An attacker impersonated a Galxe team member and contacted Dynadot, the domain registrar, with forged documentation to gain access to the Galxe.com domain account. The attacker redirected the domain to a phishing site and induced approximately 1,120 users to sign transactions to malicious contracts, resulting in $270K in losses before the domain was recovered.

On October 6, an unknown individual contacted our domain service provider Dynadot, impersonating an authorized Galxe member and bypassing the security process with falsified documentation. The impersonator then gained unauthorized access to the domain account, which was manipulated to redirect website visitors to a fake site and sign transactions that misappropriated their funds. On October 7, Galxe released a statement on the October 6 DNS security incident stating that the site is now fully restored, with an estimated 1,120 users affected and approximately $270,000 stolen. On October 11, Galxe announced a compensation plan for the security incident that occurred on October 6, 2023. Any affected users will receive full compensation in USDT on Polygon, calculated based on its value at 18:00 Beijing time on October 9.