DNS Hijack at Name.com Drains $138K From 12 DeFi Sites

At least 12 decentralized finance websites were hijacked after attackers altered DNS records at the registrar level, routing visitors to infrastructure the attackers controlled, according to Crypto Briefing, citing a Blockaid security report. All 12 affected domains were registered with Name.com and used that registrar's own nameservers, the outlet said, pointing to public registry records reviewed by The Block. Blockaid flagged the incident on October 31, 2026, characterizing it as a front-end takeover rather than any compromise of the protocols' smart contracts.

Once in control of the pages, attackers inserted the Step Drainer toolkit to prompt visitors into approving malicious transactions, Crypto Briefing reported. Onchain analysis performed by The Block has so far identified roughly $138,000 in stolen funds tied to the campaign, a figure the outlet described as reflecting only what has been tracked to date rather than a confirmed final total.

Projects named as affected include Flap, Kintsu, StonkFun and Pickle Finance, alongside other sites not publicly identified, per the report. StonkFun said in response that its own users were spared from losses. Crypto Briefing noted the underlying contracts for each project remained untouched throughout, since the attack exploited a shared weak point in domain infrastructure rather than code. Several teams reacted by switching their domains to nameservers run by Vercel and Cloudflare, according to the outlet.

Whether Name.com's own systems were breached, or attackers gained access some other way, has not been established. The complete roster of impacted projects and whether the $138,000 figure represents the full scope of losses also remain unconfirmed.