--- title: "Your Domain. Their DNS." description: "A DNS hijacking incident involving Name.com shows why owning a domain and controlling where it leads aren't always the same thing." date: 2026-11-03 author: Erwin Groen tags: - OwnTheDot - Handshake - DNS - Security image: "/media/your-domain-their-dns.png" --- *When the address is correct but the destination isn't.* On 30 and 31 October 2026, visitors to a number of cryptocurrency websites found themselves in a dangerous situation. They could enter the correct domain name and still end up on a website controlled by an attacker. According to domain registrar Name.com, 15 customer domains were improperly redirected. Security firm Blockaid identified 12 decentralised finance websites serving malicious wallet draining software. The affected domains were subsequently restored, but the precise cause of the incident hadn't been publicly established at the time of writing. [DomainGang](https://domaingang.com/domain-crime/name-com-dns-hijacking-at-least-15-domains-redirected-in-crypto-wallet-attack/) reported on the incident, while [The Block](https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251) and [Bitquery](https://bitquery.io/investigations/name-com-dns-hijack) examined the affected sites and financial losses. ## The Right Address. The Wrong Website. Most people assume that entering the correct address means they've reached the correct website. But a domain name and the computer serving its website aren't the same thing. The Domain Name System, or DNS, helps direct your browser to the right destination. If someone can change the relevant settings without permission, visitors may be sent somewhere else, even while the address in their browser looks familiar. That's what makes DNS hijacking so troubling. You don't necessarily need to be tricked into typing a fake address. The directions behind the real address can be changed. In this case, visitors encountered imitation crypto websites designed to persuade them to approve malicious wallet transactions. The underlying blockchain applications and smart contracts weren't necessarily compromised. The attack targeted the route people used to access them. ## The Cost of Trust Initial reporting identified around US$138,000 in stolen funds. Bitquery's later on chain investigation traced US$202,386 taken from 32 wallets across six blockchains. One wallet accounted for approximately US$160,531 of that total. Those are attributed investigative estimates, not a final accounting of every possible loss. Bitquery noted that its figures didn't include potential losses on Solana and Aptos. The most important lesson isn't the final dollar amount. It's that users trusted an address they already knew, and that trust was exploited. ## Who Controls the Directions? The affected sites didn't all use the same DNS provider. Reporting identified different arrangements involving Cloudflare, Vercel, and Name.com's own infrastructure. What the 12 initially identified websites had in common was their registrar, Name.com. That doesn't prove the registrar itself was breached. Some project teams pointed towards Vercel related infrastructure, while Name.com and Vercel were investigating. No verified public explanation had established the precise entry point at the time of writing. Even when a website belongs to you, the path people take to reach it may depend on several other organisations. Domain registration, DNS management, hosting, account access and browser resolution can all matter. A failure or compromise at any one of these points can affect what visitors see. ## Where Handshake Fits Handshake offers a different approach to the ownership of top level names. Rather than relying on a conventional registrar to maintain the authoritative record of who holds a top level name, Handshake records ownership on a decentralised blockchain. The holder controls the name through cryptographic keys and can publish associated resource information. That changes an important part of the trust model. It can reduce reliance on a central registrar for control of the top level name itself. But it doesn't make every Handshake website immune to hijacking. If a private key is compromised, a delegated nameserver is taken over, a resolver behaves incorrectly, or the hosting environment is breached, users can still face serious risks. Decentralised ownership and end to end security aren't the same thing. Handshake's contribution is to offer another way to control the root of a name. Securing everything that comes afterwards still matters. ## Owning the Name Isn't the Whole Story We often talk about domain ownership as though it answers every question about control. This incident shows why that isn't enough. You can register a domain, build a business around it and give customers an address they recognise. Yet the systems that direct visitors to your website may remain dependent on third parties. That doesn't mean conventional DNS has no place, or that decentralised naming solves every security problem. It means we should understand who controls each part of the journey, and which parts we can secure ourselves. The question worth asking isn't simply who holds the name. **It's who can change where that name leads.** Own the Name | Own the Rules | Own The Dot.