Hackers hijacked at least 12 decentralized finance websites registered through Name.com in late October 2026, using DNS manipulation to inject the Step Drainer malware toolkit into legitimate web frontends. While underlying smart contracts were unbreached, attackers siphoned at least $138,000 across EVM chains by deceiving users into approving fraudulent transactions. Name.com temporarily suspended 10 affected domains before lifting holds with transfer locks, as projects like Kintsu and Origami blamed registrar-layer infrastructure single points of failure.
Overview of hijacked DeFi domains
- ▪The hijacked websites include Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun, StakePoint, Flap, and Kintsu, while their underlying smart contracts remained unbreached
- ▪Hackers hijacked at least 12 decentralized finance websites registered through Name.com in a DNS hijacking attack that rewrote domain records to redirect users to malicious frontend infrastructure
Step Drainer malware capabilities and pricing
- ▪Security firm LevelBlue SpiderLabs reported in April 2026 that the Step Drainer malware toolkit sells for approximately $750 for full source code or $150 for a version that extracts a 20% commission on stolen funds
- ▪The 12 DeFi websites hijacked through the Name.com DNS attack were injected with Step Drainer, a Malware-as-a-Service toolkit that compromised frontends to harvest unlimited token approvals and signatures across more than 20 blockchain networks
Stolen funds and exploited blockchain assets
- ▪Attackers behind the Name.com DNS hijacking attack redeemed Kintsu's staked MON tokens on Monad and withdrew funds from lending protocol Neverland, while on Robinhood Chain they extracted tokenized stock assets including NVDA and AAPL from Morpho
- ▪Onchain data reviewed by The Block traced approximately $138,000 in stolen crypto funds from the Name.com DNS hijacking attack across EVM-compatible chains routed to three attacker wallets in fixed 15%, 55%, and 30% cuts
- ▪On BNB Chain, a Safe wallet flagged by liquidated0x during the Name.com DNS hijacking attack received roughly 3.1 BNB worth approximately $2,200 from four compromised user wallets between 9:00 p.m. and 9:42 p.m. ET on October 30, 2026
Statements on attack origin and attribution
- ▪Cloakd, the developer behind FluxBeam, stated on X that its Name.com representative maintained the DNS hijacking incident originated with third-party issuers rather than Name.com itself
- ▪Kintsu and Origami Finance publicly attributed the DNS hijacking attack on their Name.com-registered websites to cloud infrastructure provider Vercel, which had chosen Name.com as the registrar for its rebuilt domain service in December 2025
Historical context and supply chain risks
- ▪DeFi protocol frontends suffered DNS attacks similar to the Name.com DNS hijacking attack during previous incidents, including breaches targeting Aerodrome and Velodrome in November 2025 and Galxe via Dynadot in October 2023
- ▪Security researchers noted that registrar-level domain hijacking bypasses smart contract security controls and standard URL inspection, creating single-point-of-failure supply chain risks across decentralized finance protocols
Story comments
Loading comments…