Hackers took control of 12 DeFi sites on Friday night and used them to drain visitors’ cryptocurrency wallets. Public records show that all the identified domains were registered through Name.com. About $138,000 in stolen cryptocurrency has been traced to three wallets on EVM chains, not including potential losses on Solana or Aptos. Blockaid said the compromised sites used Step Drainer malware to trick visitors into authorizing transfers. Kintsu and Origami Finance blamed Vercel, but the origin of the incident remains unclear. None of the affected projects has disclosed how many victims there were.