.png){kind=logo}
Name.com has confirmed that attackers redirected 15 customer domains during a DeFi website hijacking that exposed visitors to wallet theft.
According to the registrar, the unauthorized activity occurred late on October 30. Security firm Blockaid initially identified 12 affected websites, while Vercel later confirmed that 10 of the hijacked domains were associated with its platform.
The attack reached websites belonging to Flap, Kintsu, Pickle Finance and Origami Finance. FluxBeam, Echelon, StonkFun and StakePoint also appeared among the projects Blockaid identified. Public registry records reviewed by The Block showed Name.com as the registrar for all 12 domains in the initial list.
Flap warned users that its flap.sh website had suffered a DNS hijacking. Blockaid later issued alerts covering other projects. DNS records tell browsers which servers to contact, so unauthorized changes can redirect visitors even when they type a project's normal website address.
On October 31, Name.com told The Block that its investigation had identified 15 affected customer domains. The company said it had restored every domain and was contacting account holders. It also reported taking steps to secure the accounts while investigating the unauthorized changes.
Earlier that Saturday, the registrar temporarily suspended 10 domains, stopping their addresses from directing visitors to websites. The restrictions were lifted later that morning. Name.com subsequently advised customers to review their DNS records and enable two-factor authentication.
Blockaid reported that the compromised DeFi websites exposed visitors to Step Drainer. The malicious software prompts users to connect their crypto wallets and approve transactions that can transfer assets to attackers. The attack targeted the websites visitors used, rather than directly changing the projects' blockchain contracts.
The Block traced about USD 138,000 to three wallets across Ethereum-compatible networks as of Saturday morning. Its analysis found payments divided among those wallets in shares of 15%, 55% and 30%. Investigators also identified activity involving BNB Chain, Ethereum, Monad and Robinhood Chain.
However, the USD 138,000 figure does not represent confirmed losses across every affected network. FluxBeam, StonkFun and StakePoint operate on Solana, while Echelon runs on Aptos. The Block's estimate excluded any stolen funds moving through those networks.
Security firm LevelBlue previously described Step Drainer as a toolkit offered to other attackers. Its April research said the software claimed to support more than 20 blockchain networks. The firm reported offers of USD 750 for its source code, or USD 150 plus a share of stolen funds.
In its October 31 security bulletin, Vercel confirmed that 10 domains associated with its platform were affected. It said Name.com had restored them and that Vercel was helping investigate the campaign. Vercel did not identify the source of the unauthorized redirects.
Kintsu claimed, “It was something that happened on Vercel's end that was out of our control.” Origami Finance warned of “an active attack on Vercel-associated Nameservers.” Neither statement establishes which system attackers accessed. The affected websites used different DNS providers, and investigators have not confirmed an entry point.
Kintsu, Origami, FluxBeam and StonkFun reported that their blockchain contracts remained unaffected. FluxBeam and StonkFun also said they had not received reports of affected users. No complete victim count had been released in the available project statements.
Name.com said it was continuing to investigate the incident and working with affected customers. The final value of stolen assets and the method used to redirect the domains remain unconfirmed.
ALSO READ: Binance to Resume Withdrawals Sunday After USD 6.3B Hack as FBI Investigates