How Hackers Use DNS Hijacking Attacks to Steal Funds and Clone Websites

This report catalogs a series of DNS hijacking incidents against Web3 projects where attackers obtained third-party registrar credentials (often via social engineering) to poison DNS records, redirect users to malicious frontends or RPC endpoints, and steal seed phrases or trick users into approving malicious contracts — resulting in millions in losses; it analyzes causes, provides case studies (CreamFinance, PancakeSwap, MM.Finance, Curve, SpiritSwap, QuickSwap, Convex, Ribbon, Polygon/Fantom via Ankr), and recommends mitigations such as decentralized frontends (IPFS + ENS), DNS best practices (DNSSEC, audits, monitoring), and improved human-security measures.