# DeFi DNS hijack wave (Step Drainer) – 12 sites: DNS hijack hits 12 DeFi sites; Blockaid links it to Step Drainer, no confirmed losses
Source page: https://vaultx.llc/hacks/defi-dns-attack-hits-12-sites · VaultX incident report by Sentinel · first published 2026-10-31, updated 2026-10-31
- Date: 2026-10-30
- Reported loss: $138K (Approximately $138,000 'traced as stolen so far' per one report, as of Oct 31, 2026. Not independently verified, and the research cites a generic crypto.news index page for it. No comprehensive aggreg)
- Attribution: Unknown. Blockaid reportedly linked the campaign to the 'Step Drainer' toolkit, but no individual or group has been named in the available reports.
- Chains: Not specified (frontend-layer attack; Kintsu is reportedly a Monad-based liquid staking protocol)
- Status: developing
- Severity: 30/100
- Response score: 60/100 (Warnings were fast and at least one site was restored on new infrastructure, but there is no published victim count, loss figure, root-cause analysis or compensation plan.)
On Oct 30–31, 2026, at least 12 DeFi and token-launch websites were reportedly hit by a DNS/frontend hijack that Blockaid says served the Step Drainer toolkit. The toolkit tries to trick visitors into connecting wallets and signing malicious transactions. Reports say the compromise was at the website/DNS layer, not the underlying smart contracts. No aggregate loss, victim count, attacker wallets or fund flows have been published, and it is unclear whether all sites were compromised through the same access path.

**What happened**
According to reports, Blockaid first warned about Flap and Kintsu on October 30, 2026, then expanded the alert on October 31 to 10 more sites, for 12 in total. The named sites are Flap, Kintsu, StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance and APEX.
Flap reportedly said its official website was hit by a DNS hijack, that visitors were being redirected to an unauthorized destination, and told users not to visit the site, connect wallets or sign transactions until further notice. StonkFun / LaunchOnSF reportedly took its site offline, moved to new infrastructure and later said it was back online. Reporting on LaunchOnSF says the attack was limited to the frontend/DNS layer, did not touch smart contracts, and that no user losses were reported.
The available reports do not give a verified total stolen, a victim count or a per-asset theft figure. Investigators reportedly had not established whether the 12 domains shared a single compromise point.

**How it worked**
According to the reports, attackers compromised DNS or related domain infrastructure, or the frontend delivery path, so that normal-looking project domains loaded attacker-controlled pages or injected scripts. Visitors were then shown fraudulent wallet-connection requests and/or transaction-signing prompts.
If a user approved them, the Step Drainer toolkit could steal assets through wallet permissions or malicious transaction signatures. Because the compromise sat at the web layer, the underlying protocols were reportedly not breached, but anyone using the hijacked domains could be exposed. One project-side comment cited in coverage reportedly said risk was limited to users who visited during a short tampering window and then approved prompts.

**Where the money went**
No confirmed on-chain fund movement, mixer or bridge use, exchange deposits, freezes or recoveries are reported in the available sources. No attacker wallet addresses have been published.

**The response**
Affected teams reportedly warned users not to connect wallets or sign transactions on flagged domains. Flap issued a do-not-use warning. StonkFun / LaunchOnSF took its site offline, moved to new infrastructure and restored it. The available reporting does not confirm paused withdrawals, compensation plans, insurance-fund payouts, or regulator or police involvement.

**Impact**
No verified losses or victim count. No verified price impact on affected tokens or the wider market was found in the reports. The main impact is on user trust and the risk to anyone who interacted with the affected sites during the compromise window.

**Timeline**
- 2026-10-30 First alerts: Blockaid reportedly warns about Flap and Kintsu serving the Step Drainer toolkit.
- 2026-10-31 Blockaid reportedly expands the warning to 12 affected sites in total.
- 2026-10-31 Flap reportedly posts that its domain was DNS hijacked and tells users not to visit, connect wallets or sign transactions.
- 2026-10-31 StonkFun / LaunchOnSF reportedly restores its website on new infrastructure and says no user losses were reported.

**How to protect yourself**
- Do not connect wallets or sign transactions on any of the 12 flagged sites until the teams confirm they are safe.
- A legitimate URL is not proof of a safe page: DNS hijacks can serve malicious content on the real domain, so treat unexpected wallet prompts as red flags.
- Read what you sign, use wallet transaction simulation or security tools, and use a separate wallet with limited funds for new or launch sites.
- If you interacted with an affected site during the window, review and revoke token approvals and consider moving funds to a fresh wallet.
- Builders should lock down registrar and DNS accounts (MFA, registry locks), monitor DNS records for changes, and have a rapid frontend takedown and communication plan.

**Still unknown**
- Total amount stolen, if any, and the number of victims
- Whether all 12 sites were compromised through the same initial access path
- Identity of the attackers and any wallet addresses used
- Exact duration of the compromise window for each site
- Whether the other affected projects have restored their sites
- Whether compensation will be offered to any affected users

**Sources**
- crypto.news – DeFi DNS attack hits 12 sites as Step Drainer flagged https://crypto.news/defi-dns-attack-12-sites-step-drainer/
- Crypto Briefing – LaunchOnSF restores website after Step Drainer attack https://cryptobriefing.com/launchonsf-restores-website-stepdrainer-attack/
- CryptoAdventure – Step Drainer hits 12 crypto sites in DNS hijack wave https://cryptoadventure.com/stepdrainer-hits-12-crypto-sites-in-dns-hijack-wave/
- Coin Alert News – DeFi DNS attack https://coinalertnews.com/news/2026/10/31/iron-fish-defi-dns-attack
- Odaily newsflash https://www.odaily.news/en/newsflash/529417
- TradingView/Bloomingbit – Signs of attacks found at 12 overseas crypto sites http://www.tradingview.com/news/bloomingbit:871b7d24f094b:0-signs-of-attacks-found-at-12-overseas-crypto-sites-users-urged-to-be-cautious-linking-wallets/
- X post by banteg https://x.com/banteg/status/2116464795167944890
- X post by Brainrot_Labs https://x.com/Brainrot_Labs/status/2116414433010573795
- Ground News – StonkFun restores website after domain attack https://ground.news/article/stonk-restores-stonkfun-website-after-domain-attack-and-moves-to-new-infrastructure

---
VaultX: free crypto news and intelligence, https://vaultx.llc