Name.com said Saturday that a number of domains on its platform were improperly redirected late Friday in what it described as a plan to access visitors’ crypto wallets. The registrar said the domains had been restored and added in a post on X that it was investigating the incident, with updates to be posted in the same thread.
The company has not said how the attackers gained control, and it has not identified the domains involved.
Vercel points to a campaign targeting crypto companies
In a security bulletin, web hosting company Vercel said Name.com, one of its domain registration partners, is investigating a takeover campaign aimed at crypto companies. Vercel said 10 of the affected domains were associated with its platform, that Name.com had restored them, and that customers did not need to take any action.
Projects that confirmed impact
Three projects publicly confirmed the attack on their own channels.
- Flap said on X that its website was affected by a DNS hijacking incident and was redirecting users to an unauthorized website.
- Kintsu said in a reply on X that this was not a contract exploit but a frontend takeover.
- Origami Finance said in a security notice that smart contracts and funds in Origami vaults were not affected, and that only the Origami website had been redirected.
Origami paused its vaults and told anyone who connected a wallet or signed on its site after midnight UTC on Oct. 31 to revoke unfamiliar approvals.
Blockaid named nine other sites serving Step Drainer
Web3 security firm Blockaid warned that, besides Origami, nine sites were actively serving the Step Drainer:
- stonkfun.xyz
- pickle.finance
- echelon.market
- fluxbeam.xyz
- stakepoint.app
- supswap.xyz
- longbow.cash
- shprd.finance
- apexdefi.xyz
Unchained said it checked public registry records on Nov. 2 for the 12 domains named either by project owners or by Blockaid. All 12 were registered at Name.com, and every record showed a change dated Oct. 31.
DNS for those domains was spread across four providers: six used Vercel, two used Cloudflare, three used NS1, and one used Name.com’s own nameservers.
Competing explanations remain unresolved
Kintsu said in the same X reply that the issue was something that happened on Vercel’s end and was out of its control. Origami, in its security notice on X, blamed an active attack on Vercel-associated nameservers for the redirects.
Vercel’s bulletin described the event differently. It said Name.com was investigating a takeover campaign involving the registrar, with Vercel assisting.
Independent researcher punkquidity said that at 12:32 UTC on Saturday, 10 of the hijacked sites were switched off at the registrar within five seconds. He added that he could not yet determine whether responsibility lay with Name.com itself or with a reseller such as Vercel.
Vercel separately confirmed a breach of its internal systems in April. Neither Vercel nor Name.com has linked that earlier incident to this one.
