Hackers hijack a dozen DeFi websites, all registered with Name.com, and steal about $138,000

Hackers who took over a dozen DeFi websites late Friday and used them to empty visitors' crypto wallets targeted domains registered through the same company, Name.com, according to public registry records reviewed by The Block. The Block has traced about $138,000 in stolen funds so far using onchain data.

Name.com is listed as the registrar for all 12 hijacked sites that were identified by security firm Blockaid, and 10 of them were suspended at the registrar level at 8:32 a.m. ET on Saturday.

X user bluexxix was among the first to notice the shared registrar, posting at 11:51 p.m. ET on Friday that it "seems @namedotcom is compromised" as more affected sites surfaced. Pseudonymous developer banteg reached the same conclusion on Saturday morning, and X user punkquidity later spotted that 10 of the domains had been switched off within seconds of each other.

Each of the 10 suspended domains now carries a "client hold" status, which stops a domain from resolving. They include Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun and StakePoint. Flap's and Kintsu's domains were not suspended and are still operational as of publishing time. 

X user liquidated0x flagged that Flap's site had seemingly been compromised at 9:10 p.m. ET on Friday, about an hour before the token launchpad warned its users that its flap.sh frontend had been hit by "a DNS hijacking incident." Blockaid warned about the attack on Flap and liquid staking protocol Kintsu at 10:54 p.m. ET, naming the 10 additional hijacked sites soon after.

Name.com's only public response so far came at 12:27 a.m. ET, when it replied to liquidated0x and bluexxix on X, asking them to fill out its abuse form. Name.com’s listed press address did not accept The Block’s request for comment, and its parent company, Identity Digital, did not immediately respond.

How the drainer works

Blockaid said the hijacked sites were rigged with Step Drainer, a malware toolkit that tricks visitors into approving transfers out of their wallets once they connect them to a site. Security firm LevelBlue SpiderLabs described Step Drainer in April as a "Malware-as-a-Service (MaaS)" kit, reportedly sold for about $750 for the full source code or $150 for a version that takes a 20% cut of each theft. The firm said the kit claims support for more than 20 blockchain networks.

Onchain data reviewed by The Block shows the attackers routing proceeds to three wallets in fixed 15%, 55% and 30% cuts. On BNB Chain, a Safe wallet flagged by liquidated0x received about 3.1 BNB, worth roughly $2,200, from four wallets between 9:00 and 9:42 p.m. ET on Friday. It split the first three deposits among the three wallets, and about 2.27 BNB was still sitting in the Safe on Saturday morning.

The same three wallets received identically split payments on Ethereum, Robinhood Chain, and Monad, the network Kintsu runs on. On Monad, two of the wallets redeemed Kintsu's staked MON token and withdrew from lending protocol Neverland before converting the proceeds into MON. On Robinhood Chain, one wallet pulled tokenized stocks including NVDA and AAPL out of Morpho and swapped them for ETH.

Together the three wallets held about $138,000 late Saturday morning, mostly MON and Robinhood Chain ETH, and almost all of it arrived after the attack started. That's only what The Block could trace on EVM chains. Three of the hijacked sites, FluxBeam, StonkFun and StakePoint, are built on Solana, and Echelon runs on Aptos, so any losses there would sit in other wallets and aren't counted.

Two projects blame Vercel

The hijacked sites don't share a DNS provider, the service that tells internet browsers which server a domain points to. Some run on Cloudflare, some on Vercel and some on Name.com's own nameservers. Punkquidity said they couldn't yet tell "whether Name.com itself or a reseller like Vercel did it." 

Kintsu and Origami Finance have both publicly blamed cloud infrastructure firm Vercel. "It was something that happened on Vercel's end that was out of our control," Kintsu wrote in a reply on X, adding that Vercel had not yet responded. Origami first warned of "an active attack on Vercel-associated Nameservers," and later said its vaults would stay paused while it waits for "root cause analysis from Vercel / name[.]com." Flap builder Cedric said shortly after midnight that the team was reaching out to both companies.

Vercel picked Name.com as the registrar for its rebuilt domain service last year, Name.com said in a December 2025 press release. Vercel had not commented publicly as of Saturday morning, and both companies' status pages listed all systems as operational. In April, Vercel disclosed a breach of its internal systems that it traced to a compromised third-party AI tool, The Block previously reported. 

Number of victims remains unclear

No affected project has reported a victim count as of yet, though onchain data shows at least four wallets sent funds to the attackers on BNB Chain alone. FluxBeam said it had "no reports of users being affected," and StonkFun, which moved its site to new infrastructure overnight, said it was "not aware of anyone affected." Kintsu, Origami, FluxBeam and StonkFun all said their onchain contracts were untouched.

Crypto front-ends have been hit by DNS hijacks before. Aerodrome and Velodrome were hijacked in November 2025, and Galxe was hit in October 2023, when attackers got into the project's account at registrar Dynadot.

Vercel did not immediately respond to a request for comment. Blockaid's PR agency said the firm was looking into The Block's questions.

This is a developing story.