Attackers redirected visitors of at least 12 decentralized finance (DeFi) websites to a wallet-draining page on October 30 and 31, 2026. Security firm Blockaid identified the StepDrainer malware on the sites. Public registry records reviewed by The Block showed Name.com as the registrar of all 12 domains in its first list.
What happened
- Name.com told The Block on October 31 that its investigation had identified 15 affected customer domains. The company said it had restored every domain and was contacting account holders.
- On the morning of October 31, Name.com temporarily placed 10 domains on client hold, which stopped them from resolving. The restriction was lifted later that morning.
- Name.com advised customers to review their DNS records and to enable two-factor authentication.
- Vercel confirmed in its October 31 security bulletin that 10 domains linked to its platform were affected and that Name.com had restored them.
- The cause is not settled. Kintsu described a registrar-level hijack of its domain, and Origami Finance pointed to Vercel-associated nameservers. Neither the entry point nor a breach of Name.com's systems has been confirmed. The affected projects used different DNS providers.
- The Block traced about USD 138,000 to three wallets across Ethereum-compatible networks. That figure does not cover losses on Solana or Aptos, where some affected projects also run.
Why it matters for domain holders
The attack did not exploit smart contracts. It changed where domain names pointed, so users typing a familiar address could land on a malicious page. A shared registrar can therefore expose unrelated projects at once. Registrar account security (two-factor login, registrar lock, reviewing DNS records) limits this kind of risk. Check how your registrar handles DNS changes and account recovery before you rely on it for a crypto project.
Sources: Analytics Insight, FinanceFeeds, CircleID.