Hackers hijack a dozen DeFi websites, all registered with Name.com, and steal about $138,000
Hackers who took over a dozen DeFi websites late Friday and used them to empty visitors' crypto wallets targeted domains registered through the same company, Name.com, according to public registry records reviewed by The Block. The Block has traced about $138,000 in stolen funds so far using onchain data.Name.com is listed as the registrar for all 12 hijacked sites that were identified by security firm Blockaid, and 10 of them were suspended at the registrar level at 8:32 a.m. ET on Saturday.X user bluexxix was among the first to notice the shared registrar, posting at 11:51 p.m. ET on Friday that it "seems @namedotcom is compromised" as more affected sites surfaced. Pseudonymous developer banteg reached the same conclusion on Saturday morning, and X user punkquidity later spotted that 10 of the domains had been switched off within seconds of each other.Each of the 10 suspended domains now carries a "client hold" status, which stops a domain from resolving. They include Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun and StakePoint. Flap's and Kintsu's domains were not suspended and are still operational as of publishing time.X user liquidated0x flagged that Flap's site had seemingly been compromised at 9:10 p.m. ET on Friday, about an hour before the token launchpad warned its users that its flap.sh frontend had been hit by "a DNS hijacking incident." Blockaid warned about the attack on Flap and liquid staking protocol Kintsu at 10:54 p.m. ET, naming the 10 additional hijacked sites soon after.Name.com's only public response so far came at 12:27 a.m. ET, when it replied to liquidated0x and bluexxix on X, asking them to fill out its abuse form. Name.com’s listed press address did not accept The Block’s request for comment, and its parent company, Identity Digital, did not immediately respond.How the drainer worksBlockaid said the hijacked sites were rigged with Step Drainer, a malware toolkit that tricks visitors into approving transfers out of their wallets once they connect them to a site. Security firm LevelBlue SpiderLabs described Step Drainer in April as a "Malware-as-a-Service (MaaS)" kit, reportedly sold for about $750 for the full source code or $150 for a version that takes a 20% cut of each theft. The firm said the kit claims support for more than 20 blockchain networks.Onchain data reviewed by The Block shows the attackers routing proceeds to three wallets in fixed 15%, 55% and 30% cuts. On BNB Chain, a Safe wallet flagged by liquidated0x received about 3.1 BNB, worth roughly $2,200, from four wallets between 9:00 and 9:42 p.m. ET on Friday. It split the first three deposits among the three wallets, and about 2.27 BNB was still sitting in the Safe on Saturday morning.The same three wallets received identically split payments on Ethereum, Robinhood Chain, and Monad, the network Kintsu runs on. On Monad, two of the wallets redeemed Kintsu's staked MON token and withdrew from lending protocol Neverland before converting the proceeds into MON. On Robinhood Chain, one wallet pulled tokenized stocks including NVDA and AAPL out of Morpho and swapped them for ETH.Together the three wallets held about $138,000 late Saturday morning, mostly MON and Robinhood Chain ETH, and almost all of it arrived after the attack started. That's only what The Block could trace on EVM chains. Three of the hijacked sites, FluxBeam, StonkFun and StakePoint, are built on Solana, and Echelon runs on Aptos, so any losses there would sit in other wallets and aren't counted.Two projects blame VercelThe hijacked sites don't share a DNS provider, the service that tells internet browsers which server a domain points to. Some run on Cloudflare, some on Vercel and some on Name.com's own nameservers. Punkquidity said they couldn't yet tell "whether Name.com itself or a reseller like Vercel did it."Kintsu and Origami Finance have both publicly blamed cloud infrastructure firm Vercel. "It was something that happened on Vercel's end that was out of our control," Kintsu wrote in a reply on X, adding that Vercel had not yet responded. Origami first warned of "an active attack on Vercel-associated Nameservers," and later said its vaults would stay paused while it waits for "root cause analysis from Vercel / name[.]com." Flap builder Cedric said shortly after midnight that the team was reaching out to both companies.Vercel picked Name.com as the registrar for its rebuilt domain service last year, Name.com said in a December 2025 press release. Vercel had not commented publicly as of Saturday morning, and both companies' status pages listed all systems as operational. In April, Vercel disclosed a breach of its internal systems that it traced to a compromised third-party AI tool, The Block previously reported.Number of victims remains unclearNo affected project has reported a victim count as of yet, though onchain data shows at least four wallets sent funds to the attackers on BNB Chain alone. FluxBeam said it had "no reports of users being affected," and StonkFun, which moved its site to new infrastructure overnight, said it was "not aware of anyone affected." Kintsu, Origami, FluxBeam and StonkFun all said their onchain contracts were untouched.Crypto front-ends have been hit by DNS hijacks before. Aerodrome and Velodrome were hijacked in November 2025, and Galxe was hit in October 2023, when attackers got into the project's account at registrar Dynadot.Vercel did not immediately respond to a request for comment. Blockaid's PR agency said the firm was looking into The Block's questions.Suspensions lifted Saturday morningThe suspensions on the hijacked domains appear to have been lifted by late Saturday morning, registry records show. The domains resolve again and now carry locks that block transfers and, for most of them, other changes.Name.com has allegedly told at least one affected project that the breach was not on its end. Cloakd, the developer behind FluxBeam, said on X that its representative at Name.com was "taking the stance that it’s not them but the 3rd party issuers."Updated at 2:00 p.m. ET with details from the lifted suspension and Cloakd's post.Update, Oct. 31, 3:37 p.m. ET: Name.com said 15 customer domains were affected, more than the 12 Blockaid identified."name.com identified unauthorized activity late Friday, October 30, that redirected a number of domains registered through the platform,” a Name.com spokesperson said in a statement to The Block. "name.com has restored all affected domains and is working directly with the name.com account holders. We’re continuing to investigate and have taken steps to secure the accounts involved."Name.com also said on X that the domains "were improperly redirected late Friday as part of a plan to access visitors’ crypto wallets," and urged customers to check their DNS records and enable two-factor authentication. Vercel said in a security bulletin that 10 of the affected domains were associated with its platform, that Name.com has restored them and that it is assisting in the investigation.