DeFi Website Hijacking: 12 Sites, $138K Stolen

Twelve DeFi websites were hijacked and roughly $138,000 was stolen. Registry records show all 12 domains share one registrar, Name.com, pointing to a supply-chain compromise.

A coordinated DeFi website hijacking has left twelve projects compromised and users roughly $138,000 poorer, and the common thread runs through a single domain registrar. Registry records accessed by The Block show that all twelve hijacked domains were registered through Name.com, a detail that shifts the story away from isolated project failures and toward a shared point of weakness.

What happened in the DeFi website hijacking

According to the research notes, hackers took control of twelve DeFi websites and extracted about $138,000 in the process. The affected projects have not been publicly identified in the available information, and the notes do not specify which tokens, wallets or contracts were involved.

What is documented is the registrar link. Every one of the twelve hijacked domains was registered through Name.com, and registry records accessed by The Block point to that shared registrar as the likely vector. That is the detail that matters most: when a dozen unrelated domains fail in the same way at the same time, the probability of twelve separate project-level breaches is low. A common dependency is the more economical explanation.

For context, domain hijacking in DeFi usually means an attacker gains control of DNS settings or registrar account access and redirects visitors to a malicious front end. The smart contracts behind a protocol can remain untouched while the website users see becomes the weapon. That is why losses in these events are often modest in total but painful for the individuals caught in them.

Why the shared registrar link matters

DeFi users are trained to check contracts, audit reports and token addresses. Far fewer check where a project's domain is registered or whether registrar-level protections are enabled. This incident suggests that gap is exploitable at scale.

Concentration risk: a single registrar relationship can expose many projects at once, which is exactly the pattern the registry records describe.
Front-end trust: users interact with a website interface, not directly with code, so a hijacked domain can mislead even careful holders.
Small headline, real harm: about $138,000 across twelve sites is not a market-moving sum, but it is a meaningful loss for the wallets that signed the transactions.

It is worth being precise about what is not established. The notes do not confirm how the registrar accounts were accessed, whether two-factor authentication was bypassed, or whether the attacker exploited a platform-level flaw rather than weak individual credentials. Those questions remain open, and treating any single explanation as confirmed would be speculation.

Market reaction

No live market data was provided alongside these research notes, and no specific coins were named among the affected projects. Without identified tokens or price figures, there is no defensible basis for describing a market reaction. Readers should be cautious of anyone claiming a measurable price impact from this event without naming the assets involved.

What to watch next

The most useful signal will be disclosure. If affected projects come forward and confirm the hijack pattern, the industry gets a clearer map of the attack surface. If Name.com publishes guidance or confirms account-level compromises, that would sharpen the picture considerably.

For everyday holders, the practical takeaway is procedural rather than predictive. Bookmark verified project URLs instead of searching for them, treat sudden wallet prompts on a familiar site as suspicious, and check whether a project uses registrar locking and strong account protections. None of this guarantees safety, but it raises the cost of the cheapest attack in DeFi: fooling the front end.

The broader question is whether domain-level security becomes a standard part of protocol risk assessments. Twelve sites and about $138,000 is a small incident by crypto standards, but the mechanism is repeatable, and that is what makes it worth watching.

FAQ

What is a DeFi website hijacking?

It is an attack where someone gains control of a DeFi project's domain, typically through registrar or DNS access, and redirects visitors to a malicious interface. The underlying smart contracts may be unaffected while the website users see is weaponized.

Why did all twelve hijacked domains share Name.com as registrar?

The research notes confirm the shared registrar but do not establish the exact cause. Registry records accessed by The Block suggest a compromise connected to that common registration point, yet the specific method of account access has not been disclosed.

How much was stolen and which projects were affected?

About $138,000 was stolen across twelve hijacked DeFi websites. The available notes do not identify the affected projects or the tokens involved, so any list circulating without confirmation should be treated as unverified.

DeFi Website Hijacking Hits 12 Sites as $138K Stolen