Name.com Suspends 10 DeFi Domains Following Widespread…

Hackers compromised at least 12 decentralized finance websites in a coordinated attack spanning multiple blockchains, deploying wallet-draining malware through legitimate project domains. Preliminary on-chain tracing identified approximately $138,000 in suspected stolen assets, while a shared domain registrar has emerged as a potential link between the affected platforms. Blockchain security firm Blockaid identified the malicious StepDrainer toolkit on websites associated with Flap, Kintsu, Pickle Finance, Origami Finance and eight other projects during the October 30–31 incident. All 12 domains were registered through Name.com, according to public registration records reviewed during the investigation. Ten were subsequently placed under registrar-level suspension on Saturday morning, preventing normal domain resolution. The incident raises questions about the concentration of operational risk in DeFi, where independently developed protocols can depend on common providers for domain registration and website access.

Why Does Name.com's Role Matter?

The affected websites included applications operating across Ethereum-compatible networks, Solana and Aptos. Despite differences in their blockchain infrastructure, their domains shared Name.com as a registrar. Ten domains, including those associated with Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun and StakePoint, received a "client hold" status at approximately 8:32 a.m. Eastern Time on October 31. The designation prevents domains from resolving normally and can help interrupt access to compromised websites. Flap and Kintsu were not included in that suspension group when the initial findings were published. However, the common registrar does not establish that Name.com's own systems were breached. The affected projects used different DNS infrastructure, including Cloudflare, Vercel and Name.com's nameservers. Kintsu and Origami Finance publicly pointed to Vercel-related infrastructure as a possible source of the incident. Origami said its vaults would remain paused pending a root-cause investigation involving Vercel and Name.com. Vercel selected Name.com as a registrar partner for its domain services in December 2025. Neither company's involvement as the original point of compromise had been established in the initial investigation.

Investor Takeaway

A shared domain provider can create correlated security exposure across otherwise independent DeFi protocols, even when their underlying blockchain infrastructure differs.

How Did StepDrainer Compromise User Wallets?

Blockaid identified StepDrainer, a multichain malware toolkit designed to deceive cryptocurrency users into approving transactions that transfer assets to attacker-controlled wallets. Rather than exploiting vulnerabilities in the protocols' smart contracts, attackers manipulated their web interfaces or domain routing. Users accessing familiar project addresses could encounter malicious pages requesting wallet connections and transaction approvals. Security firm LevelBlue SpiderLabs previously documented StepDrainer as a malware-as-a-service operation supporting more than 20 blockchain networks. Its reported commercial model included a $750 source-code package and a lower-priced version requiring operators to share proceeds. The attack resembles earlier incidents involving CoW Swap's compromised frontend and the DNS hijacking of Aerodrome and Velodrome, where malicious interfaces created risks for users despite assurances that underlying smart contracts remained secure. Kintsu, Origami Finance, FluxBeam and StonkFun reported that their smart contracts were unaffected by the latest incident. That distinction matters because compromised interfaces can still cause financial losses without any modification to on-chain protocol code.

How Much Cryptocurrency Was Stolen?

Preliminary blockchain tracing identified approximately $138,000 associated with three recipient wallets across Ethereum-compatible networks. The proceeds appeared to be distributed in recurring proportions of 15%, 55% and 30%. Activity was observed across BNB Chain, Ethereum, Monad and Robinhood Chain. On Monad, suspected attacker wallets interacted with Kintsu's liquid staking assets and the Neverland lending protocol. On Robinhood Chain, one wallet withdrew tokenized equities from Morpho and converted the proceeds into ETH. The $138,000 estimate is not a comprehensive accounting of losses. It excludes potential theft involving Solana-based platforms such as FluxBeam, StonkFun and StakePoint, as well as Echelon's Aptos infrastructure. No comprehensive victim count had been established. FluxBeam reported no known affected users, while StonkFun said it was unaware of customer losses and had restored its website after moving to different infrastructure.

Investor Takeaway

The preliminary $138,000 figure excludes several affected networks, making cross-chain tracing essential before the incident's financial impact can be assessed.

What Should DeFi Users and Protocols Watch Next?

The immediate priority is determining how the attackers gained control of multiple websites and whether the compromise originated at the registrar, a reseller, DNS administration systems or another shared service. Projects must also establish the periods during which their websites served malicious content and identify any wallet approvals generated through those interfaces. Users who interacted with affected websites during the incident should review recent transactions and revoke suspicious token allowances. A wallet connection alone does not necessarily establish that assets were compromised, but malicious signatures and approvals can authorize transfers after the original interaction. The Ethereum Foundation has previously supported efforts to detect and disrupt wallet-draining infrastructure, reflecting the growing importance of protecting users against attacks outside smart-contract code. For the affected protocols, restoring website availability is only one part of recovery. Establishing the intrusion's cause, identifying potentially exposed wallets and strengthening domain-access controls will determine whether a shared infrastructure weakness can be prevented from producing another cross-platform incident.