Blockaid Finds 12 DeFi Sites Hijacked to Serve Step Drainer

Security firm Blockaid detected 12 decentralized-finance websites serving Step Drainer after attackers took control of their domain records on Oct. 31, 2026. The affected protocols’ smart contracts and on-chain infrastructure were not compromised.

The sites were Flap, Kintsu, StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance and APEX. They provide token launches, staking, lending, yield products and prediction-style trading.

Blockaid’s first alert came at 02:54 UTC and named Flap and Kintsu. The firm told users to avoid the decentralized applications and not sign transactions. At 03:16 UTC, it listed 10 more domains that were actively serving Step Drainer.

The malicious code appeared on websites that looked like the legitimate platforms. Visitors were asked to connect a crypto wallet and approve what appeared to be a routine transaction. The signature could instead approve a token transfer to an address controlled by the attacker. A similar approval-based scam was reported in the Polyarb wallet-drainer case, where apparently routine interactions concealed permissions to transfer users’ assets.

The attack targeted the Web2 infrastructure used to access the protocols. After gaining control of domain records at a registrar, the attackers redirected the domains to a malicious server. They could also issue new SSL certificates, allowing the sites to display a valid browser padlock while showing a fake interface.

Blockaid reported that the attackers did not exploit smart contracts or alter blockchain infrastructure. The firm was investigating the incident and had not disclosed how many users were affected or whether assets had been stolen.

On-chain figure banteg noted in a reply to Blockaid’s alert that the domains shared Name.com as their registrar. The observation identified a common domain-management provider among the affected sites.

Flap confirmed the hijacking and reported that users who had connected to its legitimate website before the incident were unaffected. Kintsu urged users who connected a wallet or signed a transaction after about 00:00 UTC on Oct. 31 to revoke token approvals and move their funds. StonkFun reported that its on-chain operations were normal, took its website offline and restored it on new infrastructure while DNS changes propagated.

Users who recently connected a wallet to any of the 12 domains should revoke token approvals associated with those applications and avoid reconnecting until the relevant project confirms that its website is safe. The incident involved the websites used to access the protocols, rather than a breach of their smart contracts.

Blockaid documented a similar registrar-based campaign in February 2026. Five protocols-OpenEden, Curvance, Smithii, Avantis and Nerochain-were compromised over seven days and served AngelFerno, another wallet-draining tool. The Oct. 31 campaign involved 12 domains in one morning and used Step Drainer, a service that provides scripts for stealing assets through fraudulent wallet approvals.