DeFi DNS Hijack Hits 12 Crypto Sites Registered at Name.com

Twelve websites, under five hours, and at least $138,000 gone. That is the early toll of the DeFi DNS hijack that turned familiar crypto front ends into wallet drainers late on Friday, October 30, according to security firm Blockaid and reporting by The Block.

Visitors who typed in addresses for Flap, Kintsu, Pickle Finance or Origami Finance landed on pages that looked normal but ran Step Drainer, a rented malware kit that dresses up theft as ordinary wallet pop ups. Every one of the 12 domains Blockaid flagged was registered through Name.com, The Block found in registry records.

The DeFi DNS hijack in figures

• 12 sites flagged by Blockaid as serving the drainer.
• 15 customer domains affected, by Name.com's own later count, according to The Block.
• 10 of those domains were tied to Vercel's hosting platform, per a Vercel bulletin cited by The Block.
• $138,000 traced by The Block to three attacker wallets on EVM chains, not counting Solana or Aptos.
• $202,386 drained from 32 wallets on six chains, by the tally of blockchain analytics firm Bitquery.
• $160,531 lost by a single Kintsu staker on Monad, roughly four fifths of Bitquery's total.
• 4 hours and 33 minutes between the first drain Bitquery recorded (01:00 UTC on October 31) and the last (05:33 UTC).
• 55, 30 and 15 percent: the split every payout followed across the same three wallets.

Why The Block and Bitquery reached different totals

The Block counted what sat in the three receiving wallets that evening. Bitquery valued each theft at the price when it happened, and it also counted about $56,600 of staked MON tokens still waiting in Kintsu's unstaking queue. Bitquery calls its number "a floor," since it read transfers only up to 18:30 UTC and left out Solana and Aptos.

Either way, the losses were lopsided. Two wallets account for 96% of Bitquery's total, while more than half of the victims lost under $100. Monad took the worst of it at $163,318 across 19 wallets, followed by Robinhood Chain at $35,920. Losses on BNB Chain, Base, Ethereum and Arbitrum were small by comparison.

How a domain registrar became the weak point

No private keys were stolen here. Each drain used the victim's own signature: an approval, a permit or a transfer they were tricked into signing. The attack worked because the web address itself quietly pointed somewhere new.

That is why the Name.com link matters. The 12 sites used four different DNS providers (Vercel DNS, NS1, Cloudflare and Name.com's own), Bitquery found, so the common thread sat at the registrar level above them. Name.com later told The Block that it "identified unauthorized activity late Friday, October 30, that redirected a number of domains," and that it had restored all affected domains. In a post on its official X account, it urged customers to check their DNS records and turn on two factor authentication.

The root cause is still disputed. Kintsu said the problem happened on Vercel's end. Origami pointed to an attack on Vercel associated nameservers. Vercel chose Name.com as the registrar for its rebuilt domain service in December 2025, The Block noted. Neither company has published a technical explanation.

One Friday night, hour by hour (Eastern time)

• 9:10 p.m.: Flap's site is flagged as compromised, and Flap soon describes a DNS hijacking incident.
• 10:54 p.m.: Blockaid warns users away from Flap and Kintsu, then names 10 more sites.
• 11:51 p.m.: An independent researcher notices that every affected site shares Name.com as registrar.
• 12:27 a.m. Saturday: Name.com's first public reply points reporters to its abuse form.
• 8:32 a.m.: Ten domains are suspended at the registrar; the holds are lifted by late morning and transfer locks are added.

Revoke approvals signed on October 30 and 31

If you connected a wallet to any of these front ends during that window, Bitquery suggests revoking token approvals signed on those two dates, and Kintsu reportedly told users to revoke anything signed since midnight UTC. Check Morpho operator permissions and any positions on Kintsu, Neverland or Uniswap. Before reconnecting, confirm through the project's official account that its site is safe again. And ignore anyone who messages you offering to recover stolen funds, a pitch we also warned about after the Binance hack.

It caps a rough stretch for crypto security, following the Chainalysis breach, a suspected Trezor Safe 5 implant and the Coinbase Amplitude incident. More coverage lives on our crypto page.

Name.com says the domains are back in their owners' hands. Until someone explains how the records were changed, a familiar web address is not proof of a safe site.