According to CoinWorld, blockchain security research firm Blockaid reported that 12 DeFi websites were hijacked overnight and turned into wallet-draining tools called Step Drainer. The tool disguises itself as a normal wallet pop-up, tricking users into approving transfers while prioritizing the most valuable tokens. Researchers found that its prompt displayed a fake “+500 USDT,” making the approval appear to be an incoming payment. Affected projects include Flap, Kintsu, Stonkfun, and Pickle Finance, among others. Losses of approximately $138,000 have been tracked, excluding losses on Solana and Aptos. All 12 domains were registered with name.com, though the method of hijacking has not been confirmed. name.com responded by asking users to fill out an abuse report form, and the security of the affected teams’ websites has not yet been confirmed.