Multiple Cryptocurrency Firms Fall Victim to Squarespace Domain Hijacking

Multiple firms — including several cryptocurrency-related organizations — had domains hijacked following Squarespace’s acquisition and migration of Google Domains assets; attackers exploited a migration/registration weakness that allowed them to register Squarespace accounts using email addresses at recently-migrated domains (with no email verification and no password set) and thereby gain control of domains, sometimes redirecting them to phishing sites to steal funds. Researchers from MetaMask and Paradigm detailed the flaw, highlighted the lack of audit/logging and disabled MFA during migration, and provided guidance for affected users (enable MFA, remove unused accounts and reseller access, and test account access).