Skip to content

Back to the catalog

theblock.coarticle

Hackers hijack a dozen DeFi websites, all registered with Name.com, and steal about $138,000

Twelve DeFi websites, including Flap, Kintsu, Pickle Finance and Origami Finance, were hijacked on 30 October 2026 and served the Step Drainer kit. All 12 domains use Name.com as registrar, and 10 were suspended. The Block traced about $138,000 stolen to three EVM wallets, excluding Solana and Aptos losses. Kintsu and Origami blame Vercel. Projects say their onchain contracts were untouched.

TL;DR Reports twelve DeFi front ends hijacked via a shared registrar and loaded with a wallet drainer, with about $138,000 traced stolen.
Open original ↗

Organisations named here

  • Flap
  • Kintsu
  • Name.com
  • Origami Finance
  • Pickle Finance
  • The Block

Technologies named here

  • Vercel
  • Ethereum
  • Solana
  • Flap
  • Kintsu
  • Name.com
  • Origami Finance
  • Pickle Finance

Techniques named here

  • DNS hijacking
  • domain hijacking

Concepts named here

  • Front-end compromise without contract compromise
  • Shared registrar risk

Threat actors named here

  • Step Drainer

Related in Threat Intel