Attackers successfully rerouted DNS requests for myetherwallet.com, showing visitors an unsigned SSL cert and apparently taking $13K+ in Ethereum in two hours
At midnight ET last night, MyEtherWallet users started noticing something odd. Connecting to the service …
Context & Ripple Effects
The MyEtherWallet hijack is an early entry in a pattern the coverage keeps returning to: Ethereum users losing funds not to broken smart contracts but to compromised plumbing. The 2016 DAO drain froze $50M+ and forced a protocol-level debate; later incidents moved down the stack, from guessed low-entropy private keys to registrar-level control.
The endpoint of that descent is visible in the related reporting on GoDaddy, where social-engineered staff let attackers change email and DNS records for crypto trading platforms — the same layer this attack hit. What makes the MyEtherWallet case notable is the tell: an unsigned SSL certificate that careful users caught before connecting their wallets.
First-order effects
- MyEtherWallet users who ignored the unsigned-certificate warning had their wallet credentials harvested, with over $13K in Ethereum siphoned within roughly two hours before the reroute was stopped.
- The incident puts DNS resolution — not MyEtherWallet's own code — at the center of the trust question for every web-based wallet front-end.
Second-order effects
- Registrars and DNS providers serving crypto services face pressure to harden account controls, a pressure that materialized two years later when GoDaddy confirmed staff were socially engineered into changing DNS records for trading platforms.
- Wallet interfaces gain an incentive to push hardware wallets and offline signing, since any browser-delivered front-end inherits whatever the DNS path serves it.
Third-order effects
- If attacks keep targeting the registrar-to-browser chain rather than the blockchain itself, custody security consolidates around layers that don't depend on DNS trust — and 'verify the certificate' becomes a user-side control the industry can't assume everyone performs.
The trend: Crypto theft is migrating from smart-contract exploits toward the internet's identity infrastructure — registrars, DNS, and key generation — where a single compromise scales across every service behind it.