Hackers Hijack 12 DeFi Sites via Name.com, Steal About $138K
At least 12 DeFi websites, all registered through Name.com, were hijacked late Friday and turned into wallet drainers using the Step Drainer toolkit. About $138,000 has been traced on EVM chains, while blame for the breach is split between Name.com and Vercel.
Typing the correct web address was not enough to stay safe late Friday, October 30. At least 12 DeFi websites were hijacked in a DNS-level attack that turned their front ends into wallet drainers, and the scheme has so far netted about $138,000 on EVM chains. Smart contracts were not breached. Public registry records show all 12 domains were registered through Name.com.
The distinction matters structurally. DNS, the domain name system, works like a phone book that maps a site's name to the servers that host it. If an attacker can rewrite those entries, users who type the correct address land on a counterfeit page, while the protocol's contracts sit untouched on-chain. That is the pattern here: the code held, and the address book around it did not.
Timeline of the attack
According to a post on X, liquidated0x flagged Flap's site as apparently compromised at 9:10 p.m. ET Friday.
About an hour later, Flap said in its own post that its flap.sh front end had been hit by "a DNS hijacking incident."
Blockaid warned about Flap and Kintsu at 10:54 p.m. ET and soon named 10 more affected sites. It said they carried Step Drainer, a toolkit that tricks visitors into approving transfers out of their wallets. LevelBlue SpiderLabs described the toolkit in April as Malware-as-a-Service, reportedly sold for about $750 for full source code or $150 for a version that takes a 20% cut.
Where the money went
Onchain, proceeds flowed to three wallets in fixed 15%, 55% and 30% splits across BNB Chain, Ethereum, Robinhood Chain and Monad. On BNB Chain, a Safe wallet received about 3.1 BNB (roughly $2,200) from four wallets. Losses on Solana and Aptos are not included in the $138,000 figure, and no affected project has reported a victim count.
Registrar response and the blame dispute
Ten of the sites were suspended at the registrar level at 8:32 a.m. ET Saturday with a "client hold" status, which stops a domain from resolving. They include Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun and StakePoint. The Flap and Kintsu domains were not suspended and remained operational as of Saturday.
Name.com's only public response, at 12:27 a.m. ET, was an X reply asking users to fill out its abuse form. Its press address did not accept a request for comment, and parent company Identity Digital did not immediately respond.
The cause is contested. Kintsu said:
"It was something that happened on Vercel's end that was out of our control"
Origami also blamed Vercel. On X, bluexxix said it "seems @namedotcom is compromised," and banteg reached the same conclusion about the registrar Saturday morning. Punkquidity, who spotted that 10 of the domains were switched off within seconds of each other, said it was unclear whether Name.com or a reseller such as Vercel was responsible. Vercel had not commented, and both companies' status pages showed all systems operational.
The sites use different DNS providers, including Cloudflare, Vercel and Name.com nameservers, so the shared registrar is the common thread rather than the hosting setup. A December 2025 Name.com press release named Vercel as its registrar partner for a rebuilt domain service, and Vercel disclosed a breach of internal systems in April traced to a compromised third-party AI tool.
Recovery and wider context
Some teams recovered by moving to Vercel and Cloudflare nameservers, and StonkFun moved its site to new infrastructure overnight. FluxBeam and StonkFun said they knew of no affected users, while Kintsu, Origami, FluxBeam and StonkFun all said their contracts were untouched.
This is not the first registrar-layer incident. Aerodrome and Velodrome were hijacked in November 2025, and Galxe was hit in October 2023 through its account at registrar Dynadot. The pattern shows that sound contracts do not protect users from a compromised front end. It also lands as regulators weigh who bears responsibility for DeFi access: France has proposed liability for platforms that offer DeFi access, and the UK FCA is consulting on DeFi guidance GC26/7. Incidents like this one show how much of that exposure sits in ordinary web infrastructure.
