How to Spot a Fake Crypto Website: DNS Hijacks, Wallet Drainers and the Approval Check
When the right address leads to the wrong site
Late on Friday, October 30, 2026, attackers redirected the real domains of at least 12 DeFi sites registered via Name.com to wallet-draining copies, according to Blockaid. Name.com confirmed on X on October 31 that some domains were improperly redirected late Friday as part of a plan to access visitors' crypto wallets, putting the affected total at 15. Vercel said 10 impacted domains were tied to its platform. Affected sites included Flap, Kintsu, Pickle Finance and Origami Finance. Smart contracts were untouched — only the websites were redirected.
Estimates of the losses differed: The Block put about $138,000 in attacker wallets, while Bitquery put about $202,000 from 32 wallets. Neither tally counted Solana or Aptos. DNS is the internet's address book, and it can be changed so that the correct name leads to a fake site.
The one check that still works: read the approval
The main warning sign was what the wallet asked the visitor to approve. Kintsu said the attack used a wallet delegation signature letting another contract act on your behalf, and cancelling approvals does not undo it — affected users were told to move funds to a new wallet.
Before approving, check: what token and how much, whether the approval is unlimited or capped, and whether the requesting contract is the one you expect. An unlimited approval to an unknown contract, or an unintended delegation or permit signature, means stop, close the tab, and check official channels.
If you used affected sites on the evening of October 30 to the morning of October 31 Eastern, or before the all-clear, follow that project's instructions. If you signed anything suspicious, move funds to a new wallet with a new recovery phrase.
The other scams running alongside it
Binance co-founder Yi He warned on November 1 that fake reward campaigns and phishing were circulating. Community rewards need regulatory approval and are live only after review, expected when offices reopen on November 2, and no cash voucher campaign is currently running. Eowyn Chen warned there is no compensation for a withdrawal suspension after fake $150 screenshots circulated.
Phishing emails claiming you must upgrade to a smart wallet ask for your 12-word phrase — no upgrade, migration or verification ever requires the phrase. Seed phrases for a found wallet left in comments are another trap: a visible balance is often a fake token, and gas sent to unlock it is swept instantly.
Three rules: never import a seed phrase you did not generate, never type an existing seed phrase into any website, and never send gas to unlock or activate a found wallet.
A routine for every crypto site visit
Bookmark real sites and open them from bookmarks, not from search results or message links. Check official X and Discord channels for the all-clear after incidents. Treat a changed-looking site or an unexpected approval as compromised until proven otherwise.
Keep most funds in a rarely-connected wallet, with a separate hot wallet holding small amounts for new sites. Review and revoke approvals regularly, but remember revocation does not undo delegation signatures — a suspicious signature means moving funds. Never trust anyone messaging you to recover funds.
Frequently asked questions
What happened in the Name.com DNS hijack? Attackers redirected real DeFi domains to wallet-draining copies late on October 30, 2026. Name.com put the affected total at 15 domains.
How much was taken? About $138,000 by the Blockaid and The Block trace, versus about $202,000 from 32 wallets by Bitquery, excluding Solana and Aptos.
What is a delegation signature and why is it dangerous? It lets another contract act for you. Revoking approvals does not undo it, so affected users should move funds to a new wallet.
Does any legitimate service need my recovery phrase? No.
What if I connected to an affected site? Follow the project's instructions. If you signed something suspicious, move funds to a new wallet with a new recovery phrase, and ignore recovery offers.
Read more on Zimbuck: https://zimbuck.com/pages/zimbucknews and join the discussion at htt
