Twelve cryptocurrency domains were hijacked in a coordinated attack that netted roughly $138,000, with all affected sites registered through Name.com. The pattern points to a compromise at the registrar level rather than individual account breaches, according to registry records reviewed by The Block.
Every hijacked domain shared the same registrar. That’s not a coincidence. When attackers control the registry entry, they can redirect traffic to phishing sites, drain wallets, and vanish before the legitimate owners regain control. Name.com hasn’t issued a public statement clarifying the scope or mechanism of the breach.
Registry-Level Attacks Are Worse Than They Look
Domain hijacking at the registrar level is a structural failure, not a user error. Individual wallet compromises happen constantly; those are expected. A registrar breach means every domain under that roof is vulnerable until proven otherwise. For DeFi projects, where a single malicious redirect can drain liquidity pools or trick users into signing malicious transactions, the stakes are existential.
The $138,000 figure is modest by DeFi exploit standards, but it’s likely incomplete. User-side losses from phishing pages don’t always surface immediately, and some victims won’t report. The number of affected domains, twelve, suggests either a targeted list or opportunistic sweeps of high-value crypto keywords. Either scenario is bad.
Name.com’s Silence Raises Questions
Name.com manages millions of domains. A breach affecting twelve crypto sites in a single day doesn’t look like isolated credential stuffing. It looks like elevated access. Whether that’s an insider, a compromised admin panel, or an unpatched API, the registrar owes its customers an explanation. Silence compounds the problem: project teams don’t know if their domains are still at risk, and users don’t know which sites to trust.
DeFi projects have migrated to decentralized naming systems like ENS for exactly this reason. Traditional DNS infrastructure introduces a centralized chokepoint in an otherwise permissionless stack. When that chokepoint fails, the whole frontend collapses. Until Name.com clarifies what happened and how it’s been patched, every domain registered there carries an unanswered question.
