Name.com DNS Hijack Redirected 15 Domains to a Crypto Drainer

Name.com has confirmed that unauthorized DNS changes redirected 15 customer domains to a page hosting Step Drainer, a cryptocurrency theft toolkit. The incident began on October 31, 2026 UTC, late October 30 in the United States. The registrar's November 3 incident report identifies a support account as the source of the changes.

The Block's initial investigation traced roughly $138,000 to attacker wallets on EVM networks. That was an early snapshot, excluding potential losses on Solana or Aptos. A final total would need to account for losses outside that tracing window and those networks.

What Name.com has confirmed

The registrar says the account changed nameservers through ordinary management tools between 00:35 and 01:18 UTC. Domain owners, hosting platforms and Name.com restored all 15 domains by 16:11 UTC on October 31. Name.com revoked access for the associated support team.

Its investigation found no exploit of Name.com's infrastructure. It had not determined whether the support account was deliberately misused or its credentials were compromised. Calling this a confirmed insider attack would go beyond the report.

Name.com says it restricted support permissions and increased logging. Alerts for rapid or bulk staff DNS changes remain planned for November 13 in the report.

Vercel's updated notice identifies nine affected domains associated with its platform, all restored. That is a subset of the registrar's 15-domain count. The Block's earlier report described 12 sites identified by Blockaid, including Flap, Kintsu, Pickle Finance and Origami Finance. These counts describe different scopes and reporting times.

DNS changes can redirect a familiar website

The Domain Name System translates a website name into the network address a browser needs. Nameservers provide the answers for a domain. Changing which nameservers a domain uses can let someone redirect visitors while the name they typed stays the same.

For a decentralized exchange or lending service, the website is the interface that presents wallet requests. Its hosting and domain administration are separate from the blockchain programs that process transactions. A malicious interface can ask for a dangerous authorization without first modifying those programs.

A bookmark does not fully protect against domain hijacking. It avoids a misspelled imitation address, but still opens whichever destination the real domain resolves to. Familiar branding is not enough to establish that the page is serving the project's intended code.

Wallet approvals give the drainer access

LevelBlue SpiderLabs examined Step Drainer in April, months before this incident. Its research describes deceptive wallet prompts and token permissions that can authorize asset transfers. Its findings provide background on the toolkit. Attribution of this incident still depends on the October investigation.

Connecting a wallet and granting permission to spend tokens are different actions. MetaMask's allowance documentation explains that an approval lets a smart contract move permitted tokens on the user's behalf. A fake page can present that request as part of an expected swap or another routine action.

Simply visiting a page does not, by itself, grant a new token allowance. Exposure depends on what the wallet requested, what the user signed and whether an earlier permission remains active. The public incident sources do not establish the sequence for every affected wallet.

Why Monero users should pay attention

The reviewed disclosures do not report a break in Monero's cryptography. Their relevance to Monero users is the website trust problem, especially when using a browser service to exchange another asset for XMR. Privacy on the receiving blockchain does not establish whether the website handling the earlier part of that exchange is trustworthy.

Monero users also encounter domain-based payment names. Our OpenAlias guide explains how a wallet resolves a name into a payment address and why DNSSEC validation matters. OpenAlias serves a different purpose from a DeFi website, and the reviewed disclosures identify no attack on its payment records.

Check permissions before returning to a service

If you interacted with an affected site, check the project's current incident notice through another established channel. Review the transactions and permissions recorded in your wallet on each network you used. A restored website does not erase an authorization already recorded on a blockchain.

MetaMask distinguishes disconnecting a website from revoking approvals. Disconnecting alone leaves existing token allowances in place. Use your wallet provider's documented review and revocation process, and avoid unsolicited recovery links.

For Monero software downloads, follow the project's binary verification instructions: verify the signing key, the signed hash list and the downloaded file. This checks whether the download matches a release signed with the verified key. Keep recovery seeds out of website support forms and supposed wallet-repair pages.