Hackers hijack a dozen DeFi websites via Name.com domains

Attackers seized the web addresses of about a dozen DeFi project sites late on October 30, 2026, sending visitors to lookalike pages that drained their crypto wallets. Every affected site used the same domain registrar, Name.com. Estimates put the theft between $138,000 and $202,386.

Blockchain security firm Blockaid flagged the attack within hours and listed the sites that had been turned against their users. The lower figure comes from The Block, which tracked funds sitting in attacker wallets. On-chain analytics firm Bitquery counted more, $202,386 across 32 wallets, and called even that a floor.

How the sites turned on their users

No app was broken into in the usual sense. What changed was the domain name record, the signpost that sends a web address to the right server. Someone rewrote those signposts for the sites registered through Name.com, so a person who typed the correct address still reached a copy. The contracts held up. The names pointing to them did not.

Blockaid said the fake pages ran Step Drainer, a wallet-drainer kit sold to criminals as a ready-made service. A drainer dresses a theft up as an ordinary approval. A visitor confirms what looks routine and signs their tokens away instead. The sites looked right. The address bar looked right. Only the server behind them had changed.

The hit sites did not even share one hosting setup. Bitquery found they ran on four different DNS providers, among them Vercel, Cloudflare and NS1. What they had in common was the registrar. That pointed to the place where domains are managed, rather than the servers themselves.

Step Drainer is not new either. Security team LevelBlue SpiderLabs described it in April as a malware-as-a-service kit, rented out so that less skilled criminals can run the same theft. The tool does the hard part. The buyer only needs a way to get victims in front of it, which is what the domain hijack supplied.

How the night unfolded

The attack ran in the dark, over a few hours. Blockaid first warned about Flap and Kintsu late on Friday, around 10:54 p.m. Eastern time, after the Flap site was flagged at 9:10 p.m. Name.com posted its first public note just after midnight. By 8:32 a.m. on Saturday the registrar had suspended 10 of the domains, then lifted those holds later that morning as it moved to restore them.

How much was taken, and who lost it

Most crypto thefts this size would pass without much notice. The spread of the damage is what stands out. Bitquery traced $202,386 drained from 32 wallets between 00:00 and 06:00 UTC on October 31. The pain was not shared evenly.

One Kintsu staker on Monad lost $160,531, about 79 percent of everything taken, according to Bitquery. Two wallets together made up 96 percent of the losses. More than half of the victims lost under $100. The largest single theft went through in minutes, at about 01:56 UTC.

Those two loss estimates differ because they measure different moments. The Block counted roughly $138,000 resting in attacker wallets by Saturday evening. Bitquery valued each theft at the price when it happened and added funds still moving through Kintsu's unstaking queue, which pushed its total to $202,386. Both firms said the real number is a floor, not a final count.

By Saturday evening the money had mostly stayed put. Bitquery found about 52 percent swapped into Monad's token or held there, 29 percent still stuck in Kintsu's unstaking queue, and 18 percent sold for ether on the Robinhood Chain. Funds that sit still give investigators a chance to follow them.

Name.com, Vercel and an open question of blame

Name.com said 15 customer domains were hijacked, 10 of them tied to the hosting platform Vercel. Around midday UTC on October 31 the registrar put 10 domains on hold. By late afternoon it had restored them all, and it told customers to review their DNS settings and switch on two-factor authentication.

Who opened the door is still unsettled. Kintsu said the breach "happened on Vercel's end" and was "out of our control." Origami pointed to "an active attack on Vercel-associated Nameservers." Vercel, in a security bulletin, said 10 of the hijacked domains used its service and that it was helping to investigate. Name.com did not answer The Block's request for comment, and its parent company, Identity Digital, did not respond either.

This episode pokes at a sore point for DeFi. The apps run on public blockchains that no single company controls, yet the websites people reach them through sit on ordinary internet plumbing, with registrars and hosts that can be fooled like any other.

A modest haul hides the real worry. This method does not care how big the target is. No big exchange this time. Just a dozen young apps and one shared registrar. Aimed at a site holding billions rather than a few new protocols, the same hijack would not have stayed in the low six figures.

No one has identified the attackers or linked them to a known group. Theft on this scale counts as minor in 2026, a year in which Chainalysis attributed 89 percent of crypto hack losses to North Korea-linked actors.

What to watch

Origami has kept its vaults paused until Vercel and Name.com finish their review. A clear cause should follow in the coming days, and the open question is whether other registrars tighten how domain changes get approved. For now the incident sits beside Keystone's recent website breach as a reminder that the soft spot is often the front end, not the chain.

For people who use DeFi apps, the lesson is older than this attack. A padlock icon and the right web address no longer prove a site is safe. The habit that stops a drainer is plain. Read each transaction before approving it, and trust the request, not the logo at the top of the page.