DNS hijacks target crypto platforms registered with Squarespace

A coordinated DNS hijacking campaign has targeted multiple DeFi and cryptocurrency domains that were migrated from Google Domains to Squarespace, redirecting users to phishing pages hosting wallet-draining malware. Major projects including Compound Finance, Celer Network, Pendle and Unstoppable Domains reported redirects and urged users to revoke approvals, change credentials, and avoid affected sites; investigators suspect the compromise is tied to the migration process (disabled MFA and automatic account/reseller access) and mitigation and investigations are ongoing.