Front Sentinel / research

State of DeFi domain security, October 2026

We checked the domains of the 100 largest DeFi protocols by TVL, which together hold about $224B. Most of them can be repointed by whoever gets into a registrar account, and most would accept a certificate from any certificate authority.

Data taken 22 October 2026 from public DNS, registry RDAP servers and each protocol's main page. Aggregates only: we don't publish per-protocol results.

What the numbers mean

Locks. Almost every domain has the registrar's transfer lock, but that lock lives inside the registrar account: anyone who signs in can switch it off and change the nameservers. Only 37 add update and delete locks, and 6 have registry lock, the one kind that is set at the registry and can't be lifted from the account. 27 of the domains are at Cloudflare Registrar, which doesn't offer registry lock on its standard plans. Check a domain's locks.

CAA. A CAA record names the certificate authorities allowed to issue for a domain. Without it, anyone who can pass domain validation once, for example through a hijacked route to the web server, can get a certificate from any public CA. 74 of 100 domains have no CAA record. CAA doesn't help after the nameservers have been changed, which is why certificate monitoring sits next to it.

DNSSEC. Half the domains sign their zone. DNSSEC doesn't stop a nameserver change made through the registrar, but it stops forged answers between the resolver and the nameserver.

The frontend. 33 sites load scripts from other domains, and 31 of them do it without Subresource Integrity, so a change on the script host changes the dApp. Check a page's SRI.

Why it matters

Taking over a domain is a direct path to a protocol's users: change the nameservers, serve a copy of the app with a malicious transaction, and everyone who types the right address lands on it. In May 2025 an attacker got into the systems of Curve's registrar and pointed curve.fi at their own DNS. In July 2024 Squarespace reported unauthorized changes to DNS settings of several cryptocurrency domains.

The picture hasn't moved much. BlockSec's earlier scan of the same list found 72% without CAA and a full set of lock signals on only 7 domains. We found 74% without CAA and 6 with registry lock.

Method

The list is the top 100 protocols on DefiLlama by TVL, excluding the CEX, Chain and Services categories, with one entry per registrable domain. For each domain we read EPP statuses, registrar and expiry from the registry's RDAP server (located through the IANA bootstrap file, with fallback servers for TLDs missing from it such as .io and .co), queried NS, DS and CAA through three public resolvers, and loaded the main page once to read headers and script tags. Registry lock counts when both serverUpdateProhibited and serverTransferProhibited are set; registries can set these for other reasons, so it shows protection is in place, not who asked for it.

These are the same checks as our SEAL DNS & Registrar self-check. We plan to repeat the survey monthly and update this page.