Overnight into October 31, 2026, attackers used DNS hijacking to take over at least twelve DeFi and token-launch websites. Anyone who typed the real address of Flap, Kintsu, Pickle Finance or Origami Finance, among others, landed on pages running the “Step Drainer” wallet drainer, which tricks visitors into signing away their tokens. According to the projects, their smart contracts were not affected. The attack hit the layer above them: the domain. All affected domains are registered through Name.com, several of them via Vercel Domains. The root cause has not been established.
Key Takeaways
- Security firm Blockaid first warned about Flap and Kintsu from 02:21 UTC and, at around 03:16 UTC, listed ten more domains that were actively serving the Step Drainer.
- According to registry data reviewed by The Block, which we cross-checked via RDAP, the domains are registered with Name.com. Vercel has used Name.com as the upstream registrar for Vercel Domains since September 2025.
- Kintsu describes a hijack “at the registrar level” and blames Vercel. As of Saturday afternoon, neither Vercel nor Name.com had named a cause, and neither status page listed an incident.
- The Block has so far traced about $138,000 in stolen funds on EVM chains. Losses on Solana and Aptos are not included, and there is no official total.
- Anyone who connected a wallet or signed anything on one of the sites since about 00:00 UTC on October 31 should revoke approvals and move funds to a new address.
DNS hijacking overnight: the timeline
According to The Block, an X user noticed at around 01:10 UTC that the website of token launchpad Flap appeared to be compromised. At 02:13 UTC, Flap confirmed on X that its official address flap.sh was affected by a DNS hijacking incident and was redirecting to an unauthorized website.
Blockaid raised the alarm shortly afterwards, saying its system had detected a potential frontend attack on Flap and Kintsu. At around 03:16 UTC it followed up: the same attack had been identified on additional sites that were actively serving the Step Drainer. The list named stonkfun.xyz, pickle.finance, echelon.market, origami.finance, fluxbeam.xyz, stakepoint.app, supswap.xyz, longbow.cash, shprd.finance and apexdefi.xyz.
Kintsu, a liquid staking protocol on Monad, reported a DNS hijack “at our registrar” at 03:35 UTC. At 04:11 UTC it went further: kintsu.xyz, registered through Vercel Domains, had been hijacked at the registrar level and was serving a wallet drainer. From 04:15 UTC, the domain pointed to Kintsu’s own infrastructure again, though some networks could keep showing the malicious site for up to an hour while DNS caches cleared.
Flap moved to a fallback domain at 05:21 UTC and reported at 07:33 UTC that its official address was back online. Solana exchange FluxBeam took its website offline as a precaution in the afternoon. On-chain, it said, everything was operating normally, with no reports of affected users.
Name.com and Vercel: what is known about the cause
The Block found the common denominator in public registry records: all twelve domains named by Blockaid are registered with Name.com. We checked this on Saturday afternoon via RDAP, the successor to Whois: eleven of the twelve domains list Name.com as registrar, while RDAP returns no data for flap.sh.
The link to Vercel comes from its business model. When Vercel rebuilt its domain service in September 2025, it brought in name.com as its upstream registrar. Kintsu and Origami Finance have publicly blamed Vercel. According to The Block, Origami is keeping its vaults paused until Vercel and Name.com deliver a root cause analysis.
There is no shared DNS provider, however. According to The Block, some of the sites run on Cloudflare, some on Vercel and some on Name.com’s own nameservers. Our RDAP lookup also shows mixed nameservers today, although projects may have switched them during recovery. An attack spanning several DNS providers points more towards the registrar level, where a domain’s nameservers are set. Whether the problem lay with Name.com itself, with a reseller such as Vercel or in individual customer accounts remains unclear.
Name.com’s public response has been minimal. At 04:27 UTC, it merely asked two users on X to fill out its abuse form. On Saturday morning, according to The Block, ten of the domains were placed on “client hold” within seconds of each other, a status that stops a domain from resolving. In our RDAP check at around 16:10 UTC, none of the eleven domains carried that status any more, and all records had last been changed between 14:22 and 16:06 UTC.
How the Step Drainer works
The Step Drainer is not a new tool. Researchers at LevelBlue SpiderLabs analyzed it in detail in April 2026. It is a malware-as-a-service offering that claims support for more than 20 blockchain networks. According to LevelBlue, the source code was reportedly sold for around $750, or $150 for a version that takes a 20 percent cut of each successful theft.
Technically, the drainer relies on deception rather than exploits. It uses Web3Modal to display a convincing wallet connection dialog. It then picks the most lucrative method: NFT approvals via OpenSea’s Seaport protocol, EIP-2612 permit signatures or classic approve transactions. It does not need the seed phrase. A hardware wallet does not help either if the user confirms the malicious approval themselves.
The traces in this case fit that pattern. According to The Block’s on-chain analysis, the attackers split the proceeds in fixed shares of 15, 55 and 30 percent across three wallets on BNB Chain, Ethereum, Robinhood Chain and Monad. Together, the three addresses held about $138,000 on Saturday morning. No project has yet said how many users were affected.
What users should do now
Kintsu gives a clear window: anyone who connected a wallet to the site or signed a transaction since about 00:00 UTC on October 31 should revoke approvals with a revoke tool and move their funds. The same logic applies to all affected sites. In addition:
- Follow updates only through the projects’ official channels, since follow-up phishing is common after incidents like this.
- Read signature requests carefully. Unlimited approvals or permit signatures for a supposedly simple action are a red flag.
Our beginner’s guide to crypto scams explains how drainers and other schemes work.
Lessons for website operators
This is not the first infrastructure incident this week. In the Polymarket hack via a DebugBear script, an embedded third party delivered tampered code. On October 30 at 23:11 UTC, DebugBear said its DNS records had been compromised through its domain registrar. According to RDAP, however, debugbear.com is registered with Namecheap, not Name.com. No common attacker or cause has been established. The tampered Claude Code extension in the Cursor marketplace was another supply chain warning.
For operators of any kind, this leads to a few checks:
- Secure registrar and reseller accounts: strong two-factor authentication, ideally with hardware keys, few authorized people and regular reviews of who has access.
- Use locks: besides the usual transfer lock, many registries offer a registry lock, under which nameserver changes require manual confirmation. For critical domains, it is worth asking.
- Monitor changes: automatically check nameservers and DNS records for deviations, and watch Certificate Transparency logs for unexpected certificates issued for your domain.
- Have an incident plan: a fallback domain, prepared warnings and a clear channel for all-clear notices.
DNSSEC offers only limited help in this scenario. It protects against forged DNS responses in transit, but not against someone with registrar-level access changing the delegation itself.
Analysis
The technique is not new. According to The Block, the frontends of Aerodrome and Velodrome were hijacked in a similar way in November 2025, and Galxe was hit in October 2023 through its account at registrar Dynadot. What is new is the breadth: twelve unrelated projects in one evening, linked only by their registrar, suggest a point of attack above individual customer accounts. That has not been proven, though, and as long as Vercel and Name.com stay silent, any assignment of blame is provisional.
The known losses are small so far, but the incident hits a weakness no smart contract audit will find: whether the website users interact with still belongs to the project.
Conclusion
The October 31 DNS hijacking shows how long the chain of trust between a user and a DeFi protocol is: domain, registrar, reseller, DNS provider, hosting. If one link breaks, users end up in a trap despite typing the correct address. Affected users should check their approvals now, and operators should review their registrar accounts and domain locks, even if they are not with Name.com. The root cause analysis will have to show whether Vercel, Name.com or individual accounts were the entry point.
