Crypto Gateway eth.limo Falls Victim to Social Engineering Attack Despite Modern Security

Key Takeaways

Table of Contents

A hacker successfully impersonated eth.limo staff to manipulate EasyDNS support into granting unauthorized account control
Domain nameservers were modified twice during a five-hour window between 2am and 4am on April 18
The deployment of DNSSEC prevented actual user compromise by invalidating the attacker’s unauthorized DNS modifications
EasyDNS leadership issued a public statement acknowledging their first social engineering security failure across 28 years of operation
The Ethereum gateway service plans to transition to Domainsure, which eliminates account recovery vulnerabilities

A sophisticated social engineering operation successfully compromised the domain infrastructure of eth.limo, an Ethereum Name Service gateway, late Friday evening after manipulating customer support personnel at domain registrar EasyDNS.

🚨UPDATE: @eth_limo confirms a DNS hijack after attackers compromised its EasyDNS account via social engineering.
Malicious nameserver changes briefly redirected traffic before being reversed.
DNSSEC helped contain the attack — no user impact reported. pic.twitter.com/I6ebk0bL5A
— The Crypto Times (@CryptoTimes_io) April 20, 2026

The malicious actor initiated a fraudulent account recovery request with EasyDNS at 7:07 p.m. EDT on April 17, posing as a legitimate eth.limo representative. Approximately seven hours later at 2:23 a.m. EDT on April 18, the perpetrator successfully altered eth.limo’s nameserver configuration to point toward Cloudflare infrastructure. A second modification redirected the nameservers to Namecheap at 3:57 a.m. EDT.

Legitimate account control was returned to the actual eth.limo operators at 7:49 a.m. EDT, concluding approximately five hours of unauthorized access.

https://t.co/of1ktfaPss
— ETH.LIMO 🦇🔊 (@eth_limo) April 18, 2026

The eth.limo platform functions as a critical bridge connecting traditional internet browsers to Ethereum Name Service infrastructure. The service facilitates access to approximately 2 million .eth domains, including the personal blog of Ethereum co-creator Vitalik Buterin hosted at vitalik.eth.limo.

Had the compromise been fully exploited, the perpetrator could have redirected traffic from any .eth website to malicious phishing infrastructure. Buterin issued a warning to his community on Friday, recommending users avoid all eth.limo URLs temporarily and access content through IPFS alternatives.

DNSSEC Protection Prevented User Compromise

The threat actor failed to obtain eth.limo’s DNSSEC cryptographic signing credentials. This crucial oversight prevented the attacker from generating authenticated digital signatures required to validate DNS modifications.

When DNS resolver services evaluated the modified nameserver information, they detected signature mismatches against legitimate records. Rather than routing users to potentially malicious destinations, the resolvers delivered error responses.

“DNSSEC likely reduced the blast radius of the hijack. We are not aware of any user impact at this time,” the eth.limo team wrote in its post-mortem.
Buterin confirmed on Saturday that the situation was “all resolved now.”
EasyDNS CEO Mark Jeftovic published his own account of the incident, titled “We screwed up and we own it.” He called it the first successful social engineering attack against an EasyDNS client in the company’s 28-year history.
“This would mark the first successful social engineering attack against an easyDNS client in our 28-year history. There have been countless attempts,” Jeftovic said.

Jeftovic emphasized that no additional EasyDNS clients experienced security incidents related to this breach.

Migration Plans and Future Security

The eth.limo project will relocate its domain management to Domainsure, an enterprise-focused platform associated with EasyDNS designed for high-security client requirements. Domainsure’s infrastructure deliberately excludes account recovery functionality, eliminating the vulnerability exploited in this incident.

Jeftovic indicated that EasyDNS continues to investigate the precise methods employed during the social engineering attack.

This breach represents another example in an emerging trend. During November 2025, domain hijacking incidents targeting decentralized exchanges Aerodrome and Velodrome resulted in over $700,000 in user fund losses after attackers compromised registrar NameSilo and disabled DNSSEC protections.

Stablecoin infrastructure provider Steakhouse Financial reported a comparable security incident on March 30, following successful manipulation of OVH support personnel who removed two-factor authentication requirements.

The eth.limo platform has resumed normal operations under authorized management control.