November 01, 2026 – Attackers took over a dozen protocol websites on October 30 and loaded a wallet drainer, and the only common link was the registrar.
In Summary
Twelve DeFi websites registered with Name.com were hijacked late on October 30 and served a wallet drainer.
Early onchain tracing put losses near $138,000 across three attacker wallets.
The sites used Step Drainer, a kit that sells for about $750 or $150 plus a 20% cut.
The root cause remains unconfirmed, and Name.com and Vercel have not explained the breach.
A DeFi domain hijack hit at least 12 crypto websites late on October 30. Every domain traced back to one registrar, Name.com. Attackers pointed the sites to a wallet drainer. As a result, users who connected wallets risked handing over their tokens. Early onchain tracing put losses near $138,000 across three attacker wallets.
How the DeFi Domain Hijack Unfolded
Security firm Blockaid flagged the campaign and listed the affected sites. Its first warning came at 10:54 pm ET on Friday. By then, attackers had already held the site of Flap, a BNB Chain project, for nearly two hours. Other victims included Kintsu, Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun and StakePoint.
The damage spread across several chains. On EVM sites, users of Ethereum, BNB Chain, Monad and Robinhood Chain faced the drainer. FluxBeam, StonkFun and StakePoint run on Solana, while Echelon runs on Aptos. Notably, the projects used different DNS hosts, including Cloudflare, Vercel and Name.com itself. The one shared link was the registrar. A registrar controls who owns a domain and where it points. So one weak spot there can expose many sites at once.
Name.com’s first public reply came at 12:27 am ET on Saturday. It asked affected users to file an abuse report. At 8:32 am, the registrar put ten domains on hold. Name.com lifted those holds by late Saturday morning but kept transfer locks in place. As of Saturday, it had not publicly explained how the attackers got in.
A Drainer Sold as a Service
The sites loaded Step Drainer, a theft kit that criminals rent or buy. LevelBlue SpiderLabs researchers described it in April. Buyers paid about $750 for the full source code. Alternatively, they could pay about $150 and hand the seller 20% of each theft. It claims support for more than 20 blockchains.
Each DeFi domain hijack of this kind works in much the same way. First, a victim visits a trusted web address and connects a wallet. The fake page then asks for a token approval or a permit signature. Once the victim signs, the attacker can take the tokens at will.
Following the Money Onchain
The three attacker wallets split proceeds on a fixed 15%, 55% and 30% basis. Catenaa checked their balances on November 1. Together, they held about 5.23 million MON, worth roughly $102,000 at $0.0195 per token, on Monad’s explorer. Their small BNB balances also mirror the 15, 55 and 30 split.
In addition, a separate BNB Chain Safe wallet received about 3.1 BNB from four wallets on Friday night. It still held 2.27 BNB on November 1. The victim count is still unknown, and no project has published one.
Name.com, Vercel and an Open Question
No party has confirmed the root cause. Kintsu blamed Vercel, and Origami cited an attack on Vercel-linked nameservers. Meanwhile, a Name.com staffer reportedly told one developer that third parties were to blame. The two firms do work together. Vercel picked Name.com as registrar for its rebuilt domain service, a December 2025 release shows.
Separately, Vercel disclosed a breach in April that began with a compromised third-party AI tool. It closed that incident on October 16, 2026. Neither company has tied that case to this attack.
Several projects said attackers never touched their smart contracts. Still, anyone who connected a wallet on Friday night should review and revoke token approvals. Ultimately, a DeFi domain hijack can get around audited code entirely. The weak point is the website, not the contract.
