{"id":112,"date":"2026-11-01T09:04:48","date_gmt":"2026-11-01T06:04:48","guid":{"rendered":"https:\/\/makersgroup.online\/blog\/?p=112"},"modified":"2026-11-01T09:04:48","modified_gmt":"2026-11-01T06:04:48","slug":"defi-website-hijacking-how-a-domain-attack-put-wallets-at-risk","status":"publish","type":"post","link":"https:\/\/makersgroup.online\/blog\/defi-website-hijacking-how-a-domain-attack-put-wallets-at-risk\/","title":{"rendered":"DeFi Website Hijacking: How a Domain Attack Put Wallets at Risk"},"content":{"rendered":"

On October 31, 2026, The Block reported that attackers redirected at least 12 DeFi websites whose domains were registered through Name.com to pages using Step Drainer. About $138,000 was traced on EVM networks, but total losses remain unknown and the incident\u2019s root cause had not been established at publication time.<\/strong><\/p>\n

What happened to the DeFi websites?<\/h2>\n

Visitors to at least 12 project websites may have been redirected from the expected interface to malicious pages designed to drain connected wallets.<\/strong><\/p>\n

According to The Block, the affected domains were registered through Name.com. Projects named in the report included Flap, Kintsu, Pickle Finance, and Origami Finance. Blockaid said the sites were rigged with Step Drainer, a toolkit that prompts visitors to sign wallet operations.<\/p>\n

At the time of publication, 10 domains had been suspended at the registrar level. The report said Flap and Kintsu remained operational. Those details describe the situation at that time, not a current check of each website.<\/p>\n

How much was stolen, and what does the estimate cover?<\/h2>\n

The Block traced about $138,000 to three wallets on EVM networks, but that is not a complete estimate of all possible losses.<\/strong><\/p>\n

The figure covers funds the outlet could trace on EVM networks at the time of reporting. It excludes possible losses on Solana and Aptos, where some affected projects operate. So the $138,000 figure should be described as traced funds, not a final total loss.<\/p>\n

The report did not establish a complete victim count. Some projects said they had not received reports of affected users, but that does not establish that no losses occurred.<\/p>\n

Were the smart contracts hacked?<\/h2>\n

The available report describes an attack through project websites and wallet interactions; it does not report a confirmed exploit of the underlying smart contracts.<\/strong><\/p>\n

This distinction matters: users often reach a protocol through its website, but the site is a separate part of the infrastructure. If that site is replaced or redirects visitors, users can be prompted to sign a dangerous transaction even when the incident is not caused by a vulnerability in the protocol\u2019s core contract.<\/p>\n

The Block reported that some projects said their on-chain contracts were untouched. That is an attributed statement from those projects, not a finding about every affected service.<\/p>\n

What should users do after connecting a wallet to a suspicious site?<\/h2>\n

Review the transactions and permissions you signed, and revoke suspicious token approvals through a trusted wallet interface or an explorer for the relevant network.<\/strong><\/p>\n

    \n
  1. Do not revisit the site using a link from a message or advertisement.<\/strong> Independently verify the project\u2019s current official address first.<\/li>\n
  2. Review wallet activity.<\/strong> Check signed transactions and permissions that allow tokens to be moved.<\/li>\n
  3. Revoke unwanted or suspicious approvals.<\/strong> Use a trusted tool and carefully confirm the network and contract.<\/li>\n
  4. If you suspect compromise,<\/strong> consider moving remaining assets to a new wallet created in a secure environment and contact the project through its verified channels.<\/li>\n<\/ol>\n

    Disconnecting a dapp does not by itself revoke previously granted token approvals. Revoking an approval also does not recover funds that have already been transferred.<\/p>\n

    Has the cause of the compromise been established?<\/h2>\n

    No. The Block reported that the root cause had not been established at the time of publication.<\/strong><\/p>\n

    The report described some projects\u2019 claims of a possible connection to Vercel, but did not establish that Vercel or Name.com had been breached. A shared registrar is an important lead, but it does not by itself prove where attackers gained access.<\/p>\n

    Until an investigation publishes its findings, it is more accurate to describe the websites as compromised or redirected and to note that the technical path remains unclear.<\/p>\n

    How can projects protect domains and user-facing infrastructure?<\/h2>\n

    Projects need to secure registrar accounts, DNS, and domain-change procedures\u2014not just their smart contracts.<\/strong><\/p>\n

    The Australian Cyber Security Centre recommends multi-factor authentication, strong unique credentials, restricted administrative access, and monitoring for unusual account activity. Available registrar locks and DNS health monitoring can also help protect high-value domains.<\/p>\n

    In practice, teams can enable change alerts, routinely review DNS records, and prepare a response plan to take a site offline and notify users quickly. These controls can reduce risk and help teams respond, but they do not guarantee protection from compromise.<\/p>\n

    FAQ<\/h2>\n

    Were all the affected sites registered through Name.com?<\/h3>\n

    The Block said public registration records it reviewed listed Name.com as registrar for all 12 identified affected domains. That does not establish where the compromise occurred.<\/p>\n

    Does the $138,000 figure include losses on every affected network?<\/h3>\n

    No. It covers funds The Block traced on EVM networks and excludes possible losses on Solana and Aptos.<\/p>\n

    If I only connected my wallet, are my funds already at risk?<\/h3>\n

    Connecting a dapp is not the same as granting permission to move tokens. Check whether you also signed transactions or token approvals, and review permissions with a trusted tool if unsure.<\/p>\n

    Will disconnecting my wallet from the site help?<\/h3>\n

    It ends the connection, but does not revoke token approvals already granted. Review and revoke those approvals separately.<\/p>\n

    Sources<\/h2>\n