On this page
Key takeaways
- Late on Friday, October 30, 2026, attackers redirected the official web addresses of crypto sites registered through the domain company Name.com to copies built to empty visitors' wallets. Name.com confirmed it on X on October 31 and says the domains have been restored.
- Security firm Blockaid named 12 affected sites; Flap, Kintsu, Pickle Finance and Origami Finance were among them. Name.com told The Block that 15 customer domains were affected.
- The projects say their smart contracts weren't touched; only the websites were. Early tallies differ: The Block traced about $138,000 held in the attackers' wallets, while on-chain analytics firm Bitquery counted about $202,000 taken from 32 wallets. Neither counts Solana or Aptos.
- The lesson: typing the right address isn't always enough. Read every wallet pop-up, and if you connected to one of these sites during the attack, follow that project's own instructions.
"Check the web address" is standard crypto safety advice. This weekend it wasn't enough. Attackers took control of the real addresses of about a dozen crypto sites and sent visitors to copies built to drain their wallets. Here's what happened and what to do about it.
What happened
Late on Friday, October 30, 2026, visitors to several DeFi websites were quietly sent somewhere else. Token launch site Flap warned on X that its official address was hit by "a DNS hijacking incident" and was pointing to an unauthorized website. It told users not to visit, connect a wallet or sign anything.
Security firm Blockaid then flagged Flap and staking app Kintsu, and soon after listed 10 more sites it said were "actively serving the Step Drainer". That's a ready-made kit that tricks people into signing away their funds. The list included Pickle Finance, Origami Finance, Echelon, FluxBeam and StonkFun.
The common thread was the domain company. The Block found in public registry records that all 12 sites were registered through Name.com. On October 31, Name.com confirmed on X that some of its customers' domains "were improperly redirected late Friday as part of a plan to access visitors' crypto wallets." It said they had been restored and that it was investigating. In a statement to The Block, Name.com put the number of affected customer domains at 15, more than the 12 on Blockaid's list.
Website host Vercel, which uses Name.com for its domain service, said in a security notice that it knew of 10 impacted domains tied to its platform. Name.com has restored them, Vercel said, and it is helping with the investigation. How the attackers got in hasn't been explained publicly.
How much was taken
That isn't known yet. The Block traced about $138,000 to three attacker wallets on Ethereum-style networks. Blockchain analytics firm Bitquery, which counted what each victim lost rather than what the attackers held, put the figure at about $202,000 taken from 32 wallets, most of it from a single Kintsu user on Monad. Neither count includes Solana or Aptos, where some of the sites run. No project has published a count of affected users, though Bitquery's on-chain review found 32 wallets that lost $1 or more. FluxBeam and StonkFun said on October 31 that they hadn't heard of any.
The projects that have spoken say the attack was limited to their websites, not their smart contracts. Kintsu said its smart contracts were not compromised, and Origami Finance said none of its users' funds were. Origami reopened its vaults on November 1. Kintsu said on October 31 that it had paused deposits and withdrawals of its sMON token and says recovering stolen funds "is not yet guaranteed".
Why this one is different
Most wallet-drainer scams need you to make a mistake: click a fake link, mistype an address, trust a sponsored search result. Here, the address was right. DNS is the internet's address book, and the attackers changed the entry, so typing the correct name still led to the fake site. The page looked normal. The main warning sign was what the wallet asked you to approve.
Kintsu added a detail worth knowing. According to Kintsu, the attack used a wallet "delegation" signature. That kind of signature can let another contract act on behalf of your account. Cancelling token approvals afterward doesn't undo that, so Kintsu told affected users to move their funds to a new wallet.
What it means for you
- Read every wallet pop-up. A swap or deposit shouldn't ask for permission over all your tokens, or to hand control of your account to another contract. If a request looks broader than what you're doing, reject it.
- Use a separate wallet for DeFi. Keep savings in a wallet that never connects to websites, and move small amounts to a second wallet for apps. A drained app wallet then can't empty your savings.
- Watch the project's official accounts. Flap, Kintsu and Origami all posted warnings on X within hours. If a site you use goes quiet or acts strangely, check before you sign.
- If you used one of these sites between the evening of October 30 and the morning of October 31 (Eastern), or before the project gave the all-clear: follow that project's official instructions. If you signed anything, move what's left to a new wallet with a new recovery phrase, and don't trust anyone who messages you offering to "recover" funds. Our guide to recovery scams explains why.
For the bigger picture, see our guide to phishing and wallet drainers.
The takeaway
Attackers didn't break these projects' code. They took over the addresses people trust and pointed them at fake copies. Name.com says the domains are back and it's investigating. The last line of defense here was the wallet prompt: read what you're signing, and keep the money you can't afford to lose in a wallet that never connects to websites.
Frequently asked questions
What is a DNS hijack?
DNS is the internet's address book: it tells your browser which server sits behind a name like example.com. In a DNS hijack, an attacker changes that entry, so the real name leads to a server the attacker controls. The address bar looks normal, which is why this kind of attack is hard to spot.
Were my funds in these projects stolen?
The projects that have spoken say their smart contracts and the funds held in them were not affected. The risk was to people who visited a hijacked site during the attack and connected a wallet or signed something there. If that's you, follow the affected project's official instructions.
I used one of these sites recently. What should I do?
Check when. Kintsu says its domain led to the fake site between roughly 00:15 and 04:11 UTC on October 31 (8:15 p.m. to 12:11 a.m. Eastern), with some networks showing it until about 05:20 UTC. Origami Finance told anyone who connected or signed on its site since 00:00 UTC on October 31 to revoke approvals they don't recognize. If you signed anything during the attack, move what's left to a new wallet, as Kintsu advised. Kintsu said cancelling token approvals won't fully protect you here, because the drainer had people sign a wallet delegation.
Was my exchange account affected?
Nothing reported links this incident to centralized exchanges such as Coinbase or Kraken. It hit DeFi websites, which you use by connecting your own wallet.
Sources
- name.com statement on improperly redirected domains (X, October 31, 2026) (opens in a new tab) — name.com
- Name.com domain takeover notice (opens in a new tab) — Vercel
- Hackers hijack a dozen DeFi websites, all registered with Name.com, and steal about $138,000 (October 31, 2026) (opens in a new tab) — The Block
- DeFi DNS attack hits 12 sites with Step Drainer toolkit (opens in a new tab) — crypto.news
- A DNS hijack of 12 sites registered at Name.com drained $202K from 32 crypto wallets (October 31, 2026) (opens in a new tab) — Bitquery
- Blockaid community alerts (X, October 31, 2026) (opens in a new tab) — Blockaid
- Kintsu incident update (X, October 31, 2026) (opens in a new tab) — Kintsu
- Origami Finance update (X, November 1, 2026) (opens in a new tab) — Origami Finance
Published November 1, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.
Dave McNaught
Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.