Based on public registry records evaluated by The Block, malicious actors who seized control of over a dozen decentralized finance platforms late Friday to drain visitors’ digital wallets targeted web addresses registered through the identical service, Name.com. Utilizing onchain analysis, The Block has tracked roughly $138,000 in pilfered assets so far.
Name.com appears as the registrar for all 12 compromised portals discovered by security organization Blockaid, with 10 of them having their registrar-level operations suspended by 8:32 a.m. ET on Saturday.
An X user known as bluexxix was among the initial individuals to identify the common registrar, publishing a message at 11:51 p.m. ET on Friday indicating that “@namedotcom seems to be compromised” as additional impacted platforms emerged. The pseudonymous programmer banteg arrived at the identical deduction on Saturday morning, while X user punkquidity subsequently observed that 10 of the web addresses had been disabled within moments of each other.
Every single one of the 10 deactivated domains presently maintains a “client hold” designation, which prevents a website address from translating properly. These include Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun, and StakePoint. Conversely, the domains for Flap and Kintsu remained unsuspended and active as of the publication time.
X user liquidated0x reported that the Flap website appeared to have been breached at 9:10 p.m. ET on Friday, approximately an hour before the token launchpad cautioned its community that its flap.sh user interface had suffered “a DNS hijacking incident.” Blockaid issued a warning regarding the assault on Flap and liquid staking platform Kintsu at 10:54 p.m. ET, subsequently identifying the 10 extra compromised websites shortly afterward.
Name.com issued its sole public reaction at 12:27 a.m. ET when it responded to liquidated0x and bluexxix on X, requesting that they complete its abuse submission form. The official press contact for Name.com did not reply to The Block’s inquiry for a statement, and its parent organization, Identity Digital, did not issue an immediate comment.
How the drainer operates
Blockaid reported that the compromised websites were embedded with Step Drainer, a malicious software package that deceives users into authorizing withdrawals from their digital wallets after linking them to a platform. Security specialists LevelBlue SpiderLabs characterized Step Drainer in April as a “Malware-as-a-Service (MaaS)” package, reportedly marketed for approximately $750 for the complete source code or $150 for an alternative version that claims a 20% commission on each theft. The organization stated that the software kit asserts compatibility with more than 20 blockchain networks.
Onchain information examined by The Block indicates the perpetrators directing funds to three distinct wallets in precise distributions of 15%, 55%, and 30%. On the BNB Chain, a Safe wallet highlighted by liquidated0x collected roughly 3.1 BNB, valued at around $2,200, originating from four wallets between 9:00 and 9:42 p.m. ET on Friday. It distributed the initial three transfers among the three destination wallets, leaving approximately 2.27 BNB remaining inside the Safe on Saturday morning.
Those identical three wallets gathered identically divided transactions across Ethereum, the Robinhood Chain, and Monad, which is the network utilized by Kintsu. On Monad, a pair of the wallets redeemed Kintsu’s staked MON currency and executed withdrawals from the Neverland borrowing protocol prior to swapping the proceeds for MON. On the Robinhood Chain, a single wallet extracted tokenized equities comprising NVDA and AAPL out of Morpho and exchanged them for ETH.
Combined, the trio of wallets retained approximately $138,000 by late Saturday morning, predominantly consisting of MON and Robinhood Chain ETH, with nearly all of it arriving subsequent to the commencement of the exploit. This figure represents solely the assets that The Block could track across EVM networks. Three of the compromised platforms—FluxBeam, StonkFun, and StakePoint—operate on Solana, whereas Echelon functions on Aptos, meaning any losses sustained there reside within separate wallets and are excluded from this total.
Two projects point fingers at Vercel
The compromised websites do not utilize a unified DNS provider, which is the utility that instructs web browsers which server corresponds to a specific domain name. Certain platforms rely on Cloudflare, others depend on Vercel, and some utilize Name.com’s proprietary nameservers. Punkquidity noted that they could not yet ascertain “whether Name.com itself or a reseller like Vercel was responsible.”
Both Kintsu and Origami Finance have publicly directed blame toward cloud infrastructure provider Vercel. “This was an event that occurred on Vercel’s infrastructure beyond our administration,” Kintsu stated in an X reply, noting that Vercel had not yet provided a response. Origami initially issued a caution regarding “an active attack targeting Vercel-associated Nameservers,” and later declared that its vaults would remain frozen while awaiting “a root cause investigation from Vercel and Name.com.” Flap creator Cedric stated shortly past midnight that his crew was communicating with both enterprises.
Vercel selected Name.com as the registrar for its revamped domain infrastructure during the previous year, according to a December 2025 press release from Name.com. Vercel had not issued public statements as of Saturday morning, and the status dashboards for both businesses indicated all operations were functioning normally. In April, Vercel revealed an internal security breach that it linked to a compromised third-party artificial intelligence utility, as previously reported by The Block.
The volume of victims remains undetermined
None of the impacted initiatives have disclosed a specific tally of victims thus far, though blockchain records indicate at least four distinct wallets transferred assets to the culprits on the BNB Chain alone. FluxBeam announced it had received “no notifications of users experiencing losses,” while StonkFun, which migrated its platform to alternative infrastructure overnight, stated it was “unaware of any affected individuals.” Kintsu, Origami, FluxBeam, and StonkFun all confirmed their onchain smart contracts remained untouched.
Decentralized finance user interfaces have encountered DNS compromises previously. Aerodrome and Velodrome experienced malicious takeovers in November 2025, and Galxe was targeted in October 2023 when perpetrators gained unauthorized access to the initiative’s profile hosted at the Dynadot registrar.
Vercel did not promptly reply to a request for a statement. A public relations representative for Blockaid stated the organization was examining inquiries submitted by The Block.
This is an evolving news story.
Originally published at https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251.
