Name.com DNS Hijack: How Step Drainer Hit 12 DeFi Protocols Through the Registrar

DeFi protocols spend millions of dollars a year on formal verification, economic stress tests, and smart contract audits so that no attacker can manipulate their on-chain logic. On the night of Friday, October 30, into Saturday, October 31, 2026, twelve protocols across Ethereum Virtual Machine (EVM) chains, Solana, and Aptos were compromised at the same time, and none of them had a flaw in its contract code. The attackers skipped the blockchain and went after the domain registrar, the Web2 layer every browser uses to find a decentralized application.

Blockaid, an on-chain security firm, flagged the campaign first, and independent analysts and reporters at The Block traced it. Visitors to twelve legitimate protocol domains were redirected to rogue infrastructure running the Step Drainer malware-as-a-service (MaaS) kit. The affected projects used different DNS hosts and ran on incompatible virtual machines, yet registry records showed one shared point: every compromised domain was registered through Name.com, a subsidiary of Identity Digital. By Saturday morning Name.com had put ten of the twelve domains under a clientHold Extensible Provisioning Protocol (EPP) status, which stopped them resolving across the global DNS hierarchy. On-chain investigators had traced about $138,000 in initial losses on EVM networks. That figure leaves out any drains on Solana and Aptos, which have not been quantified.

What happened in the Name.com DNS hijack?

Twelve DeFi domains registered at Name.com were redirected on October 30 and 31, 2026 to fake front-ends that loaded the Step Drainer kit. The smart contracts were never touched. Victims lost funds by signing malicious approvals and permits, and about $138,000 has been traced on EVM networks so far.

Timeline of the October 31 Name.com DNS hijack

The first public signs of nameserver manipulation appeared on the evening of Friday, October 30, 2026 (Eastern Time), which is the early hours of October 31 UTC. Zack Abrams at The Block reconstructed the sequence, and the affected teams filled in the rest with their own disclosures.

• 9:10 p.m. EDT (01:10 UTC): Flap (flap.sh), a token launch platform backed by YZi Labs, is flagged as compromised.
• 10:13 p.m. EDT (02:13 UTC): Flap’s engineers confirm an active DNS hijack sending traffic to an unauthorized server. They stand up a clean backup domain at flap.cool and tell users not to sign any pending wallet prompts.
• 10:54 p.m. EDT (02:54 UTC): Blockaid publishes its first alert, naming Flap and Kintsu (kintsu.xyz), a liquid staking protocol on Monad, as serving the Step Drainer payload.
• 11:16 p.m. EDT (03:16 UTC): Blockaid widens the alert after its scanners find the same drainer fingerprints on ten more DeFi front-ends.
• 12:27 a.m. EDT, Saturday: Name.com’s X account replies to liquidated0x and bluexxix and tells affected parties to use its standard abuse form.
• 8:32 a.m. EDT (12:32 UTC): ten of the twelve domains are placed under clientHold. Only flap.sh and kintsu.xyz stay out of the bulk suspension, because their teams had already changed their nameserver delegation during the night.

The 12 compromised domains

EVM and multichain protocols:

• flap.sh (Flap, prominent on BNB Chain)
• kintsu.xyz (Kintsu on Monad)
• pickle.finance (Pickle Finance, a yield aggregator)
• origami.finance (Origami Finance, a leveraged yield protocol)
• supswap.xyz (SupSwap)
• longbow.cash (Longbow)
• shprd.finance (Shprd Finance)
• apexdefi.xyz (Apex DeFi)

Solana protocols:

• stonkfun.xyz (StonkFun)
• fluxbeam.xyz (FluxBeam, a DEX and Telegram trading bot platform)
• stakepoint.app (StakePoint)

Aptos protocol:

• echelon.market (Echelon Market, a money market written in Move)

How researchers traced the hijack to Name.com

As responders on the twelve teams went through their logs, it became clear this was not a BGP hijack or a single DNS provider outage. The projects used different authoritative DNS hosts, including Cloudflare, Vercel, and Name.com’s own nameservers. Pseudonymous researcher banteg (of Yearn Finance) and X analysts bluexxix and liquidated0x compared the WHOIS and Registration Data Access Protocol (RDAP) output for all twelve domains and found the common factor. Name.com, Inc. (IANA ID 625) was the sponsoring registrar for every one of them.

How a registrar compromise redirects DeFi domains

Registry, registrar, and nameserver roles

When a user types pickle.finance or kintsu.xyz into a browser, the recursive resolver (such as 1.1.1.1 or 8.8.8.8) asks the root servers, which point to the top-level domain (TLD) registry. Here that is Identity Digital (formerly Donuts) for .finance and .market, XYZ.COM LLC for .xyz, and Google Registry for .app. The registry holds the master zone file with the NS (nameserver) delegation records for every second-level domain.

Domain owners do not deal with the registry directly. They use an accredited registrar, in this case Name.com, which talks to the registry over EPP: authenticated XML commands over TLS with mutual client-certificate authentication. Those commands update NS records, glue (A/AAAA) records, DS (Delegation Signer) records for DNSSEC, and domain status codes.

The scope of access matters. An attacker who takes over a protocol’s Cloudflare account can only change the A, AAAA, or CNAME records inside that one zone. An attacker with access at the registrar layer, through a breach of an internal Name.com admin tool, an exploited API endpoint, or compromised partner credentials, can send an EPP update command straight to the registry. That command overwrites the parent NS delegation for any domain the registrar manages. Resolution then moves away from Cloudflare or Vercel to attacker-controlled nameservers, or the attacker edits records inside Name.com’s default nameserver cluster.

Why the fake sites had valid HTTPS

DNS caching means a parent-zone NS change spreads gradually as cached delegations expire across resolvers worldwide. Once a resolver picks up the injected NS records, it asks the attacker’s nameservers, which return an A record pointing at the attacker’s reverse proxy or staging server.

An attacker who controls authoritative DNS at that moment can also pass Let’s Encrypt ACME HTTP-01 or DNS-01 challenges without effort. Within sixty seconds of the NS switch, the attacker’s server can get a valid, browser-trusted X.509 certificate for the hijacked domain. The visitor sees the right domain name, a valid padlock, and no certificate warning.

The Vercel and Name.com API connection

Saturday morning’s post-mortems added context about Vercel, the platform many Web3 teams use to host React and Next.js front-ends. Kintsu and Origami Finance both looked at Vercel’s domain management layer in their incident updates. At 04:35 CET (11:35 p.m. EDT Friday), Kintsu reported a DNS hijack at its registrar. By 05:11 CET it clarified that its domain was managed through Vercel’s domain infrastructure, which uses Name.com underneath. Origami Finance said its on-chain vaults were unaffected, but it kept its contracts paused until Vercel and Name.com finished a formal root-cause analysis.

The overlap goes back to December 9, 2025, when Name.com announced an expansion of its CORE API integrations across developer cloud platforms including Vercel, Netlify, Replit, and Bolt. Vercel chose Name.com as the backend registrar for its rebuilt domain registration service. Under that setup, a developer who buys or manages a domain in the Vercel dashboard is using Vercel as an interface layer that makes programmatic API calls to Name.com to provision domains, update NS delegations, and configure zone records.

Two hypotheses for the root cause

The root cause is unconfirmed. Two explanations fit the evidence so far, and neither requires all twelve domains to be hosted on Vercel.

The first is a direct compromise of Name.com’s infrastructure or admin tooling. An attacker with access to an internal support panel, a privileged API token, or a webhook management pipeline could search Name.com’s database for crypto-related domains, by keyword or from known DeFi domain lists, and change their routing in bulk. That would work whether the customer registered directly at Name.com or through a partner such as Vercel.

The second is abuse of the partner API or reseller credential chain. A vulnerability or leaked credential in the API bridge between partner platforms and Name.com would give the same result. The Block noted that Vercel disclosed an internal systems breach in April 2026, traced to a compromised third-party AI tool. Neither Vercel nor Name.com has confirmed any link between that earlier credential exposure and the October 31 changes, and both companies’ status pages read “All Systems Operational” throughout Saturday morning.

What the clientHold status did

When Name.com acted at 8:32 a.m. EDT, it applied clientHold to ten domains. Under RFC 5731, clientHold tells the registry to drop the domain’s NS records from the published TLD zone file. It works as an emergency kill switch: later lookups return SERVFAIL or NXDOMAIN, which shuts down the attacker’s phishing servers. It also takes the legitimate protocol offline until the registrar clears the flag and verifies the registrant’s identity.

How Step Drainer malware works

When a victim’s browser resolved one of the hijacked domains, it loaded a cloned or reverse-proxied copy of the protocol’s front-end with Step Drainer injected. LevelBlue SpiderLabs documented Step Drainer in detail in April 2026, and threat intelligence platforms such as SOC Prime track it. It is a commercial, multichain MaaS platform built to extract Web3 credentials and assets across more than twenty blockchain networks.

Step Drainer pricing and the 55/30/15 profit split

Step Drainer runs on an affiliate and licensing model, which sets it apart from bespoke nation-state exploits. According to LevelBlue SpiderLabs, it is sold in two tiers:

• Full source-code license, $750: the standalone PHP backend and JavaScript client-side drainer, which the buyer can self-host and modify.
• Managed affiliate tier, $150 upfront plus 20% commission: a lower entry price for affiliate operators (“traffickers” who specialize in DNS hijacks, Google Ads malvertising, or Discord compromises), with a hardcoded smart-contract split that sends 20% of drained value back to the kit’s authors.

On-chain tracing by The Block showed that the October 31 campaign used its own distribution formula in the drainer’s settlement contracts. The roughly $138,000 stolen on EVM networks was split automatically across three recipient wallets at 55%, 30%, and 15%, with the same proportions on Ethereum Mainnet, BNB Chain, Monad, and Robinhood Chain.

On BNB Chain, one recipient address collected about 3.1 BNB (near $2,200 at the time) from four victim wallets in a 42-minute window, 9:00 p.m. to 9:42 p.m. EDT Friday. That is the same window in which flap.sh first went rogue. One plausible reading of the fixed split is a division of labor: one share for the DNS access broker, one for the affiliate running the campaign, and one for the toolkit developer. That is my interpretation, and the on-chain data does not confirm it.

Delivery, fingerprinting, and EtherRAT payloads

Step Drainer’s staging uses server-side PHP and heavily obfuscated client-side JavaScript. When a victim visits a hijacked domain, the PHP backend checks request headers, IP geolocation, and the User-Agent string to filter out known security scanners, headless browsers, and datacenter IP ranges. Visitors who pass get an obfuscated JavaScript loader, often built from base64-encoded chunks that are decoded and run in the browser’s DOM at runtime.

To raise conversion, the kit takes over the standard Web3Modal interface (built on WalletConnect / Reown) and renders a pixel-perfect overlay asking the user to connect a wallet such as MetaMask, Rabby, Phantom, or Petra. The victim arrived through a familiar bookmark like origami.finance or fluxbeam.xyz and sees what looks like the real modal, so there is little friction.

LevelBlue and SOC Prime have also documented Step Drainer campaigns that deploy a host-level payload called EtherRAT. In variants where victims are prompted to pass a fake Cloudflare verification or download an update, EtherRAT sets up persistence on Windows by writing to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key. It also uses a technique called EtherHiding: it queries Ethereum and Solana JSON-RPC endpoints to read command-and-control (C2) server IP addresses stored in immutable smart contract state, so ordinary domain takedowns do not remove the C2 infrastructure.

How the wallet drain works: Permit2, EIP-2612, and batched transactions

Once a user clicks “Connect Wallet” on an infected page, the injected script cannot reach private keys or the BIP-39 seed phrase, because browser extension sandboxes keep them isolated. Step Drainer instead abuses standard authorization features of the chains.

Automated asset enumeration

Right after reading the connected public address (0x on EVM, Base58 on Solana, hex on Aptos), the drainer queries indexer APIs such as DeBank, Alchemy, Helius, or custom RPC nodes. It builds a live inventory of every native coin, ERC-20 token, SPL token, LP position, and staked receipt token in the wallet, sorted by USD liquidity with the most valuable first.

Off-chain EIP-712 signatures and Permit2

Wallets show high-friction red warnings when an untrusted contract asks for a direct native ETH transfer, so Step Drainer prefers gasless off-chain signatures. If the victim holds tokens that support EIP-2612 permit, or has previously approved Uniswap’s canonical Permit2 contract (0x000000000022D473030F116dDEE9F6B43aC78BA3), the drainer builds an EIP-712 typed data payload (PermitSingle or PermitBatch) and calls eth_signTypedData_v4.

Signing an EIP-712 message sends no transaction and costs no gas, so many users read it as a harmless login or terms-of-service check. The signature (v, r, s) actually authorizes the attacker’s relayer address to pull the user’s tokens on-chain right afterward.

Fallback approve calls and fake function names

For legacy ERC-20 tokens that lack permit support and have not been approved to Permit2, the drainer sends a standard approve(address spender, uint256 amount) transaction with the amount set to type(uint256).max (2^256 – 1). It may instead disguise the call with a fake function selector such as SecurityUpdate(), Claim(), or Execute() on a proxy contract that routes native value into the 55/30/15 splitter contract.

Solana transaction bundling

On Solana (stonkfun.xyz, fluxbeam.xyz, and stakepoint.app), the drainer uses the runtime’s ability to pack several instructions into one atomic transaction. It builds a single VersionedTransaction with multiple SPL Token TransferChecked or Approve instructions plus native SOL SystemProgram::transfer calls. That can sweep up to a dozen distinct assets with one wallet confirmation click.

How the affected DeFi protocols responded

Which protocols had user losses and which escaped came down to detection speed, DNS setup, and whether the team paused its contracts.

Kintsu confirmed the hijack at around 00:00 UTC on October 31. It told anyone who had interacted with the site after midnight UTC to use Revoke.cash or a similar block explorer approval manager to revoke active ERC-20 allowances and Permit2 authorizations granted during the exposure window, and to move remaining assets to fresh hardware-backed addresses. After Kintsu regained control of its DNS delegation and pointed kintsu.xyz back at its real infrastructure on Saturday morning, it asked users to wait until global recursive DNS caches had flushed before reconnecting wallets.

Flap developer Cedric said that dApps never hold private keys or seed phrases on their web servers, so users who had only connected to flap.sh before the Friday night DNS change were safe and did not need to abandon their wallets. Only users who signed malicious approvals during the hijack window were at risk.

StonkFun took its front-end offline as soon as it detected the problem, moved its domain and hosting to new infrastructure, and confirmed through SolanaFloor monitoring that no StonkFun users lost funds. FluxBeam and Origami Finance also reported no direct protocol losses. Origami paused its on-chain vault contracts as a precaution, so that even if an attacker held a phished approval for an Origami vault receipt token, the vault state could not be manipulated while the investigation with Vercel and Name.com stayed open.

How to defend DeFi against registrar-level DNS hijacks

This incident follows the 2022 Curve Finance DNS hijack ($570,000 stolen), the BadgerDAO Cloudflare incident, the late-2023 Velodrome and Aerodrome registrar social-engineering attacks at Porkbun, the CoW Swap front-end compromise, and the March 2026 Neutrl DNS hijack. Each success exposes the same weak spot in the usual Web3 threat model. An immutable smart contract on Ethereum, Monad, or Solana gives no protection if the mutable HTTP layer feeding transactions into the user’s wallet can be swapped out quietly. Removing the registrar as a single point of failure takes controls at both the protocol and wallet level.

Enable Registry Lock

Standard registrar account locks (clientUpdateProhibited) are enforced only by the registrar’s own software. If the registrar is breached or a partner API token is exploited, an attacker can switch clientUpdateProhibited off and change the NS records in the same API call.

Registry Lock (serverUpdateProhibited, serverDeleteProhibited, serverTransferProhibited) is enforced one level up, at the TLD registry, such as Verisign or Identity Digital. Changing a locked domain requires an out-of-band, multi-party human verification between registrar and registry, often with hardware tokens, voice or video confirmation, and a fixed cooling-off period of 24 to 48 hours. An automated API exploit or a support-desk compromise cannot change the nameservers of a Registry-Locked domain.

Know the limits of DNSSEC

DNSSEC is often recommended as a cure for DNS hijacking. It does stop cache poisoning and man-in-the-middle route leaks, but it gives little protection when the registrar itself is compromised. The registrar has EPP authority to update the DS record in the parent zone along with the NS records. An attacker with registrar-level API access can strip the DS record, which downgrades the domain to unsigned, or upload a new DS record that matches their own signed malicious zone.

Lock down CAA records and monitor CT logs

Publish strict CAA records that limit certificate issuance to one Certificate Authority and bind it to a locked account URI (the accounturi parameter, RFC 8657). Also run automated monitoring of Certificate Transparency (CT) logs through certstream or Cloudflare CT alerts. A hijacker needs a new TLS certificate to avoid browser warnings, so a CT log webhook can alert your security team the moment an unauthorized certificate is pre-certified, often thirty to sixty minutes before on-chain drain alerts fire.

Use content-addressed hosting and signed desktop clients

To separate the interface from centralized registrars, publish deterministic, content-hashed builds to IPFS with ENS (.eth / .limo) resolution. Also distribute verifiable desktop builds (Electron or Tauri) signed with the developers’ offline keys, so users do not fetch the application over DNS on every page load.

Simulate transactions in the wallet

On the user side, wallets with real-time security engines such as Blockaid, Blowfish, and Pocket Universe are the last technical barrier. They simulate an unsigned transaction’s execution against a forked chain state before the user clicks Sign. That can show that an innocent-looking SecurityUpdate() call or Permit2 signature will move the entire balance to an untrusted contract, which defeats Step Drainer’s Web3Modal deception even when the domain itself has been compromised.

Name.com DNS hijack FAQ

Was the Name.com DNS hijack a smart contract exploit?

No. The contracts were not exploited. The attackers redirected the domains and tricked users into signing malicious approvals through fake front-ends.

How much was stolen in the Name.com DNS hijack?

About $138,000 has been traced on EVM networks. Losses on Solana and Aptos have not been quantified.

Did the attackers get users’ private keys or seed phrases?

No. The injected script cannot read them. Step Drainer relies on signed permits and approvals that let the attacker’s address move tokens.

What should I do if I used an affected site during the hijack?

Kintsu told users who interacted with its site after midnight UTC on October 31 to revoke active ERC-20 allowances and Permit2 authorizations through Revoke.cash or a similar approval manager, and to move remaining assets to fresh hardware-backed addresses. Flap said users who only connected before the DNS change were safe, and that only those who signed malicious approvals during the hijack window were at risk.