# 12 DeFi Domains Linked to Redirects Were Registered at Name.com By Simon Yoon Canonical URL: https://www.tokenpost.com/news/technology/46354 Published: 2026-11-02T11:41:56.000Z Updated: 2026-11-02T11:41:56.000Z Section: Technology > The domains used four DNS providers. Blockaid flagged nine as serving Step Drainer, while three projects confirmed their sites were redirected. Name.com was the registrar for 12 DeFi domains connected to Friday’s redirect incident, while Blockaid flagged nine of the sites as serving Step Drainer. Each record showed a change dated Oct. 31. The domains used four DNS providers: Vercel for six, Cloudflare for two, NS1 for three and Name.com for one. Flap, Kintsu and Origami confirmed their websites were redirected. Blockaid identified nine additional sites as serving Step Drainer: stonkfun.xyz, pickle.finance, echelon.market, fluxbeam.xyz, stakepoint.app, supswap.xyz, longbow.cash, shprd.finance and apexdefi.xyz. Name.com said Saturday that domains it manages were redirected late Friday as part of a plan to access visitors’ crypto wallets. The company said it restored the domains and was investigating, but did not explain how the changes were made or identify the affected domains. The registry findings add domain details to [TokenPost’s earlier coverage of Name.com’s response to the redirects](). The projects and companies described possible causes differently. Kintsu said the incident involved something on Vercel’s end, while Origami attributed the redirects to an attack involving Vercel-associated name servers. Vercel said Name.com was investigating a takeover campaign targeting crypto companies, with Vercel assisting. Kintsu characterized its incident as a front-end takeover rather than a contract exploit. Origami said its smart contracts and vault funds were unaffected and paused its vaults. It told people who connected a wallet or signed on its site after 8 p.m. ET Friday, Oct. 30 (00:00 UTC Oct. 31) to revoke unfamiliar approvals. ## Links in this article - [TokenPost’s earlier coverage of Name.com’s response to the redirects](https://www.tokenpost.com/news/technology/45601)