A Dozen DeFi Websites Hijacked in One Night, With About $138,000 Stolen on EVM Chains

By Kevin · 2026-11-02 · News

Nov. 2 (CandyPulse) — The website looked right. The address in the browser was right. The wallet pop-up looked normal. And that was exactly the problem. Attackers hijacked the domains of at least 12 DeFi front ends in a single night and turned them into wallet drainers, stealing about $138,000 traced so far on EVM chains.

Key takeaways

At least 12 DeFi websites, including Flap, Kintsu, Pickle Finance and Origami Finance, were hijacked around Oct. 31
All affected domains were registered with Name.com; the registrar later said 15 customer domains were hit and all have been restored
Visitors were served the Step Drainer kit, which fakes normal-looking wallet pop-ups to trick users into approving transfers
About $138,000 has been traced across three wallets on EVM chains; losses on Solana or Aptos aren't included
The protocols' smart contracts were not breached: the attackers went after the domain names

What happened

Question	Answer
What was attacked?	The websites (front ends), not the smart contracts
How?	Domain hijacking at the registrar level (exact method unconfirmed)
Registrar	Name.com
Sites affected	At least 12 confirmed early; Name.com later said 15
Drainer used	Step Drainer, a kit sold to scammers
Losses traced	~$138,000 on EVM chains (preliminary)
Status	Name.com says all domains are restored

Security firm Blockaid found the sites "actively serving" the drainer. Hosting provider Vercel said 10 of the affected domains were linked to its platform.

Why this kind of attack is so dangerous

Most users are taught to check the website address. In a domain hijack, the address is genuine. The attacker controls where it points. That's why the final line of defence is your wallet pop-up: read every approval request, and never sign something you don't fully understand.

How to protect yourself

Read every signature request. If a site asks to approve "unlimited" spending or a transfer you didn't expect, reject it
Bookmark the apps you use, and watch the project's official X or Discord for security alerts before connecting
Revoke old approvals regularly with a token-approval checker
Keep long-term savings in a separate wallet that never connects to DeFi sites

What's next

Watch for Name.com's explanation of how the domains were taken over and for final loss figures across all chains. More on crypto news today.

Disclaimer: This article is for information only and is not financial advice. Crypto assets are volatile and can lose value. Always do your own research before making any investment decision.