Hackers hijacked a dozen decentralised finance websites late on Friday night and turned the sites against their visitors, planting wallet-draining malware that siphoned off about $138,000 before the domains were shut down and restored. The attack did not touch any smart contract. Instead, it went after the web layer every user trusts: the domain names themselves.

The first signs appeared on Friday, October 30, when Flap, a token launch platform, was flagged as compromised at 9:10 p.m. Eastern time. Its engineers soon confirmed a DNS hijack was sending traffic to an unauthorised server. Security firm Blockaid published its first alert at 10:54 p.m., naming Flap and Kintsu as serving the malicious payload. By 11:16 p.m. its scanners had found the same fingerprints on ten more DeFi front ends.

One registrar tied them all together

The twelve hijacked domains spanned Ethereum-compatible chains, Solana and Aptos: Flap, Kintsu, Pickle Finance, Origami Finance, SupSwap, Longbow, Shprd Finance, Apex DeFi, StonkFun, FluxBeam, StakePoint and Echelon Market. They used different DNS hosts, yet registry records reviewed by The Block showed one shared point: every domain was registered through Name.com, a subsidiary of Identity Digital.

That shared registrar turned separate incidents into one campaign. Registrar-layer access lets an attacker overwrite the nameserver delegation for any domain it manages, sending visitors to attacker-controlled servers even when they type the right address. The fake pages even carried valid HTTPS certificates, since DNS control lets an attacker pass automated certificate checks within seconds.

At 8:32 a.m. Eastern on Saturday, Name.com placed ten of the twelve domains under clientHold status, an emergency registry switch that stops a domain resolving entirely. Flap and Kintsu were the exceptions only because their teams had changed nameserver delegation overnight. Name.com later said 15 customer domains were hijacked, including ten tied to Vercel, and that all affected domains had been restored. It advised customers to review their DNS settings and enable two-factor authentication.

How Step Drainer emptied wallets

The hijacked pages were rigged with Step Drainer, a commercial malware-as-a-service kit documented by LevelBlue SpiderLabs in April 2026. It is sold for about $750 for the full source code, or $150 upfront plus a 20 percent cut of each theft, and it supports more than twenty blockchain networks.

The kit cannot read private keys or seed phrases. Instead it abuses authorisation features users are trained to approve: after a visitor connects a wallet, the drainer inventories its tokens, then pushes the victim toward signing an off-chain permit or approval letting an attacker move those tokens. Signing a permit costs no gas and sends no transaction, so many users read it as a harmless login check. On-chain tracing by The Block put confirmed losses at about $138,000 across Ethereum, BNB Chain, Monad and Robinhood Chain, split across three recipient wallets in fixed 55, 30 and 15 percent shares. Losses on Solana and Aptos are not yet counted, so the final figure may rise.

Domains restored, but the root cause is open

Kintsu, Origami Finance, FluxBeam and StonkFun said their on-chain contracts were untouched, and Origami kept its vaults paused pending a root-cause analysis. Users who interacted with any hijacked site after midnight UTC on October 31 were urged to revoke active token allowances and move assets.

How the attackers got in remains unconfirmed: a direct compromise of Name.com's infrastructure, or abuse of the partner API chain, since Vercel uses Name.com as the backend registrar for domains bought through its dashboard. The incident is a reminder that in crypto, the weakest link is not always the code. Sometimes it is the address bar itself.

By Hamza Faisal