You typed the right address. You saw the right logo. Your wallet still emptied. That’s the nasty logic of a DNS hijack, and it hit at least twelve DeFi sites overnight into Saturday, October 31, 2026, when attackers redirected domains registered with Name.com to copies loaded with a wallet drainer.
The money lost was modest — about $138,000 to $202,000 depending on who counted. The method is what should worry anyone who signs transactions in a browser.
Key facts
- Attackers redirected DNS records of at least twelve DeFi sites registered with Name.com overnight into October 31, 2026, sending visitors to copies running Step Drainer.
- Name.com reported 15 affected customer domains; three have not been named publicly.
- Bitquery counts $202,386 taken from 32 wallets on six blockchains; The Block counts about $138,000 across three EVM wallets, excluding Solana and Aptos.
- One Kintsu staker on Monad lost $160,531, just under 80% of the total; more than half of victims lost under $100.
- Named projects include Flap, Kintsu, Echelon, FluxBeam, StakePoint, StonkFun, Pickle Finance, Origami Finance, longbow.cash, apexdefi.xyz, shprd.finance and supswap.xyz.
- Kintsu advised users to revoke approvals signed since midnight UTC on October 31; several projects said their smart contracts were untouched.
What happened in the Name.com DNS hijack?
Attackers changed the DNS records of DeFi domains registered with Name.com so that the real web addresses pointed to attacker-controlled copies. The copies looked like the original sites but ran Step Drainer, a malware-as-a-service kit that tricks users into signing transfers, token approvals or bundled signatures that hand over their funds.
According to The Block, Flap’s site was flagged as compromised at 01:10 UTC on Saturday; about 100 minutes later Blockaid warned about Flap and Monad staking service Kintsu and linked both to Step Drainer, later naming ten more sites. Name.com said the domains were “improperly redirected late on Friday in order to get at visitors’ wallets,” suspended ten domains in the morning and later restored them.
How much was taken
Bitquery’s investigation counts $202,386 from 32 wallets on six blockchains, with Monad accounting for $163,318 across 19 wallets and Robinhood Chain for $35,920. Most withdrawals ran between about 00:00 and 04:00 UTC on October 31. A collector contract split proceeds 55/30/15 across three wallets. Bitquery also saw address-poisoning bots using look-alike addresses in the aftermath.
The contract was fine. The domain lied.
Why does a DNS hijack bypass smart contract security?
Because it attacks the path to the contract, not the contract. Audits, multisigs and timelocks protect on-chain code; DNS decides which server your browser talks to when you type a domain. If an attacker controls DNS, they control the website — and the transactions it asks you to sign. Kintsu, Origami Finance, FluxBeam and StonkFun all said their contracts were untouched.
Step Drainer is sold as a service: LevelBlue SpiderLabs reported in April that full source costs about $750 and rental $150 plus 20% of proceeds, with support claimed for more than 20 networks. That makes DNS takeovers cheap to monetise. Earlier examples include Aerodrome and Velodrome in November 2025 and Galxe in October 2023.
What should DeFi users do after the Name.com hijack?
If you interacted with any of the affected sites on October 31, 2026, revoke token approvals and permissions signed since midnight UTC that day, using a trusted revoke tool. Check whether any unexpected transfers left your wallet. Ignore “refund” messages and look-alike addresses in your history — address poisoning often follows incidents like this.
- Bookmark the sites you use and treat sudden UI changes or unusual signature requests as red flags.
- Read what you’re signing: an “approve unlimited” or a permit for a token you didn’t mean to touch is the drainer’s signature.
- Use a separate hot wallet with limited funds for interacting with new or small DeFi sites.
What this means for swap users
Every time you connect a wallet and sign, you trust the website as much as the contract behind it. Address-only swaps reduce that surface: on SwapZilla, a standard swap needs no wallet connection and no token approvals — you send coins to a deposit address and receive at your own. Our guide to swapping without connecting a wallet explains the trade-offs.
When you do use on-chain routes, such as wallet swaps on the DEX shelf, check the domain, check the approval amount, and revoke what you don’t need afterwards. Our comparison of DEX, CEX and swap aggregators lays out where each model places the risk.
Final thoughts
About $200,000 is small by the standards of this autumn. But the Name.com incident shows how little an attacker needs: not a contract bug, not a stolen key — just control of the name you typed. The cheapest defence is still the oldest one: know exactly what you’re signing, every time.