Hackers Hijack 12 DeFi Websites Registered With Name.com, Stealing About $138,000

What happened

Hackers hijacked 12 DeFi websites registered with Name.com late Friday using Step Drainer malware, which tricks visitors into approving wallet transfers. Ten domains were suspended at the registrar level on Saturday, while Flap and Kintsu remained operational. About $138,000 in stolen funds was traced onchain.

Confirmed

Global impact / market context

A website registrar or hosting breach can turn trusted project links into traps, so investors may lose funds simply by approving a wallet request. If small DeFi projects cannot protect their domains, users may demand stronger security and move activity toward better-defended platforms.

Analyst inference

The reported loss is small, but it hits trust in DeFi, where users must approve transactions. The dispute over blame between projects and providers shows unclear responsibility. Missing Solana and Aptos losses mean the true cost could be higher, which may weigh on sentiment toward smaller projects.

Analyst inference

What to watch

1. Watch whether Name.com and Vercel publicly explain the incident, and whether Flap and Kintsu resolve their domain status. Confirmed
2. Watch for updated victim and loss figures, especially any inclusion of Solana and Aptos funds, which could change the scale of the incident. Proposed
3. Watch whether DeFi projects tighten domain and hosting controls, a change that could raise operating costs but reduce user exposure to wallet-draining attacks. Analyst inference

Affected assets

• APT — Aptos
• SOL — Solana

Evidence

• binance.com