Name.com has restored 15 hijacked domains after a cyberattack targeted at least 12 decentralized finance (DeFi) project websites. The attack, which took place between October 30 and 31, 2026, reportedly drained approximately $138,000 from users by redirecting them to malicious pages designed to empty their wallets. The hijacked domains, including 10 tied to Vercel, were temporarily placed on 'client hold' status before being restored.
The attackers exploited the registrar level to redirect users to lookalike pages running a tool known as the Step Drainer. This tool tricked users into signing transactions they did not intend to approve, leading to the loss of funds. Despite the attack, the smart contracts behind the targeted projects remained intact and uncompromised.
Name.com acknowledged the improper redirection and advised customers to review their DNS settings and enable two-factor authentication. DeFi projects Flap and Kintsu, along with security firm Blockaid, confirmed that the attack occurred at the registrar level. Some teams mitigated damage by moving their nameservers to hosting services like Vercel or Cloudflare.
The incident highlights the vulnerability of DeFi front ends, which rely on traditional internet infrastructure like domain registrars and DNS records. While the smart contracts functioned as intended, users still lost money due to the compromised domain redirection. This supply-chain attack underscores the need for DeFi teams to prioritize operational hygiene and incident response plans.