Source time Edition date
ProtocolsThe Block
Hackers hijack a dozen DeFi websites, all registered with Name.com, and steal about $138,000
黑客劫持十二个DeFi网站，均注册于Name.com，窃取约13.8万美元
Hackers stole about $138,000 via a dozen hijacked DeFi sites, and since all domains were registered with Name.com, readers should watch whether the registrar or the DeFi projects bear the remediation burden.
Judgment
Name.com and the affected DeFi projects must decide who pays for and coordinates remediation after 12 hijacked domains and about $138,000 traced on EVM chains; the registrar has suspended 10 domains but Flap and Kintsu remain live.
Basis
Blockaid said the dozen sites were rigged with Step Drainer, which tricks visitors into approving transfers after connecting wallets. The Block found all 12 domains registered through Name.com and reported 10 suspended at the registrar level at 8:32 a.m. ET Saturday; Flap and Kintsu were still operational. The Block traced about $138,000 to three EVM wallets, excluding Solana and Aptos losses. Name.com replied at 12:27 a.m. ET asking users to fill out its abuse form. Kintsu and Origami Finance blamed Vercel, while Vercel and Name.com status pages listed systems operational. LevelBlue SpiderLabs described Step Drainer as MaaS sold for about $750 for full source code or $150 for a version taking a 20% cut, claiming support for more than 20 networks.
- Traced EVM theftabout $138,000
- Hijacked domains12
- Registrar-suspended10
- Drainer source codeabout $750
Unclear The source does not give a victim count, total Solana or Aptos losses, or a root-cause finding assigning responsibility among Name.com, Vercel, or a reseller.
Next Check whether Flap and Kintsu domains are suspended and whether Name.com or Vercel publishes root-cause findings or abuse-form outcomes.