Origami Finance said Saturday that DNS for origami[.]finance had been restored following a website hijack, but its vaults remained paused pending root-cause analysis from Vercel and Name.com. It warned users not to visit the site.

The DeFi vault protocol said in an earlier notice that its smart contracts and funds held in vaults were unaffected, and that only the website had been redirected. It described the pause as a precaution.

The restriction reaches beyond the website: an Etherscan contract readout for Origami’s hOHM vault showed both deposit and withdrawal pause controls enabled. Its published vault code blocks entries and redemptions when those controls are switched on.

DefiLlama’s Oct. 31 snapshot put Origami’s total value locked at about $51.3 million across the protocol.

Origami said it was awaiting the analysis “to make sure the attack vector has been removed,” adding: “do not access origami[.]finance in the meantime.”

Loading post from X…

View post on X

Wider Frontend Attack

Security firm Blockaid included Origami in a wider series of frontend alerts covering 12 websites. It first warned of potential attacks on Flap and Kintsu, then listed 10 more sites, including Origami, that it said were serving Step Drainer. Blockaid said it was still investigating.

Origami urged users who connected a wallet or signed a transaction or message on the site since 8 p.m. ET on Oct. 30 to revoke unfamiliar token approvals. It advised moving funds to a fresh wallet if anything unusual had been signed.

The team said it would announce on X when the frontend was safe to use again.