A wave of website attacks hit the decentralized finance world. The incidents took place late on October 30, 2026. Attackers hijacked the web domains of fifteen finance websites. All of the targeted websites used the domain seller Name.com. The hackers altered the domain records. They pointed web visitors
to fake web pages. These fake sites were set up to steal crypto coins.
Security firm Blockaid was among the first to spot the attacks. The fake web pages held a bad script called Step Drainer. When visitors linked their digital wallets, the script popped up. It asked users to sign
and approve transactions. Users who clicked confirm lost their coins. The tool drained wallets quickly. Security teams call Step Drainer a crime kit for hire. Rogue groups buy the code to target web visitors.
Onchain records show that the thieves stole at least 138,000 dollars. They took funds across several major networks. The stolen funds were sent to three main wallets. The thieves split the money into three fixed cuts. The cuts were set at fifteen, fifty-five, and thirty percent. Each wallet got its share.
The theft hit several blockchains. On the Monad network, hackers took staked coins from Kintsu. On Robinhood Chain, they took tokenized company shares. Then they traded the shares for ether. Attackers also took funds on BNB Chain and Ethereum. Other affected sites run on Solana and Aptos.
The list of affected projects grew quickly on Friday night. Targeted sites included Pickle Finance and Origami Finance. Attackers also hit FluxBeam, Echelon, and StonkFun. StakePoint was hit too. The teams behind Flap and Kintsu also faced domain hijackings.
However, the underlying smart contracts were never touched. User funds inside the core blockchain contracts remained safe. Only the website front doors were altered by the attackers. The blockchain ledgers kept running as normal.
Name.com took action to stop the attacks on Saturday morning. The firm placed ten of the domains on hold. This hold stopped the fake web pages from loading. Later that morning, the firm restored control of the domains. It also added domain locks to stop future changes. Name.com said it is working directly with account owners to secure their profiles.
Cloud hosting provider Vercel was also part of the story. Some affected teams thought the breach began in Vercel systems. Vercel stated that ten of the affected domains used its platform. It confirmed that Name.com had restored the web addresses. Vercel is now helping investigators review the root cause. Vercel chose Name.com as its domain partner in late 2025.
This incident shows that website safety is vital in crypto. Even if smart contracts are safe, fake websites can trick users. Attackers target domain tools to bypass blockchain safety rules. When a domain points to a fake page, users can lose funds with one click.
Web domain routing connects everyday web tools to blockchain systems. If that bridge breaks, users face real dangers. That is why Web3 teams must guard domain tools with care. Projects should use two-step login keys on all registrar accounts. They should also set up registry locks to block sudden address changes. Domain monitoring tools can alert teams when records change.
Users must check every wallet prompt before they click confirm. Modern wallets now offer clear-signing tools. These tools show what a transaction will do before you sign. Reading contract details stops malicious drainers from taking coins. Hardware signers also help protect private keys. Careful web habits
keep digital funds safe from online thieves. Storing assets safely gives peace of mind. Taking smart steps today protects your digital funds tomorrow. Safe habits protect your wealth for the long run.