chaindrainMVP
Preview surface — demo data. Where real data exists today (e.g. RealT, BlackRock BUIDL, Lift Dollar) we render it; everywhere else we render synthetic enrichment generated deterministically from public signal and clearly marked Demo or Inferred. The Phase 3 roadmap replaces every synthetic source with live ingestion — see Methodology → Exposure Graph & Similarity Engine.
← back to incident ledger

frontend dns hijackDemo

Oct 2, 2022 · $6.4M · frontend

Narrative

On 2022-10-02, Paxos Trust Company, LLC (issuer); PayPal, Inc. (distribution/branding) suffered a frontend dns hijack incident resulting in approximately $6,404,024 in losses. The exploit targeted the frontend layer. Attribution: dprk_lazarus. This is a demonstration entry — not a real incident.

Victims

Classification

Root cause
frontend_dns_hijack
Secondary causes
—
Attack layer
frontend
Strategy
tech_vuln
Actor role
target
Attribution
dprk_lazarus
Attacker address
0x7d10412c713c935fda23836339846d0b30b86ae7
Flash loan
no
Audited at time
no
Bounty at time
no

AADAPT mappings

DEMO:AADAPT.TA0001DEMO:AADAPT.TA0008DEMO:AADAPT.T1071.001DEMO:AADAPT.T1583.001

Evidence

Disclosure date
Oct 6, 2022
Funds recovered
—
Audit firms at time
Post-mortem URLs (synthetic)
  • https://medium.com/paxos-trust-company-llc-issuer-paypal-inc-distri/post-mortem-paxos-trust-company-llc-issuer-paypal-inc-distri-2022-10-02
  • https://rekt.news/paxos-trust-company-llc-issuer-paypal-inc-distri-rekt
  • https://blog.paxos-trust-company-llc-issuer-paypal-inc-distri.xyz/incident-report
tx hashes (3)
  • 0xe3d6b7fe1de64c2fdcc54f489a3b702b8710e1a15c2dde1c2fcf71b25ffa6884
  • 0x53e07c3d3845ea165809022e0b32901eb0c399d6b78d0150daa65e9a7b53712b
  • 0x24d5897728f159753fcbc4702bb84fa80340ecf9ba4bc9f9fc1b032159640691