- GAIB-20Negative
GAIB 🟠 | RWAiFi | AI Infra (@gaib_ai)
Front-end Incident Post-Mortem Summary On March 16, 2026, the gaib.ai domain was temporarily compromised by a threat actor known as Angel Drainer ("Angelferno"), a well-documented wallet drainer operation responsible for significant losses across the crypto ecosystem. The attacker used social engineering to gain access to our domain registrar account, redirected our DNS, and deployed a replicated version of our website containing a malicious wallet-draining contract. The malicious site was live for approximately 6 hours and 40 minutes. Thanks to rapid detection by Blockaid and our team's immediate response, the impact was contained and no losses have occurred to the best of our knowledge. All GAIB smart contracts, protocol funds, treasury, and backend infrastructure remained completely unaffected. Timeline of Events March 16, ~09:00AM UTC The Attacker gained access to the “gaib.ai” domain through social engineering. He impersonated our CEO Kony through a fraudulent email (“kony.kwong@outlook.com”) and submitted a request through Gandi’s Helpdesk to replace that as the recovery email. The request was granted through an optimistic verification process and the Attacker gained access to our Gandi domain management account and DNS settings. March 16, ~09:00AM UTC Attacker redirected gaib.ai DNS to a replicated version of our website containing a malicious wallet drainer contract (Angel Drainer). March 16, 10:40AM UTC Blockaid's automated security system detected the malicious front-end and alerted our team. March 16, ~10:50AM UTC GAIB team confirmed the compromise and initiated recovery with Gandi support. March 16, ~4:40PM UTC Full access to the domain account was restored through Gandi’s support. Legitimate front-end and DNS settings are reinstated. The attacker was expelled from the account. March 17th, ~07:00AM UTC The domain account protection measures have been lifted by Gandi and the DNS changes have been effective since. Attack Vector Social Engineering The attacker submitted a fraudulent account recovery request to Gandi, our domain registrar, impersonating GAIB's CEO through a fraudulent email and claiming loss of access to the account. Gandi’s process at that time may not have required active identity verification on the attacker but adopted an optimistic verification policy. This policy allows account recovery changes to be automatically approved after a waiting window if no objection is received. In this case, the security alerts were sent to a highly restricted internal address. However, the alerts were diverted to a spam folder, preventing our team from intercepting the “automatic approval” before the window closed. The attacker was granted access to the domain management account on March 16. DNS Hijacking and Malicious Front-End Once in control of the domain, the attacker modified DNS settings to point gaib.ai to infrastructure under their control. They had prepared a replica of our website in advance, with one critical modification: the front-end included a malicious wallet drainer contract (using the Angel Drainer toolkit). Any user who approved tokens after connecting their wallet to the compromised site risked having their funds drained. The attacker did not gain access to any GAIB backend servers, databases, or internal systems. The attack was limited entirely to the DNS layer and the front-end served to visitors. No unauthorized code was pushed to our GitHub repository ; the attacker operated entirely with a cloned copy of the publicly served frontend. Following recovery, the frontend team verified the integrity of the live site and confirmed it is serving from our legitimate deployment with no unauthorized modifications. A scan for known drainer signatures returned clean. Impact Assessment User impact: To the best of our knowledge no users have been affected as the malicious front-end was only live for a short period of time. Protocol impact: None. All smart contracts, protocol funds, treasury, and governance mechanisms were unaffected. The attacker had no access to any onchain components. Data exposure: No personally identifiable information was exposed. The only data potentially visible to the attacker would be wallet addresses of users who signed malicious approval messages in the malicious front-end, which are already public on-chain and do not constitute sensitive personal data. Infrastructure impact: None. The attacker operated entirely through DNS redirection using their own infrastructure. GAIB's backend servers, databases, and internal systems were not accessed or compromised. Response and Recovery At around 10:40 UTC on March 16, Blockaid's automated security monitoring system detected the malicious front-end and immediately alerted our team. Within 10 minutes of receiving the alert, our team confirmed the compromise and began the recovery process. We contacted Gandi's support team, who collaborated with us to verify our identity and restore access to the domain account with strict access control. By approximately 4:40PM UTC, full control had been regained: the legitimate front-end and DNS configuration were reinstated, and the attacker was removed from the account. Notably, Gandi has promptly adopted a protective domain transfer lock and DNS updates restriction policy temporarily after our team’s request to prevent the attacker from transferring the domain to a different registrar, which would have made recovery significantly more difficult. Propagation Delay: Although the DNS has been updated, it can take 24 hours or more to reach everyone, some users may still see the attacker’s impersonation site while others see our legitimate one. This "staggered" update means the site is currently unstable. For this reason Please do not interact with gaib.ai or connect your wallet for at least 24 hours. Acknowledgments We extend our sincere gratitude to the @blockaid_ team, whose automated detection system identified the malicious front-end promptly and whose support was instrumental in our rapid response. Their work in protecting the web3 ecosystem is invaluable. Remediation and Preventive Measures We have implemented several infrastructure safeguards, enhanced identity-access management (IAM) and active monitoring system for our domain services. Our new security posture requires active, multi-party validation for all recovery and DNS requests to ensure full control. We’re also actively working with Gandi to patch this loophole. Next Steps Incident Resolution: We are currently reviewing reports of suspected user impacts. If you believe your account was impacted while the front-end was compromised, please submit a ticket via Telegram with our support bot @GAIBsupport_bot. Registrar follow-up: We are in ongoing discussions with Gandi regarding the vulnerability in their account recovery process that enabled this attack. Legal Action: We reserve all rights to take legal action against the parties responsible for this malicious attack and are cooperating with relevant authorities to identify the perpetrators. This document will be updated as remediation measures are finalized and additional information becomes available. For questions or concerns, please reach out to the GAIB team via our official channels.