Hackers steal $138,000 from twelve DeFi websites registered with Name.com

Hackers took control of twelve decentralized finance (DeFi) websites on Tuesday, stealing an estimated $138,000 in cryptocurrency. All of the compromised domains are registered through the registrar Name.com, according to public WHOIS data examined by The Block. The attackers redirected users to phishing pages that mimicked the original services, prompting victims to approve fraudulent transactions.

The breach matters because DeFi platforms rely heavily on trust and open‑source code, yet they often lack the robust security practices of traditional finance. Domain hijacking is a low‑cost way for criminals to intercept traffic and harvest private keys or wallet addresses. In recent months, several high‑profile DeFi projects have suffered similar attacks, highlighting a growing vulnerability in the ecosystem’s infrastructure layer. Registrars like Name.com serve as the first point of contact for domain owners, and a compromise at that level can expose dozens of projects to the same threat without the owners’ knowledge.

Name.com confirmed it is investigating the incident but said no evidence yet points to a breach of its own systems. The registrar urged customers to enable two‑factor authentication and to monitor domain settings for unauthorized changes. Affected DeFi teams are notifying users, revoking compromised addresses, and working with law‑enforcement agencies to trace the stolen funds. The Block noted that the $138,000 loss is a fraction of the total value staked across DeFi, but the incident underscores the need for stronger domain security standards. Experts expect regulators may push for mandatory security audits of domain registrars that serve crypto projects, and for the industry to adopt best‑practice measures such as DNSSEC and multi‑signature controls. In the meantime, users are being warned to verify URLs carefully and to avoid approving transactions from unfamiliar sites.