Threat actors hijacked a little over a dozen DeFi sites registered with Name.com—including Flap, Kintsu, Pickle Finance and Origami Finance—and stole about $138,000, The Hacker News reports.
How
Name.com’s post-mortem: over about 45 minutes on Oct. 31 UTC, an account in an associated support team changed nameservers on 15 domains to a malicious page running Step Drainer. Visitors who connected wallets got tricked into approving transfers out. Vercel said it knew of nine impacted domains on its platform.
My take
DNS is the soft underbelly. Registrar support paths need the same scrutiny as your deploy keys. If you run a crypto front end, watch nameservers like production.
God Bless, and Use the Source!
