defituna[.]exchange

This domain, defituna.exchange, operates as a crypto drainer designed to impersonate the Across protocol, a legitimate cross-chain bridging service. The site presents a fraudulent interface labeled 'DeFiTuna,' tricking users into connecting their cryptocurrency wallets under the pretense of accessing bridging or yield services. Once connected, the malicious scripts embedded in the site execute unauthorized transactions, draining funds from victims' wallets without consent. The threat specifically targets users familiar with decentralized finance (DeFi) platforms, exploiting trust in the Across brand to facilitate financial theft. Analysis of the domain's infrastructure reveals multiple indicators of malicious activity. The domain is flagged by 4 out of 95 security vendors on VirusTotal, with additional detections on two independent security blocklists. It resolves to the IP address 93.94.52.242 and is registered through Dynadot Inc. The site employs Google Web Server technology, supports HTTP/3, and enforces HSTS, which may lend an appearance of legitimacy. The SSL certificate is issued by Let's Encrypt, a common but not exclusive indicator of benign domains. The domain's trust score is rated at 0/100, reinforcing its classification as a high-risk entity. Users who have visited defituna.exchange or interacted with its interface should immediately disconnect any connected wallets and revoke permissions via their wallet's connected sites management tool. All cryptocurrency assets should be transferred to a new wallet address, and any transactions initiated during the interaction with the site should be reviewed for unauthorized activity. It is recommended to scan the device used for access with updated security tools to detect potential malware or browser-based exploits. Future interactions with DeFi platforms should be verified through official channels, and users should cross-reference domain names with known legitimate sources before connecting wallets.