Hijacked at the registry: 26 hours without our domain

Most DeFi teams harden contracts, cloud accounts and DNS, yet a domain can still be taken through the administrative layer above them. This talk reconstructs the cow.fi registry-level hijack: how forged identity documents and a registrar transfer redirected users to a wallet drainer while our AWS account, DNS zone, frontend, contracts and keys remained untouched.

Attendees will learn how to distinguish a registry hijack from a DNS or cloud breach, which signals shorten detection, and which controls would or would not help including DNSSEC, CAA, transfer locks and RegistryLock. We will also share a practical response model for operating when your website and cow.fi email addresses are unreachable: fallback domains, out-of-band communications, registrar escalation and recovery checks.

This matters now because DeFi frontends remain trusted gateways to immutable protocols, while registries and registrars are centralized dependencies that most threat models and incident drills ignore.

Speakers: Anuj Bansal, Nuno Anselmo

Track: Security