At least 12 decentralized finance websites fell victim to a coordinated hijacking attack in which attackers altered DNS records rather than targeting the underlying smart contracts. Security firm Blockaid reported the incident on October 31, 2026, describing a front-end attack that redirected users to infrastructure controlled by the attackers.
Blockchain analysis has traced approximately $138,000 in stolen funds so far. Every affected domain was registered with Name.com, according to public registry records reviewed during the investigation.
How the Attack Unfolded
The attackers modified DNS records for the compromised domains, effectively rewriting the directory entries that direct internet traffic. Users who typed the correct URL were sent to attacker-controlled sites with no visible indication that anything had changed. Once redirected, visitors encountered the Step Drainer toolkit, a malicious script designed to trick users into signing transactions.
Affected Projects
Named victims include Flap, Kintsu, StonkFun, and Pickle Finance, along with several other projects. The common factor was not shared code or infrastructure but rather the choice of registrar. All compromised domains relied on Name.com's nameservers, allowing attackers to redirect multiple unrelated projects in a single campaign.
Some teams regained control quickly by migrating their domains to nameservers provided by Vercel and Cloudflare. StonkFun reported that its users were not affected by the attack. Name.com did not acknowledge the incident on its status page or blog at the time of the reports.
Implications for DeFi Security
The attack highlights a gap in how the DeFi sector approaches security. Discussions typically focus on smart contract vulnerabilities, with resources devoted to audits, bug bounties, and formal verification of on-chain code. This incident bypassed those defenses entirely by compromising the domain infrastructure pointing to the contracts.
The pattern resembles supply chain attacks in traditional software, where a single point of failure at the registrar level affected dozens of unrelated projects. Domain management and security practices have lagged behind smart contract security across much of the industry.
Projects that recovered fastest had migration plans in place and direct control over their DNS setup, suggesting that preparedness and redundancy in nameserver infrastructure were key advantages during the incident response.
