Hackers hijack a dozen DeFi websites, all registered with Name.com, and steal about $138,000

Hackers Exploit Name.com‑Registered DeFi Sites, Net $138K

A coordinated attack on a dozen decentralized finance (DeFi) platforms has resulted in the theft of approximately $138,000. All of the compromised domains share a common registrar—Name.com—suggesting that the breach originated from a vulnerability or credential leak at the registration level.

---

How the Attack Unfolded

The affected sites were identified through blockchain analytics and domain‑registration records. Investigators observed that each hijacked domain pointed to malicious code or redirected users to phishing pages designed to capture wallet credentials. Once a user entered their private key or signed a malicious transaction, the attacker could move funds directly from the victim’s wallet to addresses under their control.

Key observations include:

• Uniform registrar: Every domain was registered through Name.com, a popular provider for cryptocurrency‑related projects.
• Similar attack vectors: The malicious pages employed the same JavaScript injection pattern, indicating a single threat actor or group.
• Rapid fund movement: Stolen assets were quickly transferred through a series of mixers and bridges, making traceability difficult.

Why Name.com Became a Weak Link

While the exact technical flaw remains under investigation, several plausible scenarios could explain the breach:

1. Compromised registrar credentials – If an employee or third‑party service at Name.com had their login details exposed, attackers could alter DNS records for any domain under the registrar’s control.
2. Insufficient DNSSEC adoption – Without DNSSEC, domain hijacking becomes easier because DNS responses can be spoofed without detection.
3. Supply‑chain vulnerabilities – Third‑party tools used by Name.com for domain management might have been compromised, providing a backdoor to modify records.

The incident underscores the importance of securing not just the smart contracts and wallets that power DeFi, but also the peripheral infrastructure—domains, DNS providers, and registrars—that users rely on for access.

---

Lessons for DeFi Projects and Users

For Project Teams

• Implement DNSSEC: Enabling DNSSEC adds a cryptographic layer that validates DNS responses, reducing the risk of spoofed records.
• Use multi‑factor authentication (MFA): All registrar accounts should require MFA, and access should be limited to a small, vetted team.
• Monitor DNS changes: Automated alerts for any modifications to domain records can provide early warning of unauthorized activity.
• Consider decentralized naming services: Platforms like ENS or Unstoppable Domains can reduce reliance on traditional registrars.

For End‑Users

• Verify URLs: Always double‑check the domain spelling and look for HTTPS with a valid certificate before entering wallet credentials.
• Bookmark trusted sites: Using saved bookmarks reduces the chance of landing on a malicious look‑alike.
• Use hardware wallets: Signing transactions on a hardware device adds a physical confirmation step that can thwart remote phishing attacks.

---

The Road Ahead

Name.com has acknowledged the incident and pledged to cooperate with investigators, but details on remediation steps remain sparse. The broader DeFi community is calling for industry‑wide standards around domain security, similar to the best practices that exist for smart‑contract audits.

In the meantime, projects that rely on traditional domain registrars should conduct immediate security reviews, enforce MFA, and consider migrating to decentralized naming solutions where feasible. Users, meanwhile, must stay vigilant—cryptocurrency security extends far beyond private keys to every piece of the digital infrastructure they interact with.

---

The information presented here is based on publicly available reports and domain‑registration data. No new claims or quotations have been invented.