Threat watch / Attack
Name.com support account used to hijack 15 DeFi domains
An account in a support team linked to the registrar changed the nameservers of 15 customer domains and sent visitors to a wallet drainer. About $138,000 was traced on EVM chains.
- Sector
- Tech & SaaS
- Way in
- Not public yet
- Product or vendor
- Name.com
- How it happened
- An account "within an associated support team" at Name.com changed the nameservers of 15 domains in about 45 minutes. Whether it was taken over, tricked or misused from inside is not public.[1] Checked 6 Nov 2026
- What was stolen
- Crypto drained from visitors' wallets through the Step Drainer kit, about $138,000 on EVM chains (Solana and Aptos not counted). Smart contracts were not touched.[1][3] Checked 6 Nov 2026
- Who was impacted
- 15 customer domains, mostly DeFi front ends (Flap, Kintsu, Origami Finance, Pickle Finance and others), 9 of them on Vercel, and the users who connected a wallet.[1][2] Checked 6 Nov 2026
- Threat actor
- Not attributed
Timeline
- Over about 45 minutes, a support-side account changes the nameservers of 15 domains and points them to a Step Drainer page. [1]
- Blockaid finds 12 hijacked DeFi sites, all registered at Name.com. The Block traces about $138,000 across three wallets. [3]
- Vercel says 9 domains on its platform were hit and restored, and that Name.com has published its root cause analysis. [2]
- The Hacker News quotes the root cause analysis, which names "an account within an associated support team". [1]