A DNS hijack of 12 sites registered at Name.com drained $202K from 32 crypto wallets. Four in five of those dollars were taken on Monad

01 · What happenedWhat happened in the Name.com DNS hijack

Late on Friday, 30 October, US time, some DeFi users opened apps they use every week. The pages looked normal. The address bar showed the right name. When they connected a wallet and signed, their money went to a stranger.

The apps belonged to 12 small crypto projects. They included Kintsu, a staking app on the Monad blockchain, and Flap, a site for launching memecoins on BNB Chain. All of their web addresses come from Name.com, a company that rents out domain names. For several hours those addresses led to copies of the sites, run by an attacker and loaded with a wallet drainer, a script that asks visitors to sign away their tokens.

The trick is called DNS hijacking. DNS is the internet's address book, and someone changed the entries for these sites. Bitquery reads every transfer on the chains these apps use, so we followed the drainer's payouts back to the people who paid. We traced $202K taken from 32 wallets on six chains. Four in five of those dollars came from a single Kintsu staker on Monad. Our count is higher than the $138K The Block reported that day, mostly because of stolen stake the attackers parked inside Kintsu, where it still sat that evening.

02 · The setupHow a website's address can be stolen

A web address is rented. A project registers its name with a company called a registrar, such as Name.com. The registrar keeps the record that says where the name should lead. Each time you type the name, your browser looks the record up through DNS.

Change the record and each visitor goes somewhere else, to a fake page that can look exactly like the real one. The address bar still shows the real name. It is the real name.

All 12 sites were registered at Name.com. They did not share a DNS provider. They used four: Vercel, NS1, Cloudflare and Name.com's own. The registrar is the one thing they have in common.

Nobody has said yet how the records were changed, though Vercel's domain service runs on Name.com and two of the projects pointed at Vercel. Kintsu said the hijack "happened on Vercel's end". Origami said it was waiting for Vercel and Name.com to explain the cause. Neither had done so when we checked.

03 · The nightThe night, drain by drain

The first drain we found landed at 01:00 UTC, on BNB Chain. Ten minutes later, Flap's site was seen serving the fake page. Flap warned its users about an hour after that.

Blockaid, a wallet security firm, warned about Flap and Kintsu at 02:54 UTC and tied the sites to a drainer kit sold as Step Drainer. Soon after, it named ten more sites serving the same kit.

All but one of the drains we counted landed before 04:00 UTC. The largest came on Monad. The last we found came on Ethereum, after half past five. Name.com put 10 of the domains on hold around midday UTC, and by late afternoon the registry showed none of them on hold.

04 · The methodWhat the drainer asked people to sign

A drainer works through signatures. The fake page asks your wallet to approve something that looks routine, like a deposit or a claim, and that signature quietly hands over your tokens.

We saw four kinds of request. Some victims sent coins straight to a contract the attacker controls. Some approved a token so the attacker could pull it later. Some signed a batch that sent their tokens out in one go. One user signed a permission inside a lending app, which let the attacker take the deposits out on their behalf.

Then almost every payment went three ways. A collector, the attacker's own contract, split it between three wallets: 55%, 30% and 15%. Some drains skipped the collector and paid the three wallets directly, in the same shares. Two drains went to the 15% wallet first, a lending account and a set of trading-pool positions.

That split works like a fingerprint. It is how we tied the drains, on each chain, to this campaign.

05 · The lossesHow much the hijack took

We traced $202,386 taken from 32 wallets on six chains. Another 15 wallets lost less than a dollar each. Most of those were tiny deposits in Neverland, a lending app on Monad.

Most victims lost little. More than half lost under $100. Two wallets carry the total. One belonged to a Kintsu staker on Monad. The other used Morpho, a lending app, on Robinhood Chain. Together they lost 96% of the money.

06 · MonadMonad: one staker, most of the money

Monad is a fast, young blockchain, and Kintsu is a staking app built on it. You stake MON, Monad's coin, and get sMON back, a token that earns staking rewards and can still be traded or used in other apps.

Just before 02:00 UTC, a single wallet signed away 4.79 million sMON, worth $106K at the time. It went through a spare address and was split three ways three seconds later. The owner was a regular Kintsu user. Since September they had staked more MON every few days.

Within three minutes the same wallet lost four Uniswap positions too. Those are the receipts you get when you add coins to a trading pool, and these held mostly WMON, a wrapped form of MON. The wallet was also made to create two new contracts, which carried off about 99,000 MON. It lost a little ETH on Arbitrum as well. In all, this one staker lost $160,531, four in five of everything the hijack took.

Over the next two hours the drainer worked through smaller accounts, and 31 wallets lost their Neverland deposits. Most were small.

A drain does not record which site its victim came from. The largest Monad losses were in Kintsu's own token, which fits kintsu.xyz. Kintsu told users to revoke anything they had signed since midnight UTC.

07 · Robinhood ChainRobinhood Chain: one Morpho account, $2K

Robinhood Chain is a new network for stock tokens. Morpho runs a lending app on it. Borrowers lock up tokens there to back their loans.

One user signed a Morpho permission. It let the attacker's contract manage their Morpho account. Just after 03:30 UTC, that contract pulled tokens out of the account and sent them to the attacker's 15% wallet. Twenty minutes later it came back. The second pull took more than the first. Unlike most drains, this money went to the 15% wallet whole, and that wallet later passed most of it to the other two.

Most of the haul was PONS, a token traded on the chain. There was also a token called The Index, and stock tokens for six companies, Nvidia and SpaceX among them. About an hour and a half later the attacker sold the PONS, The Index and the Nvidia tokens for 15.23 ETH.

That one account makes up 87% of what the attackers took outside Monad. Morpho's code did what it was told. We have written about Morpho's dead lending markets before.

08 · The sweepOne wallet, three chains, 80 seconds

The kit checks every chain where a wallet holds money. One wallet was drained on Base, then on BNB Chain, then on Ethereum. The whole sweep took 80 seconds.

Three of the victims we found were hit on more than one chain. Within half an hour, address-poisoning bots had copied some of the drains with look-alike fake tokens. They hope a victim will later copy a wrong address from their history. We have tracked those bots before, and we left their fake transfers out of the count.

09 · The walletsWho is behind the three wallets

Nobody has been named. The wallets have a past, though.

The two bigger wallets are new. On the chains we checked, they got nothing before the hijack. The 15% wallet is older. Since 22 September it has been paid by the same Robinhood Chain contract that later emptied the Morpho account. The keys that run the attacker's contracts on Ethereum and Robinhood Chain got their first funds on 20 September, ten minutes apart.

The 15% wallet also took a 20% share of two other drains that morning, with the rest going to a different wallet. Step Drainer is sold as a kit, The Block reported, citing researchers at LevelBlue: about $750 for the code, or $150 plus a 20% cut of each theft. A wallet that takes a fixed share from more than one drainer fits a seller's cut. The chain cannot show who holds it.

10 · The moneyWhere the stolen money went

By the evening of 31 October, none of the money had reached an exchange or a bridge that we could see. About half of it had been swapped into MON, Monad's coin.

The Kintsu stake is the exception. Minutes after the big sMON drain, the 55% wallet asked Kintsu to unstake its share, 2.64 million sMON. Unstaking on Kintsu takes two steps, a request and then a claim, and the claim had not been made. That stake was worth about $56,600 that evening and was still in Kintsu's own contracts. If those contracts let the team hold or cancel a request, this money could still be stopped.

Two smaller payments, worth $1,764 in all, had not moved either. The attacker never split them. They sat in two collectors, one on BNB Chain and one on Robinhood Chain. The three wallets can be followed with the Bitquery MCP.

11 · The countWhy our number is higher than $138K

The Block put the haul at about $138K on the day. That is close to what the three wallets held that evening, about $139K by the monadscan explorer's count. Count what each victim lost, at the moment they lost it, and you get $202K.

The biggest difference is the Kintsu stake, which dropped out of the attackers' balances the moment it went into Kintsu's queue and is still stolen money. The rest comes from price changes and swap costs since the drains, and from receipt tokens the explorer does not price.

12 · The sitesThe 12 hijacked sites

Three of the sites run on Solana and one on Aptos. We could not count losses there. No drainer address for those chains has been published. The three wallets in this story are EVM addresses, which Solana and Aptos do not use. FluxBeam and StonkFun said they had no reports of users losing money. We looked at StonkFun's fee wallet in an earlier piece.

13 · What to doIf you used one of these sites

We have traced several wallet drains this month, including the Predict.fun and Polymarket hacks. The advice is much the same.

Revoke any token approval you gave on 30 or 31 October, on every chain you use. A tool such as Revoke.cash lists them.

On Morpho, check which addresses can manage your account, and remove any you do not know. On Monad, check your Kintsu, Neverland and Uniswap positions. If one is gone, note the time and the transaction for the project's team.

Bookmark the apps you use. After an incident, check the project's own X account before you connect again. Wait for the all-clear. Ignore anyone who messages you offering to get your money back.

14 · The methodHow we traced the Name.com DNS hijack

We started from the three payout wallets The Block published and read each transfer into them on seven chains with Bitquery's data. Two of them, Optimism and Polygon, showed no drains. Each payment led back to a victim or to a collector, and each collector led to more victims.

Monad is not in our database yet. We read it from Monad's public network and the monadscan explorer instead. Each dollar figure uses the price at the time of the drain. You can buy the full history of the other chains as files on the Bitquery Data Store: the Ethereum, BNB Chain, Robinhood Chain, Base and Arbitrum datasets. For cases like this one, we also run crypto investigation services.

15 · The recordThe addresses behind the hijack

FAQ

Was Name.com hacked?

Nobody has confirmed that. All 12 sites were registered at Name.com, and their DNS records were changed. Two of the projects blamed Vercel, whose domain service runs on Name.com. Neither firm had said what went wrong when we checked.

How much was stolen in the Name.com DNS hijack?

We traced about $202K taken from 32 wallets on six chains, most of it on Monad. Losses on Solana and Aptos are not included.

Which sites were hijacked?

flap.sh, kintsu.xyz, pickle.finance, origami.finance, longbow.cash, echelon.market, apexdefi.xyz, shprd.finance, fluxbeam.xyz, stakepoint.app, stonkfun.xyz and supswap.xyz.

Is it safe to use these sites now?

By the afternoon of 31 October, none of the domains was on hold. Several projects said their sites were back. Check the project's own posts before you connect, and revoke any approval you gave on 30 or 31 October.

Can victims get their money back?

Most of it had been swapped and sat in the attackers' wallets that evening. About $56,600 of stolen Kintsu stake was still in Kintsu's unstaking queue. It is the best chance of recovery we can see.

What is DNS hijacking?

It is when someone changes the record that tells browsers where a website lives. Visitors type the right name and land on a page the attacker controls.