Attackers hijack DeFi websites registered with Name.com, stealing at least $138,000

Attackers redirected the websites of at least a dozen decentralized finance projects registered with the domain registrar Name.com and used them to trick visitors into approving transfers out of their wallets, The Block reported on October 31. Name.com later said unauthorized DNS changes were made to 15 customer domains on October 31 (UTC) and that it had revoked system access for the account where the changes originated.

What happened

In an incident notice posted on its status page on November 3, Name.com said unauthorized DNS changes were made to 15 customer domains on October 31 (UTC), that all changes were restored by 16:11 UTC that day, and that system access for the account where the changes originated had been fully revoked. The notice links to a fuller root cause analysis. Blockaid said the hijacked sites were rigged with Step Drainer, a kit that tricks users into approving transfers from their wallets, The Block reported.

Blockaid identified 12 hijacked DeFi sites, according to The Block. Projects named in the report include Flap, Kintsu, Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun, and StakePoint. Vercel said in a security bulletin that nine domains associated with its hosting platform were affected; earlier reports cited 10.

How much was taken

Three EVM wallets linked to the attack held about $138,000 late on the morning of October 31, US Eastern time, according to The Block's on-chain review. That figure does not include losses on Solana or Aptos, so the total is likely higher.

Kintsu, Origami, FluxBeam, and StonkFun said their on-chain contracts had not been affected, The Block reported. The attack targeted the websites users visit, not the code that holds funds.

Why it matters

The attack worked through a point of failure that sits outside the blockchain: the domain registrar. Projects that never had a smart contract bug still exposed their users, because the address people typed led somewhere else.

What it could mean for traders

Wallet approvals are the critical step. A transaction that asks for an unlimited token approval or a transfer to an unknown address is the warning sign, whatever the website looks like. Users who interacted with the affected sites around October 31 can check and revoke token approvals with their wallet or a block explorer.