Back Kucoin

Step Drainer Attack Spreads to 10 Additional Websites, Including StonkFun and Pickle Finance

Kucoin • October 31, 2026

ChainCatcher report: According to SolanaFloor monitoring, the Step Drainer attack has been detected on 10 additional websites, including stonkfun.xyz, pickle.finance, echelon.market, origami.finance, fluxbeam.xyz, stakepoint.app, supswap.xyz, longbow.cash, shprd.finance, and apexdefi.xyz. SolanaFloor is actively investigating and collecting additional data.

In addition, StonkFun stated that its website has been restored following the migration to new infrastructure, on-chain operations were unaffected, and no users are currently known to be impacted.

It is reported that Step Drainer is a highly active malware-as-a-service (MaaS) tool used for stealing cryptocurrency wallets in the Web3 and crypto space.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

StepDrainer Malware Targets 12 Crypto Websites in Coordinated Attack On October 31, 2026, a coordinated wave of frontend attacks impacted at least 12 cryptocurrency websites, including StonkFun and Pickle Finance. Attackers used StepDrainer malware to redirect users to wallet-draining pages after compromising domain infrastructure. Blockchain security firm Blockaid linked the incidents to StepDrainer, a malware toolkit that facilitates fraudulent wallet connections and transaction approvals. Affected platforms included Flap, Kintsu, and others, with StonkFun confirming its website was compromised but stating that on-chain operations remained unaffected. Users were advised to avoid connecting wallets or signing transactions during the incident. The attack's scope continues to be investigated, with security firms working to gather more data and restore affected services. 3 sources 63

Extracted Entities

Step Drainer Attack Spreads to 10 Additional Websites, Including StonkFun and Pickle Finance

The full story

Extracted Entities

Attack Types (1)

Companies (3)

Domains (5)

Malware (1)