DeFi sites registered at Name.com (DNS hijack, October 2026) hack — October 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | October 31, 2026 |
| Target type | Infrastructure provider |
| Loss | $202,386Price at time of incident |
| Method | Supply chain or frontend compromiseDNS records for 12 DeFi websites registered at Name.com were changed to point at copies serving the Step Drainer wallet-drainer kit; the root cause has not been confirmed |
| Chains | Ethereum, BNB Chain, Base, Arbitrum, Other |
| Outcome | Unresolved |
What happened
For several hours on 31 October 2026, 12 DeFi websites registered at the registrar Name.com sent visitors to attacker-run copies carrying a wallet drainer. Blockaid warned about Flap and Kintsu at 02:54 UTC and tied them to a kit sold as Step Drainer, then named ten more: StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance and APEX. Flap confirmed a DNS hijack of its domain and moved to a new one.
Bitquery traced $202,386 taken from 32 wallets on six chains between 01:00 and 05:33 UTC, valued when each drain happened, every one using a victim’s own signature. One Kintsu staker on Monad lost $160,531, and two wallets account for 96% of the total. Early reports of about $138,000 were close to the attackers’ balances rather than what victims lost.
The cause is unconfirmed: Flap said it was investigating whether its domain provider was involved, and Kintsu said the hijack happened on Vercel’s end. Neither Name.com nor Vercel had explained it when Bitquery checked.
Sources
- Flap on X (31 October 2026)Primary · retrieved 2026-11-02
- Bitquery investigation (October 2026)Secondary · retrieved 2026-11-02
- crypto.news (31 October 2026)Secondary · retrieved 2026-11-02
Changes to this entry
- Recorded at Bitquery’s victim-side count. Name and vector are provisional until Name.com or Vercel explains the cause.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "DeFi sites registered at Name.com (DNS hijack, October 2026) hack — October 2026", iTokenly, accessed 2026-11-02, https://itokenly.com/hacks/name-com-defi-dns-hijack-october-2026https://itokenly.com/hacks/name-com-defi-dns-hijack-october-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.