Name.com Restores the Hijacked DeFi Domains After a $138,000 Drain

The domains are resolving again. Name.com said it restored every site caught in Friday night's hijack, after ten of them sat under a registrar hold for part of Saturday, and those domains now carry transfer locks. Two counts of what the attacker took have since been published, and they sit about $64,000 apart. The registrar's own tally of affected domains is larger than Blockaid's list. No project has published a victim count.

Two totals for the same drain

The Block traced about $138,000 to three EVM wallets, mostly in MON and Robinhood Chain ether, and said the figure leaves out the three Solana sites and the one on Aptos. The CyberSec Guru carried the same number on Saturday evening and called the Solana and Aptos losses unquantified. Bitquery Research published a different reading the same day: $202,386, each loss valued as it happened, spread over six chains. On that breakdown Monad accounts for $163,318 across 19 wallets and Robinhood Chain for $35,920 across five, with BNB Chain, Base, Ethereum and Arbitrum together under $3,200. Bitquery's six chains do not include Solana or Aptos either, so chain coverage does not explain the gap. The two totals do not reconcile, and neither party addresses the other's method.

One detail in the Bitquery breakdown carries most of the sum. A single Monad wallet lost $160,531, about 79% of its total, and two wallets together account for 96%. Thirty-two wallets lost a dollar or more. Another fifteen lost less than a dollar each. That shape rests on one account, and no other researcher read here has checked it.

Twelve on the list, more at the registrar

Blockaid identified twelve hijacked front ends, all sponsored by Name.com; this desk reported that list on Saturday as twelve DeFi sites serving the Step Drainer. Name.com later told The Block that fifteen customer domains were affected. No other account read here carries the larger number, and the registrar has not said which three sit outside Blockaid's list. The ten domains put on client hold went up at 8:32 a.m. Eastern on Saturday, by two accounts; Bitquery places the action around midday UTC, which is the same event on a different clock. Flap and Kintsu escaped it; both had already moved their nameservers.

Three parties, three accounts of the cause

Blame has not settled anywhere. Kintsu said the incident happened on Vercel's end and was out of its control. Origami described an active attack on Vercel-associated nameservers and kept its vaults paused. Vercel's security bulletin said ten of the affected domains were tied to its platform, that Name.com had restored them, and that it chose Name.com as its registrar in late 2025. Cloakd, who develops FluxBeam, said a Name.com representative put the breach on third-party issuers instead. That last account comes from one party, and the registrar has not confirmed it.

The domains were "improperly redirected late Friday as part of a plan to access visitors' crypto wallets," Name.com said.

Its spokesperson's statement is narrower than that post. The company "identified unauthorized activity late Friday, October 30," and "has restored all affected domains." Neither line names a cause. Customers were told to check their DNS records and turn on two-factor authentication.

The kit cost less than the dust it swept up

The malware was Step Drainer, a subscription toolkit that gets a visitor to approve a transfer out of their own wallet. LevelBlue SpiderLabs described it in April as selling for about $750 for the full source, or $150 for a version that takes a fifth of each theft. The contracts behind the hijacked sites were never touched — Kintsu, Origami, FluxBeam and StonkFun each said so separately. The trade-off is the one that followed the $3.1 million lost through a Polymarket front end in June: the chain held and the web page did not. Bitquery puts the drains between about 01:00 and 05:33 UTC on Saturday, roughly seven hours before the registrar holds landed. We could not establish how many wallets connected inside that window. No root cause has been published by Name.com, by Vercel or by any of the twelve projects.