EN
Español
Português (Brasil)
Türkçe
Tiếng Việt
Bahasa Indonesia
Polski
Čeština
Română
Slovenčina
Magyar31 Oct 2026
Blockaid says 12 DeFi front ends, including Flap, Kintsu and Pickle Finance, served the Step Drainer wallet-draining kit after DNS hijacks. Flap and Kintsu confirmed the hijacks. No losses or attacker have been disclosed yet; users should avoid connecting wallets and review approvals.
A DNS hijack wave has turned at least 12 DeFi websites into wallet drainers. Security firm Blockaid said it found the Step Drainer toolkit served on the front ends of Flap, Kintsu, StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance and APEX, according to a Whale Alert summary of the findings.
What happened
Blockaid first flagged possible front-end attacks on Flap and Kintsu at about 03:54 CET on Saturday, October 31, then identified 10 more sites serving the same wallet-draining kit, as reported by Wu Blockchain around 05:18 CET. Flap and Kintsu both confirmed DNS hijacks, meaning their official domains were redirected to attacker-controlled pages. StonkFun said it restored its site after moving its infrastructure.
No attacker, victim count or total losses had been disclosed at the time of writing. Blockaid’s alert on X said its investigation was ongoing.
Why DNS hijacks are dangerous
In a DNS hijack the smart contracts are usually untouched. The problem is the website: users type the correct address or click a saved bookmark, but land on a cloned interface that asks them to sign malicious approvals. One signature can be enough for a drainer to move tokens out of a wallet. Because DNS changes can stay cached for a while, a site may keep sending some visitors to the malicious page even after the team fixes its records.
What it means for traders
- Do not connect wallets to the affected sites until each team confirms the issue is resolved.
- Review and revoke token approvals if you interacted with any of these front ends on October 30 or 31.
- Read what you sign. Unexpected “approve” or “permit” requests on a familiar site are a red flag.
- Keep trading funds separate. A dedicated hot wallet with limited balances reduces the damage from any single bad signature.
The attack lands in a tense week for crypto security after the Binance hack and the Chainalysis breach. If you are choosing where to keep trading balances, our exchange comparison ranks BingX first and OKX second, and explains how we test exchanges, including security.
This article is for information only and is not financial advice.
Follow TradeReviewed on X and our Telegram channel: you hear crypto and trading news here first.
Related reviews
Sources
- Whale Alert: Blockaid flags Step Drainer toolkit in DNS hijack affecting 12 DeFi websites
- Wu Blockchain on X: Blockaid: 12 Crypto Project Websites Linked to Frontend Attacks
- Blockaid on X: Blockaid alert
News is for information only and is not financial advice. More crypto news
You'll hear it here first
Get crypto news first on our Telegram channel.