Name.com Breach Hits 12 DeFi Sites, $138K Stolen
A single domain registrar breach let hackers take over 12 decentralized finance websites and steal roughly $138,000 (USD). If you have ever clicked a saved DeFi bookmark without checking the URL, this incident shows that habit can cost money.
What actually happened
All 12 compromised sites were registered through Name.com, according to registry data reviewed by The Block. The report, published 31 October 2026, puts total losses near $138,000 (USD) across the affected projects. The Block notes the shared registrar points to one breach at that level, not 12 separate, unrelated hacks. Attackers likely redirected each site's DNS records to a lookalike page once they controlled the registrar account, though the report does not confirm the exact method. The names of all 12 affected projects were not disclosed. Name.com had not issued a public statement at the time of publication.
How we got here
Website addresses sit outside blockchain code entirely. A smart contract can be audited line by line, but the site a user visits to connect a wallet depends on domain name security, a layer registrars control, not developers. When one registrar handles many projects, a single compromised account turns into a shared weak point across all of them. This is not the first time front end infrastructure, rather than contract code, became the entry point for a DeFi exploit. The pattern keeps pushing attacker focus away from audited code and toward the web layer users trust out of habit.
Why this matters for you
For everyday wallet users, including people connecting through bonuz, the lesson is simple: check the address bar and the wallet connection prompt every time, even on sites visited daily. A bookmark does not guarantee safety if the domain's DNS changes hands behind the scenes. For DeFi teams, this is a push to lock domains, add two-factor authentication on registrar accounts, and spread critical infrastructure across more than one provider. For builders of wallet or device interfaces, it strengthens the case for verification that happens outside a browser tab, on a separate screen or device a hacker cannot easily reach.
The bigger question
If a single registrar account can redirect a dozen trusted DeFi sites at once, how much of crypto's actual security depends on infrastructure that sits entirely outside any blockchain? Audits and contract reviews mean little if the page a user loads is not the real one. The open question is whether the industry treats domain and registrar security with the same seriousness it gives smart contract code.
What to watch
Name.com has not confirmed how the breach happened or named the 12 affected projects. Watch for a registrar statement, public disclosure of which DeFi sites were hit, and whether any of the $138,000 (USD) gets frozen or returned. Until then, treat every DeFi link, even familiar ones, with extra caution before connecting a wallet.
