On October 31, 2026, The Block reported that hackers took over a dozen DeFi websites late Friday and used them to empty visitors’ crypto wallets. According to the same article, the targeted domains were registered through one company, Name.com, and The Block traced about $138,000 in stolen funds so far using onchain data. Crypto Briefing also reports that the affected domains have been restored. A Vercel security bulletin says 10 domains associated with Vercel were impacted and that Name.com has restored them.

Why It Matters

A hijacked domain changes what a visitor’s browser loads, not what a protocol’s contracts do. The Vercel bulletin and The Block’s report describe domain takeovers and redirected websites. Neither describes a flaw in a protocol’s contract code, so a code audit may not have covered this path. That is our interpretation, not a finding from either source. The Block reported that one wallet pulled tokenized stocks, including NVDA and AAPL, out of a lending protocol and swapped them for ETH. On our reading, that shows assets deposited in DeFi can sit behind the same wallet that a compromised page asks to sign.

Traders usually ask who holds collateral, who sets prices and who runs liquidations. Anyone trading in a browser also relies on a registrar account, a DNS record and a hosting provider to deliver the real interface. Frontend provenance is therefore a separate layer of counterparty risk: a trader may trust a protocol and still be exposed to whoever controls the address bar. A familiar web address that now resolves somewhere else looks the same to a visitor, so the interface on screen is weak evidence of where its code came from. Provenance here means who controls the domain, the registrar account and the hosting behind the page a wallet is connected to. Crypto Briefing reports that Name.com urged customers to review their DNS settings and enable two-factor authentication.

Much remains unclear. Crypto Briefing reports that Name.com said 15 customer domains were affected. Separately, The Block reports that Blockaid identified 12 affected DeFi websites and that no affected project had reported a victim count. These counts describe different scopes. The Vercel bulletin describes Name.com as investigating a domain takeover campaign targeting crypto companies, and the reports reviewed do not establish a root cause. As a general habit, traders can bookmark known addresses, read each signing prompt before approving it and keep trading balances in a separate wallet from long-term holdings. Waiting for a project to confirm that its domain is secure before reconnecting a wallet after a security notice is also a reasonable step. Those habits reduce exposure to this kind of attack but do not remove it.

Go deeper

On LeverUp, perpetual futures trade through a protocol-managed virtual liquidity architecture.