Hackers seized 12 DeFi websites late Friday and used the websites to drain visitors' crypto wallets. Public registry records show that every identified domain was registered through Name.com. About $138,000 in stolen cryptocurrency has been traced to three wallets on EVM chains, excluding any losses on Solana or Aptos. Blockaid said the compromised websites used Step Drainer malware to deceive visitors into authorizing transfers. Kintsu and Origami Finance blamed Vercel, but the source of the compromise remains unresolved. No affected project has disclosed a victim count.