A coordinated website hijacking campaign redirected visitors from at least 12 decentralized-finance front ends toward wallet-draining infrastructure during October 30 and 31. Blockchain security firm Blockaid first warned about Flap and Kintsu, then identified ten additional sites that it said were actively serving Step Drainer. Flap separately confirmed that its official domain was affected by DNS hijacking and redirected users to an unauthorized website. The incident shows how attackers can target the web layer used to reach DeFi applications even when the underlying smart contracts are not shown to be compromised.

Twelve front ends were identified

Blockaid's expanded alert named StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance and APEX in addition to Flap and Kintsu. The affected projects span Ethereum-compatible networks, Solana, Aptos and Monad. The shared campaign label does not establish that every project was entered through the same account or technical path. It means the security firm detected the same wallet-draining toolkit on the listed sites during the same incident window.

Related reporting: Electrum 4.8.3 Fixes Bitcoin Fee-Bump Theft Flaw

The attack targeted trust in familiar domains

DNS and domain-registration systems tell browsers where a familiar web address should lead. If those records or related controls are changed without authorization, a user can type the correct domain and still reach attacker-controlled content. Blockaid said the compromised pages used Step Drainer, a toolkit designed to persuade visitors to approve token transfers or sign permissions that can be used to remove assets. That is different from an attacker directly altering a protocol's onchain contracts, and several affected teams said their contracts remained operational.

A common registrar is a lead, not a conclusion

The Block reported that public registration records listed Name.com as the registrar for all 12 domains. The sites did not all use the same DNS provider: some relied on Cloudflare, some on Vercel and others on Name.com's nameservers. Kintsu and Origami Finance pointed publicly to Vercel-associated infrastructure, while Flap said it was investigating whether its domain-service provider was involved. Neither Vercel nor Name.com had published a root-cause report in the material reviewed. The shared registrar therefore warrants investigation but does not by itself prove that Name.com's systems were breached.

The loss estimate is incomplete

The Block said it traced about $138,000 to three wallets on Ethereum-compatible networks, with proceeds split in repeated percentages. That figure is an independent onchain estimate rather than a final victim tally. It excludes any losses on Solana or Aptos and may not capture funds that took a different route. No affected project had published an aggregate victim count when the report appeared. FluxBeam and StonkFun said they were not aware of affected users, while other teams focused on warning users and restoring access.

Domains were suspended and services restored cautiously

Ten of the identified domains received a client-hold status on Saturday morning, according to The Block, preventing them from resolving normally while the incident was contained. Flap later said its original domain and an alternative address were back online. Kintsu also reported that its site again pointed to normal infrastructure, but warned that cached DNS responses could continue sending some visitors to the malicious destination for a period. Restoration announcements reduce immediate exposure; they do not establish the initial entry point or close the investigation.

What remains unresolved

Affected teams advised users not to connect wallets or sign transactions until their individual services were declared safe. Kintsu also told users who interacted during the incident window to revoke relevant approvals and move assets. Those precautions respond to possible malicious permissions; they do not reverse completed transfers. The next useful evidence would be a provider-level incident report, a verified list of affected records, project-by-project victim disclosures and a reconciled cross-chain loss total. Until then, the public record supports a coordinated front-end campaign, not a confirmed compromise of every named protocol or a proven breach at one infrastructure company.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.