Hacks & scams / Phishing / drainer
Developing story. Our agents re-check this case every few hours; the latest update is at the top of "Updates".
30severity
Phishing / draineractiveNot specified (frontend-layer attack; Kintsu is reportedly a Monad-based liquid staking protocol)
DeFi DNS hijack wave (Step Drainer) – 12 sites: DNS hijack hits 12 DeFi sites; Blockaid links it to Step Drainer, no confirmed losses
2026-10-30 · updated 2026-10-31 17:20 UTC · by Sentinel, VaultX incident desk
Reported loss$138,000Approximately $138,000 'traced as stolen so far' per one report, as of Oct 31, 2026. Not independently verified, and the research cites a generic crypto.news index page for it. No comprehensive aggreg
AttributionUnknown. Blockaid reportedly linked the campaign to the 'Step Drainer' toolkit, but no individual or group has been named in the available reports.
Response score60/100Warnings were fast and at least one site was restored on new infrastructure, but there is no published victim count, loss figure, root-cause analysis or compensation plan.
Severity30/10012 sites hit across several projects and a shared drainer toolkit, but no confirmed losses and no reported smart-contract compromise.
On Oct 30–31, 2026, at least 12 DeFi and token-launch websites were reportedly hit by a DNS/frontend hijack that Blockaid says served the Step Drainer toolkit. The toolkit tries to trick visitors into connecting wallets and signing malicious transactions. Reports say the compromise was at the website/DNS layer, not the underlying smart contracts. No aggregate loss, victim count, attacker wallets or fund flows have been published, and it is unclear whether all sites were compromised through the same access path.
Get instant hack alerts
We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.
Updates
2026-10-31 17:20 UTCAs of 2026-10-31 16:05 UTC, Blockaid's count of Step Drainer-affected DeFi sites was 12: Flap, Kintsu, StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance, and APEX/ApeX DeFi. One report said about $138,000 had been traced as stolen so far and that 10 affected domains were suspended at the registrar level on Saturday morning (Oct 31, 2026), without naming the ten or confirming the suspensions were still active. Flap and Kintsu publicly confirmed DNS hijacks, and StonkFun reportedly moved to new infrastructure and briefly went offline.
What happened
According to reports, Blockaid first warned about Flap and Kintsu on October 30, 2026, then expanded the alert on October 31 to 10 more sites, for 12 in total. The named sites are Flap, Kintsu, StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance and APEX.
Flap reportedly said its official website was hit by a DNS hijack, that visitors were being redirected to an unauthorized destination, and told users not to visit the site, connect wallets or sign transactions until further notice. StonkFun / LaunchOnSF reportedly took its site offline, moved to new infrastructure and later said it was back online. Reporting on LaunchOnSF says the attack was limited to the frontend/DNS layer, did not touch smart contracts, and that no user losses were reported.
The available reports do not give a verified total stolen, a victim count or a per-asset theft figure. Investigators reportedly had not established whether the 12 domains shared a single compromise point.
How it worked
According to the reports, attackers compromised DNS or related domain infrastructure, or the frontend delivery path, so that normal-looking project domains loaded attacker-controlled pages or injected scripts. Visitors were then shown fraudulent wallet-connection requests and/or transaction-signing prompts.
If a user approved them, the Step Drainer toolkit could steal assets through wallet permissions or malicious transaction signatures. Because the compromise sat at the web layer, the underlying protocols were reportedly not breached, but anyone using the hijacked domains could be exposed. One project-side comment cited in coverage reportedly said risk was limited to users who visited during a short tampering window and then approved prompts.
Timeline
- 2026-10-30First alerts: Blockaid reportedly warns about Flap and Kintsu serving the Step Drainer toolkit.
- 2026-10-31Blockaid reportedly expands the warning to 12 affected sites in total.
- 2026-10-31Flap reportedly posts that its domain was DNS hijacked and tells users not to visit, connect wallets or sign transactions.
- 2026-10-31StonkFun / LaunchOnSF reportedly restores its website on new infrastructure and says no user losses were reported.
Where the money went
No confirmed on-chain fund movement, mixer or bridge use, exchange deposits, freezes or recoveries are reported in the available sources. No attacker wallet addresses have been published.
The response
Affected teams reportedly warned users not to connect wallets or sign transactions on flagged domains. Flap issued a do-not-use warning. StonkFun / LaunchOnSF took its site offline, moved to new infrastructure and restored it. The available reporting does not confirm paused withdrawals, compensation plans, insurance-fund payouts, or regulator or police involvement.
Market and user impact
No verified losses or victim count. No verified price impact on affected tokens or the wider market was found in the reports. The main impact is on user trust and the risk to anyone who interacted with the affected sites during the compromise window.
What people say
55% negative · 5% positive · the rest neutral · themes: Warnings not to connect wallets or sign, Frontend/DNS risk rather than smart contract risk, Uncertainty over losses and root cause, Reassurance that smart contracts were reportedly untouched
How to protect yourself
- Do not connect wallets or sign transactions on any of the 12 flagged sites until the teams confirm they are safe.
- A legitimate URL is not proof of a safe page: DNS hijacks can serve malicious content on the real domain, so treat unexpected wallet prompts as red flags.
- Read what you sign, use wallet transaction simulation or security tools, and use a separate wallet with limited funds for new or launch sites.
- If you interacted with an affected site during the window, review and revoke token approvals and consider moving funds to a fresh wallet.
- Builders should lock down registrar and DNS accounts (MFA, registry locks), monitor DNS records for changes, and have a rapid frontend takedown and communication plan.
Check a walletScan a tokenStill unknown
- Total amount stolen, if any, and the number of victims
- Whether all 12 sites were compromised through the same initial access path
- Identity of the attackers and any wallet addresses used
- Exact duration of the compromise window for each site
- Whether the other affected projects have restored their sites
- Whether compensation will be offered to any affected users
Related on VaultX
Binance multi-chain hack (TraderTraitor-linked): Binance loses a reported ~$6.3B across…Hack report · Binance disclosed a security incident on Oct. 29, 2026. Reports put the loss at about $6.3B, taken…Polymarket (international platform) third-party script exploit: Polymarket halts…Hack report · On 2026-10-29 Polymarket paused trading on its international platform after users reported drained…Bitcoin Hyper review: High riskReview · Anonymous presale with regulator warning, user reports of vanishing funds, no working mainnetBlazpay review: CautionReview · AI DeFi presale with heavy marketing, no independent audits, anonymous team, and no working…Binance review: CautionReview · Huge, widely used exchange, but regulator actions, withdrawal complaints and a reported hack weigh…Binance hit by reported $6.3B multi-chain theft; TraderTraitor link flaggedNews · Reports put Binance's multi-chain theft at about $6.3B, with ~$3B frozen. TRM Labs links it to…How to track smart money in crypto (and when not to copy it)Guide · Learn how to read crypto smart money data, spot crowded trades, and see when copying top traders…Liquid stakingGlossary · Liquid staking gives you a receipt token for staked coins (for example stETH for ETH) that you can…DeFi (decentralized finance)Glossary · DeFi is financial services such as trading, lending and saving run by smart contracts instead of…Layer 2Glossary · A layer 2 is a network built on top of a blockchain (often Ethereum) that bundles transactions to…
Sources
- crypto.news – DeFi DNS attack hits 12 sites as Step Drainer flagged
- Crypto Briefing – LaunchOnSF restores website after Step Drainer attack
- CryptoAdventure – Step Drainer hits 12 crypto sites in DNS hijack wave
- Coin Alert News – DeFi DNS attack
- Odaily newsflash
- TradingView/Bloomingbit – Signs of attacks found at 12 overseas crypto sites
- X post by banteg
- X post by Brainrot_Labs
- Ground News – StonkFun restores website after domain attack
How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.
Get new hack reports as they happen
New exploit reports, major incidents and security updates from VaultX. Free. You choose below; nothing starts until you opt in.
On Telegram, press Start in the bot to subscribe. New reports are also posted on our alerts channel. Not financial advice. 
VaultX