Name.com-linked DeFi site hijacks drain about $138,000 in crypto

Traders Union
All News
Crypto
Defi DNS hijackings drain crypto

Highlights

Twelve DeFi-related domains registered via Name.com were hijacked with 10 placed on 'client hold' status by 8:32 a.m. ET Saturday, disrupting access to major sites like Pickle Finance and FluxBeam.
Step Drainer malware enabled the theft of about $138,000 in crypto by late Saturday morning, with funds distributed across BNB Chain, Ethereum, Robinhood Chain, and Monad in fixed proportions.
FluxBeam, StonkFun, Origami, and other affected DeFi projects report no confirmed onchain losses, as the attack targeted web interfaces rather than underlying protocol contracts.

Attack timeline and registrar response

As reported by The Block, public registry records show all 12 compromised domains are registered through Name.com, and 10 of them are placed on "client hold" status at 8:32 a.m. ET on Saturday, preventing the domains from resolving. The affected suspended sites include Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun and StakePoint.

X users tracking the incident begin flagging a shared registrar late Friday, with bluexxix saying Name.com appears compromised and pseudonymous developer banteg reaching the same conclusion on Saturday morning. Flap's domain is flagged as compromised at 9:10 p.m. ET on Friday, about an hour before the project warns users that its frontend is hit by a DNS hijacking incident, while Blockaid later warns about Flap, Kintsu and 10 additional sites.

Name.com's only public response comes shortly after midnight ET on Saturday, when it asks users on X to submit its abuse form. The company's listed press address does not accept a request for comment, and parent company Identity Digital does not immediately respond.

Malware method and sector impact

Security firm Blockaid says the hijacked websites are rigged with Step Drainer, a malware kit designed to trick visitors into approving transfers from their crypto wallets after connecting to a site. LevelBlue SpiderLabs describes the tool in April as a Malware-as-a-Service offering that reportedly supports more than 20 blockchain networks and is sold either as full source code or under a revenue-sharing model.

Onchain data reviewed by The Block traces about $138,000 in stolen funds by late Saturday morning, with proceeds routed into three wallets using fixed 15%, 55% and 30% splits across BNB Chain, Ethereum, Robinhood Chain and Monad. The traced total likely understates the full losses because some affected sites operate on Solana and Aptos, where any stolen assets would appear in different wallets.

No affected project reports a confirmed victim count yet. FluxBeam says it has no reports of impacted users, StonkFun says it is not aware of anyone affected, and Kintsu, Origami, FluxBeam and StonkFun say their onchain contracts remain untouched, underscoring that the attack targets web access points rather than core protocol infrastructure.

The incident adds to a growing list of frontend and DNS attacks across crypto platforms. Aerodrome and Velodrome are hijacked in November 2025, while Galxe is hit in October 2023 after attackers gain access to the project's account at registrar Dynadot.

Our earlier report on the Q3 2026 cybersecurity funding surge highlighted how global security and privacy startups raised $6.8 billion, with fewer deals but much larger late-stage rounds. We also noted that AI-driven and identity-security companies attracted outsized investor attention, alongside increased consolidation through major acquisitions—underscoring how escalating digital threats are shaping spending and investment priorities.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.