StepDrainer wallet drainer served through hijacked domains of Flap, Kintsu and 10 more DeFi sites
On 31 October 2026 Flap and Kintsu said attackers had hijacked their domains, and Blockaid found the StepDrainer wallet drainer on ten more DeFi sites. The sites are the projects' own domains, taken over; users who connected wallets should revoke approvals.
- First reported
- Reports
- 1
Source: cryptotimes.io · published
What happened
On 31 October 2026 the token-launch platform Flap and the liquid-staking protocol Kintsu confirmed that attackers had taken over their official websites and redirected visitors to malicious pages. Flap said at 02:13 UTC that its site flap.sh had been hit by a DNS hijack; Kintsu said kintsu.xyz had been hijacked at the domain-registrar level. Both told users not to visit the sites, connect wallets or sign transactions. According to The Crypto Times, the security firm Blockaid then reported the same wallet-draining attack on at least ten more decentralized-finance (DeFi) sites: stonkfun.xyz, pickle.finance, echelon.market, origami.finance, fluxbeam.xyz, stakepoint.app, supswap.xyz, longbow.cash, shprd.finance and apexdefi.xyz. These are the projects' own domains, taken over by attackers; the projects are victims, not the scammers.
How the scam works
Blockaid says the affected sites were serving a wallet-drainer kit called StepDrainer. Security researchers describe it as malware-as-a-service, a ready-made tool that criminals rent or buy, and say it targets more than 20 blockchain networks. Visitors who clicked “Connect Wallet” could be sent to a page built to request harmful token approvals or signatures. Once a user approves, the attacker can move the user's tokens without ever learning the private key. A single signature, such as a Permit2-style approval, can be enough to empty a wallet.
The attack does not touch a protocol's smart contracts. It targets the website layer and the registrar and DNS services behind it, so even a project with audited contracts can expose its users. Flap's founder said the risk was limited to people who connected a wallet or signed in the minutes before the announcement. Kintsu told users who interacted with the site since about 00:00 UTC on 31 October to revoke their approvals through Revoke.cash and move funds to safety. It said it had escalated the matter to Vercel Security and Name.com and later reported the domain pointing back to its own infrastructure, while asking users to wait for an all-clear. Blockaid had not published a full report, a count of affected users or confirmed losses when the story was written.
Source
The Crypto Times, “Flap, Kintsu Websites Hijacked as StepDrainer Wallet Drainer Hits 10 More DeFi Sites”, 31 October 2026, citing statements from Flap, Kintsu and Blockaid.
Red flags
- A familiar DeFi site that suddenly asks you to connect a wallet again or sign an unexpected approval.
- A signature or approval request that does not match what you are trying to do (for example a broad token approval or Permit2 signature).
- An official project announcement warning of a DNS or domain hijack.
- A wallet warning, or a security tool such as Blockaid flagging the site you are on.
- A “verify” or “claim” pop-up appearing on a site that never showed one before.
If you were targeted
- 1Stay away from the affected sites until each project posts an all-clear on its official X account.
- 2If you connected a wallet or signed anything on one of them on 31 October 2026, revoke approvals (for example on Revoke.cash).
- 3Move remaining funds to a fresh wallet, since a revoked approval does not undo a transfer already made.
- 4Never sign a transaction you cannot read; use a wallet with transaction simulation.
- 5Use bookmarks, not search results or links in posts, to reach a DeFi site, and follow official channels for incident updates.