insider trading questions

Aave, a decentralized finance (DeFi) protocol, has reached a new record of funds onchain, according to data from DefiLlama.

In an X post, Aave said it topped $40.3 billion in total value locked (TVL) on May 12. Onchain data reveals that Aave v3, the latest version of the protocol, has approximately $40 billion in TVL.

Aave is a DeFi lending protocol that lets users borrow cryptocurrency by depositing other types of cryptocurrency as collateral. Meanwhile, lenders earn yield from borrowers. 

“With these milestones, Aave is proving its dominance in the Lending Space,” DeFi analyst Jonaso said in a May 12 X post. TVL represents the total value of cryptocurrency deposited into a protocol’s smart contracts. 

Aave v3’s TVL over time. Source: DeFiLlama

Related: AAVE soars 13% as buyback proposal passes among tokenholders

Breaking all-time highs

In December, Aave achieved an all-time high TVL largely because the price of Ether (ETH) rose roughly 60% from the prior month. Ether and its staking derivatives make up nearly half of Aave’s TVL, according to data from DefiLlama. 

This time around, Aave’s all-time high TVL is also driven by inflows of deposits by users. 

In Ether-denominated terms, Aave’s TVL rose from around 6 million ETH at the start of 2025 to nearly 10 million ETH on May 12. Measuring TVL in ETH accounts for the impact of fluctuating cryptocurrency prices.

Aave says its net deposits broke $40 billion this week. Source: Aave

Before US President Donald Trump prevailed in the November election, Ether traded at less than $2,500. It peaked at almost $4,000 the following month, according to data from Google Finance. 

In the past month, Ether has also clocked substantial gains, rising from around $1,500 per Ether 30 days ago to roughly $2,500 as of May 12, according to data from Google Finance. 

The price of Aave’s native AAVE (AAVE) token has risen approximately 25% in the past seven days, reflecting a buoyant crypto market and ongoing TVL inflows, according to data from CoinMarketCap.

Magazine: Adam Back says Bitcoin price cycle ’10x bigger’ but will still decisively break above $100K