DeFi DNS hijack: Name.com counts 15 domains, Blockaid named 12 sites, and the cause is still unconfirmed

Update, 2 November 2026, 06:03 UTC: Name.com now says 15 customer domains were affected, according to The Block, while Blockaid named 12 sites; no source we read reconciles the two counts. Vercel says in a bulletin that 10 domains associated with it were hit. Bitquery counts $202,386 taken from 32 wallets on six chains, against about $138,000 on EVM chains in The Block’s count: two methods, and neither includes Solana or Aptos. The cause is still unconfirmed.

Attackers took over the web addresses of DeFi projects late on Friday 30 October US time, early Saturday in UTC, and used them to serve a wallet-draining kit to people who had typed the correct URL. Name.com says 15 customer domains were affected in this DeFi DNS hijack, The Block reported, while security firm Blockaid named 12 sites; no source we read lists the 15 or reconciles the two counts. Loss estimates differ by method: about $138,000 on EVM chains in The Block’s count, and $202,386 in Bitquery’s. Neither includes Solana or Aptos.

Kintsu, Origami, FluxBeam and StonkFun say their onchain contracts were untouched, and Longbow says the same of its own. What changed was the path between a domain name and the website behind it. About 16 hours after the first site appeared compromised, Name.com said on X at 17:13 UTC on Saturday that “a number of domains at name.com were improperly redirected late Friday as part of a plan to access visitors’ crypto wallets”. It added that the affected domains are restored and that it is still investigating. It did not say how the redirects were made.

Name.com counts 15 domains but gives no entry point

Until that post, the registrar’s only reported public response was a reply on X at 04:27 UTC asking two users to fill in its abuse form, according to The Block. The outlet said Name.com’s press address did not accept its request for comment, and that parent company Identity Digital had not responded. Name.com’s X statement names no domains and gives no count, so it does not by itself tie the registrar to each of the 12 sites.

The registration records do. Coindaro read the public registry records at 17:55 UTC on Saturday, through RDAP and, for Flap’s flap.sh, the .sh WHOIS server: all 12 domains list Name.com, Inc. as registrar, in line with The Block’s check. A shared registrar is a lead, not a finding. FinanceFeeds makes the same point: it does not establish that Name.com’s own systems were breached.

The count came later on Saturday. In an update at 19:37 UTC, The Block reported that Name.com said 15 customer domains were affected. A spokesperson told the outlet that Name.com “identified unauthorized activity late Friday, October 30”, has restored all affected domains and is working with the account holders. “We’re continuing to investigate and have taken steps to secure the accounts involved,” the statement said. Name.com’s X post also urged customers to check their DNS records and turn on two-factor authentication, The Block reported.

None of this comes with a list. Without the 15 names, Name.com’s figure cannot be checked against Blockaid’s 12, and no source we read explains the gap. Name.com’s blog had no post on the incident when we read it on 2 November; its latest item dates from 23 October.

How the DeFi DNS hijack reached people who typed the right address

DNS is the address book of the web. It tells a browser which server stands behind a name such as pickle.finance. Change that entry at the source and the name stays right while the destination is wrong, so a bookmark or a carefully typed URL gives no protection. There is no misspelled lookalike domain to spot.

Flap said on X that its site was “redirecting to an unauthorized website”. Security researcher Ogle described an injected script that sent visitors who clicked the connect button to a drainer page, according to crypto.news. Blockaid said the sites were “actively serving the Step Drainer”.

Step Drainer is malware sold as a service. It works by getting a visitor to approve a transfer or sign a malicious message after connecting a wallet. LevelBlue SpiderLabs described it in April as selling for about $750 with full source code, or about $150 plus a 20% cut of each theft, The Block reported. Crypto Briefing says it reportedly works on more than 20 networks. The kit does not need anyone’s private key. The harm depends on what a user approves or signs, and an approval stays valid after the tab is closed.

Blockaid’s list of 12 sites, and why other lists differ

We use Blockaid’s own posts, opened on X, rather than the versions relayed by outlets. Its first alert, at 02:21 UTC on Saturday, named flap.sh, kintsu.xyz and stonkbrokers.cash. At 02:54 UTC, the time The Block gives for the alert, it edited that post and dropped stonkbrokers.cash. The StonkBrokers founder called the alert a false positive and said the domain was not the platform’s official site, EconoTimes reported. Copies of Ogle’s warning also carried that name, crypto.news noted, which explains the 13th site in some lists. At 03:16 UTC it added ten more domains. The Block’s piece names eight of the 12.

The table covers Blockaid’s 12 as we read them on 31 October, not the 15 Name.com counts. Read the nameserver column with care. It shows where each domain points now, not where it pointed on Friday, so it cannot settle which setup was hit. Crypto Briefing says the hijacked domains all depended on Name.com’s own nameservers and that some teams regained control by moving to Vercel and Cloudflare. The Block and FinanceFeeds instead report a mixed setup across Cloudflare, Vercel and Name.com. “No statement found” means only that our search turned up nothing.

Ten domains went on “client hold” at 12:32 UTC on Saturday, The Block reported, a registrar-level status that stops a name from resolving. Flap and Kintsu were not among them. By the evening the holds were gone: none of the 12 records carried that status at 17:55 UTC. Eleven had last been changed between 14:22 and 16:06 UTC, and flap.sh at 06:30 UTC. A live domain is not an all-clear from the project, and the table shows how few have given one.

Two loss estimates, $138,000 and $202,386, and neither counts Solana or Aptos

The Block found about $138,000 sitting in three attacker wallets late on Saturday morning US time, mostly in MON and Robinhood Chain ETH. Proceeds were split at fixed shares of 15%, 55% and 30%. On Monad, two wallets redeemed Kintsu’s staked MON and withdrew from the lending market Neverland. On Robinhood Chain, one wallet pulled tokenized stocks including NVDA and AAPL from Morpho and swapped them for ETH.

A separate trail starts earlier. Between 01:00 and 01:42 UTC, four wallets sent funds to a Safe multisig wallet on BNB Chain, which took in about 3.1 BNB, roughly $2,200 by The Block’s estimate. About 2.27 BNB was still there on Saturday morning.

Bitquery, a blockchain data firm, reached another number by another route. Its report of 31 October counts what each victim lost, at the price when each drain happened: $202,386 from 32 wallets on six chains, in drains between 01:00 and 05:33 UTC. One Kintsu staker on Monad lost $160,531, about 79% of that total, and two wallets account for 96%. Another 15 wallets lost under $1 each and sit outside the 32.

We do not merge or average the two figures, because they measure different things. The Block’s is a balance: what three attacker wallets held. Bitquery’s is a tally from the victims’ side, and it says those wallets held about $139,000 that evening. Most of the gap, by Bitquery’s account, is about $56,600 of stolen Kintsu stake still sitting unclaimed in Kintsu’s unstaking queue. If Kintsu’s contracts allow the team to hold or cancel a request, Bitquery writes, that money could still be stopped; the sources we read do not say whether they do.

Bitquery calls its own numbers a floor, because a collector contract that took funds and never paid out would be missed. It also says a 10% move in MON shifts its total by about $16,300. It found the same 55%, 30% and 15% split as The Block. It also reads the BNB Chain Safe as the drainer’s collector, not a safe: that address passed three payments on within seconds and still held 2.27 BNB that evening.

Neither number is the full bill. FluxBeam, StonkFun and StakePoint run on Solana and Echelon on Aptos, and both The Block and Bitquery leave those chains out; Bitquery says no drainer addresses have been published for them. No project has published a victim count, no attacker has been identified, and no total loss has been confirmed. FluxBeam reported “no reports of users being affected” and StonkFun said it was “not aware of anyone affected”. The BNB transfers The Block found show at least four wallets did send money, and Bitquery counts seven drained on that chain.

Saturday’s timeline, converted to UTC

US Eastern, the zone The Block uses, was four hours behind UTC on these dates, and Paris one hour ahead. Post times come from X; the drain window is Bitquery’s; the others are The Block’s.

Root cause still unconfirmed: Vercel and Name.com are suspected, not proven

Nobody has shown where the attackers got in. The suspicion falls on two companies, and it comes from affected projects. Kintsu said kintsu.xyz was “registered through @vercel Domains” and hijacked at registrar level, calling it an apparent supply chain attack, and told The Block: “It was something that happened on Vercel’s end that was out of our control.” Longbow made the same claim: “The hijack happened at @vercel Domains, the registrar for longbow[.]cash”. Origami first cited “an active attack on Vercel-associated Nameservers”, then said it was waiting for “root cause analysis from Vercel / name[.]com”, both quoted by The Block.

The two names may be one route. Name.com said in December 2025 that Vercel had picked it as registrar for its rebuilt domain service, per The Block, so a domain bought through Vercel would show Name.com in public records. That fits what we read, but it does not show that every affected domain came through Vercel. Punkquidity told The Block it could not yet determine “whether Name.com itself or a reseller like Vercel did it”. Kintsu’s latest post that we read, at 05:27 UTC, says only that it is still working with its registrar to confirm the cause.

Vercel has since spoken. A bulletin on its site dated 31 October says: “We are aware of 10 domains associated with Vercel that were impacted.” It calls Name.com “a domain registration partner”, says Name.com is investigating a takeover campaign aimed at crypto companies and has restored those domains, and says Vercel is in contact with the customers concerned and is assisting in the investigation. “No customer action is required” is addressed to Vercel’s customers, not to anyone who connected a wallet.

The bulletin does not explain how the takeover worked or say whether Vercel’s own systems were involved, and it does not list the 10. No source we read says they are the ten domains placed on client hold, and one fact argues against it: Kintsu, which says it registered through Vercel, was not on hold.

Name.com’s view of the blame is known only second-hand. Cloakd, the developer behind FluxBeam, said on X that its Name.com representative was “taking the stance that it’s not them but the 3rd party issuers”, The Block reported. That is one project’s account of a private exchange, and Name.com’s published statements do not say it. Bitquery’s report also treats the cause as not confirmed.

Before the bulletin, Vercel had made no public comment as of Saturday morning US time and had not answered The Block. Its status history listed no incident for 30 or 31 October when we read it at about 17:55 UTC, and its security bulletins page listed none on the subject then. Vercel disclosed an internal breach in April 2026 tied to a compromised third-party AI tool; no source we read links that to this wave.

What to do if you connected a wallet on 30 or 31 October

Kintsu’s window is the most specific one published: anyone who connected or signed since about 00:00 UTC on 31 October should revoke approvals and move funds. Flap’s founder said connections made before the incident were not affected, according to EconoTimes. Both windows concern a specific project, so apply them to the site you used.

• Stay off the listed domains until the project itself posts an all-clear on its official accounts, even when the site looks normal. Longbow warned that some networks can show the malicious site for up to an hour while DNS caches clear.
• Check your wallet’s recent transactions on each chain you use for transfers you do not recognise. On Solana or Aptos sites, read your wallet’s activity list and check whether your approvals tool covers that network.
• Review and cancel token approvals you do not recognise. Kintsu pointed users to Revoke.cash, and our guide to using a DEX safely shows how to check and revoke them. Each revocation is a transaction that costs gas, and it stops future transfers without returning anything already taken.
• If you signed anything suspicious, move what remains to a new wallet with a new seed phrase, since a signed message may not appear in an approvals list. Kintsu told its users to revoke and move funds.

FinanceFeeds notes that connecting a wallet does not by itself mean funds are gone, but that a malicious approval can authorise a transfer long after the visit. A hardware wallet does not change that: if you sign, the signature is valid. Our guide to avoiding crypto scams covers the wider habits, starting with reading what the wallet shows before you confirm.

Registrars have been the weak link in DeFi before

Galxe was hit in October 2023 through the registrar Dynadot. On 1 November 2023, Frax Finance lost control of frax.finance and frax.com, also registered at Name.com, which then confirmed they were back on the right nameservers. In July 2024, Compound’s site, on a domain registered at Squarespace, was redirected to a phishing page, while Celer said it intercepted a takeover attempt. Curve moved to a new domain in May 2025 after attackers redirected its site to a draining clone, and Aerodrome and Velodrome suffered a similar hijack in November 2025.

A smart contract audit covers none of this. This wave reached at least 12 projects on several chains in about two hours, between the first report on Flap and Blockaid’s second list. A shared point of failure would explain that, but nobody has established one.

What comes next

Name.com has promised updates in its X thread, and that thread is where a root cause, a list of the 15 domains or the entry point would first appear. Origami’s vaults are the visible open item: The Defiant’s headline says its DNS is restored but its vaults remain paused. Two counts are also pending: a total for Solana and Aptos, and a victim number from any of the 12 projects.