A coordinated web attack targeted 15 cryptocurrency and decentralized finance domains registered through Name.com, tricking unsuspecting users into connecting their wallets to counterfeit websites and draining between 138,000 USD and 202,000 USD in digital assets.
By Priya Sharma | November 3, 2026
The Incident/Update: 15 DeFi Portals Hit by Registrar Breach
If you recently visited your favorite decentralized finance (DeFi) portal to deposit savings or harvest yields, your funds may have faced an invisible trap. Between October 30 and October 31, 2026, cybercriminals orchestrated a sophisticated domain hijacking campaign that compromised 15 customer domains managed by domain registrar Name.com, a subsidiary of Identity Digital. The intrusion hit roughly 12 to 15 crypto and DeFi applications, redirecting routine web traffic to malicious replica sites designed to plunder visitor balances.
Blockchain security firm Blockaid raised the red alert as users of liquid staking protocol Kintsu and decentralized launchpad Flap began reporting suspicious transaction prompts. Soon after, other recognizable platforms—including Pickle Finance, Origami Finance, FluxBeam, and StonkFun—were confirmed to be caught in the same redirect net. While the underlying blockchain vaults holding user funds remained untouched, the digital doorways leading to them were covertly swapped.
Before security teams could intervene, on-chain analysts at Bitquery tracked losses climbing between 138,000 USD and 202,000 USD across multiple blockchains. The registrar acted by placing several compromised domains on administrative client hold status, cutting off the attackers while engineering teams scrambled to regain DNS control and safeguard their communities.
- Targeted Domains — 15 customer domains confirmed hijacked at the registrar level.
- Estimated Losses — Between 138,000 USD and 202,000 USD stolen across multiple networks.
- Prominent Protocols Affected — Kintsu, Flap, Pickle Finance, Origami Finance, and FluxBeam.
- Primary Security Responder — Blockaid detected and issued immediate public warnings.
Technical Post-Mortem: How Step Drainer Exploited Digital Storefronts
To understand how this attack worked, consider a simple analogy: imagine a bank with an unbreakable underground vault. The vault door is secure, and the armed guards are alert. However, during the night, scammers swapped the street sign outside the bank. When regular customers walked down the sidewalk, the sign led them right into a counterfeit storefront across the alley. The bank vault was never broken into, but customers handed their cash directly to impostors standing at a fake counter.
That is precisely what happened in this breach. In crypto, a smart contract functions like a digital vending machine: you insert a token, and the computer code automatically hands you your interest or swap without needing a middleman. These smart contracts are stored permanently on the blockchain and were entirely unharmed. Instead, the attackers compromised the Domain Name System (DNS) at registrar Name.com. The DNS functions as the internet’s address book, translating readable web addresses like flap.sh or kintsu.xyz into server numbers.
By altering these records, the hackers routed traffic away from legitimate web hosts like Vercel and onto phishing servers. Once an everyday investor landed on the counterfeit page, the site deployed a malicious software kit known as Step Drainer. When the user clicked to connect their crypto wallet—which functions like a digital checking account—the website presented a pop-up window requesting a token approval.
A token approval is essentially a digital blank check: it gives an application permission to withdraw coins from your wallet on your behalf. Believing they were interacting with a routine deposit screen, victims approved the request. Seconds later, the Step Drainer script executed the blank check, sweeping tokens straight into attacker-controlled addresses across multiple networks.
Governance Impact: Centralized Web Flaws Challenge Decentralized Protocols
This incident strikes at the heart of one of the biggest paradoxes in decentralized finance. While decentralized autonomous organizations (DAOs) spend months voting on governance proposals, treasury allocations, and smart contract audits, almost all everyday investors still access these protocols through traditional, centralized web infrastructure. A protocol can have peerless security on-chain, but if its website relies on a standard commercial registrar account protected by a simple login, that single point of failure puts the entire community at risk.
The breach has ignited urgent governance discussions across DeFi developer groups regarding front-end resilience. Protocol teams are now debating whether critical operational controls—such as nameserver changes and hosting configurations—should require multi-signature authentication, where several trusted team members must sign off on any administrative update. Other communities are discussing rapid emergency migration to enterprise security providers like Cloudflare and decentralized storage alternatives like IPFS to prevent third-party registrars from being compromised.
For everyday token holders, this shift in governance priorities is critical. Until protocols secure the digital doorways where users enter, on-chain safety guarantees remain incomplete. Governance councils are realizing that protecting retail depositors requires securing the entire user journey, from the browser URL bar down to the settlement ledger.
TVL Shifts: Nervous Capital Pulls Back Across Ethereum DeFi
While the direct losses from the Name.com incident were contained near 202,000 USD, the psychological fallout has compounded broader capital jitters across decentralized markets. When everyday users fear that their web browser might lead them to a malicious trap, their immediate reaction is often to withdraw funds from liquidity pools—the shared piggy banks that power decentralized trading and lending—and retreat to cold storage.
This front-end scare coincided with a broader contraction in capital across the decentralized ecosystem. On-chain metrics tracking the 35-day window leading into November revealed that roughly 1.39 million ETH exited decentralized finance locking contracts. This significant net outflow brought the total volume of locked Ethereum down from over 20.8 million ETH to approximately 19.4 million ETH. With Ethereum trading at 2,286 USD, that shift represents billions in user liquidity sitting on the sidelines rather than earning yield in protocol pools.
Similarly, bellwether assets like Bitcoin trading at 77,380 USD and Solana at 93.13 USD reflect a cautious market where retail investors are scrutinizing operational risk. When liquidity thins out across decentralized platforms, borrowing costs can fluctuate sharply and trading spreads widen, making it more expensive for everyday savers to navigate the market.
Long-Term Prognosis: How Everyday Investors Can Protect Their Wallets
Front-end hijacking is rapidly becoming the weapon of choice for crypto thieves because hacking a traditional domain registrar is often far easier than finding a flaw in audited smart contract math. As long as users rely on standard web browsers, these attacks will remain a persistent threat. However, you do not have to be a software engineer to protect your life savings from these deceptive schemes.
Everyday investors can take three concrete, practical actions right now to insulate their portfolios from front-end breaches:
- Revoke Stale Token Approvals Regularly — If you interacted with Kintsu, Flap, or any affected portal in late October, use a reputable allowance tracker to inspect your wallet and cancel active permissions. Revoking permissions tears up the blank check before an attacker can cash it.
- Install Transaction Simulation Extensions — Security tools like Blockaid or dedicated browser wallet plugins simulate what a transaction will actually do before you click confirm. If a website secretly asks for permission to drain your assets, these tools flash a bright red warning on your screen.
- Separate Savings From Daily Spending — Never keep all your digital wealth in a single web wallet. Keep your long-term holdings in a secure “vault” wallet that never connects to browser dApps, and only transfer small allowances into a “burner” wallet for active trading and staking.
Decentralized finance offers remarkable opportunities to earn yield and take control of personal wealth, but self-custody requires constant vigilance. By treating every web connection with healthy skepticism and locking down wallet allowances, regular investors can navigate DeFi safely without falling victim to hijacked storefronts.
Disclaimer
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.