Tonga controls the "to" top-level domain, so they may add NS records for anything under that TLD — there's nothing stolen about it. It's not uncommon; the same

Tonga controls the "to" top-level domain, so they may add NS records for anything under that TLD — there's nothing stolen about it. It's not uncommon; the same happens with .ac, .ai, .cm, .dk, .gg, .io, .je, .pn, .sh...