Hackers hijack 12 DeFi domains via Name.com to steal $138,000
Attackers took control of a dozen decentralized finance websites registered through Name.com late Friday, deploying wallet-draining software that stole at least $138,000 across multiple blockchains.
Late Friday, attackers compromised 12 decentralized finance websites and turned them into malicious wallet drainers, according to reporting by The Block and Coin Bureau. Traced losses have reached approximately $138,000, a total that excludes potential losses on the Solana and Aptos networks. Registry records show all 12 hijacked domains are registered through domain registrar Name.com.[1][2][3][4]
According to cybersecurity firm Blockaid, the compromised sites actively served Step Drainer, a turnkey malicious kit sold to scammers that operates across more than 20 blockchains. The drainer uses fake wallet interface pop-ups, including misleading prompts showing incoming funds such as '+500 USDT', to trick visitors into approving transfers before siphoning their most valuable assets. The affected projects include Pickle Finance, Origami Finance, Kintsu, Flap, StonkFun, Echelon, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance, and APEX.[3][4]
The precise vector used to hijack the websites remains unconfirmed, though The Block noted the shared registrar suggests a compromise at Name.com. Ten of the hijacked domains were suspended by Saturday. Name.com's only public response so far has been directing users to submit an abuse form, while several affected project teams have yet to confirm their sites are clean.[1][3][4]
Key facts
- Attackers hijacked 12 DeFi websites late Friday, leading to approximately $138,000 in traced thefts.
- All 12 targeted websites share the domain registrar Name.com, pointing to a potential registrar-level compromise.
- Ten of the 12 compromised domains were suspended by Saturday.
- Blockaid found the hijacked sites served Step Drainer, a phishing kit operating across more than 20 blockchains that tricks users with fake pop-ups such as '+500 USDT'.
- The $138,000 stolen funds figure excludes potential losses suffered on Solana and Aptos.
- Targeted platforms include Flap, Kintsu, StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance, and APEX.
- Name.com's only public response to the incidents so far has been directing users to its abuse reporting form.
Sources · 4 sources
- TB
The BlockArticle ·
Hackers hijack a dozen DeFi websites, all registered with Name.com, and steal about $138,000 All 12 hijacked domains are registered through Name.com, according to registry records accessed by The Block, suggesting a compromise.
Open source - CB
Crypto BriefingArticle ·
Hackers hijack 12 DeFi websites registered with Name.com, draining about $138K The attack highlights the critical need for DeFi projects to enhance domain security, as DNS vulnerabilities can undermine even flawless smart contracts. The post Hackers hijack 12 DeFi websites registered with Name.com, draining about $138K appeared first on Crypto Briefing .
Open source - CB
Coin Bureau@coinbureauPost on X ·
🚨This is CONCERNING. 12 DeFi websites were hijacked and turned into wallet drainers in just ONE night. Blockaid found the sites "actively serving" Step Drainer, a kit that fakes normal-looking wallet pop-ups to trick visitors into approving transfers. Step Drainer is sold to scammers as a ready-made kit and works across more than 20 blockchains. Once a victim approves, it goes after their most valuable tokens first. Researchers have even seen its prompt show a fake "+500 USDT" so the approval looks like money coming in. Affected projects include Flap, Kintsu, StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance and APEX. About $138,000 has been traced so far, and that excludes losses on Solana and Aptos. All 12 domains were registered with Name(.)com, though how they were hijacked is still unconfirmed. Name(.)com's only public response so far has been asking users to fill out its abuse form, per The Block. Not every affected team has confirmed its site is clean yet.
Open source - TB
The Block@TheBlockCoPost on X ·
THE BLOCK: Hackers who hijacked a dozen DeFi sites late Friday, including Pickle, Origami and Kintsu, targeted domains all registered with https://t.co/XmhyqgLekO, registry records show. Ten were suspended Saturday. The Block has traced about $138,000 in stolen funds so far. https://t.co/gDANWYCORf
Open source