More than a dozen DeFi websites were hijacked on Oct. 31, sending users to fake pages loaded with wallet-draining malware.
Blockaid flagged the incident on X and listed affected sites including Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun and StakePoint. After checking registration records, The Block found that all 12 domains named by Blockaid were registered with domain registrar Name.com.
Blockaid says Step Drainer was planted on the sites
According to Blockaid, the compromised websites were injected with a wallet drainer called Step Drainer. Once users connected their wallets, they were prompted to sign transfer approvals.
The Block cited an April report from cybersecurity firm LevelBlue SpiderLabs, which described Step Drainer as a malware-as-a-service kit. The full source code was priced at about $750, or available on a rental basis for $150 plus a 20% share of each theft. The kit was advertised as supporting more than 20 blockchain networks.
Beyond the sites named above, Blockaid’s list also included supswap.xyz, longbow.cash, shprd.finance and apexdefi.xyz. Flap and Kintsu were also affected.
Flap saw the earliest issue, and called it a DNS hijacking incident
Based on a timeline compiled by The Block, Flap’s website showed the earliest signs of trouble shortly after 9 a.m. Taipei time on Oct. 31. Blockaid then went on to identify other affected sites.
Flap described the event as a "DNS hijacking incident." DNS maps a web address to the actual server behind it. If an attacker changes those records, users can be routed to a fake site even when they enter the correct URL.
The Block said the affected projects were not all using the same DNS provider. Some used Cloudflare, some used Vercel, and some used Name.com’s own nameservers. The shared factor was that all of the domains were registered through Name.com.
Name.com says 15 domains were affected; Vercel says 10 tied to its platform were restored
Name.com said on X early on Nov. 1 Taipei time that some domains had been improperly redirected late Friday night U.S. time in an attempt to access visitors’ crypto wallets. The company said the affected domains had been restored and that the investigation was ongoing.
A Name.com spokesperson later told The Block that 15 customer domains were affected. The company said it had restored all impacted domains, was working directly with domain holders, and urged customers to review DNS records and enable two-factor authentication. Name.com’s parent company, Identity Digital, did not respond to The Block’s request for comment.
Hosting platform Vercel said in a notice that Name.com was investigating a domain takeover campaign targeting cryptocurrency and DeFi companies. It said 10 domains related to Vercel were affected and had been restored by Name.com, and that Vercel customers did not need to take any action.
Kintsu and Origami Finance both pointed to Vercel. Kintsu said, "This happened on Vercel’s side, which is outside our control." FluxBeam developer Cloakd said a Name.com representative told him the issue was not with Name.com, but with a third-party issuer.
At 8:32 a.m. Eastern Time on Saturday, 10 of the domains were suspended at the registrar level. Near midday, that suspension appeared to be lifted and the domains resumed normal resolution.
About $138,000 traced on Ethereum-related networks, with Solana and Aptos losses not yet counted
The Block said the stolen funds were consistently split into three portions — 15%, 55% and 30% — and sent to three wallets. Across Ethereum, Robinhood Chain and Monad, the traced total came to about $138,000, mostly in MON and ETH on Robinhood Chain.
One of the wallets withdrew tokenized Nvidia and Apple shares from lending protocol Morpho and then swapped them into ETH. A wallet on Monad redeemed staked MON from Kintsu.
That figure does not include losses tied to FluxBeam, StonkFun and StakePoint on Solana, or Echelon on Aptos. The number of victims was still unclear, and no project had disclosed a victim count.
