Hacker Returns Ethereum Domains Lost in Bug Exploit

The domain names stolen from the Ethereum Name Service's (ENS) auction have been returned.

As CoinDesk reported at the time, the ENS bidding process managed by digital-collectibles marketplace OpenSea was exploited, allowing a hacker to nab 17 domain names for lower bids than other users placed. ENS and OpenSea asked the hacker to return the domain names, promising compensation for finding the bug.

An alternative to Web 2.0’s centralized domain name servers (DNS) system, ENS is built on top of the ethereum blockchain to leverage its immutability and decentralized properties. As it happens, immutability isn't always a good thing.

Once the hacker claimed the ENS domain names – which included apple.eth – ENS and OpenSea’s only recourse was to blacklist the domains and ask for the hacker to return them.

Fortunately, they were.

Update: the stolen ENS names were all returned successfully to @ensdomains! 🤗Thanks for supporting the community; we’re working hard to restart bidding this week before #devcon5 and will send out emails to bidders when it’s ready

— OpenSea (@opensea) October 3, 2019

The hacker was apparently swayed by an attractive offer: 25 percent of the final bidding price for each of the returned domains once they are re-auctioned. Some domain names are listed for impressively high bids such as the owner of coffeshop.eth asking for 100 wrapped ether, worth about $17,000 at press time. With 17 domains stolen, the hacker could be in store for a decent payday depending on the auction prices.

OpenSea says auctions will commence again in the coming weeks.

Speaking with CoinDesk, ENS lead developer Nick Johnson said OpenSea had no direct communications with the hacker before the domains were returned. The company solicited feedback in a Sept. 29 blog post disclosing the bug.

Gift image via Shutterstock