A DNS hijack at the registrar level sent users of Flap, Kintsu, Pickle Finance and others to sites loaded with the Step Drainer toolkit
At least 12 decentralized finance websites were hijacked in a coordinated attack. The smart contracts behind them were never breached. The attackers went after the domain names instead.
The Block has traced about $138,000 in stolen funds so far using onchain data. Every affected domain was registered with Name.com, according to public registry records the outlet reviewed.
How the attack worked
Security firm Blockaid reported the incident on October 31, 2026. It described a front-end attack in which the DNS records for the affected sites were altered.
The attackers effectively rewrote those phone book entries. Users typing the correct URL landed on infrastructure the attackers controlled, with no visible sign that anything had changed.
Once there, visitors met the Step Drainer toolkit. This malicious script was injected into the hijacked pages to trick users into signing transactions.
Who got hit
Named victims include Flap, Kintsu, StonkFun and Pickle Finance, along with other projects. The common thread was registrar choice rather than any shared code or chain.
The compromised domains all depended on Name.com’s own nameservers. By targeting the registrar layer, the attackers could redirect several unrelated projects in one campaign.
Some teams recovered fast by moving their domains to nameservers from Vercel and Cloudflare, which let them regain control of their traffic. StonkFun said its users were not affected. The drained total of about $138,000 reflects only what has been traced so far.
Name.com had not acknowledged the incident on its status page or blog at the time of the reports. For affected teams, that meant handling incident response without public guidance from the registrar.
Why the front end keeps getting overlooked
DeFi security conversations usually focus on smart contracts. Audits, bug bounties and formal verification all target the code that holds user funds.
This attack sidestepped all of that. A protocol can have flawless contracts and still lose user money if the website pointing to those contracts gets redirected.
When trust breaks at the DNS level, ordinary safety advice offers little protection. Checking the URL does not help when the URL itself is correct.
The research summary describes this as part of a troubling trend. Domain management and security hygiene still lag behind contract security across much of the DeFi sector.
What this means for DeFi projects and users
The projects that recovered fastest moved to Vercel and Cloudflare nameservers. That suggests teams with a ready migration path and control over their DNS setup were better positioned when things went wrong.
A dozen projects shared one point of failure through their registrar, and one compromise at that layer touched all of them together. That pattern resembles supply chain attacks in traditional software.
Wallet-level transaction warnings, from firms like Blockaid that flagged this incident, are one defense. The reputational hit also extends beyond the stolen funds: users who lost money on a hijacked site tend to blame the project whose name was on the page, regardless of where the actual failure occurred.
