On the evening of Friday, October 30, 2026, twelve decentralized finance websites were hijacked within hours. All were registered with the registrar Name.com and redirected their visitors to the Step Drainer malicious kit, which enabled the theft of roughly $138,000. This analysis reconstructs the timeline, the on-chain flows and the questions that remain open.
🔑 Key takeaways
- Twelve DeFi sites, including Flap, Kintsu, Pickle Finance and Echelon, were redirected to booby-trapped pages.
- About $138,000 was stolen on EVM-compatible chains, excluding Solana and Aptos.
- Ten domains were suspended at the registrar level at 8:32 a.m. on Saturday, while Flap and Kintsu stayed online.
- Name.com has not confirmed the incident, and the root cause, registrar or Vercel, remains unestablished.
Twelve DeFi Sites Hijacked in a Single Evening
The affected sites belonged to different protocols, spanning lending, liquid staking, token launch platforms and yield tools. They included Flap, Kintsu, Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun and StakePoint. Visitors were redirected to pages hosting the Step Drainer kit. The mechanism is well documented: when a user connects a wallet to the site, the page presents an approval request that later authorizes the transfer of assets. The protocols’ smart contracts were not exploited directly; the trust placed in the domain name and the user interface was hijacked instead.
A Kit Sold as a Service
According to Blockaid, the sites were equipped with Step Drainer, a kit that tricks visitors into approving transfers. LevelBlue SpiderLabs had described the software in April as “Malware-as-a-Service”. The full source code was reportedly offered for about $750, or $150 for a version taking 20% of each theft. The kit claimed support for more than twenty blockchain networks, which helps explain the geographic spread of the flows.
Timeline: One Hour Between the First Signal and the Suspensions
The public sequence runs from Friday evening to Saturday morning. It is reconstructed from alerts, posts and registry records reviewed by The Block.
| Time (ET) | Event |
|---|---|
| 9:10 p.m. Friday | First public signal on Flap, posted by liquidated0x |
| About 10:00 p.m. Friday | Flap warns users of a “DNS hijacking incident” |
| 10:54 p.m. Friday | Blockaid flags Flap and Kintsu, then identifies ten more compromised sites |
| 11:51 p.m. Friday | bluexxix points to the shared registrar, Name.com |
| 12:27 a.m. Saturday | Name.com responds publicly and asks for an abuse report |
| 8:32 a.m. Saturday | Ten domains suspended at the registrar with a “client hold” status |
The pseudonymous developer banteg reached the same conclusion on Saturday morning. Punkquidity later noted that ten domains had been deactivated within seconds, a reminder of how quickly a registrar can cut off a website.
“It happened on Vercel’s side and was outside of our control”
Kintsu team, public statement on X
Name.com replied publicly at 12:27 a.m., asking liquidated0x and bluexxix to complete its abuse reporting form. That reply was not a technical confirmation. According to Crypto Briefing, the company had not acknowledged the incident on its blog or status page, and the status pages of Name.com and Vercel still showed normal operation. Name.com’s press address did not respond to The Block’s request for comment, and its parent company, Identity Digital, did not react immediately.
On-Chain Flows Spread Across Four Networks
The funds were directed to three wallets in fixed proportions of 15%, 55% and 30%. The identical split across several chains points to shared infrastructure, although the operators have not been identified. The $138,000 total covers only funds traceable on chains compatible with the Ethereum Virtual Machine; potential losses on Solana and Aptos are excluded.
| Network | Wallets | Observed flows |
|---|---|---|
| BNB Chain | One Safe and three attacker wallets | About 3.1 BNB (roughly $2,200) received from four wallets between 9:00 and 9:42 p.m.; about 2.27 BNB remained in the Safe on Saturday morning |
| Monad | Two wallets | MON staked with Kintsu, withdrawn from the Neverland lending protocol and converted into MON |
| Robinhood Chain | One wallet | Tokenized NVDA and AAPL shares pulled from Morpho and swapped for ETH |
| Solana and Aptos | Not quantified | FluxBeam, StonkFun and StakePoint on Solana, Echelon on Aptos; losses not included |
By Saturday morning, the three wallets held roughly $138,000 together, mainly in MON and in ETH on Robinhood Chain. Nearly all of these sums arrived after the attack began.
What the Affected Projects Say
No affected project has disclosed a victim count. FluxBeam said it had “no reports of affected users”, while StonkFun, which moved its site to new infrastructure overnight, said it was not aware of any affected person. Kintsu, Origami, FluxBeam and StonkFun all say their on-chain contracts were not touched. Yet at least four wallets on BNB Chain sent funds to the attackers, which indicates that victims do exist.
Disputed Responsibility and Precedents: Name.com, Vercel or a Reseller?
Sources disagree on the nameservers used. The Block reports that the sites did not share a single DNS provider: some used Cloudflare, others Vercel, and others Name.com’s servers. Crypto Briefing claims instead that every domain depended on Name.com’s nameservers. These accounts cannot be reconciled with certainty. What is established is that all twelve domains shared the same registrar, while their active DNS configuration remains unclear. Punkquidity summed up the doubt by asking whether “Name.com itself or a reseller like Vercel” was at the origin.
Origami Finance first warned of “an active attack on nameservers associated with Vercel”, then kept its vaults paused pending a root-cause analysis. Vercel had selected Name.com as registrar for its domains service rebuilt in 2025, according to a Name.com release from December 2025, and has not publicly commented on the attack. In April, Vercel disclosed an intrusion into its internal systems attributed to a compromised third-party artificial intelligence tool; no published evidence links that episode to October 30.
A separate earlier attack targeted projects registered with Squarespace. Compound Finance saw its main domain replaced by a phishing page, while Celer Network intercepted an attempt and quickly restored its DNS records. The affected domains had been transferred from Google Domains to Squarespace in June 2023. Researchers Samczsun, Taylor Monahan and Andrew Mohawk believe that disabling multi-factor authentication during the migration could be connected to the incident. The Block also cites the hijacks of Aerodrome and Velodrome in November 2025, and of Galxe in October 2023, when attackers gained access to the project’s account at its registrar Dynadot.
“Our ongoing investigation indicates that the attack vector likely involved third parties outside of our control”
Celer Network, official statement
Outlook: Risk Is Shifting Toward the DNS Layer
This episode shows risk moving elsewhere. Audits, bug bounty programs and formal verification focus on the code that holds funds, and do not necessarily cover domain management, nameservers or registrar accounts. Projects that quickly moved to separate DNS infrastructure regained control of their traffic faster than the others.
Three scenarios remain open. If Name.com or Vercel confirms a flaw, the debate over registrar liability will intensify and stronger account authentication will become a baseline expectation. A shared responsibility with a reseller would complicate compensation. Without a definitive public cause, projects will need to reinforce internal controls on their own. In the short term, users should revoke token approvals granted to contracts, verify the exact address of a site before connecting a wallet, and follow official protocol announcements.
Sources
Cet article est publié à titre informatif et éducatif. Il ne constitue en aucun cas un conseil en investissement. Faites vos propres recherches (DYOR) avant toute décision.
