A wave of DNS hijacking attacks has redirected visitors from at least 12 cryptocurrency websites to malicious pages designed to steal digital assets, with affected operators reporting compromises involving domain registration infrastructure. The incidents, detected October 30–31, have drawn attention to Vercel Domains and Name.com, although the precise entry point and any common root cause remain unconfirmed.

Security researchers identified the same wallet-draining toolkit across 12 sites. Blockchain security firm Blockaid initially flagged attacks against Flap, a token launch platform, and Kintsu, a decentralized finance protocol, before identifying ten additional affected websites. These included StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance, and APEX. The sites were reportedly serving malicious code associated with Step Drainer, a toolkit that can induce users to authorize cryptocurrency transfers to attacker-controlled wallets.

Kintsu traced its domain hijack to the registrar level. In an October 31 statement, the company said kintsu.xyz, registered through Vercel Domains, had been hijacked at the registrar level. Kintsu characterized the incident as a supply-chain attack beyond its control and reported escalating the matter to Vercel and Name.com. The company subsequently restored its website, warning that cached DNS responses could temporarily continue directing visitors to the malicious destination.

Flap separately confirmed a DNS hijack affecting flap.sh and instructed users not to connect wallets or approve transactions. The project investigated whether its domain service provider was involved and temporarily directed users to an alternative domain.

The attacks exploited website routing rather than blockchain protocols. DNS translates domain names into the network addresses needed to reach websites. Attackers who gain control over relevant DNS records or delegation settings can redirect visitors entering a legitimate domain to infrastructure under their control. In this campaign, visitors could encounter fraudulent wallet interfaces even when using familiar website addresses.

The exact technical method remains unresolved. Registrar-level access could permit unauthorized changes to authoritative nameservers or DNS configuration, depending on the provider’s architecture and account permissions. Neither the use of compromised registrar credentials nor a breach of a registrar’s internal systems has been publicly established. DNSSEC alone would not necessarily prevent an attack involving authorized changes to a domain’s delegation.

The incidents followed a separate DNS-related compromise affecting Polymarket. On October 29, attackers exploited a third-party monitoring script associated with DebugBear to steal approximately $2.7 million from 726 wallets on the prediction-market platform. DebugBear subsequently reported that its DNS records had been compromised through its domain registrar, while saying it had found no evidence that its own systems were breached. Polymarket said it would return approximately $3.9 million to users, including compensation for trading-related losses.

The DebugBear incident involved the delivery of malicious third-party JavaScript, while the subsequent cryptocurrency attacks involved redirection of project websites. No common attacker, registrar, or technical cause has been established between the two incidents.

The shared infrastructure behind the latest campaign remains unidentified. Kintsu’s disclosure implicates its domain registration service, but the available evidence does not establish that Vercel Domains or Name.com suffered a platform-wide breach. The incidents nevertheless demonstrate how unauthorized control over domain configuration can expose users to fraudulent content without compromising the applications’ underlying blockchain contracts.

Affected projects have begun restoring their domains and advising users who interacted with suspicious pages to revoke potentially malicious wallet approvals. Investigators have not established an aggregate financial loss for the 12-site campaign.