Zapper Hack

On 1 April 2025 an attacker took over zapper.fi, the original domain of the DeFi dashboard Zapper. The attacker did not break into Zapper's own systems. According to Zapper, the attacker socially engineered Netim, the registrar for its .fi domain. Zapper warned users on X not to visit or click any link on zapper.fi, said zapper.xyz was the only safe way to reach the site, and said it was working to get the .fi domain back. A report published in July 2026, when Zapper announced it would shut down, said the attackers sent visitors to a phishing site. Neither Zapper nor the news coverage published a figure for user losses.

A DNS or registrar hijack like this works because users trust a familiar domain. Whoever controls the domain record can serve a lookalike app that asks visitors to sign malicious approvals or transactions, even though the protocol's contracts are unchanged.