DeFi DNS attack hits 12 sites with Step Drainer toolkit

A Halloween attack has targeted at least 12 DeFi websites, with Blockaid identifying the Step Drainer toolkit across affected pages and teams warning users against connecting wallets or signing transactions.

Blockaid’s initial warning named Flap and Kintsu as targets of a potential frontend attack on Oct. 31. In a subsequent alert, the blockchain security company listed 10 additional domains that it said were actively serving Step Drainer.

The affected teams began issuing their own warnings as the incident unfolded. Flap confirmed that visitors to its official address were being redirected elsewhere, while StonkFun later reported that it had restored its website after taking it offline and moving to new infrastructure.

Blockaid identifies Step Drainer across 12 DeFi sites

In its initial alert, Blockaid asked users to avoid interactions with Flap and Kintsu until the issue was resolved. Its expanded list named StonkFun, Pickle Finance, Echelon, Origami Finance, and FluxBeam.

The remaining projects were StakePoint, SupSwap, Longbow, Shprd Finance and APEX. Together with Flap and Kintsu, the list covered 12 distinct websites.

Blockaid described the additional sites as serving the same drainer and said its investigation was continuing. The alerts did not identify a confirmed attacker, disclose a victim count, or provide an aggregate loss figure.

An earlier warning circulated by security researcher Ogle described an injected script that sent visitors who clicked the wallet connection button to a malicious drainer page. His post urged users to avoid connecting wallets to the named sites.

Copies of that earlier warning included stonkbrokers[.]cash. Blockaid’s later public alert named Flap and Kintsu before its separate expansion to 10 more domains, so the circulating screenshots did not all contain an identical list.

Flap confirms its official domain redirected visitors

Flap confirmed that its official website had been affected by a DNS hijack. The team said its website was redirecting visitors to an unauthorized destination and asked users not to visit, connect wallets, or sign transactions until further notice.

At the time of the warning, Flap said it was working to restore the website and would announce when it was safe to use again. Its accompanying Chinese-language notice asked users to rely on announcements from the project’s official social accounts.

DNS records direct browsers from a domain name to the infrastructure serving its website. In Flap’s account of the incident, the legitimate address itself was sending visitors to an unauthorized site.

The warning therefore covered people navigating to the project’s familiar domain, without requiring them to follow a misspelled address or an unsolicited promotional link. Flap’s notice did not identify the provider responsible for the compromised records or explain how the attacker obtained access.

StonkFun restores its website after infrastructure move

StonkFun confirmed that its website had been affected by the domain attack flagged by Blockaid. Its first notice asked users to stay away and avoid connecting wallets while the team worked on restoration.

The project said the incident affected its website and that everything on-chain was operating normally. It was unaware of anyone affected, according to the notice.

In a subsequent update, StonkFun said it had taken the website offline and moved it to new infrastructure. Although the site had been restored, the team asked users to wait an hour before connecting a wallet because some networks could take that long to recognize the change.

The restoration notice repeated that on-chain operations were functioning normally and that the team was unaware of affected users. Neither StonkFun statement supplied a loss estimate or announced a compensation process.

Earlier DNS attacks prompted domain migrations

Similar website compromises have previously forced DeFi teams to change how users access their services. In May 2025, crypto.news reported that Curve Finance had migrated to a new domain after attackers redirected its original website to a wallet-draining clone.

Curve engaged security partners and its registrar during the response. The team said delays in the registrar’s response contributed to its decision to abandon the old domain.

The registrar subsequently froze Curve.fi, disabling the malicious drainer. Curve then confirmed plans to introduce an Ethereum Name Service address as another access option.