about a dozen defi sites got hijacked friday night, all registered with the same registrar, name dot com. you typed the right address and landed on a fake page built to drain your wallet. the block traced ~$138k stolen on evm chains, bitquery counts ~$202k across 6 networks. the smart contracts were fine, none got touched. what changed was the address book. a domain is basically rented, and whoever controls that registration decides where the name sends you. someone got control, pointed the sites to pages running a drainer kit you can literally rent online, and waited. every theft still needed the victim to sign. one kintsu staker alone lost ~$160k, per bitquery. blockaid flagged 12 sites, name dot com says 15 customer domains were hit and all are restored. whose fault it was is still open: name dot com points at "third parties", kintsu points at vercel. no confirmed root cause yet. the lesson for me isn't "defi is broken". it's that "i checked the url" isn't enough anymore. bookmark the apps you use, and read what you're signing like it matters, because that's the exact moment the money moves. small hack in dollars, big one in what it teaches...