# Hijacked domain records sent visitors of 12 DeFi sites to a wallet drainer, taking about $138,000

All 12 sites used the registrar Name.com. In the same week, Chainalysis disclosed a customer-data breach and a London victim lost $14,000 after a street theft, and an Ethereum proposal would let wallets check transaction previews themselves.

- Published: 2026-11-01T05:46:52.612Z
- Canonical: https://polylog.news/crypto/2026-11-01/hijacked-domain-records-sent-visitors-of-12-defi-sites-to-a
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [crypto.news](https://crypto.news/defi-dns-attack-12-sites-step-drainer/), [CryptoSlate](https://cryptoslate.com/chainalysis-breach-customer-names-emails-roles/), [CoinDesk](https://www.coindesk.com/business/2026/11/01/a-stolen-iphone-usd14-000-in-losses-and-london-s-crypto-theft-problem), [Ethereum Research](https://ethresear.ch/t/erc-draft-independent-simulation-result-for-stva/26198), [The Block](https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251)

At about 00:00 UTC on October 31, someone changed the domain-name records of twelve DeFi websites (Cyber Sec Guru). The sites included Flap, Kintsu, Pickle Finance, Origami Finance and StonkFun. The attack exploited the Domain Name System (…

This story is for subscribers. Read it in full at https://polylog.news/crypto/2026-11-01/hijacked-domain-records-sent-visitors-of-12-defi-sites-to-a (subscription information: https://polylog.news/pricing).