Hackers hijack 12 DeFi websites registered with Name.com, draining about $138K - Crypto Briefing
Hackers hijacked at least 12 decentralized finance websites in a coordinated DNS attack, redirecting users to malicious sites and draining approximately $138,000 in stolen funds.
The attack, reported by security firm Blockaid on October 31, 2026, represents a front-end compromise where DNS records for affected sites were altered. Users typing the correct URLs were redirected to attacker-controlled infrastructure without visible signs of tampering.
Once on the compromised pages, visitors encountered the Step Drainer toolkit, a malicious script designed to trick users into signing transactions that drained their funds. The Block has traced about $138,000 in stolen funds using onchain data, though this figure likely represents only a portion of the total losses.
Attack Method
The attackers exploited a common vulnerability by targeting the registrar layer rather than the smart contracts themselves. Every affected domain was registered with Name.com, creating a single point of failure across multiple unrelated projects.
The attackers effectively rewrote those phone book entries. Users typing the correct URL landed on infrastructure the attackers controlled, with no visible sign that anything had changed.
Affected Projects
Named victims include Flap, Kintsu, StonkFun and Pickle Finance, among others. The compromise was not due to shared code or blockchain, but rather their choice of registrar. Some teams recovered quickly by moving their domains to Vercel and Cloudflare nameservers.
StonkFun reported that its users were not affected by the attack. Name.com had not acknowledged the incident on its status page or blog at the time of reporting, leaving affected teams to handle incident response without public guidance from the registrar.
Security Implications
This attack highlights a troubling trend in DeFi security, where domain management and security hygiene lag behind contract security. Even protocols with flawless smart contracts can lose user funds if the website directing traffic to those contracts gets compromised.
The pattern resembles supply chain attacks in traditional software, where one compromise at a critical infrastructure layer affects multiple downstream projects. Wallet-level transaction warnings from firms like Blockaid offer some defense, but users often blame the project whose name appears on the hijacked site, regardless of where the actual failure occurred.
Related
