A coordinated cyberattack targeting a dozen decentralised finance (DeFi) websites has resulted in approximately $138,000 in cryptocurrency theft after hackers compromised the platforms’ web domains and redirected visitors to malicious pages designed to drain their wallets.
According to blockchain security firm Blockaid, the affected websites were infected with Step Drainer, a malicious toolkit that deceives users into approving transactions that give attackers access to their digital assets. The incident involved 12 websites whose domains were all registered through Name.com.
Public domain registry records reviewed by The Block showed that 10 of the affected domains were initially suspended by the registrar on Saturday morning. However, the suspensions were later lifted, and the domains were restored.
Among the affected projects were Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun, StakePoint, Flap and Kintsu.
The first signs of the incident emerged late Friday when cryptocurrency community members noticed that several unrelated DeFi websites were experiencing suspicious activity. Some users also discovered that the affected domains shared the same registrar.
X users, including bluexxix, banteg and punkquidity, highlighted the connection to Name.com as more compromised websites were identified.
Flap was among the first projects to acknowledge the incident, warning users that its flap.sh website had suffered a DNS hijacking attack. Blockaid subsequently identified additional compromised platforms, including liquid staking protocol Kintsu.
Name.com initially responded to reports by directing affected users to its abuse reporting process. Its parent company, Identity Digital, was also contacted for comment.
How the Step Drainer Attack Worked
Blockaid identified Step Drainer as the malicious toolkit deployed across the compromised websites. The software is designed to steal cryptocurrency by manipulating users into signing malicious wallet transactions.
Once visitors connect their cryptocurrency wallets to an infected website, they may be presented with transaction approval requests that appear legitimate. However, approving these requests can authorize transfers that allow attackers to move funds out of victims’ wallets.
Security company LevelBlue SpiderLabs previously described Step Drainer as a Malware-as-a-Service (MaaS) operation. Reports indicate that the toolkit has been marketed for approximately $750 for its complete source code or $150 for a version that takes a 20% share of stolen funds.
The toolkit reportedly supports more than 20 blockchain networks, making it a potential threat to users across multiple cryptocurrency ecosystems.
Onchain investigations conducted by The Block identified three wallets receiving proceeds from the attack. Transactions were distributed according to fixed percentages of 15%, 55% and 30%.
On BNB Chain, one Safe wallet reportedly received approximately 3.1 BNB, valued at around $2,200, from four different wallets during the attack. The funds were subsequently distributed among the three identified wallets.
Similar payment patterns were observed across Ethereum, Robinhood Chain and Monad.
On the Monad network, two of the wallets reportedly converted staked MON tokens and withdrew assets from lending protocol Neverland before exchanging the proceeds. On Robinhood Chain, another wallet withdrew tokenised stocks, including NVIDIA and Apple shares, from Morpho and converted them into ETH.
By Saturday morning, the three wallets collectively held approximately $138,000, with most of the funds consisting of MON and Robinhood Chain ETH.
However, the actual financial damage could be higher. Several affected platforms operate on Solana and Aptos, meaning additional stolen assets may exist in wallets outside the EVM networks examined during the investigation.
Vercel Infrastructure Comes Under Scrutiny
Although all 12 compromised websites shared Name.com as their domain registrar, they did not all use the same DNS provider or hosting infrastructure.
Some relied on Cloudflare, others used Vercel, while several operated through Name.com’s own nameservers.
The differences raised questions about where the initial compromise occurred and whether the incident involved the registrar, a third-party service provider or another part of the infrastructure.
Kintsu and Origami Finance publicly pointed to potential problems involving Vercel’s infrastructure.
Kintsu said the incident originated from an issue on Vercel’s end that was outside the project’s control. Origami Finance also warned about an active attack involving Vercel-associated nameservers and said it would keep its vaults paused while awaiting a technical investigation.
Flap’s developer also confirmed that the team was contacting both Vercel and Name.com to investigate the incident.
Vercel selected Name.com as the registrar for its rebuilt domain service in 2025. However, neither company initially provided a complete public explanation of the attack.
The incident also attracted attention because Vercel had disclosed a separate security breach in April involving its internal systems. That earlier incident was reportedly linked to a compromised third-party AI tool.
Number of Affected Users Remains Unknown
Despite the confirmed theft, the total number of cryptocurrency users affected by the incident remains unclear.
Onchain investigations identified at least four wallets that transferred funds to the attackers on BNB Chain alone. However, no comprehensive victim count had been released by the affected projects.
Some platforms reported that they had not received complaints from users.
FluxBeam said it had no reports of affected customers, while StonkFun stated that it was unaware of any victims. The project also moved its website to new infrastructure following the incident.
Kintsu, Origami Finance, FluxBeam and StonkFun separately indicated that their underlying blockchain smart contracts had not been compromised.
This distinction is important because the attack targeted the websites users interact with rather than necessarily exploiting vulnerabilities in the underlying DeFi protocols.
Similar incidents have affected cryptocurrency platforms in the past. Aerodrome and Velodrome experienced frontend compromises in November 2025, while Galxe suffered a DNS-related attack in October 2023 after attackers gained access to an account associated with its domain registrar.
These incidents demonstrate how compromising a website’s infrastructure can expose cryptocurrency users to financial losses even when the underlying blockchain contracts remain secure.
Name.com Confirms 15 Domains Were Affected
In a subsequent statement, Name.com confirmed that the incident affected 15 customer domains, exceeding the 12 websites initially identified by Blockaid.
The registrar said unauthorised activity occurred late Friday, October 30, resulting in the redirection of several domains registered through its platform.
According to the company, all affected domains were restored, and it was working directly with customers while investigating the incident and implementing additional security measures.
Name.com also urged customers to review their DNS records and activate two-factor authentication to strengthen account security.
Vercel later confirmed in a security bulletin that 10 of the affected domains were associated with its platform. The company said Name.com had restored the domains and that it was assisting with the ongoing investigation.
The incident highlights the risks associated with domain security in the cryptocurrency industry. Even when blockchain networks and smart contracts remain operational, compromised websites can provide attackers with an opportunity to deceive users and steal digital assets.
For DeFi users, the incident reinforces the importance of verifying website addresses, checking wallet transaction requests carefully and avoiding suspicious signature approvals, particularly when a previously trusted platform suddenly behaves differently.
Source: theblock.co Edited by Bernie
