Name.com, a leading domain registrar based in the United States, announced on Saturday that a number of domains registered on its platform were maliciously redirected late Friday as part of an attack seeking access to visitors’ cryptocurrency wallets. The company stated on X that the affected domains have been restored and investigations are ongoing, although it has not disclosed details about how the breach occurred or which domains were targeted.
Crypto companies hit by domain redirection
Web hosting provider Vercel, which partners with Name.com for domain registration services, warned in a security bulletin of a domain takeover campaign specifically aimed at companies in the cryptocurrency sector. Vercel identified 10 domains connected to its platform that were impacted during the incident. Name.com reestablished control over the affected domains, and Vercel advised customers that no immediate action was required on their part.
Several crypto projects, including Flap, Kintsu, and Origami Finance, publicly confirmed that their websites experienced unauthorized redirection due to the incident. Flap announced on X that its site “was affected by a DNS hijacking incident and is redirecting to an unauthorized website.”
Kintsu clarified that the issue did not involve a contract exploit, but rather a compromise of the frontend interface. In an X reply, the project wrote that the incident “was something that happened on Vercel’s end that was out of our control.”
Origami Finance released a security notice assuring users that its smart contracts and vault funds were untouched and that the hack only impacted the Origami website, which was briefly redirected. The project paused its vaults and urged anyone who interacted with its site after midnight UTC on October 31 to revoke any unfamiliar wallet approvals.
Additional targets and impact assessment
Blockaid, a Web3 security company specializing in blockchain threat detection, warned that at least nine other sites—stonkfun.xyz, pickle.finance, echelon.market, fluxbeam.xyz, stakepoint.app, supswap.xyz, longbow.cash, shprd.finance, and apexdefi.xyz—were also “actively serving the Step Drainer” malware during the attack.
Mini dictionary: Step Drainer — A malicious program that attempts to siphon cryptocurrency from users’ wallets by exploiting frontend website redirects or phishing attacks. It typically tricks users into giving harmful smart contract permissions.
The security notice from Origami Finance emphasized that no user funds were lost in the vaults and that only the web interface was compromised through redirection.
Public registry records reviewed on November 2 for 12 domains named either by project teams or Blockaid indicated all were registered through Name.com. Registry entries all documented DNS changes made on October 31. The domains utilized four different DNS providers: Vercel (6 domains), Cloudflare (2), NS1 (3), and Name.com’s own nameservers (1).
| DNS Provider | Number of Affected Domains |
|---|---|
| Vercel | 6 |
| Cloudflare | 2 |
| NS1 | 3 |
| Name.com Nameservers | 1 |
Response and investigation
Origami’s notice attributed the exploit to an “active attack on Vercel-associated Nameservers,” while Vercel described the event as a takeover attempt on Name.com, with Vercel assisting in mitigation. Security researcher punkquidity reported that at 12:32 UTC on Saturday, 10 of the hijacked sites were deactivated at the registrar within five seconds, but it remains unclear whether the action was taken by Name.com or a reseller.
Kintsu, in its public response, emphasized that the redirect was triggered by a third-party infrastructure provider, and that neither their contracts nor user funds were at risk.
Vercel confirmed a previous breach of its internal systems in April, but stated there is no current evidence linking that incident to the domain redirects. Both companies continue to investigate the source and full scope of the latest attack.
