Name.com Restores 15 Hijacked Domains After DeFi Front-End Attack

How the Attack Worked and What Was Stolen

Name.com confirmed that all 15 customer domains hijacked by hackers have been fully restored. The attack targeted 10 domains hosted on Vercel and five others. The incident exposed critical weaknesses in how decentralized finance platforms depend on centralized web infrastructure.

The breach occurred when attackers exploited a vulnerability in the registrar's authentication system. They gained unauthorized access to customer accounts and redirected domains to malicious sites. These sites ran wallet drainer scripts that stole funds from visiting users.

The malicious domains displayed fake DeFi interfaces designed to mimic popular protocols. When users connected their wallets, the drainer script automatically initiated unauthorized transactions. The campaign reportedly extracted approximately $138,000 from victims before the domains were taken down.

Why DeFi Reliance on Centralized Infrastructure Remains a Risk

Security researchers noted that the attack leveraged the trust users place in familiar domain names. Because the domains belonged to legitimate DeFi projects, users had no reason to suspect fraud. The registrar stated that the vulnerability has been patched and all affected accounts have been secured.

This incident highlights a persistent structural weakness in the DeFi ecosystem. Many decentralized applications still depend on centralized domain registrars and hosting platforms. A single point of failure at the registrar level can compromise multiple projects simultaneously.

Experts warn that even fully decentralized protocols often use conventional DNS and registrar services for their front ends. This creates an attack surface that smart contract audits alone cannot address. The $138,000 loss, while significant, may represent only the confirmed portion of the total damage.

Frequently Asked Questions

How many domains were hijacked in the Name.com attack? Fifteen customer domains were compromised, including ten hosted on Vercel. All have now been restored by the registrar.

How much money did the wallet drainer steal? The malicious campaign extracted approximately $138,000 from users who connected their wallets to the fake DeFi front ends.

What vulnerability allowed the hackers to hijack the domains? Attackers exploited a weakness in Name.com's authentication system, granting them unauthorized access to customer accounts and domain control.