Name.com confirms its domains were redirected to drain crypto wallets

Updated 31 October, 17:45 UTC. Name.com has acknowledged the redirects.

Name.com, the registrar behind a dozen hijacked decentralised finance websites, acknowledged on Saturday that “a number of domains at name.com were improperly redirected late Friday as part of a plan to access visitors' crypto wallets.” It said the affected domains had been restored and that it is investigating. It did not say how the attackers made the changes.

The statement, posted at 17:13 UTC, came 15 hours after the first site raised the alarm. Until then the registrar's only public response had been to ask users to fill in its abuse form, according to The Block. In a second post, Name.com told every customer to check their nameserver and DNS records for changes they did not make and to turn on two-factor authentication.

How the night unfolded

Token launch platform Flap posted the first warning at 02:13 UTC: its site was redirecting to an unauthorised copy. Blockaid, a wallet security firm, flagged Flap and Kintsu at 02:54 UTC and ten more sites 22 minutes later, all serving the same kit, which it calls Step Drainer: StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, SHPRD and ApeX DeFi.

Kintsu, a liquid staking protocol on Monad, has given the most precise account. An unauthorised nameserver change at its registrar, Vercel, which uses Name.com, sent visitors to a malicious clone of its site from about 00:15 to 04:11 UTC, it said. Some networks kept serving the clone until about 05:20 UTC because they had cached the bad answer. At 04:11 UTC, with the attack still live, Kintsu wrote that its fix would not propagate and that support “is a bot”.

At 12:32 UTC, ten of the 12 domains were put on client hold, which stops them resolving at all, The Block reported. Flap's and Kintsu's were not.

What the registrar link does and does not show

Registry records list Name.com as the registrar for all 12 domains, according to The Block. Vercel has used Name.com as its upstream registrar since it rebuilt its domains service in September 2025. Kintsu bought its domain through Vercel, and Origami Finance warned of “an active attack on Vercel-associated Nameservers.”

The sites did not share one DNS setup, though. Some used Cloudflare, some Vercel and some Name.com's own nameservers, The Block found. That points to the layer above all three: the registrar record that says which nameservers a domain uses. Anyone who can edit that record can send the domain anywhere, whoever hosts its DNS. It is also why, as CircleID notes, DNSSEC alone would not necessarily have stopped it.

What nobody has established is how the attackers got that access. Stolen customer credentials, a compromised reseller account or API, and a breach of Name.com itself would all produce the same result, and Name.com's statement does not distinguish between them. Vercel has not commented publicly and did not respond to The Block.

The drainer and the money

Step Drainer is sold as a service. LevelBlue's SpiderLabs team priced it in April at about $750 for the source code, or $150 for a version that keeps 20% of each theft, The Block reports. Proceeds from this campaign went to three wallets in fixed shares of 15%, 55% and 30%, and the same split appears on BNB Chain, Ethereum, Robinhood Chain and Monad.

The Block traced about $138,000 to those wallets. That is a floor. FluxBeam, StonkFun and StakePoint run on Solana and Echelon on Aptos, and losses there are not counted. No project has said how many users signed anything. Kintsu paused deposits and withdrawals of its sMON token at 06:34 UTC, which also blocks a pending redemption it has tied to stolen funds.

What to do

Anyone who connected a wallet to one of these sites during the window should move their funds to a new wallet. The attack used a delegation signature, so revoking token approvals is not enough, Kintsu warned.

For domain owners, start with what Name.com recommends: check the nameservers on the registrar record, not only the DNS zone, and turn on two-factor authentication. Where the registrar and the domain's extension offer registry lock, use it. Changes under registry lock need manual verification at the registry, so a stolen password alone cannot move the domain.

Name.com says it will update its thread as it learns more. This article will be updated when Name.com or Vercel explains how the records were changed.