Short answer
Name.com told The Block it identified unauthorized activity late on 30 October 2026 that redirected customer domains, and it has restored all 15 affected domains. Attackers used the hijacked DeFi sites to serve a wallet drainer. The Block traced about $138,000 in stolen funds. The root cause has not been settled publicly.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Name.com |
|---|---|
| Incident type | Crypto theft |
| Status | Under investigation |
| Sector | Domain registrar |
| Country | United States |
| Detected | 2026-10-30 |
| Disclosed | 2026-10-31 |
| People or records affected | 15 customer domains per Name.com; about a dozen DeFi front ends identified by Blockaid; about $138,000 traced by The Block |
What data was exposed
- Control of DNS for 15 customer domains, which let attackers serve a malicious front end
- Crypto wallets of visitors who approved transfers on the hijacked sites
- No Name.com customer payment data has been reported as taken
What happened
Late on Friday 30 October 2026, attackers took over DNS for a group of cryptocurrency sites and pointed them at a malicious copy of each front end. The Block reports the sites served Step Drainer, a kit that tricks visitors into approving token transfers out of their wallets. Security firm Blockaid identified about a dozen sites, all registered at Name.com.
Name.com told The Block it “identified unauthorized activity late Friday, October 30” that redirected domains. It said it had restored all affected domains, secured the accounts involved and was working with account holders. It later said 15 customer domains were affected.
Scale and losses
The Block traced about $138,000 in stolen funds to three EVM wallets, mostly MON and Robinhood Chain ETH, and noted that losses on Solana and Aptos were not counted. No affected project had reported a victim count. Vercel said it knew of affected domains tied to its platform, and that Name.com had restored them.
The open question
The affected sites used different DNS providers, according to the coverage we reviewed, so the common factor looked like the registrar. Even so, the cause has not been settled in public. The Block says Kintsu and Origami blamed Vercel, while a FluxBeam developer said a Name.com representative told them the breach was not on Name.com’s end. The Hacker News, summarizing a Name.com post-mortem, reports that an account in a support team changed nameservers for 15 domains over about 45 minutes. We have not independently reviewed that post-mortem, so treat that detail as reported, not confirmed.
What users should do
If you connected a wallet to one of these sites on 30 or 31 October and approved a transaction, revoke the token approvals and consider moving funds to a fresh wallet. Name.com urged all customers to check nameservers and DNS records and enable two-factor authentication.
Wallet drainers depend on a single rushed approval. Read our guide to crypto wallet drainer and fake airdrop scams and our recovery scams guide, because victims are often contacted by fake recovery services. Also see the data breach checklist.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Wallet drainer pages on look-alike or hijacked sites that ask you to approve token transfers or sign a message.
- Fake recovery services that contact victims on social media and ask for a fee or seed phrase.
- Phishing that impersonates a DeFi project or Name.com and tells you to 'verify' your wallet.
What to do if you are affected
- 01If you connected a wallet to any affected DeFi site on 30 or 31 October 2026 and approved a transaction, revoke token approvals with a trusted approval checker.
- 02Move remaining funds to a new wallet if you signed anything suspicious.
- 03If you own domains at Name.com, check nameservers and DNS records for changes and turn on two-factor authentication, as Name.com advises.
- 04Treat unsolicited recovery offers as scams and never share a seed phrase.
- 05Follow each affected project's own announcements before reconnecting a wallet.
Frequently asked questions
Which sites were affected?
The Block lists Flap, Kintsu, Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun and StakePoint among about a dozen sites identified by Blockaid. Name.com later said 15 customer domains were affected.
Was the hack Name.com's fault or Vercel's?
That is not settled. The Block reports Kintsu and Origami blamed Vercel, and a FluxBeam developer said a Name.com representative told them the breach was not on Name.com's end. Vercel's notice describes a takeover campaign against Name.com domains. Name.com has not publicly confirmed a root cause in the sources we reviewed.
How much was stolen?
The Block traced about $138,000 across three EVM wallets, and said losses on Solana and Aptos were not included. Other trackers have given higher totals, so treat the figure as a minimum.
Do Vercel customers need to do anything?
Vercel says no customer action is required, that it knows of affected domains tied to its services, that Name.com has restored them, and that it is contacting affected customers directly.
Sources
- Hackers hijack a dozen DeFi websites, all registered with Name.com, and steal about $138,000, The Block, 2026-10-31
- Name.com domain takeover notice, Vercel, 2026-11-03
- ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks, The Hacker News, 2026-11-05
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.