Daily Cyber Threat Brief — November 1, 2026: Name.com DNS hijack turns 12 DeFi sites into wallet drainers

Two questions remain open, and both matter for the remediation advice. First, the entry point is contested: Kintsu said the incident happened on Vercel's end and was out of its control, while Vercel disclosed a breach of internal systems in April traced to a compromised third party, and a December 2025 Name.com press release named Vercel as its registrar partner for a rebuilt domain service. Investigators have not confirmed which company's account or system the attackers compromised. Second, the loss figures disagree and are both partial: The Block traced about $138,000 on EVM chains, while Bitquery counted about $202,000 taken from 32 wallets — neither includes Solana or Aptos, and no affected project has reported a victim count. What is established: the smart contracts were not breached, the domains are restored, and anyone who connected a wallet or signed a transaction on an affected site during the window should revoke unfamiliar token approvals. The incident is a reminder that a correct URL is not, by itself, proof of a genuine site when the registrar layer is the thing that moved.

Northflank has disclosed no root cause, no attacker, and no count of affected customers, and it has not said whether bring-your-own-cloud customers are affected or whether attackers copied every environment variable or touched application data. The rotation advice itself is the durable part: revoke the old credential with the issuing provider first, then generate a replacement — changing a value only inside Northflank leaves the stolen key working. Wiz counts at least nine AI developer platform incidents in October, including Railway, OpenCode, Warp, and Lightning AI, with stolen keys tested within about 30 minutes and later resold; in two cases Wiz examined, stolen credentials ran roughly 2.5 million Amazon Bedrock calls worth about $100,000. The pattern is now a class of incident, not a one-off: any platform that stores environment variables is a credential vault, and its disclosure should be treated as a full rotation event.

Read the 60,471 figure precisely: it counts blocked attack attempts, not confirmed site compromises, and the number of individual sites targeted cannot be derived from it. The signal is still meaningful — mass exploitation tooling moved within days of the patch — and it sets the priority for any WordPress operator still on a pre-7.1.4 release: update, then check for unexpected administrator accounts, unfamiliar files in the uploads and plugin directories, and scheduled tasks created around the upgrade window. The race-condition detail also matters for defenders running web application firewalls: the vulnerable moment is the upgrade itself, so the window of exposure is tied to update activity rather than to steady-state traffic.

The operational consequence is prioritization at machine speed. An infostealer that can score its own haul will surface high-value victims — crypto wallets, privileged credentials, corporate VPN access — faster than a manual review queue, which compresses the time between initial infection and targeted follow-on action. For defenders, the detection angle is the outbound pattern: structured data bundles sent to public AI model endpoints from endpoints that have no business reason to call them. Blocking or alerting on unsanctioned AI API traffic from user workstations is a control that did not exist as a priority a year ago and now belongs in the standard endpoint policy set.

Treat the headline as a claim count, not a breach count. A leak-site listing is not a confirmed breach, and trackers disagree by double digits because they measure different things: HackerFeeds counts leak-site claims, Bitdefender counts claimed victims through its own telemetry, and RansomNews reports a smaller series it labels confirmed attacks. The concentration is the more reliable signal — three groups producing nearly two-fifths of listings — and it matches the month's other theme: extortion infrastructure scaling faster than victim defenses. For prioritization, the names matter less than the access pattern behind them; initial-access brokers and exposed edge devices remain the common thread across the top crews' victim sets.