Wallet-Drainer Attack on DeFi Front Ends Traces to Name.com, With Cause Still Unclear
Flap, Kintsu and Origami confirmed their sites were redirected on Friday night, while Blockaid flagged nine more; who opened the door is still disputed.
UnchainedUnchained · November 2, 2026 · 3h agoBrief · 1 min read
Domain registrar Name.com said Saturday that several domains were sent to unauthorized pages late Friday in an effort to reach crypto wallet holders, and that it has reverted them. The firm said it is investigating and has not yet explained how the domains were taken or which ones were hit. Web host Vercel, a Name.com partner, described a takeover drive targeting crypto firms in a bulletin and counted 10 of its associated domains among those affected. Flap, Kintsu and Origami Finance confirmed attacks on their sites. Origami said its contracts and vault funds were untouched, paused its vaults, and urged those who had linked a wallet from midnight UTC on Oct. 31 onward to cancel suspicious token permissions. Blockaid named nine more sites it said were serving the Step Drainer.
Why it matters: It shows how domain registration and DNS control can expose crypto users to wallet-draining attacks even when smart contracts remain intact.
Summary by Dextape, based on reporting by Unchained. Written with AI from the publisher’s text and checked automatically for copied wording and unsupported figures. Not investment advice.
Headline and excerpt from Unchained’s public feed. Unchained holds the copyright and publishes the full story; Dextape links to it rather than reprinting it.
The Dextape Desk signs Dextape's own work: briefs on wire stories, the daily market report and desk analysis. Briefs are written by an AI model from the publisher's article text and checked automatically for copied wording, unsupported figures and investment advice before they appear. AI drafts from the editorial desk need corroborating sources and an editor's review before release.
