Blockaid reported that at least 12 DeFi websites were targeted in a Halloween attack, with the Step Drainer toolkit appearing on affected pages; the team warned users not to connect their wallets or sign transactions.
Blockaid flagged Flap, Kintsu, and 10 other websites in its alert regarding front-end attacks.
- Flap confirms its DNS was compromised, and its official domain was redirected to an unauthorized website.
- StonkFun has restored its website after migrating its infrastructure and stated that it is unclear whether any users were affected.
These alerts list compromised websites, but the number of victims and any associated losses remain unconfirmed.
Blockaid's first alert identified Flap and Kintsu as potential targets of a front-end attack on October 31. In a subsequent alert, the blockchain security firm listed an additional 10 domains, stating that these websites are actively distributing Step Drainer.
As the situation unfolded, the affected teams began issuing their own warnings. Flap confirmed that users accessing its official address were being redirected elsewhere; subsequently, StonkFun stated that its website had been restored after taking it offline and migrating to new infrastructure.
Blockaid reports that 12 DeFi websites are affected by Step Drainer.
In the initial alert, Blockaid advised users not to interact with Flap and Kintsu until the issue is resolved. Its extended list includes StonkFun, Pickle Finance, Echelon, Origami Finance, and FluxBeam.
The remaining projects are StakePoint, SupSwap, Longbow, Shprd Finance, and APEX. Together with Flap and Kintsu, this list covers 12 different websites.
Blockaid stated that the newly added websites are all offering the same drainer, and the investigation is ongoing. The alert did not confirm the identity of the attackers, nor did it disclose the number of victims or the total amount of losses.
Previously, security researcher Ogle issued a warning that a injected script redirects visitors who click the wallet connect button to a malicious drainer page. In his post, he urged users to avoid connecting their wallets to these websites.
The circulated screenshot of the early warning also included stonkbrokers[.]cash. Blockaid’s subsequent public alert first named Flap and Kintsu, then later expanded to an additional 10 domains, meaning the circulated screenshot does not contain the exact same list.
Flap confirms that its official domain will redirect visitors.
Flap has confirmed that its official website was subject to DNS hijacking. The team stated that the website is redirecting visitors to an unauthorized destination and has requested users not to access the site, connect their wallets, or sign transactions until further notice.
When issuing the warning, Flap stated that it is working to restore the website and will provide further notice when it is safe to use. The accompanying Chinese announcement instructed users to rely on information posted by the project’s official social media accounts.
DNS records direct browsers from a domain to the infrastructure hosting the website. According to Flap’s description of the incident, the legitimate address itself was directing visitors to an unauthorized website.
Therefore, this warning targets individuals who directly access the project’s familiar domain without needing to click on misspelled addresses or unsolicited promotional links. Flap’s announcement did not specify which service provider was responsible for the compromised records or explain how the attackers gained access.
StonkFun has restored its website after migrating its infrastructure.
StonkFun has confirmed that its website was targeted by a domain attack flagged by Blockaid. Its initial announcement urged users to avoid the site and not connect their wallets while the team works on recovery.
The project stated that the incident affected only the website, while on-chain functions remain fully operational. The announcement noted that it is currently unknown who, if anyone, has been impacted.
In a subsequent update, StonkFun stated that the website has been taken offline and migrated to new infrastructure. Although the site has been restored, the team still asks users to wait one hour before connecting their wallets, as some networks may require this long to recognize the change.
The recovery announcement again emphasized that on-chain operations are functioning normally and that the team is unaware of any affected users. Neither of StonkFun’s two statements provided an estimate of losses or announced a compensation process.
Previous DNS attacks prompted the project to migrate its domain.
Similar website breaches have previously forced DeFi teams to change how users access their services. In May 2025, crypto.news reported that Curve Finance migrated to a new domain after attackers redirected its original website to a clone site designed to steal wallets.
Curve contacted its security partners and domain registrar during the response process. The team stated that the registrar's delayed response was one of the reasons for their decision to abandon the old domain.
Subsequently, the registrar froze Curve.fi, disabling the malicious drainer. Curve later confirmed that it plans to introduce an Ethereum Name Service address as an alternative access option.