Domain registrar Name.com said on Saturday that a number of domains on its platform “were improperly redirected late Friday as part of a plan to access visitors’ crypto wallets,” and that it had put them back. The company said in a post on X that it was investigating and would share updates in the same thread. It has not said how the attackers gained control or which domains were involved.

Web hosting company Vercel said in a security bulletin that Name.com, one of its domain registration partners, is looking into a takeover campaign aimed at crypto companies. Vercel counted 10 Vercel-associated domains among those affected, said Name.com had restored them and told customers they did not need to take any action.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

Who Was Hit

Three projects confirmed the attack on their own sites. Flap said in a post on X that its website was “affected by a DNS hijacking incident and is redirecting to an unauthorized website.” Kintsu said in a reply on X that “it wasn’t a contract exploit, it was a frontend takeover.” Origami Finance said in its security notice “smart contracts and funds in Origami vaults are not affected. Only the Origami website was redirected.” Origami paused its vaults and told anyone who connected a wallet or signed on its site after midnight UTC on Oct. 31 to revoke unfamiliar approvals.

Web3 security firm Blockaid warned that nine sites besides Origami were “actively serving the Step Drainer”: stonkfun.xyz, pickle.finance, echelon.market, fluxbeam.xyz, stakepoint.app, supswap.xyz, longbow.cash, shprd.finance and apexdefi.xyz.

Unchained checked public registry records on Nov. 2 for the 12 domains named by their owners or by Blockaid. All 12 are registered at Name.com, and every record shows a change dated Oct. 31. Their DNS is spread across four providers: six use Vercel, two use Cloudflare, three use NS1 and one uses Name.com’s own nameservers.

Cause Still Disputed

In the same reply on X, Kintsu said “it was something that happened on Vercel’s end that was out of our control.” Origami’s security notice on X blamed an “active attack on Vercel-associated Nameservers” for the redirects. Vercel’s bulletin instead describes a Name.com takeover campaign that Name.com is investigating, with Vercel assisting. Independent researcher punkquidity said that at 12:32 UTC on Saturday, 10 of the hijacked sites “were switched off at the registrar within 5 seconds,” and that he could not yet tell whether Name.com itself or a reseller such as Vercel was responsible.

Vercel separately confirmed a breach of its internal systems in April. Neither company has tied that incident to this one.

Related Listen: Why Calling Out Bad Security Practices in DeFi Isn’t ‘Grave Dancing’