Name.com Restores 15 Hijacked Domains After Wallet-Drainer Attack on DeFi Sites

Name.com says every customer domain redirected in a two-day attack on decentralized finance websites has been restored. The registrar put the count at 15. Security firm Blockaid flagged at least 12 DeFi sites serving a wallet-draining toolkit.

The attack ran from the evening of Friday, Oct. 30 into Saturday, Oct. 31. The Block traced about $138,000 in stolen funds to three wallets on EVM chains. That figure excludes any losses on Solana or Aptos, which have not been quantified.

What happened

Visitors who typed familiar DeFi addresses landed on lookalike pages controlled by attackers. Those pages loaded Step Drainer, software built to trick users into approving wallet transactions they never intended to authorize.

Flap, a token launch platform backed by YZi Labs, raised the alarm first. It said its domain, flap.sh, was redirecting visitors to an unauthorized site, and it told users not to connect wallets or sign anything.

Blockaid then flagged Kintsu, a liquid staking protocol built on Monad. A follow-up alert named ten more domains serving the drainer: stonkfun.xyz, pickle.finance, echelon.market, origami.finance, fluxbeam.xyz, stakepoint.app, supswap.xyz, longbow.cash, shprd.finance and apexdefi.xyz.

The affected sites ran on Ethereum-compatible networks, Solana and Aptos. The teams affected said their on-chain contracts were not compromised. StonkFun said only its website was hit and that it knew of no affected users.

Two different counts

The numbers do not line up, and they are not meant to. Name.com counts 15 customer domains. Blockaid's alerts covered 12 DeFi sites. The two tallies have different scopes.

Vercel said 10 of the affected domains were connected to its platform. It said Name.com had restored them and that it was helping investigate.

Registry records show all 12 flagged domains were registered through Name.com. Ten of them received a "client hold" status at roughly 8:32 a.m. ET on Oct. 31, which stops a domain from resolving at all. Flap and Kintsu were not in that group when the first findings were published.

Name.com acknowledged that domains had been improperly redirected. It said it had secured the accounts involved and is investigating. It also told customers to review their DNS settings and turn on two-factor authentication.

Who is responsible is still open

A shared registrar does not by itself show that Name.com's systems were breached. The affected projects used different DNS hosts, including Cloudflare, Vercel and Name.com's own nameservers.

Kintsu said its domain was compromised at the registrar level. Kintsu and Origami Finance both pointed publicly to Vercel-related infrastructure as a possible source. Origami said its vaults will stay paused until a root-cause investigation with Vercel and Name.com is finished.

Vercel has not accepted that framing. It says only that 10 of the domains were tied to its platform and that it is assisting.

Vercel chose Name.com as a registrar partner for its domain services in December 2025. Neither company has been established as the original point of compromise.

No attacker has been identified. How the hijackers gained access to the registrar layer remains unknown, and investigators are still working on it.

The toolkit

Step Drainer is sold as a service. Security firm LevelBlue SpiderLabs previously documented it as a malware-as-a-service operation supporting more than 20 blockchain networks. Its reported pricing included a $750 source-code package and a cheaper version that requires operators to share proceeds.

That means the kit is available to anyone willing to pay. Whoever ran this campaign did not need to build it.

It works on approvals and off-chain signatures, not stolen private keys. A user who connects a wallet and signs a malicious permit hands over access voluntarily, without realizing it.

Cleanup

Teams moved fast once the alerts went out. Some limited the damage by shifting their nameservers to hosting services like Vercel or Cloudflare. StonkFun took its site offline and moved to new infrastructure. Flap migrated to a new domain.

Kintsu told anyone who connected a wallet or signed a transaction after 00:00 UTC on Oct. 31 to revoke their approvals.

The old plumbing under the new system

DeFi markets itself on trustless design. Code is law, contracts are immutable, no middleman can freeze your funds.

But the address bar still depends on domain registrars, DNS records and account logins. Those are ordinary internet services protected by ordinary credentials.

This is not the first time. Earlier incidents include a compromised CoW Swap frontend and the DNS hijack of Aerodrome and Velodrome. In each case the contracts did their jobs and users were hit through the website anyway.

The practical fixes are not exotic. Registrar accounts need two-factor authentication, and users should revoke token approvals they do not recognize.

What comes next is the root-cause finding. Origami's vaults stay paused until it arrives, and neither Name.com nor Vercel has said how the attackers got in or when an answer is due.