Wallet & RPC incidents: the case for infra-level monitoring

Why this list exists

When we say "rogue RPCs and CDN misconfigs have cost real money," the next question is always which ones. This page is the receipts. The pattern repeats: BGP hijack → DNS poisoning → fresh TLS cert → drainer contract → wallet approval → funds gone. Or: registrar takeover → same chain. Or: dependency / credential exfiltration → wallet vendor compromised → users drained. Classical TLS protects the bytes in flight; it does not protect against an attacker who obtains a legitimately-issued certificate for a hijacked domain. That's the gap continuous TLS-posture monitoring (issuer change, leaf-cert reuse, CT-log fresh cert, SAN drift) is designed to close.

An attacker advertised a more-specific BGP route for AWS Route 53 IPs, intercepted DNS queries for myetherwallet.com, and served the site from a malicious origin presenting a self-signed TLS certificate. Browsers showed a cert warning, but a non-trivial fraction of users clicked through and signed transactions that drained their wallets. Classic 'classical TLS doesn't help if the user accepts an invalid cert' case.

Attackers compromised Curve's domain registrar and pointed the curve.fi nameservers at a malicious origin. The malicious frontend served a wallet-drainer contract address in place of the real Curve contracts. Users who connected wallets and approved 'Curve' lost funds. The attacker was able to obtain a valid Let's Encrypt cert for the hijacked domain, so TLS handshakes looked clean.

Same BGP-hijack pattern as the MEW 2018 attack, four years later. An attacker advertised more-specific BGP routes covering Celer's frontend nameserver IPs, served a malicious frontend, and drained wallets that approved transactions on the impostor site. Demonstrates that BGP-hijack remains a viable attack on production crypto infrastructure.

Attackers social-engineered Galxe's domain registrar (Dynadot) into transferring DNS control. Galxe.com was redirected to a wallet-drainer hosted on impostor infrastructure. The attacker again obtained a valid TLS cert from a public CA. The whole episode lasted under an hour, but that was enough.

Atomic Wallet users worldwide had wallets drained simultaneously; root cause was never fully published, but evidence pointed at a compromised build pipeline or update channel. Users running the same vetted-looking app version were drained, indicating a code-level compromise rather than per-user phishing. Linked publicly to Lazarus Group by multiple analysts.

The 2022 LastPass breach (encrypted vault export stolen) translated into wallet drains throughout 2023 as attackers brute-forced master passwords on stolen vaults that contained Solana / Ethereum seed phrases stored as 'secure notes.' Demonstrates that off-chain credential storage is part of the wallet-security threat model whether or not the wallet vendor knows it.

Mintlify, used by many DeFi teams to host docs, was breached and customer GitHub access tokens were exposed. Several crypto-infrastructure orgs had to invalidate tokens and audit private repos for backdoored CI workflows that would have produced poisoned wallet / RPC binaries. No on-chain loss was tied to it, but the blast radius is exactly the supply-chain category the Curve compiler hack landed in.

Patterns to watch for

• Fresh TLS cert on a previously-stable origin. Almost every DNS / BGP hijack leaves this footprint. RPCScan stores per-host issuer + leaf-cert + SAN history.
• Issuer change without an operator announcement. When a host that's used Let's Encrypt for years suddenly hands you a cert from a different CA, that's worth a 30-second pause.
• Cert reused across unrelated hosts. Drainer kits often re-use a single cert across the impostor domains they spin up.
• Wallet vendor downloads served over a CDN with no SCTs. If the wallet binary path is the supply chain, the binary's transport hygiene is part of your wallet's threat model.
• RPC URL pasted from Discord. Treat any unsolicited "fast Ethereum RPC" message the same way you'd treat an unsolicited "click here for free crypto" message.

How RPCScan helps (and where it doesn’t)

RPCScan continuously probes every public RPC and explorer host in our catalogue, captures the full TLS handshake fingerprint (issuer, SAN set, signature alg, OCSP, SCTs, key-exchange group, PQ class), and writes every observation to an append-only probe_events log. That makes change on these hosts a queryable signal, the kind that fires on three of the seven incidents above before any user funds move.

What RPCScan doesn’t do: protect you from a wallet-app supply-chain compromise (Atomic), an off-platform credential dump (LastPass), or any attacker who is the legitimate operator of the endpoint. Those need different defences (reproducible builds, hardware wallets, key-handling hygiene). The four entries above marked "Out of scope" are reminders that infra hygiene is necessary but not sufficient.

See also: security leaderboard, TLS regressions feed, PQ adoption tracker.