Name.com hijackers still hold valid TLS certificates for 13 domains

Updated 31 October, 19:23 UTC. Coinspect found the attacker changed nameserver delegation at Name.com and still holds valid TLS certificates for 13 of the domains.

The attackers who redirected decentralised finance websites registered through Name.com still hold valid TLS certificates for 13 of those domains, security firm Coinspect said on Saturday. All 15 affected domains have been restored, but the attacker's DNS zones for 13 of them are still hosted on Name.com's nameservers, and the certificates stay valid until 29 January 2027, Coinspect said at 18:24 UTC.

Name.com acknowledged at 17:13 UTC that "a number of domains at name.com were improperly redirected late Friday as part of a plan to access visitors' crypto wallets." It said the domains had been restored and that it is investigating. It has not said how the attackers made the changes.

How the domains were taken

Between 00:35 and 01:20 UTC on Friday night, the attacker set up DNS zones for 14 domains on Name.com's nameservers, according to Coinspect, whose scanner recorded the changes as they happened. The attacker then switched each domain's nameserver delegation at the registrar to point at those zones. Ownership of the domains was not transferred. Most of the victims normally ran their DNS on Vercel, Cloudflare, Akamai or NS1.

Changing delegation at the registrar sends a domain wherever the attacker wants, whoever normally hosts its DNS. Registry records list Name.com as the registrar for the affected domains, The Block reported. Vercel has used Name.com as its upstream registrar since September 2025, and Origami Finance warned of "an active attack on Vercel-associated Nameservers."

Two domains did not fit that pattern, Coinspect found. SupSwap already used Name.com's DNS, so its delegation did not need to change. Kintsu's registrar-level nameservers never changed: its records were edited inside its existing zone, which Coinspect says suggests a different way in. Kintsu had described the attack as an unauthorised nameserver change.

How the attacker got access to change records at Name.com is still not known. Stolen customer credentials, a compromised reseller account or API, and a breach of Name.com itself would all produce the same result. Vercel has not commented publicly.

How the night unfolded

Token launch platform Flap posted the first warning at 02:13 UTC. Blockaid, a wallet security firm, flagged Flap and Kintsu at 02:54 UTC and ten more sites 22 minutes later, all serving a drainer kit it calls Step Drainer. Coinspect's full list also includes Dooar, Perena and Stonkbrokers.

Kintsu said visitors were sent to a malicious clone of its site from about 00:15 to 04:11 UTC, and some networks kept serving it until about 05:20 UTC from cache. At 04:11 UTC, with the attack still live, Kintsu wrote that its fix would not propagate and that support "is a bot". At 12:32 UTC, ten domains were put on client hold, which stops them resolving at all, The Block reported.

The certificates

With the domains pointed at its servers, the attacker obtained certificates for them through ACME, the automated process certificate authorities use to check domain control. Two domains escaped, Coinspect said. Perena's staged zone pointed to a parking page rather than the attacker's server. Dooar was signed with DNSSEC, which stopped the attacker obtaining a certificate. A CAA record, which limits which authorities may issue certificates for a domain, did not protect Origami Finance, because the attacker's zone left it out.

A certificate stays valid until it expires or is revoked. Until these 13 are revoked, anyone who can steer a visitor to the attacker's server, for example through a poisoned resolver or a hostile network, can present a valid certificate for the real domain.

The drainer and the money

Step Drainer is sold as a service, The Block reports, at about $750 for the source code or $150 for a version that keeps 20% of each theft. Proceeds from this campaign went to three wallets in fixed shares of 15%, 55% and 30% across BNB Chain, Ethereum, Robinhood Chain and Monad. The Block traced about $138,000 to those wallets. That excludes Solana and Aptos, where several of the sites run. Kintsu paused deposits and withdrawals of its sMON token at 06:34 UTC.

What to do

Anyone who connected a wallet to one of these sites during the attack should move their funds to a new wallet. The attack used a delegation signature, so revoking token approvals is not enough, Kintsu warned.

Owners of the affected domains can find the attacker's certificates in Certificate Transparency logs and ask the issuing authority to revoke them. Name.com told all customers to check the nameservers on the registrar record, not only the DNS zone, and to turn on two-factor authentication. DNSSEC and registry lock, where the extension offers it, both raise the cost of this attack.

Coinspect said it will publish an analysis of the drainer payload next. Name.com has said it will update its thread as it learns more.