Hackers compromised the web front ends of 12 decentralized-finance projects late Friday, turning legitimate project domains into wallet-draining sites and stealing at least $138,000 across Ethereum-compatible networks, according to cybersecurity firm Blockaid and onchain records. The incident appears to have targeted internet infrastructure rather than the projects smart contracts, exposing users who connected wallets and approved transactions through altered websites.
All 12 affected domains were registered through Name.com, while the sites used a mix of Cloudflare, Vercel and Name.com nameservers. Ten domains were placed on client hold at 8:32 a.m. ET Saturday, a registrar status that prevents a domain from resolving normally in browsers, according to public registry records.
The affected projects identified by Blockaid included Flap, Kintsu, Pickle Finance and Origami Finance. Other suspended domains included FluxBeam, Echelon, StonkFun and StakePoint. Flap and Kintsu remained reachable during the initial review period, though accessibility alone would not establish whether their web interfaces had been fully remediated.
The $138,000 figure reflects assets tracked to wallets on EVM-compatible networks, where transactions and destination addresses can be publicly followed. It excludes potential losses from Solana-based projects FluxBeam, StonkFun and StakePoint, as well as Aptos-based Echelon, because funds on those networks would have moved through separate wallet systems.
Wallet drainer used familiar approval tactic
Blockaid linked the malicious behavior to Step Drainer, a toolkit that creates deceptive wallet-connection and token-approval prompts. Rather than breaking into a users wallet directly, such tools seek authorization from the wallet holder. A victim who signs the malicious request may allow an attacker to transfer specified tokens or assets.
LevelBlue SpiderLabs described Step Drainer in an April report as a malware-as-a-service product. The security firm said its operators advertised full source-code access for roughly $750, or a lower-cost version that retained 20% of stolen proceeds. Step Drainers operators also claimed support for more than 20 blockchain networks, allowing the same style of web compromise to target users across several ecosystems.
Onchain records indicate the operation used a consistent revenue-sharing arrangement. Funds were routed to three addresses in fixed 15%, 55% and 30% portions:
0x5aff449b63c033Df386aF0C45384cd20c5918dBf0x012f89Ff307568F8409Bbe379ca92ED41Bc4D3860x7bf2037264efbFF55bD52777772779C1D9e87695
The same split appeared in transactions on Ethereum, Robinhood Chain and Monad, according to the transaction flows reviewed. Repeated allocation patterns across chains provide a stronger link between the separate thefts than any single compromised website would on its own.
Attackers moved funds through defi protocols
The thefts did not remain confined to the assets initially taken from victims. On Monad, two recipient wallets redeemed Kintsu staked MON tokens, withdrew assets from lending protocol Neverland and converted proceeds into MON. Those transactions suggest the attackers were actively consolidating and simplifying the assets received from compromised users.
On Robinhood Chain, one of the wallets withdrew tokenized stock positions, including NVDA and AAPL, from Morpho before swapping the assets into ETH. The transactions show how a front-end compromise can reach beyond basic token balances: users who had deposited assets in defi applications could have their positions unwound if they granted sufficiently broad permissions through the fraudulent interface.
BNB Chain activity showed at least four wallets transferring funds to an attacker-controlled Safe wallet between 9:00 p.m. and 9:42 p.m. ET Friday. The address, 0x24497068cA4166ca32a04ae530ce00Cf79755bD5, received about 3.1 BNB, valued at roughly $2,200 at the time. It distributed the first three incoming deposits among the three main destination wallets, while about 2.27 BNB remained in the Safe wallet on Saturday morning.
By late Saturday morning, the three principal wallets held roughly $138,000, primarily in MON and ETH on Robinhood Chain. Most of those inflows arrived after the web attack began.
Registrar link raises infrastructure questions
The shared Name.com registration was among the earliest public clues. Posts on X pointing to the registrar connection began appearing at 11:51 p.m. ET Friday. Name.com issued a public reply at 12:27 a.m. ET Saturday directing users to its abuse-reporting process. The company had not publicly detailed the source of the incident within the reporting window.
A common registrar does not by itself establish how the websites were compromised. The affected domains did not share one DNS provider, and technical setups were spread across several hosting and DNS services. Kintsu and Origami Finance each publicly attributed the incident to Vercel, although technical information available publicly did not establish a definitive initial point of compromise.
Name.com said in a December 2025 press release that Vercel had selected it as registrar for Vercels rebuilt domain service. Vercel separately disclosed an internal-system breach in April involving a compromised third-party AI tool. Neither disclosure independently establishes a connection to Fridays incident.
Several affected teams said their onchain contracts had not been compromised. That distinction affects the response required from users: a smart-contract exploit may require protocol-level intervention, while a malicious web interface creates risk through wallet approvals made during the period the site was altered.
Users who connected wallets face approval risk
Projects moved to suspend access or investigate their web deployments, with several sites remaining offline while teams assessed the compromise. The immediate risk is concentrated among users who connected a wallet and signed a transaction through an affected interface after the attack began.
Users who approved unfamiliar token permissions should review and revoke them through a trusted wallet-security tool or blockchain explorer, using independently verified links rather than links supplied by a potentially compromised project website. Where a wallet may have approved broad asset access, moving remaining funds to a newly created wallet can limit further exposure, provided the transfer is initiated through a trusted interface.
The episode follows other recent cases in which attackers exploited domain or front-end weaknesses instead of attacking blockchain code directly. Aerodrome and Velodrome suffered web-related compromises in November 2025, while Galxe was targeted in October 2023 after an attacker accessed an account at registrar Dynadot. Fridays attack adds a multi-chain example of how a single breach in the web layer can place users of otherwise unaffected defi contracts at risk.
To keep your funds safe from phishing and wallet-draining scams, read Safer and Better Trading Tips to Spot Crypto Scams now.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
