Domain registrar Name.com said on Saturday that “a number of domains” it manages were redirected late Friday “as part of a plan to access visitors’ crypto wallets.” Beyond earlier replies asking users to file abuse reports, it is the company’s first public statement on the incident, which came after at least 12 DeFi websites, including Flap, Kintsu, Pickle Finance and Origami Finance, were hijacked overnight and pointed at a wallet drainer.
Name.com said the affected domains have been restored, but it has not explained how the redirects happened. Several of the hit projects are still telling users to stay away from their websites.
What Name.com said
Later on Saturday, the registrar said: “The affected domains have been restored. We’re investigating and will update this thread as we learn more.” In a follow-up it asked customers to review their nameserver and DNS records for unauthorized changes and to turn on two-factor authentication.
The statement does not say whether Name.com’s own systems, a reseller or individual customer accounts were the entry point. That gap matters, because the affected projects have pointed in different directions.
How the attack unfolded
The first project warning came from Flap, a token launchpad. At 02:13 UTC on October 31, it said flap.sh was “affected by a DNS hijacking incident and is redirecting to an unauthorized website.” Kintsu, a liquid staking protocol on Monad, posted its own warning about 80 minutes later, saying its domain was hit “at our registrar.”
Security firm Blockaid flagged both sites within the hour, and about 20 minutes after that it named 10 more domains it said were “actively serving the Step Drainer”: stonkfun.xyz, pickle.finance, echelon.market, origami.finance, fluxbeam.xyz, stakepoint.app, supswap.xyz, longbow.cash, shprd.finance and apexdefi.xyz.
Step Drainer is sold as a malware-as-a-service kit, according to security firm LevelBlue SpiderLabs as cited by The Block. It shows visitors a page that looks like the real app and asks them to sign approvals that hand over their tokens. Security firm GoPlus said the attacker used two methods: asking victims to send BNB directly to a Safe multisig wallet controlled by the attacker, and abusing ERC-20 token approvals to pull tokens with transferFrom.
Kintsu, Origami, FluxBeam and StonkFun have said their on-chain contracts were untouched and only the websites were redirected. That is why the advice from the projects focuses on approvals rather than on funds held in pools.
One registrar, mixed infrastructure
The Block reported that public registry records list Name.com as the registrar for all 12 domains Blockaid identified, and that 10 of them were placed on “client hold” on Saturday morning, U.S. Eastern time, which stops a domain from resolving. Those suspensions appeared to have been lifted by late morning.
The sites did not share a DNS host. Some used Cloudflare, some Vercel and some Name.com’s own nameservers, according to the same report. Origami first warned of “an active attack on Vercel-associated Nameservers” and later said its vaults would stay paused while it waits for “root cause analysis from Vercel / name[.]com.” Vercel uses Name.com as the registrar for its domain service, according to The Block. Vercel had not commented publicly as of Saturday morning, The Block reported.
FluxBeam’s developer said a Name.com representative told it the problem lay with third-party issuers rather than with Name.com itself, The Block reported. Until the registrar publishes its findings, the root cause should be treated as unconfirmed.
Losses so far look small
The Block traced about $138,000 to three attacker wallets on EVM chains, with proceeds split in fixed 15%, 55% and 30% cuts across BNB Chain, Ethereum, Robinhood Chain and Monad. That figure excludes Solana and Aptos, where FluxBeam, StonkFun, StakePoint and Echelon run, so the real total may be higher. No project has published a victim count. FluxBeam said it had no reports of affected users and took its site offline as a precaution.
The dollar amount is modest next to this week’s exchange losses. The method is the bigger concern: one weak point at the domain layer exposed a dozen unrelated teams at once, and none of them had to make a coding mistake for it to happen. We saw a similar pattern of drainers chasing traffic in the PolyArb wallet drainer case earlier this year.
What users should do
Kintsu’s guidance applies across the list. The team told users that anyone who “connected or signed since ~00:00 UTC Oct 31” should revoke approvals and move funds. Revoking token approvals with a checker tool and moving assets to a fresh wallet are the standard steps. Users should rely on each project’s official X account for the all-clear rather than links shared in replies.
FAQ
Which crypto sites were hijacked? Blockaid named flap.sh, kintsu.xyz, stonkfun.xyz, pickle.finance, echelon.market, origami.finance, fluxbeam.xyz, stakepoint.app, supswap.xyz, longbow.cash, shprd.finance and apexdefi.xyz.
Were the protocols’ smart contracts hacked? Not according to the projects that have commented. Kintsu, Origami, FluxBeam and StonkFun said only their websites were redirected and their contracts were untouched.
Did Name.com say it was breached? No. Name.com confirmed domains it manages were improperly redirected and said it is investigating, but it has not named a cause.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
