At least 12 decentralized finance websites were hijacked in a coordinated attack after hackers altered their domain name system records at the registrar level. The smart contracts used by the affected projects were not breached; instead, attackers targeted the domains that direct users to the projects’ websites.

The Block has traced approximately $138,000 in stolen funds using on-chain data. According to public registry records reviewed by the outlet, every affected domain was registered with Name.com.

How the attack worked

Security firm Blockaid reported the incident on October 31, 2026, describing it as a front-end attack. The attackers changed the DNS records for the affected websites, effectively rewriting the entries that direct a domain to its hosting infrastructure. A domain’s nameservers, typically operated through its registrar, act as the directory that tells browsers where a website actually resides. Whoever controls that directory can redirect visitors before any code review, audit or contract check comes into play.

Users who entered the correct web addresses were sent to infrastructure controlled by the attackers, with no obvious indication that the sites had been redirected. The compromised pages contained the Step Drainer toolkit, a malicious script designed to trick visitors into signing transactions that could transfer their assets.

Projects affected

Named victims included Flap, Kintsu, StonkFun and Pickle Finance, along with other projects. The affected projects did not share code or operate on a single blockchain. Their common connection was that their domains relied on Name.com’s own nameservers.

By targeting the registrar layer, the attackers were able to redirect multiple unrelated projects in the same campaign. Some teams recovered quickly by moving their domains to nameservers operated by Vercel and Cloudflare, allowing them to regain control of their traffic.

StonkFun said its users were not affected. The approximately $138,000 in drained funds represents only the amount traced so far. Name.com had not acknowledged the incident on its status page or blog at the time of the reports, leaving affected teams to manage their incident response without public guidance from the registrar.

Why the front end matters

DeFi security discussions typically focus on smart contracts. Audits, bug bounties and formal verification are generally directed at the code that holds or manages user funds.

The attack bypassed those protections. A protocol can have secure smart contracts and still expose users to losses if the website that points them to those contracts is redirected. When trust fails at the DNS level, standard safety checks provide limited protection: verifying the URL does not help when the URL itself is correct but leads to attacker-controlled infrastructure.

The tactic is not unprecedented. In 2022, Curve Finance’s own homepage was redirected to a fraudulent clone after a registrar-level compromise of its domain. The incident reflects a broader security concern in the DeFi sector, where domain management and operational security have often received less attention than contract security.

Implications for projects and users

The projects that recovered most quickly had the ability to migrate to Vercel and Cloudflare nameservers. This suggests that teams with a prepared migration path and direct control over their DNS configuration were better positioned to respond.

The incident also exposed a shared point of failure. A dozen projects were connected through the same registrar, allowing one compromise at that layer to affect multiple websites at once. The pattern resembles a supply-chain attack in traditional software systems.

Wallet-level transaction warnings, including alerts from firms such as Blockaid, provide one layer of defense. However, the consequences extend beyond the stolen funds. Users who lose money through a hijacked website may hold the project named on the page responsible, even when the underlying failure occurred at the registrar or DNS level.

The reports did not detail how the attackers obtained access to the DNS records or whether registrar safeguards such as transfer or registry locks were enabled, and a public account from Name.com could clarify those points.

Source: CryptoBriefing