On October 31, 2026, the cryptocurrency launchpad Flap.sh became the target of a DNS hijacking attack that redirected visitors from its legitimate website to an unauthorized malicious page.
This incident highlights an important reality of Web3: even familiar and established crypto platforms can become targets of sophisticated attacks.
đ What happened?
Flap's team publicly warned that its official domain, flap.sh, had been compromised at the DNS level.
Instead of reaching the legitimate platform, visitors could be redirected to a fraudulent website designed to imitate the original interface and trick users into connecting their wallets or signing malicious transactions.
The security company Blockaid also identified the same malicious infrastructure affecting other DeFi websites.
The malicious pages were associated with wallet-draining activity, including attempts to obtain dangerous transaction signatures and token spending approvals.
đĄïž How did Flap respond?
The Flap team reacted by warning users, restricting access to affected frontends and introducing an alternative domain.
The project subsequently announced that flap.sh had been restored. However, it later migrated its official website to:
https://flap.cool
Users were specifically advised to access the new domain directly and avoid connecting wallets or signing transactions through flap.sh while the migration and investigation continue.
The exact cause of the DNS compromise remains under investigation.
No independently confirmed total of stolen funds or affected wallets has been published.
â ïž Why should every crypto user care?
This incident demonstrates that website security and blockchain security are not the same thing.
A website can look completely legitimate while its domain is redirecting visitors to an attacker's infrastructure.
You might enter the correct address, recognize the familiar design and still end up interacting with a malicious interface.
In crypto, one careless signature can be enough to put your assets at risk.
đ 10 Essential Rules for Crypto Security
1. Verify every website address.
Check spelling, domain extensions and unexpected redirects. Bookmark official websites instead of relying on search advertisements or forwarded links.
2. Never trust random wallet-connection links.
Avoid connecting wallets through unsolicited Telegram messages, social media comments or private messages.
3. Never share your seed phrase or private keys.
No legitimate project administrator or support agent needs them.
4. Read wallet signature requests carefully.
A signature is not always harmless. Some signatures can authorize transfers or grant access to your assets.
5. Understand token approvals.
Approve, Permit and Permit2 requests can grant spending permissions. Never approve unlimited access without understanding why it is needed.
6. Separate your wallets.
Use a dedicated wallet for experimental dApps and keep your long-term holdings in a separate wallet.
7. Review and revoke unnecessary permissions.
Use trusted tools such as https://revoke.cash to inspect token allowances. Always verify the domain before connecting your wallet.
8. Protect your accounts.
Enable strong two-factor authentication on exchanges, email accounts and domain registrar accounts.
9. Stop when something feels wrong.
Unexpected redirects, unusual wallet prompts, urgent warnings or requests to retry transactions should be treated as red flags.
10. Follow official security announcements.
Check multiple official communication channels before interacting with a platform during a security incident.
đš What if you already interacted with a suspicious website?
- Stop interacting with the website.
- Check your wallet's transaction history and token approvals.
- Revoke suspicious permissions using a verified tool.
- If you signed a malicious authorization or suspect your wallet is compromised, move remaining assets to a newly created secure wallet.
- Contact the platform through verified official channels.
Remember: connecting a wallet alone does not automatically mean your funds have been stolen. The actual risk depends on what permissions or signatures were authorized.
Final thoughts
Web3 gives us financial freedom, but that freedom comes with personal responsibility.
Security is not just the responsibility of exchanges, developers or blockchain projects. Every user is part of the security chain.
The Flap incident is a reminder that trust should never replace verification.
Stay informed. Verify before you connect. Read before you sign. Protect your assets.
â CHABARAKA đ
Information current as of October 31, 2026. The Flap incident remains subject to investigation.
Sources:
- Flap official incident updates: https://x.com/FlapOfficial
- Blockaid security alerts: https://x.com/Blockaid_
- Incident reporting: https://tsnmedia.org/flap-kintsu-dns-hijack/