A dozen DeFi websites were hijacked through Name.com and turned into wallet drainers

In the early hours of Saturday 31 October 2026 (UK time), at least twelve DeFi websites stopped showing their real front-ends. Their domain names had been pointed at copies run by attackers, and those copies carried a wallet drainer: a kit that asks a visitor's wallet to sign what looks like a normal transaction and instead hands over their tokens.

The smart contracts behind these projects were not hacked. The attack happened one layer up, at the domain name. That is what makes it worth understanding, because a visitor typing the correct address into their browser still landed on the fake site.

What happened

Every affected domain was registered through Name.com, a domain registrar. Blockaid, a wallet security firm, flagged the first two sites (Flap and Kintsu) and then named ten more, all serving the same drainer kit, which it identified as Step Drainer.

The twelve domains Bitquery lists in its analysis are:

Name.com later put the number of affected customer domains at fifteen, so the list above is the confirmed core rather than the full set.

Roughly, in UK time (which has been GMT since 25 October):

• Around 01:00: the first wallets are drained, per Bitquery's on-chain data. Flap's site was reported compromised shortly after.
• Around 03:00: Blockaid publishes warnings, first about Flap and Kintsu, then the further ten sites.
• Around 03:50: users start pointing at Name.com as the common factor.
• 05:33: the last drain in Bitquery's data.
• Around 12:30: Name.com suspends ten of the domains at registry level ("client hold"), taking them offline entirely.
• Later on 31 October: the suspensions are lifted with transfer locks in place, and Name.com tells The Block it "has restored all affected domains and is working directly with the name.com account holders."

How much was taken

The two published figures disagree, and the reason is useful:

Bitquery says the gap is mostly about $57,000 of stolen Kintsu stake that had already moved into Kintsu's unstaking queue, so it no longer showed in the attackers' balances. Both figures leave out losses on Solana and Aptos, so both are floors.

The losses were extremely concentrated. Per Bitquery, a single Kintsu staker on the Monad network lost about $160,500, roughly four in every five dollars taken, and two wallets account for 96% of the total. More than half the victims lost under $100. Several protocols, including FluxBeam and StonkFun, said they were not aware of any of their users being affected.

Whose fault was it?

That is not settled. Two names keep coming up:

• Vercel, a hosting platform many of these sites run on. Kintsu said publicly that "it was something that happened on Vercel's end that was out of our control", and Origami warned of an attack on Vercel-associated nameservers. Vercel's own security bulletin says it is aware of ten affected domains associated with its platform, that Name.com has restored them, that it is assisting the investigation, and that no action is required from its customers. It does not state a cause.
• Name.com itself. Every affected domain was registered there, and Name.com described the domains as "improperly redirected" in a campaign to reach visitors' wallets. At least one affected project said Name.com told it the problem was with third parties.

Not every affected site was hosted on Vercel; Cloudflare and Name.com's own nameservers also appear. As of 2 November no root-cause report has been published by either company.

Why this matters if you use DeFi

A domain hijack defeats most of the advice you will have read about phishing. The usual rule is "check the URL", and here the URL was correct. Bookmarking the site would not have helped either: the bookmark points at the domain, and the domain was what had been taken.

What still protects you:

• Read what you are signing. A drainer works by getting an approval or transfer signed. If a swap or a stake suddenly asks for an unlimited approval on a token you were not using, or your wallet shows an unfamiliar contract, stop. Our guide to common DeFi scams covers how drainer prompts are dressed up.
• Use a hardware wallet for anything you could not afford to lose. It will not stop you signing a bad transaction, but it forces every signature through a separate screen, which is a moment to notice something is off. Our DeFi wallet comparison covers the options, and a device such as the Ledger Nano S Plus is a sensible first step up from a browser wallet.
• Keep a separate wallet for trying new protocols. The large losses here came from wallets holding substantial staked positions. Our guide to setting up an Ethereum wallet walks through creating a second address.
• Check and revoke approvals after an incident. If you visited any of the domains above in the early hours of 31 October and connected a wallet, review its token approvals and revoke anything you do not recognise. Our wallet security best practices explain how.
• Watch the project's own channels during an incident. Blockaid's warnings and the projects' own posts were out within a couple of hours, well before the domains were suspended.

If you lost funds, report it to Action Fraud. It is unlikely to recover crypto stolen this way, but a report is what gets an incident counted.

What this does not resolve

• The root cause. Whether the redirects came from a compromised Name.com system, a reseller or a hosting provider has not been confirmed by anyone involved.
• The final loss figure. Neither published estimate includes Solana or Aptos, and the Monad-heavy total moves with the MON price: Bitquery notes that a 10% move shifts its figure by about $16,300.
• Whether funds will be returned. No project has announced a reimbursement at the time of writing, and Origami's vaults were still paused pending a root-cause analysis.

There is also a regulatory echo. The FCA is currently consulting on when a DeFi front-end needs authorisation in the UK, which we covered in FCA consults on when a DeFi front-end needs authorisation. This incident is a reminder that the front-end is the part of DeFi most users actually touch, and the part attackers find easiest to reach.

Sources

• The Block, Hackers hijack a dozen DeFi websites, all registered with Name.com, and steal about $138,000, 31 October 2026, including Name.com's statement
• Vercel, Name.com domain takeover notice (security bulletin)
• Bitquery, Name.com DNS hijack investigation, on-chain analysis to 18:30 UTC on 31 October
• Statements from Name.com, Kintsu, Origami, FluxBeam and StonkFun on X, as reported by The Block

This is news, not financial advice. See our disclaimers and risks.