Hackers hijack 12 crypto websites through domain registrar Name.com
Visitors to a dozen DeFi platforms were sent to fake sites that drained their wallets. All the domains were registered through Name.com; about $138,000 has been traced so far.
Symbolic image · Photo: अरविंद धरेप्पा बगले / Wikimedia Commons, CC BY-SA 4.0 (cropped and resized)
Unknown attackers redirected at least 12 decentralized finance (DeFi) websites starting late Friday U.S. Eastern time, sending visitors to convincing copies that tricked them into approving transfers from their crypto wallets. Affected platforms include Flap, Kintsu, Pickle Finance, Origami Finance, FluxBeam, Echelon and StonkFun. Security firm Blockaid, which first flagged the attacks, said the sites ran the Step Drainer phishing kit.
Security researchers found that all of the domains shared the same registrar, U.S.-based Name.com, which suspended 10 of them on Saturday so they no longer resolve. Crypto news site The Block traced about $138,000 in stolen funds on Ethereum-compatible chains, excluding losses on Solana and Aptos. The number of victims is unknown. Several projects said their smart contracts were not affected.
How the attackers gained control of the domains remains unclear. Kintsu called it a supply-chain attack and pointed to Vercel's domain service, through which its address was registered. Neither Name.com nor Vercel had publicly commented on the cause as of Saturday morning U.S. time. On Thursday, attackers stole about $2.7 million from 726 wallets on prediction market Polymarket via a third-party script; no link to the current campaign has been established.