Ethereum’s ENS Gateway Hijacked: A Wake-Up Call for Web3 Security

On April 18, Ethereum founder Vitalik Buterin warned the crypto community to steer clear of eth.limo URLs. The reason? A DNS hijack that compromised this popular ENS gateway, sending shockwaves across the Ethereum market.

The Timeline of the Hijack

It all unfolded like a digital thriller. Minutes after Buterin's cautionary tweet, the eth.limo team confirmed the compromise. Their domain had been hijacked, leaving users exposed to potential phishing attacks. The attacker gained control over eth.limo's registrar account, allowing traffic to be redirected to malicious sites. Imagine expecting to access decentralized web content and instead ending up on a phishing page. That's the scenario eth.limo users faced.

Eth.limo has been a convenient bridge for users to access Ethereum Name Service content without needing an IPFS node. It translates ENS names into HTTPS URLs, effectively opening a gateway to the decentralized web via regular browsers. But on that day, the gateway turned into a potential trap.

Buterin, always quick on the uptake, provided a safer alternative. He shared a direct IPFS link to his personal blog and advised waiting for an all-clear from eth.limo before resuming normal activities. But what does this incident say about Web3's vulnerabilities?

The Fallout from the Attack

So, what exactly broke here? The incident exposed a critical flaw in the Web3 infrastructure. Even though ENS records and IPFS content remained untouched, the DNS layer, a important component, remains a centralized weak spot. This isn't the first time we've seen this kind of attack. It's reminiscent of past registrar-level compromises targeting DeFi protocols like Cream Finance and Aerodrome.

The crypto world is no stranger to phishing attacks. In 2025 alone, these attacks resulted in over $4 billion in losses. This DNS hijack at eth.limo is a reminder that as we innovate, the bad actors innovate too.

No user funds have been reported lost yet, but the specter of what could have been lingers. Users are still being urged to avoid all URLs ending in *.eth.limo until the team gives the green light. Is this the price we pay for decentralization being tethered to centralized elements?

The Road Ahead for Web3 Security

This incident serves as a wake-up call. Web3 aims to decentralize the web, yet still relies on centralized services like DNS. Can the industry address these vulnerabilities before they become major threats? What are the alternatives to these centralized points of failure?

The eth.limo episode might accelerate conversations around reinforcing the security of Web3 infrastructure. Developers and users alike need to demand better solutions. After all, Latin America doesn't need crypto missionaries. It needs better rails.

So, as we move forward, embracing decentralization, it's clear we can't ignore the centralized weak spots that underpin much of our infrastructure. Whether eth.limo's team and others can close these gaps will determine if Web3 can truly deliver on its promise of a safer, decentralized internet.