When a valuable domain is stolen, the story people expect is a technical one. The real story is usually duller. Someone gained access to the registrar account, changed the contact email, and moved the name to another registrar before the owner noticed.
Each step is ordinary. Together they can move an asset worth more than the company's office lease in an afternoon.
How it usually happens
- A password reused from another breach, on a registrar account with no second factor.
- A recovery email at a domain that has itself expired, so anyone can register it and receive the reset.
- A phone-based reset, after the number is moved to a new SIM by someone posing as the owner.
- A former employee or contractor whose access was never removed.
The weakest point of a registrar account is usually its recovery process, not its password.
The controls that matter
Use app-based or hardware second factors rather than text messages. Make sure the recovery address sits on a domain you control and renew, and is not the domain the account is protecting. Turn on every transfer lock the registrar offers, and the registry lock for the names that matter most.
Then make sure someone would notice. Changes to contacts, nameservers and lock status should alert a person who does not share the account's login, so a single compromised inbox cannot both make the change and hide it.
If it happens
Speed matters more than anything else. Contact the registrar that held the name and the one it moved to, ask for the transfer to be reversed, and keep every email and log you have. A name recovered within days is a support ticket. A name that has moved several times is a legal matter.
