DNS Hijackers Drain $138K From 12 DeFi Sites

Hackers hijacked 12 DeFi websites late Friday and used Step Drainer malware to steal about $138,000, with all 12 identified domains registered through Name.com. The figure covers funds traced on EVM chains; losses on affected Solana and Aptos sites may not be included. The number of victims remains unclear.

Why it matters

The sites did not share a DNS provider, and responsibility for the hijacks has not been established. Kintsu and Origami Finance blamed Vercel infrastructure, while Name.com reportedly told at least one affected project that a third-party issuer was responsible. Name.com’s public response asked users to file an abuse report. Vercel had not commented publicly, and both companies listed their systems as operational.

Step Drainer tricks users into approving wallet transfers after connecting to an affected site. Onchain activity showed proceeds split among three wallets in 15%, 55% and 30% cuts. The attack crossed networks: funds were traced on BNB Chain, Ethereum, Robinhood Chain and Monad. On Monad, wallets redeemed staked MON and withdrew from Neverland; on Robinhood Chain, a wallet moved tokenized NVDA and AAPL shares from Morpho and swapped them for ETH.

Market impact

Ten domains were suspended at the registrar level, then the suspensions were lifted by late Saturday morning. Flap and Kintsu’s domains remained operational at publication time. Some affected projects said their onchain contracts were untouched, but a safe contract does not prevent a malicious frontend from prompting users to approve transfers.

At least four wallets sent funds to attackers on BNB Chain alone. FluxBeam reported no known affected users, while StonkFun said it was not aware of any. The incident leaves users with a practical risk to watch: a familiar DeFi site can become a wallet-draining interface if its domain or hosting infrastructure is compromised.