A Halloween DNS hijack has knocked at least a dozen DeFi sites offline or onto malicious pages, with blockchain security firm Blockaid identifying the “Step Drainer” toolkit on affected frontends and teams warning users not to connect wallets or sign transactions. What happened - On Oct. 31 Blockaid first warned of a possible frontend compromise targeting Flap and Kintsu. The firm quickly expanded its alert to include 10 more domains that it said were actively serving Step Drainer — a drainer toolkit that redirects users to malicious pages designed to request wallet connections or signatures. - Security researcher Ogle independently flagged an injected script that sent visitors who clicked a wallet-connection button to a drainer page, urging users to avoid connecting wallets to the named sites. Affected projects Blockaid’s list covered 12 distinct websites: - Flap - Kintsu - StonkFun (stonkfun[.]xyz) - Pickle Finance (pickle[.]finance) - Echelon (echelon[.]market) - Origami Finance (origami[.]finance) - FluxBeam (fluxbeam[.]xyz) - StakePoint (stakepoint[.]app) - SupSwap (supswap[.]xyz) - Longbow - Shprd Finance - APEX What teams reported - Flap confirmed a DNS hijack: its legitimate domain was redirecting visitors to an unauthorized destination. The team asked users not to visit the site, connect wallets, or sign transactions and said it was working to restore service while directing users to official social accounts for updates. - StonkFun said its site was affected but that on-chain operations remained normal. The project took the site offline, migrated to new infrastructure, restored the site, and advised users to wait about an hour before reconnecting wallets to allow networks to recognize the change. Both teams reported no known victims and provided no loss estimates or compensation plans. Investigation status and impact - Blockaid said the additional sites were serving the same Step Drainer and that its investigation is ongoing. The alerts did not name a confirmed attacker, give a victim count, or provide an aggregate loss figure. - Because the attack involved DNS records, visitors who typed familiar domains into their browsers could be redirected to the malicious pages — no phishing link or typo-squatting was required. Blockaid and affected projects have not disclosed how attackers gained access to DNS records or which provider, if any, was compromised. Context and precedent - Similar frontend and domain-hijack incidents have hit DeFi before. In May 2025 Curve Finance moved to a new domain after attackers redirected its site to a wallet-draining clone; Curve worked with security partners and its registrar, which later froze the malicious domain. Curve also said it planned to add an ENS address as an alternate access method. What users should do now - Do not visit the flagged domains, connect wallets, or sign transactions until projects confirm recovery via their official channels. - Monitor official project social accounts for restoration notices and guidance. - Consider using hardware wallets and third-party transaction-review tools to reduce exposure to malicious signing requests. We’ll update as Blockaid and the affected teams release more details on the attacker, scope, and any losses. Read more AI-generated news on: https://app.chaingpt.org/news