Hackers Hijack DeFi Websites Registered With Name.com, Drain Wallets

2026 11 02 07 defi websites hijacked name com dns wallet drainer 1200x630 v1

ແຮັກເກີຍຶດເວັບໄຊ DeFi ທີ່ຈົດທະບຽນກັບ Name.com ແລະ ດູດເງິນຈາກກະເປົາ

ຜູ້ໂຈມຕີໄດ້ຍຶດເວັບໄຊ DeFi ປະມານສິບກວ່າແຫ່ງ ໃນຄືນວັນສຸກທີ 30 ຕຸລາ (ຕາມເວລາສະຫະລັດ) ລວມທັງ Flap, Kintsu, Pickle Finance ແລະ Origami Finance, ແລ້ວໃຊ້ເວັບໄຊເຫລົ່ານັ້ນດູດເງິນອອກຈາກກະເປົາຄຣິບໂຕຂອງຜູ້ເຂົ້າຊົມ, ອີງຕາມບໍລິສັດຄວາມປອດໄພ Blockaid ທີ່ The Block ລາຍງານ. ອີງຕາມຂໍ້ມູນການຈົດທະບຽນທີ່ The Block ກວດເບິ່ງ, ເວັບໄຊທັງ 12 ແຫ່ງທີ່ Blockaid ລະບຸ ລ້ວນແຕ່ຈົດທະບຽນຜ່ານ Name.com. ຕໍ່ມາ Name.com ກ່າວວ່າ ມີໂດເມນຂອງລູກຄ້າໄດ້ຮັບຜົນກະທົບ 15 ໂດເມນ ແລະ ໄດ້ກູ້ຄືນທັງໝົດແລ້ວ, ສ່ວນ Vercel ກ່າວວ່າ 10 ໂດເມນທີ່ໄດ້ຮັບຜົນກະທົບ ກ່ຽວຂ້ອງກັບແພລດຟອມຂອງຕົນ.

Blockaid ກ່າວວ່າ ເວັບໄຊເຫລົ່ານັ້ນຖືກຝັງ Step Drainer ເຊິ່ງເປັນຊຸດມັລແວທີ່ຫລອກໃຫ້ຜູ້ເຂົ້າຊົມ ອະນຸມັດການໂອນເງິນອອກຈາກກະເປົາ ເມື່ອເຊື່ອມຕໍ່ກະເປົາກັບເວັບໄຊ. The Block ຕິດຕາມເງິນທີ່ຖືກລັກໄດ້ປະມານ 138,000 ໂດລາ ໃນກະເປົາ 3 ໃບ ເທິງເຄືອຂ່າຍ EVM, ເຊິ່ງຍັງບໍ່ລວມຄວາມເສຍຫາຍທີ່ອາດເກີດຂຶ້ນເທິງ Solana ຫລື Aptos. ຍັງບໍ່ມີໂຄງການໃດລາຍງານຈຳນວນຜູ້ເສຍຫາຍ.

Kintsu, Origami, FluxBeam ແລະ StonkFun ກ່າວວ່າ ສັນຍາ onchain ຂອງຕົນບໍ່ໄດ້ຮັບຜົນກະທົບ. Kintsu ແລະ Origami ໄດ້ກ່າວໂທດບໍລິສັດໂຄງສ້າງພື້ນຖານຄລາວ Vercel ຢ່າງເປີດເຜີຍ, ໃນຂະນະທີ່ Cloakd ຜູ້ພັດທະນາ FluxBeam ກ່າວວ່າ ຕົວແທນຂອງ Name.com ຖືວ່າ ບັນຫາບໍ່ໄດ້ເກີດຈາກຝ່າຍ Name.com; Name.com ແນະນຳໃຫ້ລູກຄ້າກວດເບິ່ງບັນທຶກ DNS ແລະ ເປີດໃຊ້ການຢືນຢັນສອງຂັ້ນຕອນ. ກ່ອນອະນຸມັດຄຳຂໍໃດໆໃນກະເປົາ, ກະລຸນາກວດເບິ່ງໃຫ້ລະອຽດວ່າ ທ່ານກຳລັງເຊັນອະນຸມັດຫຍັງ.

ພະນັກງານ bitqik ຈະບໍ່ຂໍລະຫັດຜ່ານ, ລະຫັດ 2FA ຫລື seed phrase ຂອງທ່ານ.

ເງິນຄຣິບໂຕ ບໍ່ແມ່ນເງິນ ແລະ ບໍ່ແມ່ນເຄື່ອງມືຊຳລະທີ່ຖືກຕ້ອງຕາມກົດໝາຍ ຂອງ ສປປ ລາວ (ແຈ້ງການ ທະນາຄານແຫ່ງ ສປປ ລາວ ເລກທີ 156/ຫກ, ລົງວັນທີ 11 ສິງຫາ 2021).

Late on Friday, 30 October (US time), attackers seized control of roughly 12 DeFi websites, among them Flap, Kintsu, Pickle Finance and Origami Finance, and used them to drain visitors’ crypto wallets, security firm Blockaid said, according to The Block. All 12 hijacked sites identified by Blockaid were registered through Name.com, according to registry records reviewed by The Block. Name.com later said 15 customer domains were affected and that it has restored all of them, while Vercel said 10 of the affected domains were associated with its platform.

Blockaid said the sites were loaded with Step Drainer, a malware kit that, once a visitor connects a wallet, prompts them to sign approvals that send their funds to the attackers. The Block traced about $138,000 in stolen funds to three wallets on EVM chains, a figure that does not include any losses on Solana or Aptos. No affected project has reported a victim count.

Kintsu, Origami, FluxBeam and StonkFun said their onchain contracts were untouched. Kintsu and Origami publicly blamed cloud infrastructure firm Vercel, while Cloakd, the developer behind FluxBeam, said its Name.com representative was taking the stance that the problem was not on Name.com’s side. Name.com urged customers to check their DNS records and turn on two-factor authentication. Before approving any wallet request, check carefully what you are signing.

bitqik staff will never ask for your password, 2FA code or seed phrase.

Cryptocurrency is not money and is not a lawful means of payment in the Lao PDR (Bank of the Lao PDR Notice No. 156/ຫກ, 11 August 2021).

Source: The Block – https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251

Additional sources: