OpenZeppelin retired the hosted Defender service on July 1, 2026. Most teams that used it now ask one question: what watches our contracts? It is the right question. It is also only half of the job.
The two largest front-end attacks of the last few weeks touched no contract and stole no key.
Two attacks with no contract bug
Across Protocol. Attackers took control of Across's official domain through a social engineering attack on its registrar, Namecheap. Visitors to the real address saw a copy of the site that asked them to sign approvals, and a drainer emptied those wallets on several networks. Visitors lost about 350 thousand dollars. Cloudflare removed the attackers' DNS records, and Across got its domain back. (The Block)
About 15 DeFi sites at Name.com. The attackers changed each domain's nameservers, so the real address served a wallet drainer. Name.com said 15 customer domains were affected, and Blockaid named 12 of them. Visitors lost about 138 thousand dollars. The first warning to a team came about an hour after the first drain. (The Block)
In both cases the contracts were fine, and so were the keys. A contract monitor had nothing to alert on.
The first sign was public
Before any visitor was asked to sign, the domain's DNS records changed. That change is public. Anyone who reads the records can see it, and nobody has to be hacked for you to notice.
When several domains at one registrar change at about the same moment, it is a pattern and not a mistake. That is how a hijack at the registrar looks from the outside.
What to watch after Defender
A replacement for Defender should cover what Defender covered, and the places attackers actually went this year:
- Contracts: owner and admin changes, upgrades, pauses, and the events you already wrote monitors for.
- Safes and treasury wallets: new signers, threshold changes, and large or unusual transfers.
- Your domain: DNS records and nameservers. This is the step both attacks above started with.
- Code and team accounts: who can push to your repositories, and who can sign in to your registrar, cloud and chat.
What you can check today
- Turn on the registrar lock and two-step login at your registrar. Ask whether it has a stronger account lock.
- Make sure your registrar account uses an email address only your team can reach.
- Write down which registrar you use. If it is named in an attack, you want to know at once.
- Decide now who takes the site down, and how you warn users, if your domain is ever taken.
Where we fit
We build SixStar for Teams. It watches contracts, Safes, wallets, domains, code and team accounts, read only, and alerts your team in Telegram, Discord, Slack, PagerDuty or email when something changes. It never holds a key.
On domains, it reads your DNS records at regular intervals and sends an Urgent alert when one changes, with the old and the new value. When domains of two or more of our teams at the same registrar change within the same hour, each of those teams gets a second Urgent alert that names the registrar. That gives a team time to act before most visitors arrive.
Coming from Defender? You can upload your Defender-as-code or OpenZeppelin Monitor file, and each monitor becomes a watch on the same networks with the same alert channels: Coming from Defender.
We also keep some free read-only tools, with no wallet connection and no sign-up, for checking approvals, Safes and lookalike domains.
