More than a dozen decentralized finance websites were hijacked at once this week, and investigators say the attackers never had to touch a single line of code. Instead, they hit the place where the websites live: a domain registrar. The Block reported on October 31 that all of the hijacked domains were registered with Name.com, and that roughly 138,000 USD worth of crypto has already been stolen from users who clicked what looked like trusted sites.
By Priya Sharma | October 31, 2026
The Hook: Your Favorite DeFi Site Turned Against You
Here is what happened, in plain terms. Every website you visit has an address behind it, called a domain, and a company called a registrar keeps the records that say who owns that address. According to The Block, attackers managed to seize control of the domains for at least a dozen DeFi projects — all registered through the same registrar, Name.com. Once they controlled the domains, they could show visitors fake versions of the real sites. To the person browsing, everything looked normal. The logo was right. The colors were right. But behind the scenes, wallet connection prompts and deposit addresses belonged to the thieves.
Think of it like this: a criminal does not need to break into your bank. If they can swap the sign on the front of the building and hire a teller who looks like yours, you will hand them your money yourself. That is a domain hijack. It is a phishing attack wearing a perfect costume.
On-Chain Evidence: The Numbers Behind the Attack
The damage reported so far sits at roughly 138,000 USD in stolen funds, according to The Block’s reporting. That number could grow. Investigators often find that victims delay reporting, either out of embarrassment or because they have not yet noticed small test transactions draining their wallets. The stolen amount is small compared to the record-breaking 6.3 billion USD Binance hack that has dominated headlines this week, but the technique is arguably more worrying — because it did not require exploiting any protocol’s code at all.
- A dozen or more DeFi websites — all hijacked in a coordinated operation, per The Block
- One common link — every affected domain was registered with Name.com
- Roughly 138,000 USD stolen — the early estimate of losses from victims interacting with fake sites
- No protocol exploits — the smart contracts themselves were not broken; the websites were
The Core Conflict: Convenience Versus a Single Point of Failure
The uncomfortable truth at the center of this story is that DeFi — an industry built on the promise that no single company should hold power over your money — still depends on deeply centralized plumbing. Domains are bought from registrars. Websites are hosted on corporate servers. When every project uses the same registrar, that registrar becomes a single point of failure, like one lock on a whole street of houses.
This comes at a sensitive moment. The crypto industry is still absorbing the Binance hack, where billions were stolen from the world’s largest exchange. This domain attack is a different kind of warning: it says that even if your smart contracts are flawless and your audits are clean, the simple website that introduces users to your protocol can be turned into a weapon. Security researchers have long pushed projects to decentralize their front-ends or use blockchain-based naming systems, but adoption has been slow, because traditional domains are easier and cheaper.
Market Implications: What This Means for Your Wallet
For regular investors, the message is blunt: the padlock in your browser bar means less than you think. A hijacked domain can still show a valid security certificate, because the attacker now controls the domain that certificate is issued for. If you use DeFi apps, treat every site as guilty until proven innocent — especially in the coming days, as more hijacked domains may surface.
Bitcoin is currently trading around 77,479 USD, up modestly on the day, according to CoinGecko data — the market is not panicking over this incident. That is rational. A 138,000 USD theft is a rounding error next to the week’s bigger events. But the reputational damage matters. Every incident like this pushes cautious newcomers one step further from trying DeFi at all, which slows the growth that token prices ultimately depend on.
The Verdict: Boring Habits Beat Clever Hackers
You cannot fix Name.com’s security from your kitchen table. What you can do is make yourself a harder target. Always navigate to DeFi apps from a saved bookmark, never from a search result, a link in a message, or a social media post — domain hijacks rely on you typing the familiar name and landing somewhere hostile. Consider a hardware wallet, which keeps your private keys offline and away from browser-based attacks exactly like this one. And if a site you trust suddenly asks you to re-enter a seed phrase or approve an unusual transaction, stop — no legitimate DeFi protocol will ever ask for your recovery words.
For the industry, the fix is structural: projects need to stop pooling their domains at a handful of registrars and start treating their web presence as attack surface, not marketing real estate. Until then, the weakest link in decentralized finance remains a very centralized one.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
a dozen defi projects on one registrar and nobody flagged the single point of failure. 138k drained and zero lines of solidity were broken
this. years of audits defeated by what, a password reset at name.com
right, one compromised registrar api and the whole street burns down
the padlock meant nothing here, a valid cert on a hijacked domain looks fine. verify contract addresses before you sign anything
name.com owes these projects answers. how do twelve separate accounts fall at the same time
twelve separate accounts falling at the same hour points to a registrar side compromise, not twelve phished passwords. name.com needs to show logs not a template apology
name.com showing api logs is the bare minimum. if all twelve fell in the same hour it was registrar side, and every enable 2fa take in my feed is missing the actual failure
registrar side means 2fa would have saved nobody. dns records swapped upstream, the login page was the real page, just pointed somewhere else
correct, dns was swapped upstream so the 2fa lectures are noise. the only fix is registrar level monitoring on your own records, alert on any ns change
registrarwatch agree, and projects should publish their ns fingerprint so users can diff it. took the community hours to even list which dozen domains were poisoned
the api logs answer everything. same hour across twelve accounts is one token leaked or one console breached, name.com knows which and owes the projects the timestamp
the timestamps decide the whole story. same-minute changes across twelve accounts is a leaked token, spread over an hour is somebody in the console
twelve accounts at the same hour is the smoking gun alright. curious whether name.com even enforced api key rotation
if api keys never rotated this is a policy failure, not a hack. registrars treat key hygiene as the customer problem until a dozen storefronts burn at once
bookmark the real contract addresses now, not after the next hijack. a registrar compromise turns every bookmark into a liability
bookmarks are dead, contract address file on a cold note is where im at now. learned that lesson the expensive way back in 2022
cold note of contract addresses saved my bag on this one. checked the router against my list, site said mismatch, closed the tab
A dozen projects all registered through the same registrar and it took one compromise to turn every trusted site into a phishing page. The 138,000 USD figure will probably grow – victims often delay reporting out of embarrassment or miss small test transactions entirely.
expecting the 138k to grow too. people report a 200 dollar loss to nobody and a 20k loss to everyone, the real number surfaces over weeks not days
agreed, 138k is the floor. half these users cannot even say which site they signed on because the bookmark looked identical
and the growth has a lag. phishing kits keep the seed list for weeks before draining in bulk, half the affected users are not even in the count yet
The costume metaphor in the article is exactly right: no need to break the bank when you can swap the sign out front and hire a lookalike teller. Registrar locks, multi-factor on the registrar account, and verifying contract addresses before signing should be baseline for anyone in DeFi.
What worries me most is that no protocol was exploited. All the audits in the world do not help when the domain layer fails. Does anyone know if the affected projects are planning a migration announcement standard for this kind of incident? Coordinated hijacks like this will happen again.
138k drained across a dozen defi sites and the takeaway everywhere is user vigilance. spread your registrations across registrars and monitor your own dns, one registrar account should never hold the entire storefront
138k is week-one accounting. seed lists from these kits get sold and resold for months, expect followup drains at smaller wallets