Hackers hijack 12 DeFi websites registered with Name.com, draining about $138K

A DNS hijack at the registrar level sent users of Flap, Kintsu, Pickle Finance and others to sites loaded with the Step Drainer toolkit At least 12 decentralized finance websites were hijacked in a coordinated attack. The smart contracts behind them were never breached. The attackers went after the domain names instead. The Block has traced about $138,000 in stolen funds so far using onchain data. Every affected domain was registered with Name.com, according to public registry records the outlet reviewed. How the attack worked Security firm Blockaid reported the incident on October 31, 2026. It described a front-end attack in which the DNS records for the affected sites were altered. The attackers effectively rewrote those phone book entries. Users typing the correct URL landed on infrastructure the attackers controlled, with no visible sign that anything had changed. Once there, visitors met the Step Drainer toolkit. This malicious script was injected into the hijacked pages to trick users into signing transactions. Who got hit Named victims include Flap, Kintsu, StonkFun and Pickle Finance, along with other projects. The common thread was registrar choice rather than any shared c...