When the real site is the attack: DeFi frontend hijacks

Most crypto scams rely on a fake site: a lookalike domain, a cloned design. But some of the most damaging incidents in DeFi happened on the real domain. The address bar was correct, the padlock was there — and the page was still stealing.

How a real site turns hostile

• DNS hijack. Attackers compromise the registrar or DNS provider and point the real domain at their server. Visitors type the right address and land on a drainer.
• Compromised hosting or deploy keys. The attacker pushes a malicious version of the site through the project's own pipeline.
• Poisoned dependencies. A hacked JavaScript library or analytics tag injects wallet-draining code into a site that did nothing wrong.

In every case, the smart contracts are untouched — the attacker only needs to change what your browser asks your wallet to sign. The swap you think you're making is swapped out for an approval to the attacker's address.

Why the usual advice fails here

"Check the URL" doesn't help — the URL is genuine. "Look for the padlock" doesn't help — the connection is encrypted, straight to the attacker. This is why frontend incidents are so scary: they break the one check most careful users rely on. What still works is checking what you're signing, not where you're signing it.

Your defences

• Read every wallet prompt. A swap page asking for an unlimited approval on a token you're not trading, or a blind signature, is a red flag — on any domain.
• Check official channels during weirdness. If a familiar site suddenly behaves oddly, look at the project's verified account — teams usually acknowledge an incident within minutes.
• Prefer exact-amount approvals so a hijacked frontend can take at most what you meant to trade.
• Keep a separate "vault" wallet that never connects to dapps, so a bad signature can't reach your savings.

Where CapyGuard helps

Domain checks can't catch a hijacked real domain — so CapyGuard doesn't stop at domains. It watches the wallet requests themselves and pauses the dangerous ones — unlimited approvals, setApprovalForAll, Permit signatures, unusually large sends — wherever they come from, including sites on the trusted list. When the padlock lies, the transaction prompt is your last line of defence, and CapyGuard makes sure you actually get to read it.