AI · The Block
Hackers hijack a dozen DeFi websites, all registered with Name.com, and steal about $138,000
Compiled by KHAO Editorial — aggregated from 1 source. See llms.txt for citation guidance.
★ Tier-1 Source
Hackers who took over a dozen DeFi websites late Friday and used them to empty visitors' crypto wallets targeted domains registered through the same company, Name.com, according to public registry records reviewed by The Block.
Key facts
- Security firm LevelBlue SpiderLabs described Step Drainer in April as a "Malware-as-a-Service (MaaS)" kit, reportedly sold for about $750 for the full source code or $150 for a version that takes
- On BNB Chain, a Safe wallet flagged by liquidated0x received about 3.1 BNB, worth roughly $2,200, from four wallets between 9:00 and 9:42 p.m
- Onchain data reviewed by The Block shows the attackers routing proceeds to three wallets in fixed 15%, 55% and 30% cuts
- Together the three wallets held about $138,000 late Saturday morning, mostly MON and Robinhood Chain ETH, and almost all of it arrived after the attack started
Summary
Name.com is listed as the registrar for all 12 hijacked sites that were identified by security firm Blockaid, and 10 of them were suspended at the registrar level at 8:32 a.m. X user blueix was among the first to notice the shared registrar, posting at 11:51 p.m. Each of the 10 suspended domains now carries a "client hold" status, which stops a domain from resolving. X user liquidated0x flagged that Flap's site had seemingly been compromised at 9:10 p.m. " Blockaid warned about the attack on Flap and liquid staking protocol Kintsu at 10:54 p.m.