Hackers hijacked 12 DeFi websites, all registered through Name.com, and stole about $138,000 (USD). Anyone who clicked a familiar DeFi link during the window could have been exposed to a fake, attacker-controlled site.
What actually happened
All 12 hijacked domains share one registrar, Name.com, according to registry records reviewed by The Block. The outlet reported the pattern suggests a compromise at the registrar level rather than 12 unrelated, separate attacks. The total stolen across the affected sites is estimated at about $138,000 (USD). The report, published 31 October 2026, does not name all 12 projects or detail the exact exploitation method used once the domains were under attacker control.
How we got here
Crypto front ends are a known weak point. Smart contracts can be audited, but the website users visit to connect a wallet depends on domain name security, which sits outside the blockchain entirely. If an attacker controls a registrar account, they can repoint a domain's DNS records to a lookalike site without touching any code the project itself wrote. Shared infrastructure, in this case one registrar serving 12 different DeFi projects, turns a single point of failure into a multi-project incident.
Why this matters for you
For users, the incident is a reminder to verify a site's address and check wallet connection prompts before signing anything, even on a bookmarked or familiar link. For DeFi teams, it raises questions about registrar account security, two-factor authentication, and domain locking features. For builders generally, it strengthens the case for hardware-level and device-level verification, an area where wearable and smart-glasses interfaces could eventually offer an added prompt layer outside a compromised browser tab.
The bigger question
If attackers can redirect trusted DeFi domains through one shared registrar, how much of crypto's security actually depends on infrastructure outside any blockchain at all?
What to watch
Name.com has not issued a public statement included in the current report. Watch for confirmation of which 12 projects were affected, whether Name.com discloses how the compromise occurred, and whether any of the $138,000 (USD) is recovered or frozen.
