Is Vercel Domains Safe? Registrar-Level DNS Hijacking Analysis

The October 2026 DNS hijacking campaign compromised 15 domains registered through Name.com, with 10 of those domains hosted on Vercel. Attackers altered nameserver records at the registrar level to redirect visitors to wallet-draining sites, resulting in estimated losses between $138,000 and $202,000 from 32 wallets. Vercel Domains itself experienced no direct platform compromise.

Is Vercel Domains Safe After the Name.com Incident

Name.com confirmed that unauthorized changes to nameserver and DNS records occurred on the affected accounts. The domains belonged to DeFi projects including Flap, Kintsu, Pickle Finance, Origami Finance, Echelon, and StonkFun. Changes routed traffic away from legitimate project sites to attacker-controlled infrastructure serving the Step Drainer toolkit. Smart contracts of the projects remained untouched; only the front-end domains were altered.

Vercel stated that the 10 linked domains were restored once Name.com corrected the records. The attack exploited control at the registrar rather than any vulnerability in Vercel’s hosting or DNS service. Projects that had previously moved nameservers to Vercel or Cloudflare still faced redirects when the registrar-level records were overridden.

Both companies issued statements on October 31. Name.com reported that it restored all domains, advised customers to enable two-factor authentication, and began an internal investigation. Vercel confirmed its involvement in the recovery effort and noted that no broader breach of its systems had been identified. Investigations by the companies and independent researchers continued into early November with no final root-cause report released by November 1.

Security Measures and Practical Steps for Domain Owners

Domain owners can reduce registrar-level risks by enabling two-factor authentication on registrar accounts and monitoring DNS record changes through alerts. Regular checks of nameserver settings and WHOIS data help detect unauthorized modifications quickly. Diversifying DNS providers across multiple services limits single-point exposure.

Users of Vercel Domains should review their current nameserver configuration and confirm that any secondary DNS providers are also secured. Projects that rely on at-cost registration through the Vercel and Name.com partnership should treat registrar credentials with the same protection standards applied to wallet keys. On-chain monitoring tools can flag unexpected domain activity even before traffic is redirected.

The incident underscores that registrar-level access remains a high-impact vector regardless of the hosting platform. Affected projects reported that some attacker infrastructure, including certain IP addresses and certificates, remained active after domain restoration. Continued monitoring of certificate transparency logs and DNS history provides an additional layer of visibility.

• Enable 2FA on all registrar and DNS accounts.
• Set up change notifications for nameserver and record modifications.
• Maintain DNS records with at least two independent providers where possible.
• Review domain history weekly during high-risk periods.