DNS hijacking of 12 DeFi sites leads to about $200,000 in crypto-asset losses
The DNS of at least 12 DeFi websites registered with Name.com was tampered with, redirecting visitors to fake sites loaded with the Step Drainer wallet-draining tool. Attackers tricked users into approving asset transfers, and a follow-up tally found about $202,386 stolen from 32 wallets. Unauthorised redirection of the domains was confirmed, but the initial intrusion route has not been identified, and the smart contracts themselves were not compromised.
Key facts
- Affected organisation
- Being confirmed
- Incident type
- Phishing & smishing
- Occurred / detected
- Not confirmed
- Scale of damage
- About $202,386 in crypto-assets stolen from 32 wallets
- Cause / method
- DNS tampering redirected users to fake sites, where Step Drainer tricked them into approving asset transfers
- Location
- Other countries
If your data was exposed
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
Timeline
- DNS tampering at 12 DeFi sites and wallet thefts were reported, with tracked losses ranging from about $138,000 to about $202,000 depending on the analysis.
- The tactic of luring users into approving asset transfers on malicious pages was identified, and the initial cause of the intrusion has not been identified.
- Follow-up on-chain analysis put the losses from 32 wallets at about $202,386.
8 related reports
- A DNS hijack of 12 sites registered at Name.com drained $202K from 32 crypto wallets. Four in five of those dollars were taken on Monad
- DeFi DNS hijack: 12 sites served a wallet drainer, and Name.com confirms redirects but not the cause
- DeFi Domain Hijack Hits 12 Sites on Name.com
- Hackers hijack 12 DeFi websites as Vitalik Buterin questions how people access crypto
- DNS-Hijacking bei DeFi: Name.com-registrierte Domains werden per Step Drainer missbraucht
- Hackers hijack a dozen DeFi websites, all registered with Name.com, and steal about $138,000
- Hackers hijack 12 DeFi websites registered with Name.com, draining about $138K
- Name.com domains hijacked: drainer on twelve DeFi sites, approvals from October 31 should be revoked
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.