Crypto Wallet Drainer Attack: 12 DeFi Sites Hijacked in One Night — 5 Steps If You Connected Your Wallet

12 DeFi Websites Were Hijacked in a Single Night — and the Smart Contracts Were Never Touched

On the night of Friday, October 30, 2026, twelve decentralized finance websites were quietly hijacked and turned into traps. Anyone who visited them and connected a crypto wallet was shown a fake version of the site — one designed to drain their funds. The smart contracts underneath were never breached. The attack happened one layer up, in the part of crypto most users never think to distrust: the website itself.

Domain registrar Name.com later confirmed that a number of domains on its platform "were improperly redirected late Friday as part of a plan to access visitors' crypto wallets," and said it had restored them. Web3 security firm Blockaid warned that nine of the hijacked sites were "actively serving the Step Drainer" — a malicious script that empties a connected wallet the moment a victim approves a transaction. Three projects — Flap, Kintsu and Origami Finance — publicly confirmed their sites had been taken over.

If you used any DeFi site between October 30 and 31, read this before your next transaction. Below are the twelve sites, how the attack worked, why the companies involved still disagree about what happened — and the five steps to take if you connected a wallet during the attack window.

What Happened on October 31: A Timeline

Late Friday, October 30: The redirects begin. Visitors to a cluster of DeFi websites are silently sent to lookalike pages controlled by the attackers instead of the real sites. The pages look identical — same branding, same layout, same prompts to connect a wallet. The only difference is invisible: the "connect wallet" flow now serves a drainer script.

Saturday, October 31, 00:00 UTC: The cutoff that matters most. Origami Finance later told its users that anyone who connected a wallet or signed a transaction on its site after midnight UTC on October 31 should revoke any unfamiliar token approvals immediately.

Saturday, October 31, 12:32 UTC: Independent researcher punkquidity reported that 10 of the hijacked sites were "switched off at the registrar within 5 seconds" — a coordinated kill-switch suggesting Name.com acted on all of them at once. Even so, he could not yet tell whether Name.com itself or a reseller such as Vercel was responsible for the original takeover.

Saturday, October 31: Name.com posts on X that a number of domains "were improperly redirected late Friday as part of a plan to access visitors' crypto wallets," that it has put them back, and that it is investigating. The company does not say how the attackers gained control or which domains were involved.

Sunday, November 1 – Monday, November 2: Vercel publishes a bulletin describing a Name.com takeover campaign aimed at crypto companies. On November 2, Unchained publishes the first full accounting: 12 domains, all registered at Name.com, all showing a registry change dated October 31.

The response was fast — but the attack window, Friday night into Saturday, is exactly when many DeFi users are most active.

The 12 Hijacked Sites

Three projects confirmed the attack on their own sites. Nine more were flagged by Blockaid as actively serving the drainer. Every one of the twelve domains was registered at Name.com, and public registry records checked on November 2 showed a change dated October 31 for all of them.

Site	How it was flagged	What the project said
Flap	Confirmed by the project	Its website was "affected by a DNS hijacking incident and is redirecting to an unauthorized website"
Kintsu	Confirmed by the project	"It wasn't a contract exploit, it was a frontend takeover"
Origami Finance	Confirmed by the project	"Smart contracts and funds in Origami vaults are not affected. Only the Origami website was redirected." Vaults paused as a precaution
stonkfun.xyz	Flagged by Blockaid	Actively serving the Step Drainer
pickle.finance	Flagged by Blockaid	Actively serving the Step Drainer
echelon.market	Flagged by Blockaid	Actively serving the Step Drainer
fluxbeam.xyz	Flagged by Blockaid	Actively serving the Step Drainer
stakepoint.app	Flagged by Blockaid	Actively serving the Step Drainer
supswap.xyz	Flagged by Blockaid	Actively serving the Step Drainer
longbow.cash	Flagged by Blockaid	Actively serving the Step Drainer
shprd.finance	Flagged by Blockaid	Actively serving the Step Drainer
apexdefi.xyz	Flagged by Blockaid	Actively serving the Step Drainer

Two details matter most. First, Origami's statement that its vaults were not affected is the key to this attack: the money in the protocols was never at risk — only the money in visitors' wallets. Second, all twelve domains share one registrar: a DeFi site is only as trustworthy as the least secure link in its domain chain.

How a Wallet Drainer Works — and Why This Was Not a "Hack" in the Usual Sense

Most people picture a crypto hack as someone breaking into a vault. A wallet drainer works the other way around: it convinces you to hand over the keys yourself. Understanding the difference is the single most useful piece of security knowledge in DeFi — and our complete beginner's guide to DeFi explains how protocols, wallets and frontends fit together.

When you connect a wallet to a DeFi site, you are not giving the site your money. You are giving it permission to ask your wallet to sign transactions. A legitimate site asks you to sign transactions you intend — a swap, a deposit, a stake. A drainer asks you to sign a transaction that looks like one of those, but actually transfers your tokens to the attacker's address, or grants the attacker's contract unlimited permission to move your tokens later. The signature is real. That is why drained funds are almost never recovered: there is no bug to fix and no transaction to reverse. The "Step Drainer" named by Blockaid is a pre-built kit of this malicious code, deployed on hijacked sites. One signature is enough.

Here is how this attack differs from the contract exploits that usually make headlines:

	Frontend hijack (this attack)	Smart contract exploit
What gets attacked	The website / domain / DNS — the front door	The code holding the funds — the vault
Who loses money	Individual visitors who connect wallets	Everyone with funds in the protocol
Are protocol funds safe?	Yes — Origami's vaults were untouched	No — the protocol itself is drained
Can the project fix it?	Only by regaining the domain and warning users	By pausing or patching the contract
Can victims get funds back?	Almost never — the signature was valid	Sometimes — via freezes, negotiations or white-hat recovery
Warning signs	Almost none — the fake site looks identical	Often visible on-chain before the damage spreads

That last row is the frightening one. A contract exploit leaves traces that analysts can spot. A hijacked frontend leaves none for the average user: the URL is correct, the branding is correct, and the wallet prompt looks exactly like the one you have approved a hundred times. The only defense is habit — checking approvals, using a separate wallet for DeFi, and treating every signature as a transaction, not a login.

The Blame Game: Name.com vs Vercel

A week after the attack, nobody has publicly established how the attackers got in — and the two companies whose infrastructure sits at the center of the story are pointing in different directions.

Kintsu said in a reply on X that the takeover was "something that happened on Vercel's end that was out of our control." Origami's security notice blamed an "active attack on Vercel-associated Nameservers." Vercel's own bulletin tells a different story: it describes a Name.com takeover campaign that Name.com is investigating, with Vercel assisting. Name.com has said only that domains "were improperly redirected," that it restored them, and that it is investigating — without saying how the attackers gained control.

The registry records add one hard fact: all twelve domains were registered at Name.com, with changes dated October 31. But the DNS picture is mixed — six used Vercel, two Cloudflare, three NS1 and one Name.com's own nameservers — consistent with an attack at the registrar level, though it does not prove it.

There is one more uncomfortable detail. Vercel separately confirmed a breach of its own internal systems in April 2026. Neither company has tied that incident to this one. But it is part of why the question matters beyond finger-pointing: if the weakness sits at a registrar or hosting provider, every project using that provider inherits the risk, and no amount of smart-contract auditing can fix it. For users, the practical consequence is simple: do not wait for a final answer before protecting yourself.

Did Anyone Lose Money?

As of November 2, no public total of stolen funds had been published. That is not the same as saying nobody lost money — drainers are quiet, and victims often discover the loss days later. What is on the record:

• Origami Finance: smart contracts and vault funds were not affected. The project paused its vaults as a precaution and told users who connected a wallet or signed after midnight UTC on October 31 to revoke unfamiliar approvals.
• Flap and Kintsu: both confirmed the redirect and warned users away from their sites until the domains were restored. Neither published a loss figure in the first accounting of the incident.
• The nine Blockaid-flagged sites: Blockaid's warning was that they were "actively serving" the drainer — meaning visitors who connected wallets during the window were exposed. No per-site loss totals were published with the warning.

Be skeptical of any specific dollar figure attached to this attack unless it comes with on-chain evidence. What is certain is the exposure: twelve sites, one shared registrar, and a drainer that needed only one signature per victim.

5 Steps to Take Right Now If You Connected Your Wallet

If you visited any of the twelve sites above — or any DeFi site at all — between late Friday, October 30 and Saturday, October 31, treat your wallet as exposed until you have checked it.

Step 1 — Revoke unfamiliar token approvals immediately. Open Etherscan's Token Approvals checker or Revoke.cash, connect your wallet, and look for any approval you do not recognize — especially unlimited ("infinite") approvals granted around October 31. Revoke anything suspicious. An approval you granted to a drainer is a loaded gun: the attacker can use it to move your tokens at any time, even weeks later.

Step 2 — Move your funds to a fresh wallet. If you signed anything on a hijacked site, do not just revoke and relax. Create a brand-new wallet, send your remaining funds there, and stop using the exposed wallet for anything valuable. Revocation closes the known doors; a fresh wallet closes the ones you cannot see.

Step 3 — Check your recent transactions. Look at your wallet's transaction history for October 30–31. Any outgoing transfer you do not recognize, any approval to an unknown contract, or any zero-value transaction that granted permissions is a red flag. If you find one, assume the wallet is compromised and complete step 2 before doing anything else.

Step 4 — Check every chain, not just Ethereum. Drainers operate across chains, and several of the hijacked sites serve users on multiple networks. Check your approvals on each chain you use — Solana, BNB Chain, Arbitrum, Base and the others — not just the one you remember using that night. Our comparison of the best crypto wallets in 2026 explains which wallets make multi-chain approval checks easiest.

Step 5 — Turn on the habits that would have stopped this. From now on, use a separate "hot" wallet with small amounts for DeFi, and keep the bulk of your holdings in a hardware wallet that never touches a DeFi frontend. Review your token approvals once a month. And never approve an "unlimited" spend limit when a site offers a custom amount instead — it costs one extra click and removes the attacker's favorite weapon. Our guide Is Your Hardware Wallet Safe in 2026? covers the physical and digital defenses that actually work.

How to Spot a Hijacked Frontend Before You Connect

The cruel truth about this attack is that the fake sites looked real — because in most respects they were real sites, served from the real domain, with one poisoned layer added. But there are checks that catch most frontend attacks:

• Check the project's official X or Discord before connecting, after any outage. Flap, Kintsu and Origami all warned users on X within hours. A two-minute check of a project's social feed is the fastest early-warning system in crypto.
• Read the signature request, every time. A normal login asks you to sign a free message. A drainer asks you to approve a token transfer or grant spending permission. If the wallet popup mentions "approve," "spend limit," or an amount you did not type — stop.
• Bookmark the sites you use and only visit them from the bookmark. DNS hijacks redirect the real domain, so this is not foolproof — but it eliminates the far more common lookalike-domain phishing that rides on the back of every real incident like this one.
• Use a wallet that simulates transactions. Modern wallets can show you in plain language what a signature will actually do before you confirm it. If the simulation shows tokens leaving your wallet and you expected a simple login, you have caught the attack.
• Keep a separate DeFi wallet with limited funds. If a drainer ever gets you, the damage is capped at what is in that wallet. The bulk of your holdings should live somewhere that never connects to a website at all.

The Bigger Pattern: October 2026 Was Crypto's Worst Security Month on Record

The Name.com hijack did not happen in isolation. It landed in the middle of the worst month for crypto security anyone can remember — and the pattern matters, because it shows attackers moving up the stack, from code to infrastructure to people.

On October 29, hackers drained about $6.3 billion from Binance's hot wallets in roughly 20 minutes — the largest crypto theft in history, about four times the $1.5 billion Bybit hack of February 2025. The FBI has since confirmed that North Korea's TraderTraitor group, a Lazarus subunit, was behind it. Around $3 billion was frozen with help from Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council — which itself moved about $30 million of the hack's funds without the attacker's private key, using emergency powers that require nine of its twelve council members to agree.

Days later, on-chain investigator ZachXBT reported that a wallet linked to an alleged exploit of French bank Crédit Mutuel Arkéa converted roughly $63 million of USDC and USDT into 27,553 ETH — because stablecoins can be frozen by their issuers and ETH cannot. ZachXBT put suspected losses at the bank above $133 million; the bank has not confirmed the figure, so treat the size as an allegation for now.

Put together, the month tells a coherent story. Attackers are no longer just hunting bugs in smart contracts. They are compromising the laptops of DevOps engineers (the Binance entry point, according to the exchange), hijacking domains at the registrar level (Name.com), and using governance emergency powers to seize funds without private keys (Arbitrum). The industry's weakest points have moved from code to the infrastructure and people around the code — exactly where most users have the least visibility.

FAQs

What is a wallet drainer?

A wallet drainer is malicious code that tricks you into signing a transaction that transfers your tokens to an attacker — or grants the attacker's contract unlimited permission to move your tokens later. It usually runs on a website that looks legitimate, and it needs only one signature from you. The "Step Drainer" flagged by Blockaid in this attack is one such kit.

Which DeFi sites were hijacked in the Name.com attack?

Three projects confirmed it: Flap, Kintsu and Origami Finance. Blockaid flagged nine more as actively serving the Step Drainer: stonkfun.xyz, pickle.finance, echelon.market, fluxbeam.xyz, stakepoint.app, supswap.xyz, longbow.cash, shprd.finance and apexdefi.xyz. All twelve domains were registered at Name.com, and all showed a registry change dated October 31, 2026.

Was my crypto safe if I only visited the site but did not connect my wallet?

Yes — a drainer cannot touch a wallet that was never connected. The risk begins the moment you connect and, above all, the moment you sign something. If you only loaded the page and left, you were not exposed. If you connected or signed after midnight UTC on October 31, follow the five steps above.

Are the smart contracts of Flap, Kintsu and Origami safe?

According to the projects themselves, yes. Origami stated explicitly that its smart contracts and vault funds were not affected and paused its vaults as a precaution. Kintsu stressed that "it wasn't a contract exploit, it was a frontend takeover." The attack targeted the websites, not the protocols.

How do I revoke a token approval?

Use Etherscan's Token Approvals checker or Revoke.cash: connect your wallet and revoke anything you do not recognize — especially unlimited approvals granted around October 30–31. Check every chain you use, not just Ethereum. Revoking costs a small gas fee per approval.

Who is responsible — Name.com or Vercel?

Still disputed. Kintsu and Origami pointed at Vercel-associated infrastructure; Vercel's bulletin describes a Name.com takeover campaign; Name.com has not said how the attackers gained control. What is established: all twelve domains were registered at Name.com, with registry changes dated October 31. Do not wait for the final answer before checking your approvals.

Conclusion

The Name.com attack is the most instructive crypto security incident of 2026 — not because of how much was stolen, but because of how little had to go wrong. No vault was cracked. No contract was exploited. Twelve websites were redirected, a drainer was served to visitors, and the only thing standing between a user and an empty wallet was whether they read the signature request.

That is the real lesson, and it applies far beyond these twelve sites. In a month that also saw the $6.3 billion Binance theft and a $133 million alleged bank exploit laundered through ETH, the attack surface of crypto has clearly moved. It is no longer just the code. It is the domain, the registrar, the hosting provider, the laptop of the engineer — and the one click you make without reading.

If you used any DeFi site on October 30 or 31, check your approvals today. It takes five minutes. Then move your long-term holdings somewhere that never connects to a website at all. The next frontend hijack will not announce itself either — but next time, the wallet it meets can be empty.