Ethena Labs suffers frontend attack, confirms protocol remains unaffected

Ethena's recent frontend compromise exposes users to potential data theft and fund loss.

Key Takeaways

Ethena's frontend compromise has led to significant user risk. The protocol's USDe token is backed by crypto assets and futures. <?xml encoding="UTF-8"?>

Ethena, a synthetic dollar protocol built on Ethereum, has suffered a frontend compromise, prompting warnings for users to avoid interacting with its user interface or links. News of the compromise was first shared based on a lookup done by Ethereum security researcher Pascal Marco Caversaccio, who warned about it on X.

Ethena is a synthetic dollar protocol on Ethereum that aims to provide a crypto-native monetary solution independent of traditional banking infrastructure. The protocol’s synthetic dollar token, USDe, is backed by crypto assets and corresponding short futures positions rather than fiat currency like USDC or USDT.

The protocol utilizes delta hedging of Ethereum and Bitcoin collateral to maintain USDe’s peg stability. Key features of Ethena include permissionless acquisition through external AMM pools, direct minting/redeeming for approved market makers, and staking options for users in permitted jurisdictions to earn protocol revenue as rewards.

The frontend compromise poses significant risks to users interacting with the Ethena protocol. Frontend attacks can potentially lead to the theft of user funds or sensitive information by redirecting transactions or capturing input data.

Users are strongly advised to exercise caution and avoid any interaction with the protocol until the issue is resolved and officially communicated by the Ethena team. A recent update from the Ethena Labs team indicates that both the protocol and its funds are unaffected, adding that the site has since been deactivated.

The Ethena domain registrar account was recently compromised and we have taken steps to deactivate the site until further notice.

The protocol is unaffected and funds are safe.

Please do not interact with any site or application purporting to be the Ethena frontend.

— Ethena Labs (@ethena_labs) September 18, 2024

Disclaimer