Weekend security alert: Front ends of at least 12 DeFi/token launch sites injected with StepDrainer
1. Security firm Blockaid disclosed that between October 30 and 31, the front ends of at least 12 decentralized finance and token launch sites were infected with the StepDrainer toolkit. GoPlus also warned that sites including Flap and Kintsu had been spoofed through DNS hijacking.
2. The attack did not modify smart contracts. Instead, tampered official website domains were used to lure users into “connecting wallets / signing / granting unlimited approvals.” The attackers targeted approvals and signatures, not private keys directly.
3. StonkFun’s operators said the site had been restored and that no on-chain losses had been reported. Kintsu and others also said they had switched back, but DNS caches may mean malicious pages remain visible for a short time.
4. Check your activity: If you connected to any affected site during the suspicious period, revoke your approvals as soon as possible using tools such as Revoke.cash. Never click unfamiliar “claim/verify” pop-ups.
$ETH $BNB For informational purposes only; not investment advice. DYOR. Use official channels only, and don’t click unfamiliar claim links.
#安全 #DeFi #DNS #Web3 #BNB