EasyDNS Accepts Responsibility for eth.limo Hijack in First Social Engineering Breach in 28 Years

DNS provider EasyDNS confirmed responsibility for the eth.limo domain hijack on April 17-18, marking its first successful social engineering attack in 28 years after an attacker impersonated an eth.limo team member to gain account access. The attacker switched eth.limo's nameservers twice between 2:23 a.m. and 3:57 a.m. EDT before EasyDNS restored legitimate access at 7:49 a.m. However, DNSSEC protections prevented any actual traffic redirection because the attacker never obtained eth.limo's cryptographic signing keys, causing resolvers to return SERVFAIL errors instead of malicious responses. The incident affects a service providing browser access to roughly 2 million ENS domains and follows similar DNS hijacks at Aerodrome, Velodrome, Steakhouse Financial, and Neutrl that collectively drained over $700,000 from users. EasyDNS will migrate eth.limo to Domainsure, an enterprise service without account recovery mechanisms, while Vitalik Buterin advocates for reducing Ethereum's dependence on centralized DNS by 2026.

Social engineering attack and timeline of the eth.limo hijack

• ▪An attacker impersonated an eth.limo team member to trick registrar EasyDNS into running an account recovery process at 7:07 p.m. EDT on April 17.
• ▪The attacker flipped eth.limo's nameservers to Cloudflare at 2:23 a.m. EDT on April 18.
• ▪The eth.limo nameservers were switched to Namecheap at 3:57 a.m. EDT on April 18.
• ▪The eth.limo wildcard DNS record at *.eth.limo covers roughly 2 million .eth domains registered through ENS.
• ▪EasyDNS restored the eth.limo team's account access at 7:49 a.m. EDT on April 18.

DNSSEC protection prevented widespread damage

• ▪Vitalik Buterin confirmed on Saturday that the eth.limo situation was all resolved.

EasyDNS response and accountability measures

• ▪Mark Jeftovic declined to detail exactly how the attacker fooled the EasyDNS support process, citing an ongoing internal post-mortem.
• ▪Mark Jeftovic apologized to the eth.limo team and the wider Ethereum community on behalf of EasyDNS.
• ▪EasyDNS CEO Mark Jeftovic stated the eth.limo incident marked the first successful social engineering attack against an EasyDNS customer in the firm's 28-year history.

Pattern of DNS hijacks targeting crypto platforms

• ▪Yield platform Neutrl suffered a DNS hijack incident in March 2025.
• ▪Vitalik Buterin declared in January that 2026 should be the year developers reverse Ethereum's dependence on centralized DNS resolution by pushing users toward direct IPFS access paths.
• ▪Steakhouse Financial disclosed a DNS hijack incident on March 30 after OVH support staff were socially engineered into removing two-factor authentication from its account.
• ▪eth.limo provided whiteglove support to the Aerodrome team during the November hijack.
• ▪DNS hijacks of decentralized exchanges Aerodrome and Velodrome in November drained more than $700,000 from users after attackers compromised an account at registrar NameSilo.
• ▪Attackers stripped DNSSEC from the Aerodrome and Velodrome domains during the November hijacks.

Perspective of EasyDNS

• ▪The eth.limo hijack represented EasyDNS's first successful social engineering attack in 28 years of operation.
• ▪EasyDNS will migrate eth.limo to Domainsure, which offers no account recovery mechanism to prevent similar social engineering attacks.

Perspective of eth.limo team

• ▪eth.limo serves as a critical bridge allowing roughly 2 million ENS domains to be accessed through standard browsers.

Perspective of Vitalik Buterin

• ▪Vitalik Buterin advocates for pushing users toward direct IPFS access paths instead of DNS-based gateways.
• ▪Vitalik Buterin believes 2026 should be the year Ethereum reverses its dependence on centralized DNS resolution.

1 source