Name.com-linked domain hijack hit DeFi front ends as root cause remains unresolved
A wave of malicious redirects tied to domains registered through Name.com hit several DeFi front ends late Friday, with the apparent goal of gaining access to visitors’ crypto wallets. Name.com said Saturday that a number of domains on its platform had been improperly redirected and were later restored, but it did not explain how the attackers gained control or identify the affected domains. Vercel, one of the companies pulled into the incident, described the episode as a takeover campaign targeting crypto firms and said 10 affected domains were associated with its platform. Several projects publicly confirmed impact, including Flap, Kintsu, and Origami Finance. Origami said its smart contracts and vault funds were unaffected, but paused its vaults and urged users who connected wallets or signed transactions on its site after midnight UTC on Oct. 31 to revoke unfamiliar approvals. Blockaid said nine additional sites were actively serving the Step Drainer. Public registry checks reviewed by Unchained showed 12 named domains were all registered at Name.com and all reflected changes dated Oct. 31. Responsibility remains disputed, with project teams, Vercel, and independent researcher punkquidity offering differing views on whether the issue originated at Name.com, a reseller, or Vercel-linked nameservers.
