DeFi DNS attack hits 12 sites as Blockaid flags Step Drainer

DNS hijacking of DeFi front ends is not new; wallet-drainer kits such as Inferno and Pink Drainer have circulated for years, swapping malicious connect-wallet scripts onto legitimate-looking pages. This Halloween incident added Step Drainer to that list, hitting at least 12 sites including Flap and Kintsu. The pattern is familiar: attackers do not touch audited smart contracts, they intercept the domain layer users trust to reach them, a weaker link than the code itself.

Anyone who visited the affected front ends during the window faces the same drill: check wallet approvals, revoke any signature granted to the drainer contract, and treat the roughly $138,000 pulled across the dozen sites as the visible floor, not the full tally. Projects lose the assumption that a secure contract is enough; several teams had to post emergency warnings telling users not to connect wallets at all, a stopgap that only works if it reaches people before they click.

DeFi markets itself as trustless, yet the front door to nearly every protocol still runs through a centralized registrar, DNS records that can be repointed in minutes, and a login an attacker only needs to guess or phish once. Flawless Solidity cannot protect a user if the URL they typed resolves somewhere else. Until domain locking, DNSSEC and registrar-side multi-factor controls become standard practice rather than an afterthought, this category of attack will keep working regardless of how secure the contracts behind it are.

Name.com has restored the 12 hijacked domains but has not disclosed how the attacker gained control of its platform or which accounts were compromised, saying only that it is investigating and will post updates on X. That disclosure, whenever it lands, will determine whether this was a credential-level breach specific to a handful of accounts or a broader registrar vulnerability, a distinction that decides whether every Name.com customer needs to act now or just the twelve already hit.