Blockaid identified the Step Drainer toolkit on at least 12 DeFi websites, and affected teams warned users not to connect wallets. Flap confirmed a DNS hijack, while StonkFun restored its site. The number of victims and any losses remain unestablished.
Blockaid flagged Flap and Kintsu as targets of a potential frontend attack on Oct. 31. In a follow-up alert, the blockchain security company listed 10 additional domains that it said were actively serving Step Drainer.
The affected teams then issued their own warnings. Flap confirmed that visitors to its official address were being redirected elsewhere, while StonkFun later said it had restored its website.
Blockaid names 12 sites serving Step Drainer
In its initial alert, Blockaid asked users to avoid interactions with Flap and Kintsu until the issue was resolved. Its expanded list named StonkFun, Pickle Finance, Echelon, Origami Finance and FluxBeam, plus StakePoint, SupSwap, Longbow, Shprd Finance and APEX.
Blockaid described the additional sites as serving the same drainer and said its investigation was continuing. However, the alerts did not identify a confirmed attacker, disclose a victim count or provide an aggregate loss figure.
An earlier warning from security researcher Ogle described an injected script that sent visitors who clicked the wallet connection button to a malicious drainer page. Copies of that warning included stonkbrokers[.]cash, so the circulating screenshots did not all contain an identical list.
Flap confirms a DNS hijack
Flap confirmed that its official website had been affected by a DNS hijack. The team said the site was redirecting visitors to an unauthorized destination and asked users not to visit, connect wallets or sign transactions until further notice.
Because the legitimate address itself sent visitors to the unauthorized site, the warning covered people navigating to the project's familiar domain. Flap's notice did not identify the provider responsible for the compromised records or explain how the attacker obtained access.
StonkFun moves to new infrastructure
StonkFun confirmed that the domain attack flagged by Blockaid had affected its website. The project said everything on-chain was operating normally and that it was unaware of anyone affected.
The team then took the website offline and moved it to new infrastructure. Although the site was restored, StonkFun asked users to wait an hour before connecting a wallet, because some networks could take that long to recognize the change.
Similar compromises have forced teams to change how users reach their services in the field of decentralized finance. In May 2025, crypto.news reported that Curve Finance migrated to a new domain after attackers redirected its original website to a wallet-draining clone.
Source: crypto.news
Trading involves risk.
Risk Disclaimer
