Blockaid Flags 12 DeFi Sites Serving Step Drainer in Coordinated DNS Hijack

Security firm Blockaid said on October 31 that twelve decentralized-finance websites were serving a wallet-draining script after a coordinated domain hijack, and that none of the affected protocols had their smart contracts touched. The attacker operated entirely in the Web2 layer: taking over domain records, pointing them at a malicious server, and planting a drainer behind interfaces that looked identical to the real thing.

Blockaid’s first alert , posted at 02:54 UTC, named two projects: the token launchpad Flap and the Monad staking protocol Kintsu. “Our system has detected a potential frontend attack targeting @flapdotsh and @Kintsu,” the firm wrote, telling users to “refrain from signing transactions and avoid interactions with these dApps until the issue is resolved.” Twenty-two minutes later the picture had grown to a dozen sites.

In addition to our earlier alert, the same attack has now been identified on additional sites. These are actively serving the Step Drainer: stonkfun[.]xyz, pickle[.]finance, echelon[.]market, origami[.]finance, fluxbeam[.]xyz, stakepoint[.]app, supswap[.]xyz, longbow[.]cash, shprd[.]finance, apexdefi[.]xyz. We're actively investigating and gathering more data.

— Blockaid (@blockaid_) October 31, 2026

The twelve domains Blockaid named

The second alert, posted at 03:16 UTC, listed ten additional domains it said were “actively serving the Step Drainer.” Added to the original two, the full set spans launchpads, a lending market, yield protocols and a prediction-style trading app: StonkFun (stonkfun.xyz), Pickle Finance (pickle.finance), Echelon (echelon.market), Origami Finance (origami.finance), FluxBeam (fluxbeam.xyz), StakePoint (stakepoint.app), SupSwap (supswap.xyz), Longbow (longbow.cash), Shprd Finance (shprd.finance) and APEX (apexdefi.xyz).

Step Drainer is a wallet-draining toolkit that works like a paid product. Once it loads on a compromised page, it prompts a visitor to connect a wallet and sign what appears to be a routine transaction. The signature is instead an approval or transfer that moves the victim’s assets to an address controlled by the attacker. Blockaid closed the alert by saying “We’re actively investigating and gathering more data,” a signal that the final victim count and any losses were still unknown.

How a DNS hijack turns a real frontend into a trap

A DNS hijack attacks the part of a crypto project that has nothing to do with a blockchain. Every protocol still depends on a domain name to reach its users, and the domain is managed by a registrar and served by a hosting provider. When an attacker gains control of those DNS records, the familiar URL resolves to an attacker-controlled server instead of the project’s own. The user sees the correct address in the browser bar and a valid padlock, so nothing looks wrong.

Blockaid has documented this chain before. In a threat report on an earlier campaign, the firm described the four steps an attacker takes: social-engineering domain registrar support staff into handing over account access, redirecting DNS records, issuing fresh SSL certificates to keep the padlock valid, and finally deploying a fake frontend that looks identical to the real site. “The malicious actors never exploited a smart contract or manipulated onchain infrastructure,” Blockaid wrote. The same logic applies to the October 31 campaign: the protocols’ on-chain assets and treasuries stayed untouched because the attack never reached the chain.

The registrar is the weak link, not the code

The compromise pattern points at a shared Web2 dependency rather than any single project’s security. A well-known on-chain figure, banteg, noted in reply to Blockaid’s alert that “all these domains share a name[.]com registrar.” That observation matches the mechanism in Blockaid’s earlier research, where every incident in a February 2026 wave began with an attacker convincing registrar support staff to transfer a domain account.

That February campaign is a useful measuring stick. Between February 16 and February 23, Blockaid caught five compromised protocols: OpenEden, Curvance, Smithii, Avantis and Nerochain, all injected with the AngelFerno drainer over a seven-day window. The October 31 event compressed a larger list, twelve domains, into a single morning, with the gap between the two alerts just twenty-two minutes. The step up, from five protocols over a week to twelve sites flagged in under half an hour, shows the attack moving faster and wider while using the same entry point: the registrar, not a smart contract.

That is the uncomfortable detail for users. A wallet-drainer warning tied to a malicious smart contract is comparatively easy to spot and block. A drainer served from a project’s own real domain is invisible until a security firm like Blockaid flags it, because the user has done nothing wrong except trust the URL they always used.

Step Drainer sits in a small but crowded market of drainer-as-a-service tools. Blockaid’s earlier research profiled AngelFerno, one of the largest, which sells chain-specific variants rather than a single script: AngelFerno EVM for Ethereum and EVM chains, SolFerno for Solana, TronFerno for Tron, XRPFerno for the XRP Ledger and SeedFerno for cross-chain seed-phrase theft. SeedFerno alone claimed more than 5,000 stolen seed phrases in its first week after a January 2026 update. The October 31 campaign used Step Drainer across a dozen EVM-facing sites, which shows the same playbook being rented out and aimed at whichever project has the weakest registrar account. The smart contract is never the target; the login to a domain dashboard is.

The escalation is measurable. The February 2026 wave worked out to roughly five protocols flagged over seven days, under one site per day. The October 31 event flagged twelve domains in a single morning, with the second alert landing twenty-two minutes after the first. That is an order-of-magnitude faster pace through the identical entry point, a pattern that matters less for what it says about any one project and more for what it says about how cheaply the Web2 plumbing of DeFi can be turned against its users.

What users should do now

Flap confirmed the hijack and said its founder, Cedric, reported that users who had connected to the legitimate site before the incident were unaffected. The risk fell on people who visited the compromised page and connected a wallet or signed an approval in the tens of minutes before the alert went out. Kintsu told users who connected a wallet or signed anything after roughly 00:00 UTC on October 31 to revoke approvals and move funds. StonkFun said everything on-chain was operating normally, took its site offline, restored it on new infrastructure, and asked users to wait before reconnecting while DNS changes propagated.

The practical checklist is short: treat any recent connection to one of the twelve domains as potentially exposed, revoke token approvals on those dApps, and do not reconnect until each project announces its site is safe. This is the same front-end risk class the industry has seen before, from the Velodrome and Aerodrome front-end breach to the wider pattern Blockaid now attributes to infrastructure failures, which its own monitoring data says drive 74% of crypto losses.

What the incident does not mean is that DeFi’s smart contracts failed. No drain was executed on-chain by exploiting a protocol; the exploit lived in the domain layer that sits between a user and the chain. The unresolved questions are who ran the campaign and how many users signed during the window. Blockaid’s investigation is still open, and the firm’s next alert will determine whether the twelve-domain list grows or whether the attacker moved on.