Hackers Hijack Domains of 15 DeFi Projects - ForkLog

The incident was first reported by cybersecurity firm Blockaid, which detected malicious pages on 12 sites before registrar Name.com confirmed unauthorized redirection of 15 client domains. Affected projects included Flap, Kintsu, Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun, and StakePoint.

The registrar regained control over the domains, enhanced client account security, and began investigating the incident, according to developers. By the evening of October 31, stolen Kintsu tokens worth approximately $56,600 remained in the unstaking queue, not yet retrieved by the hackers.

Attack Methodology

Hackers altered DNS settings, which link domain names to server addresses, redirecting users entering the correct address of a crypto project to fake sites. On these compromised pages, Blockaid analysts found Step Drainer, a malicious tool for siphoning cryptocurrencies from connected wallets.

Financial Impact

Bitquery analysts estimated losses from 32 wallets across six blockchains at $202,386. Approximately 79% of the estimated damage was attributed to a single wallet on the Monad network, whose owner lost tokens and positions worth $160,531. On-chain data showed that the stolen assets were distributed among three wallets in proportions of 55%, 30%, and 15%.

Investigation Underway

All 12 sites from Blockaid's initial list were registered through Name.com but used different DNS infrastructure providers, including Cloudflare, Vercel, and the registrar itself. Kintsu stated that the issue originated with Vercel, while Origami Finance reported an attack on Vercel-linked name servers.

Vercel confirmed that ten affected domains were associated with its platform and is assisting in the investigation. Teams from multiple affected projects stated that their smart contracts were not compromised. The root cause of the compromise remains unknown, with neither company disclosing how attackers gained access to change domain settings.