Domain registrar Name.com has restored 15 customer domains that were hijacked in a coordinated attack, including 10 domains tied to Vercel. However, the restoration came after the compromised domains had already been used to redirect users to malicious pages designed to drain cryptocurrency wallets.
The campaign ran on October 30-31 and targeted at least 12 decentralized finance project websites. On-chain losses from the attack are estimated at approximately $138,000.
How the Attack Worked
Attackers gained access to the domain registrar and redirected DNS records to pages under their control. When users visited familiar DeFi project URLs, they were sent to convincing lookalike pages instead. These malicious pages deployed a tool called Step Drainer, which tricked users into signing unauthorized transactions that emptied their wallets.
The underlying smart contracts of the targeted projects remained intact and uncompromised throughout the incident. All 15 affected domains were registered through Name.com, with registry records showing that ten domains were placed on client hold status before being restored.
Response and Investigation
Name.com publicly acknowledged the improper redirections and advised customers to review their DNS settings and enable two-factor authentication. DeFi projects Flap and Kintsu, along with security firm Blockaid, confirmed the attacks occurred at the registrar level.
Some targeted teams limited damage by moving their nameservers to hosting services like Vercel or Cloudflare. The exact method by which attackers gained access to the registrar remains under investigation.
Implications for DeFi Security
The incident highlights a persistent vulnerability in decentralized finance infrastructure. While DeFi protocols emphasize trustless systems and immutable smart contracts, the traditional internet infrastructure used to access these systems—domain registrars, DNS records, and account logins—remains a potential weak point.
For users, the attack demonstrates that careful attention to transaction prompts provides limited protection when the website address itself is compromised. For project teams, the incident underscores the importance of operational security practices including strong authentication, DNS monitoring, and incident response plans that address registrar-level compromises.
Until the root cause of the breach is determined, whether through compromised internal systems or stolen credentials, other DeFi projects and registrars may need to reassess their security protocols.
