A Halloween attack has targeted at least 12 DeFi websites. Blockchain security firm Blockaid identified the Step Drainer toolkit on the affected pages and warned users not to connect their wallets or sign transactions.
Summary
- Blockaid identified Flap, Kintsu, and 10 other websites in alerts about the frontend attack.
- Flap confirmed that attackers had hijacked its DNS and redirected its official domain to an unauthorized website.
- StonkFun restored its website after moving to new infrastructure and said it was not aware of any affected users.
- The alerts identified compromised websites, but the number of victims and total financial losses remain unknown.
Blockaid initially warned about a possible frontend attack targeting Flap and Kintsu on October 31. In a later alert, the security firm identified 10 additional domains that were actively serving the Step Drainer toolkit.
The affected projects began warning users as the incident developed. Flap confirmed that visitors to its official website were being redirected to an unauthorized destination. StonkFun later said it had restored its website after taking it offline and moving to new infrastructure.
Blockaid identifies Step Drainer on 12 DeFi websites
In its initial warning, Blockaid advised users to avoid interacting with Flap and Kintsu until the issue was resolved. Its expanded list included StonkFun, Pickle Finance, Echelon, Origami Finance, and FluxBeam.
The other affected projects were StakePoint, SupSwap, Longbow, Shprd Finance, and APEX. Together with Flap and Kintsu, the list covered 12 websites.
Blockaid said the additional websites were serving the same drainer toolkit and confirmed that its investigation was ongoing. However, it did not identify a confirmed attacker, provide a victim count, or disclose total losses.
An earlier warning shared by security researcher Ogle described an injected script that redirected visitors to a malicious wallet-draining page when they clicked the wallet connection button. The researcher advised users to avoid connecting their wallets to the affected websites.
Some copies of that earlier warning also included stonkbrokers[.]cash. However, the lists shared in different security alerts were not identical.
Flap confirms DNS hijacking of its official website
Flap confirmed that its official website had been affected by a DNS hijacking attack. The team said visitors were being redirected to an unauthorized website and warned users not to visit the site, connect wallets, or sign transactions until further notice.
Flap said it was working to restore the website and would announce when it was safe to use again. It also asked users to follow updates through its official social media accounts.
DNS records connect a website’s domain name to the servers hosting it. In this case, Flap said its official domain was directing visitors to an unauthorized destination.
This meant users could be exposed to the malicious website simply by visiting the project’s familiar web address. They did not need to click a suspicious link or visit a misspelled domain.
Flap did not identify which provider was responsible for the compromised DNS records or explain how the attackers gained access.
StonkFun restores its website after moving infrastructure
StonkFun confirmed that its website had been affected by the domain attack identified by Blockaid. Its initial warning told users to stay away from the website and avoid connecting their wallets while the team worked to fix the problem.
The project said the incident affected its website, while its on-chain operations continued normally. It also said it was not aware of any users being affected.
In a later update, StonkFun announced that it had taken the website offline and moved it to new infrastructure. The website was then restored, but the team advised users to wait another hour before connecting their wallets because some networks could take time to recognize the changes.
StonkFun repeated that its on-chain operations were working normally and that it had no reports of affected users. The team did not provide a financial loss estimate or announce any compensation plans.
Previous DNS attacks have forced DeFi projects to change domains
Similar website attacks have previously forced DeFi projects to change how users access their platforms.
In May 2025, Curve Finance moved to a new domain after attackers redirected its original website to a fake version designed to drain users’ wallets.
Curve worked with security partners and its domain registrar to respond to the incident. The team said delays in the registrar’s response contributed to its decision to abandon the original domain.
The registrar later froze Curve.fi, disabling the malicious website. Curve then announced plans to introduce an Ethereum Name Service address as another way for users to access the platform.