DeFi DNS Attack Hits 12 Sites As Step Drainer Deployed

A coordinated DNS attack has targeted at least 12 decentralized finance websites, prompting blockchain security firm Blockaid to identify the Step Drainer toolkit deployed across the affected frontends. Affected project teams and security researchers have warned users against connecting wallets or signing any transactions.

According to CryptoNews, Blockaid’s initial alerts on Oct. 31 named Flap and Kintsu as targets of a potential frontend attack. In a subsequent update, the blockchain security company expanded its list to include 10 additional domains actively serving Step Drainer: StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance, and APEX.

Project Responses and Infrastructure Moves

Projects impacted by the incident began issuing warnings as the campaign unfolded. Flap confirmed that its official domain was subjected to a DNS hijack that redirected visitors to an unauthorized destination. The team advised users not to visit the site, connect wallets, or sign transactions until further notice.

StonkFun reported that its website was similarly affected by the domain attack. The team took its website offline and moved to new infrastructure to restore the service. StonkFun stated that on-chain operations continued to function normally and that it was unaware of any affected users at the time of its update.

Security Warnings and Scope

An earlier warning circulated by security researcher Ogle detailed an injected script that redirected visitors clicking the wallet connection button to a malicious drainer page. While the alerts successfully identified the compromised websites, the exact number of victims and an aggregate financial loss figure remain unestablished.

Key facts

• At least 12 DeFi websites were targeted in a DNS hijack campaign.
• Blockaid identified the Step Drainer toolkit active across the compromised frontends.
• Flap confirmed its official domain was redirected to an unauthorized website.
• StonkFun restored its website after moving to new infrastructure, stating on-chain operations were normal.
• The total number of victims and financial losses remain unestablished.