Name.com registrar hijack redirects a dozen DeFi front ends, drainer pulls $138k

Name.com, a US domain registrar owned by Identity Digital, confirmed that an unauthorized actor redirected a batch of its customer domains overnight on October 30–31, 2026 — hitting at least a dozen DeFi project front ends and funnelling visitors into the Step Drainer wallet-drainer kit. Protocol smart contracts were untouched; the compromise sat one layer up, at the registrar. The Block traced about $138,000 to three EVM payout wallets. Crypto Briefing confirmed Name.com had restored every affected domain by Saturday morning.

What happened

Flap's web front was first flagged around 21:10 ET on Oct 30. Blockaid issued a public warning at 22:54 ET naming 12 compromised DeFi sites, all with DNS tied back to Name.com. Deposits into a Safe wallet on BNB Chain at 0x24497068cA4166ca32a04ae530ce00Cf79755bD5 ran from 21:00 to 21:42 ET. Ten of the affected domains were placed on clientHold by 08:32 ET on Oct 31 and later restored.

Name.com's statement to The Block: the firm "identified unauthorized activity late Friday, October 30" and "has restored all affected domains and is working directly with the name.com account holders." On X, the registrar said the domains "were improperly redirected late Friday as part of a plan to access visitors' crypto wallets."

Named protocols hit, per The Block: Flap, Kintsu, Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun and StakePoint. Blockaid counted 12 affected front ends in total; Name.com later put the number of hijacked customer domains at 15. Vercel, which hosts a chunk of the DeFi front-end layer, said 10 of the affected domains were tied to its platform.

Mechanism — registrar, not contract

Attribution of the exact entry point is still open. Flap called it "a DNS hijacking incident." Origami cited "an active attack on Vercel-associated Nameservers" and paused its vaults pending root-cause analysis from Vercel and Name.com. The affected sites did not share a single DNS provider, which — if confirmed — points up the stack rather than into any one authoritative nameserver.

What is confirmed is the payload. Visitors arriving at an unchanged URL saw a lookalike front end that routed wallet connections through Step Drainer, a prepackaged drainer-as-a-service kit. A drainer collects malicious transaction approvals and permit signatures and uses them to sweep ERC-20 balances, NFTs, and permissioned stablecoins from the signer's wallet. No contract on any of the eight named protocols was patched or paused for a code-level fix because none was exploited.

The split across three payout wallets, visible on-chain, is characteristic of a drainer-as-a-service revenue share:

• 0x5aff449b63c033Df386aF0C45384cd20c5918dBf — 15% take
• 0x012f89Ff307568F8409Bbe379ca92ED41Bc4D386 — 55% take
• 0x7bf2037264efbFF55bD52777772779C1D9e87695 — 30% take

The BNB Chain Safe 0x24497068cA4166ca32a04ae530ce00Cf79755bD5 collected roughly 3.1 BNB in the first 42 minutes of the campaign.

Numbers block

- Front ends compromised (Blockaid)     : 12
- Customer domains hijacked (Name.com)  : 15
- Of which tied to Vercel               : 10
- EVM losses traced (The Block)         : ~$138,000
- Chains covered in the $138k figure    : EVM only (Ethereum + BNB Chain)
- Chains NOT yet totalled               : Solana, Aptos
- First Blockaid warning                : 2026-10-30 22:54 ET
- Domains placed on clientHold          : 10, at 2026-10-31 08:32 ET
- Status                                : all restored

Numbers compiled from The Block's wallet tracing and Name.com's own statements. The $138,000 figure undercounts the campaign: it does not cover losses on Solana or Aptos front ends in the Blockaid list.

Impact — the registrar-level pattern

Smart-contract audits do not cover a project's DNS. The attack surface here is a project's registrar account and the authoritative nameservers it points at — infrastructure most DeFi teams outsource and inherit from their deploy pipeline. Kintsu told The Block: "It was something that happened on Vercel's end that was out of our control." FluxBeam's developer, Cloakd, said Name.com was "taking the stance that it's not them but the 3rd party issuers" — which, as of writing, is the only published public dispute over which layer carries the duty of care.

The practical fallout for users is narrow but severe. Anyone who connected a hot wallet to a listed front end in the ~45-minute window and approved an unexpected permit or setApprovalForAll is already drained; a wallet that only visited and did not sign is not. The right follow-up on-chain is a revoke pass against the affected addresses on revoke.cash across every chain the signer uses.

Action checklist

1. If you connected a wallet to Flap, Kintsu, Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun or StakePoint between 21:00 ET Oct 30 and the restoration window, assume the front end was lookalike and revoke outstanding allowances across EVM, Solana and Aptos.
2. For teams: enable registrar-level two-factor and registry locks on authoritative domains; verify DNS and nameserver records against a known good; check for recent changes to NS, A/AAAA and TXT records.
3. For users: treat an unexpected permit, permit2, or setApprovalForAll prompt as a stop condition, regardless of which URL you typed.

Context — the Nth front-end hijack

Front-end and DNS compromises against DeFi are a recurring class, with prior public cases against Curve (2022, Namecheap DNS hijack), BadgerDAO (2021, Cloudflare worker injection), and Convex / Ribbon fronts. What is different this week is the horizontal spread across one registrar and the drainer kit's commoditised revenue split, visible in the 15/55/30 payout structure. Expect follow-up disclosures from Vercel and from Name.com's parent, Identity Digital, on which account-level control the attacker bypassed; the registrar's own X thread stopped short of naming it.