Coordinated Attack Hijacks 12 DeFi Websites, Draining $138K in Funds

In a significant security breach, hackers hijacked at least 12 decentralized finance (DeFi) websites, draining approximately $138,000 from users. The attack, reported by security firm Blockaid, occurred between October 30 and 31, 2026, and involved altering the DNS records of the affected sites, all of which were registered with Name.com.

How the Attack Unfolded

The attackers executed a front-end attack, effectively redirecting users from legitimate URLs to malicious pages under their control. This was achieved by manipulating the DNS records, allowing users to land on sites that appeared authentic but were designed to steal funds through a malicious script known as the Step Drainer. Notably, the smart contracts of the targeted projects remained intact and uncompromised.

Affected Projects and Recovery Efforts

• Among the affected projects were Flap, Kintsu, StonkFun, and Pickle Finance.
• Some teams managed to mitigate losses by quickly migrating their domains to nameservers from Vercel and Cloudflare.
• Name.com has since restored the hijacked domains and advised customers to review their DNS settings and enable two-factor authentication.

Implications for DeFi Security

This incident highlights a critical vulnerability in the DeFi space, where the focus on smart contract security often overlooks the importance of domain management and DNS security. The attack underscores the need for DeFi projects to adopt comprehensive operational hygiene practices, including robust incident response plans that address registrar vulnerabilities.

As investigations continue to determine how the attackers gained access to the registrar layer, DeFi teams are urged to treat their domain accounts with the same caution as they do their smart contract keys.