NewsCompaniesFlawsGuides
Get the app

Hijacked at the registrar: crypto sites bought through Name.com and Vercel served a wallet drainer

From the HARD Situation Room · First reported
For everything else happening in security now, see the Situation Room.

Late on Friday 30 October, US time, at least twelve crypto websites registered through Name.com started sending visitors to a copy of the site rigged with Step Drainer, a kit that tricks people into approving transfers out of their wallets. Ten of the domains were bought through Vercel Domains, which uses Name.com underneath. Name.com says 15 domains were affected and all have been restored. About US$138,000 has been traced so far. Neither company has said how the attackers got in.

Over a weekend, attackers took over at least twelve crypto websites at the company that registers their names. The addresses were right and the padlocks were there. Behind them was a page built to empty wallets.

Current event. First reported . Details may change as more becomes known; updates will be added to the timeline.

What happened

Late on Friday 30 October, US time, people visiting a dozen well-known crypto websites typed the right address, saw the padlock, and got a page built to empty their wallets. Nothing on the sites themselves had been touched. Someone had changed where their names pointed.

Every one of the domains was registered through Name.com, a large American registrar. Ten of them had been bought through Vercel Domains, the domain service of the popular website host Vercel, which uses Name.com underneath. Kintsu, one of the projects hit, said its domain was "hijacked at the registrar level" and that its fix wouldn't take. Name.com has since said 15 customer domains were affected, and that all of them have been restored.

Timeline

  1. Visitors to a dozen crypto sites, every one registered through Name.com, are sent to copies running Step Drainer.[1][2]

  2. Vercel posts a bulletin: Name.com is investigating a takeover campaign aimed at crypto companies, and the ten affected domains that came from Vercel have been restored.[3]

  3. Name.com tells The Block that 15 customer domains were affected and all have been restored. About US$138,000 has been traced so far.[1]

  4. HARD publishes its article, at High.

How a right address can be the wrong site

A website's name is rented from a registrar. The registrar tells the rest of the internet which servers answer for that name. Change that one setting and every visitor goes somewhere else, with no change to the address in their browser. Because the attacker then controls the name, they can get a genuine security certificate for it in about a minute, so the padlock shows too.

That is what makes this kind of attack so hard to spot. The usual advice, check the address and look for the padlock, was followed perfectly by everyone who lost money. The sites looked right because, as far as the browser could tell, they were.

Everyone who lost money checked the address.

What the drainer does

Step Drainer doesn't steal passwords or recovery words. It waits for you to connect your wallet, which these sites ask for as a matter of course, then shows a request that looks like an ordinary step: a claim, a sign-in, an approval. Signing it gives the attacker permission to move your tokens, sometimes all of them, sometimes later. The wallet asked, and the person said yes.

Those permissions don't expire when the site is fixed. Anyone who signed one that weekend may still have an open door, until they close it.

Who is affected

Why it matters if you don't use crypto

Most families never connect a wallet to anything. But many own a domain: the family office's website, the address the family's email runs on, a business. The same weakness applies. Whoever controls where that name points controls where the email goes, and can reset the passwords sent to it. Kintsu's experience, a domain taken over at the registrar and support that was "a bot", is the one to plan for.

How this reaches a family

  1. A site you’ve used for monthsYou type the address yourself. The padlock is there. Nothing looks different.
  2. “Connect your wallet”It asks for an approval that looks routine: a claim, a sign-in.
  3. The door stays openSigning gives someone else permission to move your tokens, today or next month.
  4. HARDEngineerFor the domains the family owns, your engineer knows where each one is registered and who can change it, and sets up two-step sign-in and a registry lock, so the family’s own addresses can’t be turned against you the same way.See how it works
Where HARD comes in.HARD for Mac and iPhone, the extension for Chrome and Brave, and HARD Engineer.

What to do

  1. If anyone connected a wallet to a crypto site on 30 or 31 October, check its approvals.Go to revoke.cash, connect the wallet, and revoke anything you don't recognise, especially unlimited approvals. If you signed something on one of these sites, move what's left to a new wallet.
  2. Don't trust the address bar for anything that moves money.Read what your wallet is asking you to approve. If it's an approval or a signature you didn't expect, reject it.
  3. If the family owns a domain through Vercel or Name.com, check it today.Make sure its nameservers and contact details are what you expect, and look through the account's activity log for changes you didn't make.
  4. Lock the registrar account down.Turn on two-step sign-in with an app or security key, not text messages, and ask whoever looks after the domain about a registry lock, which stops changes without a manual check.

Or have someone keep watch for you. Knowing which domains the family owns, where each one is registered and who can change it, before something like this happens, is part of what private cybersecurity is for.

References

  1. ^ The Block (). “Hackers hijack a dozen DeFi websites, all registered with Name.com, and steal about $138,000”. The timeline, the shared registrar, about US$138,000 traced on EVM chains, and Name.com's statement that 15 domains were affected and all restored.
  2. ^ CircleID (). “DNS hijacking campaign targets 12 cryptocurrency sites as registrar-level compromise investigated”. The twelve sites Blockaid found, Kintsu's and Flap's accounts, and what is still unconfirmed.
  3. ^ Vercel (). “Name.com domain takeover notice”. Name.com is investigating a takeover campaign aimed at crypto companies; ten affected domains came from Vercel and have been restored.
  4. The CyberSec Guru (). “Name.com DNS hijack: Step Drainer hits 12 DeFi protocols”. How Step Drainer asks for approvals, and the likely ways the domains were redirected.
  5. @codingpanda_jp on X (). “Vercel Domains hijack report (Japanese)”. Early warning to Vercel Domains customers: check nameservers, audit logs and two-step sign-in.

Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.