Fraudulent Redirects on 15 Domains Including DeFi Sites Result in Fund Theft

Key Points of This Article

• Estimated damage exceeds 32 million yen
• Same domain registrar used

Fraudulent Redirects on 15 Domains Including Flap

On October 30, 15 domains, including DeFi (Decentralized Finance) related sites registered with the domain registrar Name.com, were fraudulently redirected. The Block reported this on the 31st.

Blockchain security company Blockaid reported on the 30th that sites such as Flap, Kintsu, Pickle Finance, and Origami Finance were compromised, leading to funds being siphoned from visitors' cryptocurrency wallets.

All these DeFi-related websites were registered using the domain registrar Name.com. On the 31st, Name.com stated that 15 customer domains were affected, and after a temporary suspension, they have now been restored.

They also mentioned that they are working directly with the registrants of each domain to address the issue. They stated that they will continue to investigate and have taken measures to protect the affected accounts.

Late on October 30, they confirmed that multiple domains registered through the platform were being redirected to different locations, which was aimed at accessing visitors' wallets.

The cloud company Vercel, which provides hosting and deployment for websites and applications, uses Name.com as its domain service registrar. According to their security information, 10 of the affected domains were related to their platform.

At this time, it remains unclear where the hacking occurred—whether on Name.com, Vercel, or in the integration between the two.

Estimated Damage Exceeds 20 Million Yen on EVM Alone

According to Blockaid, the compromised sites contained a malware toolkit called "Step Drainer." This tool prompts users to approve the transfer of assets from their wallets to external accounts when they connect their wallets to the site. Kintsu, Origami, FluxBeam, and StonkFun explained that there was no damage to the contracts themselves.

In tracking by The Block on EVM (Ethereum Virtual Machine) compatible chains, approximately $138,000 (about 22 million yen) of stolen funds flowed into three wallets.

On the other hand, among the affected sites, FluxBeam, StonkFun, and StakePoint were built on Solana (SOL), while Echelon was built on Aptos (APT), and The Block has not investigated those. There may also be losses occurring on these networks.

Separately, blockchain analysis firm Bitquery estimates the damage on EVM-related sites alone to be about $202,000 (approximately 32 million yen). This includes the balance that flowed into the attackers' wallets, as well as funds in Kintsu's unstaked waiting queue.

Kintsu is a staking app on Monad, and the attackers applied for the unstaking of the stolen staking tokens "sMON" (worth about $56,600) from the victims. According to Bitquery, as of the evening of the 31st (UTC), no procedures for receiving the funds had been carried out, and the funds remained in Kintsu's contract. Bitquery suggests that if Kintsu has a mechanism to hold or cancel the application, it may be possible to prevent the outflow of these funds.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.