Hackers hijack a dozen DeFi websites registered via Name.com and drain about $138,000

Hackers take over 12 DeFi websites and empty visitor wallets

Hackers took over a dozen DeFi websites late Friday and used them to drain crypto wallets belonging to people who visited the sites. DeFi, or decentralized finance, refers to crypto apps that run on blockchains without a central company in charge.

Security firm Blockaid identified the 12 hijacked sites, which include Flap, Kintsu, Pickle Finance and Origami Finance. The attackers targeted domains all registered through the same company, Name.com, according to public registry records reviewed by The Block. Onchain data shows roughly $138,000 in stolen funds traced so far.

Key points at a glance

• All 12 hijacked domains are registered through Name.com, and 10 were suspended at the registrar level at 8:32 a.m. ET on Saturday.
• Blockaid said the sites were rigged with Step Drainer, a malware kit that tricks visitors into approving transfers out of their wallets.
• The Block traced about $138,000 to three attacker wallets on EVM chains — a figure that excludes any losses on Solana or Aptos.
• Kintsu and Origami Finance have publicly blamed cloud infrastructure firm Vercel, which has not commented.
• No affected project has reported a victim count so far.

What the security firm and registry records show

Blockaid warned about the attack on Flap and the liquid staking protocol Kintsu at 10:54 p.m. ET on Friday, then named 10 more hijacked sites soon after. X user liquidated0x had flagged Flap's compromised site at 9:10 p.m. ET, and Flap warned users about "a DNS hijacking incident" about an hour later. DNS is the service that tells internet browsers which server a website lives on.

X user bluexxix was among the first to notice the shared registrar, posting at 11:51 p.m. ET that it "seems @namedotcom is compromised." Pseudonymous developer banteg reached the same conclusion on Saturday morning, and X user punkquidity later spotted that 10 of the domains had been switched off within seconds of each other.

The 10 suspended domains now carry a "client hold" status, which stops a domain from resolving in browsers. They include Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun and StakePoint. Flap's and Kintsu's domains were not suspended and remained operational as of publishing time.

Name.com's only public response came at 12:27 a.m. ET, when it replied to two users on X asking them to fill out an abuse form. Its listed press address did not accept The Block's request for comment, and its parent company, Identity Digital, did not immediately respond.

How the Step Drainer malware works

According to Blockaid, the hijacked sites were rigged with Step Drainer, a toolkit that tricks visitors into approving transfers out of their wallets once they connect them to a site. Security firm LevelBlue SpiderLabs described it in April as a "Malware-as-a-Service" kit, reportedly sold for about $750 for the full source code, or $150 for a version that takes a 20% cut of each theft. The firm said the kit claims support for more than 20 blockchain networks.

Where the stolen funds went

Onchain data reviewed by The Block shows the attackers routing proceeds to three wallets in fixed 15%, 55% and 30% cuts. On BNB Chain, a flagged Safe wallet received about 3.1 BNB, worth roughly $2,200, from four wallets between 9:00 and 9:42 p.m. ET on Friday. About 2.27 BNB was still sitting in the Safe on Saturday morning.

The same three wallets received identically split payments on Ethereum, Robinhood Chain and Monad, the network Kintsu runs on. On Monad, two wallets redeemed Kintsu's staked MON token and withdrew from lending protocol Neverland before converting into MON. On Robinhood Chain, one wallet pulled tokenized stocks including NVDA and AAPL out of Morpho and swapped them for ETH.

The three wallets held about $138,000 late Saturday morning, mostly MON and Robinhood Chain ETH. That total only covers EVM-compatible chains. Three of the hijacked sites — FluxBeam, StonkFun and StakePoint — are built on Solana, and Echelon runs on Aptos, so any losses there would sit in other wallets and are not counted.

Projects point to Vercel, but the entry point is unclear

The hijacked sites do not share a DNS provider. Some run on Cloudflare, some on Vercel and some on Name.com's own nameservers. Punkquidity said they couldn't yet tell "whether Name.com itself or a reseller like Vercel did it."

Kintsu and Origami Finance have both publicly blamed Vercel. "It was something that happened on Vercel's end that was out of our control," Kintsu wrote on X, adding that Vercel had not yet responded. Origami first warned of "an active attack on Vercel-associated Nameservers" and later said its vaults would stay paused while it waits for "root cause analysis from Vercel / name[.]com." Flap builder Cedric said the team was reaching out to both companies.

Vercel chose Name.com as the registrar for its rebuilt domain service last year, according to a December 2025 Name.com press release. Vercel had not commented publicly as of Saturday morning, and both companies' status pages listed all systems as operational. In April, Vercel disclosed a breach of its internal systems that it traced to a compromised third-party AI tool, The Block previously reported.

Victim count and full losses still unknown

No affected project has reported a victim count. Onchain data shows at least four wallets sent funds to the attackers on BNB Chain alone. FluxBeam said it had "no reports of users being affected," and StonkFun, which moved its site to new infrastructure overnight, said it was "not aware of anyone affected." Kintsu, Origami, FluxBeam and StonkFun all said their onchain contracts were untouched.

Crypto front-ends have been hit by DNS hijacks before. Aerodrome and Velodrome were hijacked in November 2025, and Galxe was hit in October 2023, when attackers got into the project's account at registrar Dynadot.

Why this matters for DeFi users

The attack shows that connecting a wallet to a familiar-looking website is not always safe, even for well-known projects. If a domain registration or hosting provider is compromised, visitors can be shown a rigged site that appears legitimate. Until the entry point is identified, users of the affected projects cannot know for certain how the takeover happened or whether similar sites remain at risk.

What happens next

Origami said its vaults will stay paused while it waits for a root cause analysis from Vercel and Name.com. Ten of the domains remain suspended, while Flap's and Kintsu's domains were still live at publishing time. Neither Name.com nor Vercel had provided a full public explanation as of Saturday morning, and Blockaid was still reviewing questions from The Block.

This is a developing story.

Sources

• The Block