# Hackers Hijack 12 DeFi Websites Registered With Name.com and Steal About $138,000 > Hackers hijacked 12 DeFi sites registered with Name.com and drained about $138,000 in crypto, with 10 domains suspended at the registrar level. - Published: 2026-10-31T15:45:57+00:00 - Section: Incidents - Author: News Desk - URL: https://newsforagent.com/news/2026-10-31/name-com-defi-websites-hijacked - Source: [TradingView](https://www.tradingview.com/news/the_block:8384020e0094b:0-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138-000/) ## Key takeaways - Twelve DeFi websites registered with Name.com were hijacked and about $138,000 in crypto was traced to three attacker wallets. - Ten of the hijacked domains were suspended at the registrar level at 8:32 a.m. ET on Saturday and now carry a client hold status. - Blockaid said the sites were rigged with Step Drainer, a malware kit that tricks visitors into approving wallet transfers. Hackers took over 12 DeFi websites registered with [Name.com](https://akta.pro/company-profiles/0006188/name-com) and used them to drain visitors' crypto wallets, with about $138,000 in stolen funds traced so far. TradingView [carried the report](https://www.tradingview.com/news/the_block:8384020e0094b:0-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138-000/) from The Block, which reviewed public registry records and onchain data. ## How the Name.com Domain Hijack Unfolded Name.com is listed as the registrar for all 12 hijacked sites identified by security firm [Blockaid](https://akta.pro/company-profiles/000073n/blockaid). Ten of the domains were suspended at the registrar level at 8:32 a.m. ET on Saturday and now carry a client hold status, which stops a domain from resolving. They include Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun and [StakePoint](https://akta.pro/company-profiles/02mo2me/stakepoint). Flap's and Kintsu's domains were not suspended and remained operational as of publishing time. X user bluexxix posted at 11:51 p.m. ET on Friday that it "seems @namedotcom is compromised" as more affected sites surfaced. Pseudonymous developer banteg reached the same conclusion on Saturday morning, and X user punkquidity later spotted that 10 of the domains had been switched off within seconds of each other. Name.com replied to liquidated0x and bluexxix on X at 12:27 a.m. ET, asking them to fill out its abuse form. Its listed press address did not accept The Block's request for comment, and parent company Identity Digital did not immediately respond. Blockaid said the hijacked sites were rigged with Step Drainer, a malware toolkit that tricks visitors into approving transfers out of their wallets once they connect them to a site. Security firm LevelBlue SpiderLabs described Step Drainer in April as a "Malware-as-a-Service (MaaS)" kit, reportedly sold for about $750 for the full source code or $150 for a version that takes a 20% cut of each theft. ## Name.com's Registrar Scale and Vercel Ties Name.com is an ICANN-accredited registrar based in Denver that manages 2.6 million domains across more than 600 domain extensions, according to [akta.pro company records](https://akta.pro/company-data). The same records list 37% year-over-year growth in email and website product usage, up from 27%. Name.com launched direct integrations with Bolt, Netlify, Replit and Vercel in December 2025, embedding domain search and registration into the developers' deployment workflows, the same records show. Vercel picked Name.com as the registrar for its rebuilt domain service last year, Name.com said in a December 2025 press release. Kintsu and Origami Finance have both publicly blamed Vercel for the attack. "It was something that happened on Vercel's end that was out of our control," Kintsu wrote in a reply on X, adding that Vercel had not yet responded. ## Other Crypto Security Incidents This Week Chainalysis said on October 31 that a hacker using "offensive agentic techniques" accessed its customers' names and emails, [The Block reported](https://www.theblock.co/news/business/2026-10-31-chainalysis-says-hacker-using-offensive-agentic-techniques-accessed-its-customers-names-and-emails-432244). CFTC Chairman Michael Selig said on October 30 that blockchain records give investigators a strong chance of tracing funds stolen in the Binance hack, which cost about $6.34 billion, [TradingView reported](https://www.tradingview.com/news/stocktwits:29e82af25094b:0-binance-hacked-cftc-chair-says-blockchain-gives-a-very-good-shot-at-tracing-stolen-funds/). [ET NOW reported](https://www.etnownews.com/technology/binance-hack-polymarket-security-breach-us-dhs-data-leak-three-cyberattacks-raise-global-security-concerns-article-156432544) that Polymarket lost $2.6 million in a security breach on October 29. ## What Remains Open in the Name.com Attack No affected project has reported a victim count. FluxBeam said it had "no reports of users being affected," and StonkFun, which moved its site to new infrastructure overnight, said it was "not aware of anyone affected." Kintsu, Origami, FluxBeam and StonkFun all said their onchain contracts were untouched. Origami said its vaults would stay paused while it waits for "root cause analysis from Vercel / name[.]com." ## Companies in this story - [Name.com company profile](https://akta.pro/company-profiles/0006188/name-com) · website: http://www.name.com - [Blockaid company profile](https://akta.pro/company-profiles/000073n/blockaid) · website: https://www.blockaid.io - [stakepoint company profile](https://akta.pro/company-profiles/02mo2me/stakepoint) · website: https://stakepoint.com --- News for Agent · https://newsforagent.com/llms.txt