Echelon Restores Site After DNS Phishing Redirect
The decentralized money market said a registrar-level nameserver change had sent visitors to a phishing copy of its website.
Updated on Nov. 1, 2026 in Cybersecurity
Echelon, a modular money market, restored access to its website after an unauthorized nameserver change at its domain registrar redirected visitors trying to reach the official site to an unauthorized page. The company said its smart contracts were unaffected by the change.
Why it matters
The incident shows that even protocols with secure on-chain contracts can be exposed through off-chain infrastructure such as domain registration and DNS, where a single account change can route users to a fraudulent copy of a site.
The only verifiable facts are the company's own statement that its nameservers were moved to Name.com's DNS and that its smart contracts were not affected, with no independent figures released on how many users were exposed. It remains unclear whether the registrar account was compromised or how the change was authorized.
The players
Echelon
Echelon is a modular money market whose website was redirected to a phishing copy by a registrar-level nameserver change, and which said its smart contracts were not affected.
Name.com
Name.com is a domain registrar whose DNS service received the nameserver change that redirected Echelon's visitors.
The details
Echelon's domain was managed through Vercel, but its nameservers were switched to Name.com's DNS, which redirected visitors attempting to reach the official site to a phishing copy. Echelon warned of the issue on Saturday and later said access had been restored and domain resolution was functioning normally.
Timeline
Saturday: Echelon warned that its domain might be sending visitors to an unauthorized website.
Sunday, Nov. 1, 2026: Echelon published a follow-up saying website access had been restored.
Big Picture
Echelon's incident fits a recurring pattern in which DeFi protocols with audited smart contracts are exposed through their domain registrar and DNS layers, where attackers redirect users to counterfeit front-ends. The company's statement that its contracts were unaffected places the risk squarely in off-chain infrastructure.
Users who typed Echelon's address during the incident could have landed on a phishing page, so anyone who interacted with a wallet or form there should check their approvals and watch for unexpected transaction requests. Verifying the official address from the project's own published channels before connecting a wallet reduces the risk of similar redirects.
The takeaway
Smart contract security does not protect users from attacks on the domain and DNS layers that route them to a site in the first place. Confirm the address of any DeFi app through trusted sources before connecting a wallet.
Further reading
Learn more in the Cybersecurity section on Wisevoter.com.
Source note: This article includes information reported by TokenPost.
