Name.com DeFi hijack sent users of 12 sites to a wallet drainer

No smart contract was broken, and users still lost money. The Name.com DeFi hijack late on Friday rerouted at least a dozen decentralized finance websites to look-alike pages loaded with a wallet-draining kit, a reminder that the weakest link in crypto is often the plain old web address.

What happened

Security firm Blockaid flagged the attack, and The Block found that all 12 sites it identified, including Flap, Kintsu, Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun and StakePoint, were registered through Name.com. Flap's site appeared compromised around 9:10 p.m. ET on Friday; ten of the domains were put on hold at the registrar level at 8:32 a.m. ET on Saturday.

Visitors who connected wallets met Step Drainer, a malware-as-a-service kit that tricks users into signing approvals. The Block traced about $138,000 to three attacker wallets on EVM chains, split in fixed 15%, 55% and 30% cuts across BNB Chain, Ethereum, Robinhood Chain and Monad. That excludes any losses on Solana or Aptos, where four of the affected projects run.

By Saturday afternoon Name.com said 15 customer domains had been affected, more than Blockaid's count, that all had been restored and that it had secured the accounts involved. Vercel said ten of the domains were associated with its platform, Crypto Briefing reported.

Why it matters

Front-end attacks bypass audits entirely. Code can be perfectly audited and users can still be robbed if the registrar or DNS layer pointing to its site is compromised, because the browser shows the right URL. Kintsu, Origami, FluxBeam and StonkFun all said their on-chain contracts were untouched.

Blame is still being sorted out. Kintsu and Origami pointed at Vercel, which uses Name.com as registrar for its domain service, while FluxBeam's developer said Name.com was blaming third-party issuers. The pattern echoes other weak points exposed this month, from the lending curbs in our Aave market freeze story to the third-party script behind the Polymarket international halt.

The Block's wallet trail shows how quickly a compromise turns into theft. On BNB Chain, a Safe wallet received about 3.1 BNB from four victim wallets between 9:00 and 9:42 p.m. ET on Friday. On Monad, attackers redeemed staked MON and withdrew from a lending protocol, and on Robinhood Chain one wallet pulled tokenized stocks out of Morpho and swapped them for ether. Step Drainer itself has been sold for about $750 for full source code, security firm LevelBlue SpiderLabs said in April. The low cost helps explain why the Name.com DeFi hijack hit so many sites at once.

What's next

Watch for a root-cause report from Name.com or Vercel and for victim counts from the affected projects, none of which had published one by Saturday. The Block's registrar investigation has the wallet trail.

Users who connected to any affected site on Friday night should review and revoke token approvals. Projects are likely to add registrar locks and DNS monitoring after the Name.com DeFi hijack, steps Name.com itself urged alongside two-factor authentication.

Earlier DNS attacks on Aerodrome, Velodrome and Galxe showed the same lesson, and it keeps repeating.