Anyone who touched a DeFi front end on or after October 31, revoke your token approvals before you finish reading this.
CryptoTicker.io reports that hijacked Name.com domains dropped a wallet drainer onto twelve DeFi sites, and approvals granted from October 31 are the ones to revoke. The Hacker News reports an attacker got into the cPGuard update system on November 2 and pushed a malicious script to customers' Linux servers, which installed a backdoor and collected password hashes. GBHackers News reports a WordPress RCE vulnerability under active attack, with over 58,000 exploit attempts blocked.
None of this was a flaw in application logic. All three were delivery paths: a registrar record, an update channel, a plugin surface. Each one hands an attacker your users without ever touching your code. Your perimeter stops where your code stops only if you never shipped anything.
I audit domain, DNS and front end delivery integrity for payment and crypto products: registrar locks and 2FA, who can change a DNS record, what your front end loads at runtime, and whether you would notice if that changed. A review like this takes days, not months, and you get cost and timeline inside a day.
If you run a product where a swapped front end means drained users, message me and I will tell you what the review covers.