At least a dozen organizations had their domain names hijacked through Squarespace last week, according to reporting from KrebsOnSecurity. The attackers exploited a gap left behind when Squarespace absorbed about 10 million domains from Google Domains in June 2023, and customers who never finished setting up their new accounts became the easiest targets.
The hijackings ran from July 9 through July 12, and most of the known victims operate in the crypto space. Some stolen domains were quietly redirected to phishing pages built to drain wallets from unsuspecting visitors.
What actually happened
The core problem, laid out by researchers from Tamsk and Paradigm, is a default that worked against customers. Squarespace appears to have expected every migrating Google Domains customer to log in through a social provider like "Continue with Google" or "Continue with Apple." Anyone who used the plain email option instead could register a brand-new Squarespace account using an address tied to a transferred domain, and Squarespace would hand over control of that domain on the spot.
Taylor Monahan, a senior product manager at Metamask, told KrebsOnSecurity that there was no real barrier to entry. If the legitimate owner of a domain-linked email had not yet created their own Squarespace account, anyone who guessed or found that email could claim the domain first. No verification email, no second factor, no warning. The "domain administrator" role inside Squarespace has nearly the same powers as the owner, which widens the blast radius once an attacker is in.
The attackers were efficient. The hijackings concentrated over four days, and the victims cluster in a single industry, suggesting a focused campaign rather than opportunistic scanning.
Why this matters
This is not a one-off bug story. It is a migration story, and migrations are where domain security most often breaks down. The Google Domains handover is now a year old, and a large share of those 10 million domains are still sitting in a half-migrated state. Every one of them is a quiet invitation to anyone who can guess the right email address.
Crypto is a logical first target because stolen domains convert directly into stolen funds through phishing pages, but the same trick works on any business that never finished its account setup. A holding company, a nonprofit, a small agency, a defunct startup whose DNS still resolves mail—all of them sit in the same pool. The risk is not theoretical; it is a list of addresses an attacker can try in a loop.
The bigger structural complaint from researchers is that Squarespace's account model gives domain owners less visibility than Google did. There are no audit logs, owners do not get notified when a "Domain Admin" makes changes, and the controls that security teams expect simply do not exist. That is the kind of gap that turns a single hijacking into a recurring problem.
Who should care
| Situation | Risk level | Action priority |
|---|---|---|
| Domain transferred from Google Domains, never logged into new Squarespace account | High | Lock down today |
| Domain transferred, but only social login used (Google/Apple) | Low | Still audit admin accounts |
| Domain transferred, active MFA enabled on all accounts | Minimal | Monitor for certificate changes |
| Google Workspace purchased through Google Domains | Elevated | Disable reseller access now |
What to do this week
A guide from the Tamsk and Paradigm researchers walks through the lockout steps in detail. The short version for any team still running a Squarespace-managed domain:
- Turn on multi-factor authentication for every account that can touch the domain, immediately. It was disabled during migration and does not switch itself back on.
- Audit every user tied to the domain. Most teams have no idea which emails are listed as "Domain Admin" or billing contacts—exactly the list an attacker would try.
- Remove any account that no longer belongs to a current employee or contractor. Old addresses on former staff are a common weak point.
- Disable the Google Workspace reseller connection through Squarespace if you bought Workspace through Google Domains. Leaving it on gives a Squarespace account holder a side door into your email and files.
What to watch next
Watch whether Squarespace publishes any statement or change to the email-based signup flow. The platform remained silent through the disclosure window, and silence on a known attack path is its own answer. Also watch your DNS records and certificate transparency logs for any domain you care about—a renewed certificate on a name you did not renew is a strong signal that someone else now controls the zone.
If your domain moved with Google Domains and you have not finished the setup, finish it today.
Key takeaways
- Treat any domain that moved from Google Domains to Squarespace as unfinished business until you have personally logged in, set MFA and reviewed every admin.
- Assume the email-based signup path is the weak link, and lock it down with strong, unique credentials and MFA before you do anything else.
- Audit old "Domain Admin" and billing contacts, and remove anyone who no longer works on the account.
- Disable the Google Workspace reseller handoff in Squarespace if you do not need it; it is an open side door otherwise.
Frequently asked questions
Which organizations were hit in the Squarespace domain hijackings?
Named targets include Cellar network, Complex financing, Pindle Finance and Unstoppable Domains, with most known victims operating in the crypto space.
How were the attackers able to take over Squarespace-managed domains?
Researchers say the attackers registered new Squarespace accounts using email addresses tied to transferred Google Domains before the legitimate owners set up their own accounts, and the email signup path did not require verification.
Was multi-factor authentication enabled by default after the migration?
No. The published guidance from the researchers states that MFA was disabled during the Google Domains migration, and accounts had to be locked down manually.
Why is Google Workspace involved in a Squarespace domain issue?
Anyone who bought Google Workspace through Google Domains now has Squarespace listed as the authorized reseller, which gives a Squarespace account holder a path into Workspace unless reseller access is explicitly disabled.
What is the first thing a domain owner should do right now?
Log in to your Squarespace account, turn on MFA, list every user with admin or billing rights, remove anyone who should no longer have access, and disable the Google Workspace reseller connection if you do not need it.