Hackers Drain $138,000 From 12 DeFi Sites Hijacked via Name.com

Twelve Projects, One Registrar

The websites of twelve DeFi projects were hijacked and turned against their own users, and on-chain tracing so far puts confirmed losses at roughly $138,000. Every affected site shares one infrastructure detail: its domain was registered through Name.com. Twelve projects under a single registrar is a wide blast radius, and that shared vendor is what turned separate domain incidents into one campaign. The security firm Blockaid identified compromises at Flap, Kintsu, Pickle Finance and Origami Finance, four of the twelve caught in the sweep. Attackers planted malicious code on the legitimate sites rather than spinning up lookalikes, so visitors who connected a wallet saw the interface they expected. What they actually signed was an asset-transfer approval generated by a drainer known as Step Drainer, which strips funds the moment a user authorizes the movement. The intrusion began on the night of Oct 30, and Flap disclosed a DNS hijack, a takeover of domain-name records that redirects traffic without touching the project's servers. The documented record ends there, and the causal chain does not. The twelve sites ran different DNS services on top of their shared registrar, so the takeover could have started inside Name.com's own systems or at a third-party provider such as the cloud platform Vercel; neither explanation is confirmed. Kintsu and Origami Finance have publicly pointed at Vercel's infrastructure, but that stands as an assertion from affected parties, not an established finding. The $138,000 tally covers flows on Ethereum, BNB Chain, Monad and Robinhood Chain. Losses on the Solana and Aptos networks sit outside that count, which is why the final damage figure remains open. Pickle Finance and Flap have not published detailed post-incident statements in the disclosures available so far. Both victim projects stated that their on-chain smart contracts were never breached; the theft ran entirely through front-end signatures.

The Drainer Economy and the Fund Trail

The operational timeline shows how fast the campaign moved and how quickly it was contained. At 08:32 local time on Oct 31, ten of the affected domains were suspended, cutting traffic to the malicious pages; all ten were restored later that morning. Research from LevelBlue SpiderLabs adds a commercial layer to the picture: the full source code for Step Drainer sold for about $750, while a variant that remits 20% of stolen funds as a commission changed hands for $150. That price point puts the toolkit within reach of low-skill operators, which is consistent with a campaign hitting twelve unrelated projects at once. Funds taken in the campaign did not stay put either. On-chain records show the proceeds were consolidated into three wallets, drawing from Ethereum, BNB Chain, Monad and Robinhood Chain in a split of 15%, 55% and 30%, and the tracing behind the $138,000 figure followed those wallets. The named victims, Flap, Kintsu, Pickle Finance and Origami Finance, are small altcoin-ecosystem protocols rather than major venues, a profile that matches a drainer aimed at retail wallet connections. Vercel, the platform the two victim teams accuse, hosts the projects' front ends, which is why a compromise there would have exposed every visitor. Name.com is understood to have told some affected teams that the fault lies with a third party rather than its own systems. Kintsu and Origami's Vercel accusation and the registrar's deflection leave two plausible failure points with no adjudicator. Origami Finance said it will keep its asset custody service suspended until Vercel and Name.com complete their root-cause analysis. The DNS directory that maps a domain to its host is controlled at the registrar account level, and that centralized control is what on-chain naming systems such as ENS domain names remove from the equation. The number of affected users has not been disclosed, and no recovered funds have been reported.

Aptos Losses Remain Uncounted

The confirmed $138,000 is a floor, not a total. The trace behind it excludes losses on Solana and on Aptos, a layer 1 blockchain, so the final figure will settle higher once those networks are counted. For the Aptos ecosystem the exposure is structural rather than contractual: the front end was the attack surface, and the on-chain contracts stayed intact, which caps the damage at individual user balances rather than protocol treasuries. The unresolved question, registrar or hosting provider, decides the remediation path. A registrar-side fault points to account security and transfer controls at Name.com; a Vercel-side fault points to deployment pipelines and to teams that would need to harden their own hosting. Users who signed the malicious approvals have limited recourse, and a front-end signature loss is the profile that DeFi insurance products typically do not cover. That security picture is separate from the network's development track, where the encrypted mempool rollout on mainnet accepted a 20ms latency cost for transaction privacy. What the record establishes is a four-chain trace of about $138,000 and twelve hijacked front ends; what it does not establish is which provider failed, and that answer, not the running total, is what the affected projects are waiting on.