Blockaid indicates that at least 12 DeFi websites were subjected to a Halloween attack, with the Step Drainer toolkit appearing on the affected pages. The team warned users not to connect to their wallets or sign any transactions.
- Blockaid named Flap, Kintsu, and another 10 websites in the alert regarding front-end attacks.
- Flap confirmed that its DNS was hijacked, and the official domain name was redirected to an unauthorized website.
- StonkFun restored the website after migrating the infrastructure and stated that they were not sure whether any users were affected.
These alerts list the websites that have been compromised, but the number of victims and any resulting losses have not yet been determined.
The first alert from Blockaid listed Flap and Kintsu as potential targets for front-end attacks on October 31. In a subsequent alert, this blockchain security company listed another 10 domain names, stating that these websites were actively providing Step Drainer.
As the incident unfolded, the affected teams also began to issue their own warnings. Flap confirmed that users accessing their official website would be redirected to another location; subsequently, StonkFun stated that after taking the website offline and migrating it to new infrastructure, the website had been restored.
Blockaid claims that 12 DeFi websites have Step Drainer
In the initial alert, Blockaid requested that users not interact with Flap and Kintsu until the issue was resolved. The extended list included StonkFun, Pickle Finance, Echelon, Origami Finance, and FluxBeam.
The remaining items are StakePoint, SupSwap, Longbow, Shprd Finance, and APEX. Together with Flap and Kintsu, this list covers a total of 12 different websites.
Blockaid indicates that newly added websites are all providing the same drainer, and it is stated that the investigation is still ongoing. The alert has not confirmed the identity of the attackers, nor has it disclosed the number of victims or summarized the amount of losses.
Previously, security researcher Ogle issued a warning stating that a certain injection script would direct visitors who clicked on the wallet connection button to a malicious drainer page. In his post, he urged users to avoid connecting to these websites' wallets.
The early warning screenshot that circulated also included stonkbrokers [.] cash. The subsequent public alerts first named Flap and Kintsu, and then extended to another 10 domain names, so not all the circulated screenshots contained exactly the same list.
Flap confirms that its official domain name will redirect visitors
Flap It has been confirmed that its official website has been hijacked by DNS. The team stated that the website is redirecting visitors to an unauthorized destination and advised users not to access, connect to their wallets, or sign any transactions until further notice.
When a warning is issued, Flap indicates that efforts are being made to restore the website, and users will be notified again when it is safe to use it again. The accompanying Chinese announcement requires users to refer to the information published on the project's official social media accounts.
DNS records the process of directing browsers from domain names to the infrastructure that hosts websites. According to the description of this incident in Flap, the legitimate address itself is actually sending visitors to unauthorized websites.
Therefore, this warning is aimed at those who directly access the project's familiar domain names, and does not require them to click on misspelled addresses or unsolicited promotional links. The announcement from Flap does not identify the service provider responsible for the compromised records, nor does it explain how the attackers obtained access rights.
StonkFun Restoring the website after migrating the infrastructure
StonkFun It has been confirmed that their website has been attacked by the domain names marked as Blockaid. Their first announcement advised users to stay away from the website and not to connect to their wallets during the team's recovery period.
The project indicates that this incident has affected websites, while all on-chain functions are operating normally. The announcement states that it is currently unknown who has been affected.
In subsequent updates, StonkFun indicates that the website has been taken offline and migrated to new infrastructure. Although the website has since been restored, the team still requests users to wait for one hour before connecting to their wallets, as some networks may take that amount of time to recognize this change.
The recovery announcement reiterates that operations on the chain are running normally, and the team is unaware of any users who may have been affected. Neither of the two statements from StonkFun provides an estimate of losses, nor do they announce a compensation process.
A previous DNS attack prompted the project to migrate its domain name.
Similar website intrusions had previously forced the DeFi team to change the way users accessed their services. In May 2025, crypto.news reported that Curve Finance had migrated to a new domain name after attackers redirected their original website to a clone site that stole wallets.
Curve contacted security partners and domain registrars during the response process. The team stated that the delay in the registrars' response was one of the reasons they decided to abandon the old domain name.
Subsequently, the registrar froze Curve.fi, thereby disabling the malicious drainer. After that, it was confirmed that a Ethereum Name Service address was planned to be introduced as another access option.
