DeFi

Pickle

Origami

Monad

Pickle Finance

<p>Anyone who visited one of at least twelve DeFi sites registered with US registrar Name.com during the night to October 31, 2026 may not have landed on the real site. Attackers had redirected the DNS records of these domains and sent visitors to copies running a wallet drainer. The address in the browser looked perfectly normal. According to <a href="https://bitquery.io/investigations/name-com-dns-hijack" rel="noopener noreferrer nofollow">Bitquery’s analysis</a>, 32 wallets lost a combined $202,386, while The Block puts the figure at around $138,000. The most important consequence for you: if you confirmed a transaction or signature on one of the affected sites on October 30 or 31, you should revoke the approvals granted in the process.</p>
<p>The projects’ smart contracts themselves were untouched, according to Kintsu, Origami Finance, FluxBeam and StonkFun. The attack did not target the blockchain but the route to it: the website through which users connect their wallet. That is exactly why such an attack hits retail investors directly, and exactly why no protocol audit helps you here.</p>
<h2 id="name-com-hijack-what-happened-during-the-night-to-october-31">Name.com hijack: what happened during the night to October 31</h2>
<p>According to <a href="https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251" rel="noopener noreferrer nofollow">The Block’s</a> reconstruction, the site of the Flap platform on BNB Chain was flagged as compromised on Friday evening, October 30, at 9:10 p.m. Eastern time, which is 01:10 UTC on Saturday. About 100 minutes later, security firm Blockaid warned about Flap and the Monad staking service Kintsu and attributed both sites to the drainer kit Step Drainer. Blockaid later named ten more sites. All twelve had only one thing in common: they were registered with Name.com, a registrar that belongs to the Identity Digital group.</p>
<p>Users on X were the first to spot this common denominator. Shortly before midnight Eastern time, one user wrote that Name.com appeared to be compromised. Name.com replied a good half hour later and asked those affected to fill in the registrar’s abuse form. On Saturday morning at 8:32 a.m. Eastern time, the registrar suspended ten of the domains; according to The Block, Flap and Kintsu were not among them. By late morning the suspensions had been lifted and the domains were resolving normally again.</p>
<p>Bitquery counted the withdrawals on the blockchain. According to its data, they ran on October 31 between about 00:00 and 06:00 UTC, most of them before 04:00 UTC. For readers in Germany, that means the window fell in the night from Friday to Saturday between 1 and 7 a.m. German time, an hour at which many people do not trade, but users in Asia and the US very much do.</p>
<h2 id="dns-hijacking-how-the-redirect-to-fake-defi-sites-works">DNS hijacking: how the redirect to fake DeFi sites works</h2>
<p>The Domain Name System, or DNS, is the address book of the internet: it translates a name such as kintsu.xyz into the server address where the site is hosted. Anyone who can change these records at the registrar or DNS provider can send every visitor to a server of their choice. This type of attack is called DNS hijacking or domain hijacking.</p>
<p>A registrar is the company with which a domain is registered and managed. According to Bitquery’s breakdown, six of the twelve domains at Name.com ran through the DNS service of Vercel, a hosting service many Web3 projects use to deliver their front ends. Three used NS1, two Cloudflare and one Name.com itself. The fact that the redirect worked across different DNS providers suggests that the intervention took place one level higher. How the attackers were able to change the records has still not been clarified.</p>
<p>The insidious thing about this method: the address bar shows the real name, and the padlock symbol for an encrypted connection is often there too. The fake site looks like the original because it is a copy. The only difference lies in what the site asks your wallet to sign.</p>
<h3 id="why-bookmarks-offer-no-protection-here">Why bookmarks offer no protection here</h3>
<p>A common piece of advice against phishing is to open sites only via bookmarks. Against fake search ads and typo domains, that is correct. With DNS hijacking, however, the bookmark also leads to the attackers’ server, because the name itself points there. In this case, the only protection is what happens in the wallet: reading the signature, the wallet’s warning, and keeping the money you use for DeFi separate from the rest.</p>
<h2 id="step-drainer-the-toolkit-behind-the-withdrawals">Step Drainer: the toolkit behind the withdrawals</h2>
<p>A wallet drainer is malicious code on a website that gets visitors, after connecting their wallet, to confirm transfers or approvals that let attackers pull out the funds. According to The Block, LevelBlue SpiderLabs described Step Drainer back in April as a “malware-as-a-service” offering: the full source code reportedly costs around $750, and a rental version $150 plus 20 percent of every haul. According to its own advertising, the kit supports more than 20 networks.</p>
<p>In its analysis, Bitquery distinguishes four routes through which the money flowed out:</p>
<ul>
 <li>direct transfers to an attacker contract,</li>
 <li>token approvals that let the attackers pull balances themselves later,</li>
 <li>bundled signatures that moved several tokens in a single transaction,</li>
 <li>a permission in the lending platform Morpho that allowed an attacker contract to manage a user’s account.</li>
</ul>
<p>A token approval is permission you grant a smart contract so it can move tokens out of your wallet. It remains in place until you revoke it, even if you closed the site long ago. According to Bitquery, the victims confirmed requests that looked routine, such as a deposit or claiming a reward. A collector contract then split the haul between three wallets in a ratio of 55, 30 and 15 percent.</p>
<figure><img src="https://cryptoticker-strapi-media.s3.eu-central-1.amazonaws.com/name_com_dns_kaperung_drainer_2_0cc55d6f2c.webp" alt="Hand with a thumb over the confirm button for a signature on a smartphone, a coffee cup beside it on a dark wooden table" width="1920" height="1080">
 <figcaption>
  One tap is enough: the victims confirmed requests that looked like an ordinary deposit.
 </figcaption>
</figure>
<h2 id="damage-138-000-to-202-000-depending-on-the-count">Damage: $138,000 to $202,000, depending on the count</h2>
<p>The two published damage figures do not contradict each other; they measure different things. The Block tracked around $138,000 across three wallets on EVM blockchains, meaning Ethereum and compatible networks, mostly in MON and in ETH on Robinhood Chain. Losses on Solana and Aptos are not included. Bitquery values each withdrawal at the time of the outflow and also counts funds still sitting in a queue. That gives $202,386 from 32 wallets on six blockchains. According to Bitquery, the balance of the attacker wallets on the evening of October 31, at around $139,000, largely matches The Block’s figure.</p>
<table>
 <thead>
  <tr>
   <th>Blockchain</th>
   <th>Damage according to Bitquery</th>
   <th>Wallets affected</th>
  </tr>
 </thead>
 <tbody>
  <tr>
   <td>Monad</td>
   <td>$163,318</td>
   <td>19</td>
  </tr>
  <tr>
   <td>Robinhood Chain</td>
   <td>$35,920</td>
   <td>5</td>
  </tr>
  <tr>
   <td>BNB Chain</td>
   <td>$2,386</td>
   <td>7</td>
  </tr>
  <tr>
   <td>Base</td>
   <td>$427</td>
   <td>1</td>
  </tr>
  <tr>
   <td>Ethereum</td>
   <td>$298</td>
   <td>3</td>
  </tr>
  <tr>
   <td>Arbitrum</td>
   <td>$38</td>
   <td>1</td>
  </tr>
 </tbody>
</table>
<p>The damage is extremely unevenly distributed. A single Kintsu staker on Monad lost $160,531 according to Bitquery, just under 80 percent of the total. More than half of the victims, by contrast, lost less than $100. That shows how a drainer works: it takes whatever the wallet will give. Anyone who holds a large position in the same wallet they use to try out new sites exposes everything at once if something goes wrong.</p>
<p>Some of the money may not yet be lost. Around $56,600 in the form of 2.64 million sMON was sitting in Kintsu’s withdrawal queue as of Bitquery’s snapshot on October 31 at 18:30 UTC. Whether the team can halt these requests depends on the project’s contracts. According to Bitquery’s observations, the funds had not reached an exchange or bridge by then.</p>
<h2 id="affected-sites-flap-kintsu-pickle-finance-and-nine-others">Affected sites: Flap, Kintsu, Pickle Finance and nine others</h2>
<p>The Block names eight of the twelve projects found by Blockaid: Flap, Kintsu, Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun and StakePoint. Bitquery additionally lists longbow.cash, apexdefi.xyz, shprd.finance and supswap.xyz. Name.com itself spoke of 15 affected customer domains; the remaining three have not been named publicly.</p>
<p>The projects are spread across several networks. Flap runs on BNB Chain, Kintsu on Monad, Echelon on Aptos, FluxBeam, StakePoint and StonkFun on <a href="https://cryptoticker.io/en/prediction/solana-price-prediction/" rel="noopener noreferrer nofollow">Solana</a>, and Pickle Finance and Origami Finance on <a href="https://cryptoticker.io/en/prediction/ethereum-price-prediction/" rel="noopener noreferrer nofollow">Ethereum</a> and other EVM networks. FluxBeam and StonkFun said they were not aware of any affected users. Origami Finance said it was keeping its vaults paused until the cause is clear. According to Bitquery, Kintsu advised its users to revoke everything they had signed since midnight UTC on October 31.</p>
<p>Bitquery also observed bots trying to imitate the withdrawals with fake tokens at similar-looking addresses. This address poisoning is a trick of its own: it relies on victims later copying a wrong address from their transaction history.</p>
<h2 id="name-com-and-vercel-what-the-companies-have-said-so-far">Name.com and Vercel: what the companies have said so far</h2>
<p>According to The Block, Name.com stated on October 31 that it had restored all affected domains and was working directly with the account holders. On X, the registrar wrote that the domains had been improperly redirected late on Friday in order to get at visitors’ wallets. Name.com advised its customers to check nameservers and DNS records for unauthorised changes and to switch on two-factor authentication.</p>
<p>According to The Block, Vercel confirmed in a security notice that ten of the affected domains were connected to its platform, that Name.com had restored them and that Vercel was supporting the investigation. Vercel chose Name.com in 2025 as the registrar for its newly built domain service. Kintsu wrote on X that the incident had occurred on Vercel’s side and had been outside its control. That is the account of an affected project, not an established cause. Neither Name.com nor Vercel has yet explained publicly how the attackers were able to change the records.</p>
<figure><img src="https://cryptoticker-strapi-media.s3.eu-central-1.amazonaws.com/name_com_dns_kaperung_drainer_3_81f7095953.webp" alt="Hand using heavy pliers to separate a single key from a large bunch of keys on a dark workbench" width="1920" height="1080">
 <figcaption>
  Revoking an approval means taking the spare key back from a stranger.
 </figcaption>
</figure>
<h2 id="defi-in-germany-why-nobody-stands-behind-the-damage-in-front-end-attacks">DeFi in Germany: why nobody stands behind the damage in front-end attacks</h2>
<p>For investors in Germany, the case is instructive partly because it shows where supervisory protection ends. If you buy and store crypto-assets with a MiCA-licensed provider, a company with a registered office, a licence and a point of contact is liable. If, on the other hand, you use a DeFi application via your own wallet, there is usually nobody who will answer for a loss: you gave the signature yourself, and the contract correctly executed what you approved. Which exchanges hold a licence is shown in our overview of <a href="https://cryptoticker.io/en/comparison/best-regulated-exchange/" rel="noopener noreferrer nofollow">regulated crypto exchanges</a>.</p>
<p>That is not an argument against DeFi, but it is one for a clear separation. Anyone who uses a separate wallet only for dealing with new applications and keeps a small amount there limits the damage of such an attack to exactly that amount. Which software wallets simulate transactions before signing and warn about known drainers is compared in our <a href="https://cryptoticker.io/en/comparison/software-wallets/" rel="noopener noreferrer nofollow">software wallet comparison</a>. The rest belongs on a device that signs only on your explicit confirmation.</p>
<h2 id="how-to-protect-yourself-against-dns-hijacking-and-wallet-drainers">How to protect yourself against DNS hijacking and wallet drainers</h2>
<p><strong>What happened:</strong> On October 31, 2026, between about 00:00 and 06:00 UTC, attackers used DNS changes to redirect at least twelve DeFi domains registered with Name.com to copies running Step Drainer. The damage amounts to around $138,000 according to The Block and $202,386 from 32 wallets according to Bitquery (as of October 31). Name.com says it has restored the domains.</p>
<p><strong>Are you affected?</strong> You may be affected if, during the night from October 30 to 31, you opened one of the named sites, such as Flap, Kintsu, Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun, StakePoint, longbow.cash, apexdefi.xyz, shprd.finance or supswap.xyz, connected a wallet there and confirmed something. Anyone who did not use the sites during this time, or only looked at them without signing, has lost nothing as things stand. Three of the 15 domains have not been named publicly, so also check other DeFi sites you used that night.</p>
<ol>
 <li><strong>Revoke approvals:</strong> Open an approval checker such as Revoke.cash, connect the affected wallet and revoke every token approval from October 30 and 31, on every blockchain you used there.</li>
 <li><strong>Check Morpho permissions:</strong> If you use Morpho, check in the account settings which addresses are allowed to manage your account and remove any you do not recognise.</li>
 <li><strong>Read signatures:</strong> Cancel any signature that requests an unlimited approval, a transfer to an unknown address or an account permission when you only wanted to deposit or claim something.</li>
 <li><strong>Take wallet warnings seriously:</strong> If a warning about a malicious site appears when you connect, close the tab even if the address bar looks right, and check the project’s official X account for an all-clear.</li>
 <li><strong>Separate your DeFi wallet:</strong> Set up a dedicated wallet with a small amount for new applications and keep larger holdings on a hardware wallet that you never connect to unknown sites.</li>
</ol>
<p>The basics of safe storage are explained in our guide on <a href="https://cryptoticker.io/en/how-to-store-crypto-safely/" rel="noopener noreferrer nofollow">how to store crypto safely</a>, and suitable devices are compared in the <a href="https://cryptoticker.io/en/comparison/hardware-wallets/" rel="noopener noreferrer nofollow">hardware wallet comparison</a>.</p>
<h2 id="cause-unknown-the-questions-name-com-and-vercel-still-have-to-answer">Cause unknown: the questions Name.com and Vercel still have to answer</h2>
<p>Above all, it is unclear at which point the attackers gained control of the domains. Possibilities include a breach at the registrar, access via the interface of a partner such as Vercel, or compromised customer accounts. None of these variants has been proven so far, and it would be irresponsible to treat any of them as fact. In April, Vercel reported a security incident that the company traced back to a compromised third-party tool. Whether there is a connection is not known.</p>
<p>The pattern is not new. The Block recalls similar DNS attacks on the trading platforms Aerodrome and Velodrome in November 2025 and on Galxe in October 2023. What is new is the breadth: an intervention at registrar level hits projects on six blockchains at once that otherwise have nothing in common. Once Name.com or Vercel identifies the cause, it will be easier to judge whether other customers of the same providers are at risk.</p>
<h2 id="name-com-hijack-approvals-from-october-30-and-31-remain-the-risk">Name.com hijack: approvals from October 30 and 31 remain the risk</h2>
<p>The domains have been restored, but an approval that has been granted does not expire as a result. Three steps are enough to close the remaining risk:</p>
<ol>
 <li>Check and revoke all approvals from October 30 and 31. For the future, a wallet that simulates transactions before signing helps; candidates are shown in the <a href="https://cryptoticker.io/en/comparison/software-wallets/" rel="noopener noreferrer nofollow">software wallet comparison</a>.</li>
 <li>Move holdings you do not actively need in DeFi to a device from the <a href="https://cryptoticker.io/en/comparison/hardware-wallets/" rel="noopener noreferrer nofollow">hardware wallet comparison</a>, and never connect it to sites you do not know.</li>
 <li>Buy and store your core holdings with a licensed provider; which platforms have a MiCA licence is shown in the list of <a href="https://cryptoticker.io/en/comparison/best-regulated-exchange/" rel="noopener noreferrer nofollow">regulated crypto exchanges</a>.</li>
</ol>
<p><em>(As of November 2, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)</em></p>

Name.com domains hijacked: drainer on twelve DeFi sites, approvals from October 31 should be revoked

Table of Contents

CryptoTicker ENG

Other articles published on Nov 3, 2026

Join our free newsletter for daily crypto updates!