Hackers successfully hijacked 12 decentralized finance websites in a coordinated domain-based attack, stealing approximately $138,000 from users who were redirected to malicious phishing interfaces. The incident represents a significant supply-chain security breach targeting the domain infrastructure layer rather than the protocols themselves.
All 12 compromised domains were registered through Name.com, according to registry records reviewed by The Block, strongly indicating a systemic compromise at the registrar level rather than isolated breaches of individual projects. The uniform registration pattern across all affected sites suggests attackers exploited a vulnerability or credential compromise within Name.com's systems to gain unauthorized control over the domains.
Domain hijacking attacks redirect legitimate traffic to attacker-controlled servers, typically presenting users with fraudulent interfaces that mimic the authentic DeFi platforms. Users attempting to connect their wallets or approve transactions on these spoofed sites inadvertently grant attackers access to their funds. The technique bypasses blockchain-level security measures by compromising the traditional internet infrastructure that users rely upon to access decentralized services.
The $138,000 in stolen funds, while relatively modest compared to protocol-level exploits, demonstrates the ongoing viability of infrastructure attacks against DeFi users. The attack surface expands significantly when projects rely on centralized domain registrars and DNS infrastructure, creating single points of failure that sophisticated attackers can exploit.
Name.com, a subsidiary of Identity Digital, has not yet publicly disclosed the specific nature of the compromise affecting the affected accounts. The incident highlights persistent risks in the domain registration ecosystem, where social engineering, credential stuffing, or API vulnerabilities can enable mass compromises across seemingly independent projects sharing a common registrar.
DeFi projects and users face limited options for mitigating registrar-level attacks. While some protocols have implemented additional verification layers or alternative access methods, the standard web browsing experience remains vulnerable to DNS and domain compromises. The incident serves as a reminder that blockchain security extends beyond smart contracts to encompass the full stack of infrastructure enabling user access.
Security researchers have long warned about the concentration risk present when multiple DeFi projects utilize the same domain infrastructure providers. The Name.com compromise validates these concerns, demonstrating how a single point of failure can cascade across numerous independent projects simultaneously. Users who verified contract addresses and practiced otherwise sound security hygiene still fell victim because the compromise occurred at the domain resolution layer, before any blockchain interaction took place.
The attack joins a growing list of infrastructure-focused breaches in the cryptocurrency sector, where attackers increasingly target the less-secure periphery rather than hardened protocol code. Domain registrars, email providers, and frontend hosting services present attractive targets due to typically weaker security postures compared to the protocols they serve, while offering direct access to user funds through transaction interception and credential harvesting.