{"investigation":{"slug":"name-com-defi-domain-hijacking-october-2026","entity_name":"Name.com DeFi Domain Hijacking (October 2026)","trust_score":15,"severity_base":null,"score_modifier":0,"confidence":0.65,"status":"published","content_type":"investigation","summary":"On the night of October 30-31, 2026, attackers hijacked the DNS/domain settings of at least 12 decentralized finance project websites that were all registered through registrar Name.com, replacing legitimate sites with pages running the 'Step Drainer' wallet-drainer malware kit. Security firm Blockaid identified the affected sites; on-chain tracing by The Block found roughly $138,000 moved through three EVM wallets as of the following morning, with losses on Solana and Aptos not yet quantified. Name.com temporarily suspended 10 of the affected domains before lifting the suspensions without a public explanation of root cause, and some affected projects publicly attributed the breach to registrar partner Vercel rather than to their own infrastructure.","sections":[{"content":"Late in the evening of Friday, October 30, 2026 (Eastern Time), the website of DeFi project Flap was compromised, with security firm Blockaid flagging unauthorized activity affecting Flap and the staking protocol Kintsu around 10:54 p.m. ET that night. Blockaid subsequently identified at least 12 hijacked domains in total, all registered through domain registrar Name.com, including Flap, Kintsu, Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun, and StakePoint. Name.com later stated that 15 of its customer domains were affected. The hijacked sites were altered to serve a wallet-drainer malware kit identified as 'Step Drainer,' which presents visitors with deceptive wallet-connection and transaction-approval prompts designed to trick them into authorizing transfers of their crypto holdings once they connect a wallet to the compromised site.","heading":"The incident","sources":[{"url":"https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251","name":"The Block: Hackers hijack a dozen DeFi websites all registered with Name.com, steal about $138,000","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Blockaid identified the malicious code on the hijacked sites as 'Step Drainer,' a malware-as-a-service drainer kit. Security researchers at LevelBlue SpiderLabs described Step Drainer in an April 2026 report as being sold commercially, reportedly for about $750 for the full source code or $150 plus a 20% cut of each theft, and advertised as supporting more than 20 blockchain networks. On-chain analysis cited by The Block found that proceeds from the October 30-31 hijackings were split across three wallets on EVM-compatible chains in fixed shares of approximately 15%, 55%, and 30%, consistent with an affiliate/operator revenue-split structure typical of drainer-as-a-service operations. As of Saturday morning, October 31, 2026, roughly $138,000 had been traced across those three wallets, denominated mostly in MON and Robinhood Chain ETH; a BNB Chain Safe wallet separately received about 3.1 BNB (roughly $2,200) from four addresses between 9:00 and 9:42 p.m. ET on October 30. These figures exclude any losses on Solana (affecting FluxBeam, StonkFun, and StakePoint) and Aptos (affecting Echelon), which had not been quantified in initial reporting. Several affected projects, including FluxBeam, StonkFun, Kintsu, and Origami, stated their on-chain smart contracts were not compromised and that they were not aware of confirmed user losses tied specifically to their sites at the time of reporting.","heading":"Step Drainer malware and stolen funds","sources":[{"url":"https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251","name":"The Block: Hackers hijack a dozen DeFi websites all registered with Name.com, steal about $138,000","type":"news_article","credibility":2}],"severity":"high"},{"content":"According to reporting by The Block, users began publicly flagging the shared Name.com registrar link among the compromised sites around 11:51 p.m. ET on October 30, 2026. Name.com's first public response, around 12:27 a.m. ET on October 31, directed affected users to its abuse-reporting form rather than offering a substantive update. At approximately 8:32 a.m. ET on October 31, ten of the affected domains were placed into registrar-level 'client hold' status, effectively suspending them. By late Saturday morning, those suspensions had been lifted and the domains were resolving again, now carrying transfer locks. In a statement issued October 31, Name.com said it had restored all affected domains, was investigating the incident, had secured the accounts involved, and urged customers to review their DNS records and enable two-factor authentication. The company did not publicly explain why the domains were suspended and then unsuspended within the same day, nor did it confirm a root cause. According to the developer of FluxBeam (Cloakd), a Name.com representative told them the breach was not on Name.com's end and pointed instead to third-party issuers. Name.com's parent company, Identity Digital, did not respond to The Block's request for comment.","heading":"Name.com's response and the unexplained suspension reversal","sources":[{"url":"https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251","name":"The Block: Hackers hijack a dozen DeFi websites all registered with Name.com, steal about $138,000","type":"news_article","credibility":2}],"severity":"high"},{"content":"Name.com served as Vercel's registrar for Vercel's rebuilt domain-registration service, a relationship announced in a December 2025 Name.com press release. Following the hijackings, Kintsu and Origami Finance publicly attributed the breach to Vercel rather than to their own operational security. Kintsu stated, 'It was something that happened on Vercel's end that was out of our control.' Origami Finance warned of 'an active attack on Vercel-associated Nameservers' and paused its vaults pending 'root cause analysis from Vercel / name[.]com.' Vercel had not commented publicly as of Saturday morning, October 31, 2026, but later issued a security bulletin stating that 10 of the affected domains were associated with its platform, that Name.com had restored them, and that it was assisting the investigation. Separately, Vercel had disclosed an earlier, unrelated breach of its internal systems in April 2026, traced to a compromised third-party AI tool; whether that earlier incident has any connection to the October hijackings has not been established and should be treated as a separate matter. As of this writing, the precise technical root cause linking registrar, DNS provider, and platform-level failures across the affected sites remains unconfirmed, and responsibility between Name.com, Identity Digital, and Vercel is disputed between the parties.","heading":"Disputed root cause: Name.com vs. Vercel","sources":[{"url":"https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251","name":"The Block: Hackers hijack a dozen DeFi websites all registered with Name.com, steal about $138,000","type":"news_article","credibility":2}],"severity":"medium"},{"content":"This incident follows a recognizable pattern of registrar- and DNS-level compromises affecting multiple unrelated DeFi projects simultaneously, rather than vulnerabilities in any single project's smart contracts. In a similar prior incident, Frax Finance reported on or around November 1, 2023, that it had lost control of its frax.finance and frax.com domains in a suspected DNS hijacking; registrar Name.com restored the domains to Frax's control the same day, and Frax stated there had been no confirmed instances of user funds being compromised in that episode. Other reported registrar/DNS-level incidents affecting DeFi frontends industry-wide have involved Namecheap (2022, including a reported loss of 16.5 WBTC from one victim) and Squarespace (July 2024, affecting over 100 DeFi protocols including Compound and Celer, also using wallet-drainer payloads). These recurring incidents illustrate a structural risk: DeFi protocols' on-chain contracts can remain secure while their user-facing websites, which depend on third-party domain registrars and DNS infrastructure outside the protocols' direct control, remain an attractive and recurring attack surface for wallet-drainer operators.","heading":"Pattern: recurring registrar-level supply-chain risk in DeFi","sources":[{"url":"https://www.theblock.co/news/ecosystems/2023-11-01-frax-finance-regains-control-over-domain-names-after-potential-hijacking-attempt-260311","name":"The Block: Frax Finance regains control over domain names after potential hijacking attempt","type":"news_article","credibility":2},{"url":"https://decrypt.co/239524/220-defi-protocols-risk-squarespace-dns-hijack","name":"Decrypt: More Than 220 DeFi Protocols Still 'at Risk' From Squarespace DNS Hijack","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2023-11","event":"Frax Finance loses control of its frax.finance and frax.com domains in a suspected DNS hijacking; registrar Name.com restores the domains to Frax's control the same day. No user funds were reported compromised.","source":"The Block","source_url":"https://www.theblock.co/news/ecosystems/2023-11-01-frax-finance-regains-control-over-domain-names-after-potential-hijacking-attempt-260311"},{"date":"2024-07","event":"Mass DNS hijacking tied to registrar Squarespace affects over 100-220+ DeFi protocol websites, including Compound and Celer, with several sites serving wallet-drainer malware.","source":"Decrypt","source_url":"https://decrypt.co/239524/220-defi-protocols-risk-squarespace-dns-hijack"},{"date":"2026-10-30","event":"Flap's website is compromised around 9:10 p.m. ET; Blockaid flags the attack on Flap and Kintsu at 10:54 p.m. ET the same night.","source":"The Block","source_url":"https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251","date_evidence":"Flap's site was reportedly compromised around 9:10 p.m. ET [on Friday, October 30, 2026]; Blockaid ... warned about the attack on Flap and Kintsu at 10:54 p.m. ET Friday."},{"date":"2026-10","event":"Users publicly flag Name.com as the shared registrar linking the compromised DeFi sites.","source":"The Block","source_url":"https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251","date_evidence":"Friday, 11:51 p.m. ET: Users began flagging the shared registrar.","date_original":"2026-10-30"},{"date":"2026-10","event":"Name.com's first public response directs affected users to its abuse-reporting form.","source":"The Block","source_url":"https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251","date_evidence":"Saturday, 12:27 a.m. ET: Name.com's only early public response asked affected users on X to fill out its abuse form.","date_original":"2026-10-31"},{"date":"2026-10","event":"Name.com places 10 of the affected domains into registrar-level 'client hold' suspension.","source":"The Block","source_url":"https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251","date_evidence":"Saturday, 8:32 a.m. ET: Ten domains were suspended at the registrar level with \"client hold\" status.","date_original":"2026-10-31"},{"date":"2026-10","event":"The domain suspensions are lifted later Saturday morning without a public explanation; domains resolve again with transfer locks applied. Name.com later states all affected domains have been restored and secured, and says it is investigating.","source":"The Block","source_url":"https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251","date_original":"2026-10-31"}],"sources_used":[{"url":"https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251","name":"The Block: Hackers hijack a dozen DeFi websites all registered with Name.com, steal about $138,000","type":"news_article","credibility":2},{"url":"https://www.theblock.co/news/ecosystems/2023-11-01-frax-finance-regains-control-over-domain-names-after-potential-hijacking-attempt-260311","name":"The Block: Frax Finance regains control over domain names after potential hijacking attempt","type":"news_article","credibility":2},{"url":"https://decrypt.co/239524/220-defi-protocols-risk-squarespace-dns-hijack","name":"Decrypt: More Than 220 DeFi Protocols Still 'at Risk' From Squarespace DNS Hijack","type":"news_article","credibility":2}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-10-31T20:17:53.426896+00:00","updated_at":"2026-10-31T20:17:58.571+00:00"},"source_quality":{"total":3,"tier1":0,"tier2":3,"tier3":0,"unrated":0},"follower_count":null,"content_updated_at":"2026-10-31T20:17:54.011Z","last_fact_checked_at":null,"fact_check_next_allowed_at":null,"update_next_allowed_at":null}