Name.com domain hijack redirects DeFi sites to wallet drainers, 15 domains hit

About a dozen decentralized finance (DeFi) websites had their domains hijacked at once, sending visitors to fake pages designed to drain their crypto wallets. All of the affected sites used domains registered with domain registrar Name.com. In a post on its official X account early Nov. 1 KST, Name.com said "a number of domains at name.com were improperly redirected late Friday as part of a plan to access visitors' crypto wallets," adding that the affected domains have been restored.

Web hosting company Vercel said in a security bulletin on Oct. 31 that 10 domains associated with its platform were impacted. Crypto news outlet The Block reported that Name.com confirmed 15 affected customer domains.

A Friday night redirect

The attack began on Friday night (Oct. 30) U.S. Eastern time. The domains' DNS records were changed to point to attacker-controlled servers instead of the real ones, so typing the correct address still brought up a fake page. The sequence of events was as follows (KST).

1. Oct. 31, around 10:10 a.m.Token launch platform Flap's site (flap.sh) appears to be the first one compromised, according to The Block
2. Oct. 31, 11:13 a.m.Flap says its official site "is currently affected by a DNS hijacking incident and is redirecting to an unauthorized website," urging users not to visit, connect wallets or sign transactions
3. Oct. 31, 11:54 a.m.Security firm Blockaid issues an alert on a potential frontend attack targeting Flap and Kintsu
4. Oct. 31, 12:16 p.m.Blockaid names 10 more sites hit by the same attack, including Pickle Finance, Origami, FluxBeam and Echelon
5. Oct. 31, 3:53 p.m.Origami pauses all of its vaults
6. Nov. 1, 2:13 a.m.Name.com says on X that the affected domains have been restored

Blockaid said the additional sites were "actively serving the Step Drainer." A drainer is malicious code that, once a visitor connects a wallet and signs, takes over the approvals to spend their tokens and drains them.

Smart contracts intact, only the websites changed

The affected projects said their on-chain smart contracts were not attacked. Origami said "smart contracts and funds in Origami vaults are not affected. Only the Origami website was redirected." Solana-based exchange FluxBeam said it "continues to operate normally on-chain" and that "the compromise is confined to the website." Memecoin launch platform StonkFun said it took its site offline and moved it to new infrastructure to restore it.

There is no official tally of losses yet. The Block traced about $138,000 drained across three attacker wallets, mostly in Monad's MON token and ETH on Robinhood Chain. That figure excludes losses on Solana and Aptos, and the number of victims is unknown. MON is listed on Upbit's Korean won market and traded at 26.3 won on Upbit around 12:30 p.m. KST on Nov. 1.

Vercel or Name.com?

Accounts of the cause differ. Kintsu said "it was something that happened on Vercel's end that was out of our control," while Origami described "an active attack on Vercel-associated Nameservers" (the servers that direct a domain to its host). In its bulletin, Vercel said "Name.com, a domain registration partner, is investigating a domain takeover campaign targeting crypto (DeFi) companies," adding that no customer action is required and that it is assisting in the investigation.

FluxBeam developer Cloakd, however, said it had spoken to its representative at Name.com and that the registrar was "taking the stance that it's not them but the 3rd party issuers." In a statement to The Block, Name.com said only that it "has restored all affected domains and is working directly with the name.com account holders." Origami said its vaults will remain paused until the root cause analysis is complete.

If you signed, revoke approvals first