Name.com Domains Hijacked: 15 DeFi Sites Redirected to Wallet Drainers

Published November 4, 2026

Late on Friday, October 30, 2026, visitors typing the correct address of a crypto project website landed on a fake copy built to empty their wallets. The address bar looked normal. The site was not. By the time the weekend was over, registrar Name.com confirmed 15 customer domains had been improperly redirected, and on-chain trackers counted roughly $138,000 to $202,000 taken from visitors.

This one matters beyond crypto. The attack worked at the registrar layer — the level that decides where your domain points. Whoever controls that controls every visitor, no matter how good the website itself is.

What happened

The timeline, as reported by The Block and confirmed in part by Name.com:

• Friday evening, Oct 30 — Security firm Blockaid flagged the first compromised sites. The site of the Flap platform was flagged at 9:10 p.m. Eastern; within about two hours Blockaid warned about Flap and the staking service Kintsu, attributing both to a wallet-draining kit known as Step Drainer.
• Overnight, Oct 30–31 — Attackers changed DNS records so at least 12 identified domains resolved to copycat pages running the drainer. Visitors who connected a wallet and approved a transaction had funds taken.
• Saturday morning, Oct 31, 8:32 a.m. Eastern — Name.com placed 10 of the domains on “client hold,” a status that stops a domain resolving at all. The suspensions were lifted later that morning, and the domains resolved normally again, now carrying locks blocking transfers and, for most, other changes.
• Saturday, Oct 31 — Name.com confirmed on X that a number of its customers’ domains “were improperly redirected late Friday as part of a plan to access visitors’ crypto wallets,” said the affected domains had been restored, and said it was investigating. In a statement to The Block it put the total at 15 affected customer domains — three more than Blockaid’s initial list of 12, and three that have not been publicly named.
• Vercel’s role — Web platform Vercel, whose domain service uses Name.com as its registrar, said in a security bulletin that 10 of the affected domains were associated with its platform, that Name.com had restored them, and that Vercel was assisting the investigation.

Named among the affected projects: Flap, Kintsu, Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun and StakePoint, plus longbow.cash, apexdefi.xyz, shprd.finance and supswap.xyz in on-chain firm Bitquery’s wider list.

What it cost

The two loss tallies differ because they count differently, and both are partial:

• The Block traced about $138,000 to attacker wallets on Ethereum-style networks.
• Bitquery counted $202,386 taken from 32 wallets, valued at the moment of each theft. That count excludes Solana and Aptos, so neither figure is a complete total.

One reassuring detail, confirmed by several of the projects: the projects’ smart contracts were not touched. Only the websites were redirected. The damage was done entirely through the front door — visitors trusting a familiar domain name.

What is still unknown

As of November 1, neither Name.com nor anyone else had publicly confirmed how the domain settings were changed. Name.com said it found “unauthorized activity,” restored the domains, secured the accounts involved, and is continuing to investigate. Whether the registrar itself was breached, or individual customer accounts were compromised, has not been established — and that distinction matters for what other Name.com customers should do.

Don’t read the restoration as a resolution. Restored domains and an open investigation is the starting point, not the end of the story. If Name.com publishes a root cause, this post will be updated.

Why the registrar layer is the weak point

A domain hijack bypasses everything you did right on your own site. HTTPS, good code, audited contracts — none of it helps when the name itself resolves to someone else’s server. And the affected sites did not share one DNS setup: Bitquery’s breakdown has six on Vercel’s DNS, three on NS1, two on Cloudflare and one on Name.com itself. The common thread was the registrar, not the DNS host.

That is the same lesson as the October Namecheap seizure, from the other direction: your registrar account is a single point of failure for your entire online presence, whether the threat is an attacker or the registrar itself. Read what happened with Namecheap in October.

What to do this week

If you visited any of the named sites on October 30 or 31 and approved a transaction or signature, revoke those approvals now — that is the advice coming out of the incident coverage, and it is the one action that stops further draining from an approval you already granted.

For every domain you own, regardless of registrar:

1. Turn on two-factor authentication on your registrar account, with an authenticator app rather than SMS where offered.
2. Check your DNS records and nameservers right now. A hijack that is still in place looks exactly like your site working normally to everyone except the attacker. Compare against what you set.
3. Turn on registry lock if your registrar offers it — it requires out-of-band approval for DNS and nameserver changes, which is exactly the change this attack made. At minimum, keep the transfer lock on.
4. Use a dedicated email address for your registrar account, with its own strong password and 2FA. If your registrar email is compromised, every reset flow belongs to the attacker.
5. Monitor your domains. A free uptime or DNS monitor that alerts on nameserver changes catches a redirect in minutes rather than days.

Full checklist: how to protect your domain from hijacking.

Sources

• The Block (via TradingView), “Hackers hijack a dozen DeFi websites, all registered with Name.com, and steal about $138,000,” October 31, 2026: https://www.tradingview.com/news/the_block:8384020e0094b:0-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138-000/
• Crypto Briefing, “Name.com restores hijacked domains after attack hit at least 12 DeFi front ends,” October 31, 2026: https://cryptobriefing.com/name-com-restores-hijacked-defi-domains/
• ForkLog, “Hackers Hijack Domains of 15 DeFi Projects,” November 2026: https://forklog.com/en/hackers-hijack-domains-of-15-defi-projects/