Hijacked DeFi domains: Vercel confirms restoration of ten domains associated with its platform

Ten domains within Vercel’s stated scope

Vercel confirms that ten domains associated with its platform were affected by a takeover campaign targeting decentralized-finance companies. In its October 31 security bulletin, the company says its registration partner Name.com restored them. It adds that it is in contact with affected customers and is assisting the investigation. This official update, reviewed on November 1, provides direct confirmation for a specific group of domains, rather than a complete description of every incident reported around the campaign.

The number ten therefore needs to retain its attribution. It refers to domains Vercel says it knows about that were associated with its services; the bulletin does not present it as the total number of victims, affected crypto sites or affected accounts at its partner. The document also provides no figure for cryptocurrency losses. This reporting does not add a financial or human impact assessment absent from that technical confirmation.

A website’s address is a technical dependency

Several mechanisms connect a website’s name with the server displaying its content. In particular, the Domain Name System translates a readable name into an address a browser can use to reach a resource, as Cloudflare’s technical documentation explains. Registering a domain and operating its website are therefore distinct layers. For a crypto application, this access infrastructure remains important even when some operations run on a blockchain: the browser first needs to reach the interface with which the user interacts.

However, a domain takeover does not automatically establish that a protocol’s contracts have been modified, its blockchain compromised or an entire hosting service is vulnerable. Likewise, not every redirection problem necessarily involves DNS cache poisoning. That mechanism can send users to an incorrect address, but describing it does not prove it explains this campaign. Vercel’s bulletin does not detail a definitive technical cause that would resolve that question.

Restoration and investigation are separate developments

Vercel states in its notice that no customer action is required as part of this restoration. That instruction must remain tied to the bulletin’s context: it is not an individualized assessment of operations a wallet user might have signed on a hijacked website. The document supplies neither a list of transactions to cancel nor confirmation of reimbursement. It therefore does not equate returning a domain to its expected destination with recovering any funds that may already have been transferred.

Updates from Name.com and the investigation’s conclusions remain the developments to follow. The bulletin links to the partner’s official thread, but its content could not be directly reviewed during this check; no additional statement is therefore attributed to it here. This copy preserves October 31 as the bulletin’s date and separates that confirmation from general explanations of DNS. Before publication, any provider corrections must be checked, without treating an absence of new detail as proof that a cause has been identified.