At least 12 cryptocurrency websites were targeted in a coordinated wave of frontend attacks on October 31, with malicious code redirecting users toward wallet-draining pages after attackers c
At least 12 cryptocurrency websites were targeted in a coordinated wave of frontend attacks on October 31, with malicious code redirecting users toward wallet-draining pages after attackers compromised domain infrastructure serving decentralized finance protocols and token launch platforms.
The affected projects include Flap, Kintsu and StonkFun, alongside several DeFi applications. Blockchain security firm Blockaid linked the incidents to StepDrainer, a malicious toolkit designed to steal cryptocurrency through fraudulent wallet connections and transaction approvals.
The attacks targeted website infrastructure rather than the underlying blockchain protocols. No comprehensive loss estimate has been confirmed, and investigators have yet to establish whether the affected domains share a single point of compromise.
Flap, a token launch platform backed by YZi Labs, first warned that its original domain, flap.sh, had been hijacked and was redirecting visitors to an unauthorized website.
The team instructed users to avoid the domain and refrain from connecting wallets or signing transactions while it worked with security partners to contain the incident.
Shortly afterward, Blockaid detected similar activity targeting Kintsu, a Monad-based liquid staking protocol. The company subsequently identified 10 additional websites serving StepDrainer, including stonkfun.xyz, pickle.finance, echelon.market, origami.finance, fluxbeam.xyz, stakepoint.app, supswap.xyz, longbow.cash, shprd.finance and apexdefi.xyz.
The malicious infrastructure exploited the websites’ frontend interfaces, potentially presenting visitors with deceptive transaction requests through otherwise familiar application pages.
Unlike smart contract exploits, DNS hijacking allows attackers to redirect legitimate web addresses toward infrastructure they control. Users can therefore encounter malicious wallet prompts even when navigating to a project’s recognized domain.
StepDrainer can exploit token approvals and malicious signatures to authorize asset transfers without requiring attackers to obtain private keys.
Kintsu confirmed that its domain had been compromised at the registrar level and advised users who connected wallets or signed transactions after 00:00 UTC on October 31 to revoke suspicious token approvals and move potentially exposed assets to secure wallets.
The protocol later restored its domain routing but continued warning against wallet interactions while DNS caches propagated the changes.
Flap subsequently migrated its platform to flap.cool, recommending that users access the new address directly rather than relying on redirects from the compromised domain.
The project said the root cause remained under investigation, including whether the incident originated from its domain service provider. Its team has been coordinating with Blockaid and infrastructure providers Vercel and Name.com.
StonkFun also confirmed that its website was affected, while maintaining that its on-chain operations continued functioning normally. The platform said it was unaware of any affected users at the time of its announcement.
The attacks follow a Polymarket frontend compromise that drained approximately $2.7 million earlier in the week after malicious JavaScript entered the prediction market’s website through a compromised monitoring provider.
Similar vulnerabilities have affected DeFi platforms previously. In May 2025, Curve Finance suffered another DNS hijacking incident, temporarily exposing visitors to a malicious website despite its underlying smart contracts remaining secure.
The latest incidents underscore a persistent security weakness in decentralized applications: blockchain contracts may remain uncompromised while attackers exploit conventional web infrastructure to target users.
Investigators have not confirmed the total financial impact or identified the attackers. Affected users remain advised to avoid compromised domains until their respective teams confirm that access is safe.
The post StepDrainer Hits 12 Crypto Sites in DNS Hijack Wave appeared first on Crypto Adventure.
