StepDrainer Malware Hits 12 Crypto Sites in Coordinated Frontend Attack

A coordinated wave of frontend attacks hit at least 12 cryptocurrency websites on October 31, with malicious code steering visitors toward wallet-draining pages after attackers seized control of domain infrastructure used by DeFi protocols and token launch platforms.

Blockchain security firm Blockaid tied the incidents to StepDrainer, a malware toolkit that steals crypto by inducing fraudulent wallet connections and transaction approvals. The compromised sites include StonkFun, a Solana token launchpad that lets creators pair new coins with tokenized stocks or ETFs, along with Flap and Kintsu and nine other platforms.

Flap, a token launch platform backed by YZi Labs, was first to raise the alarm, saying its original domain, flap.sh, had been hijacked and was redirecting visitors to an unauthorized site. The team told users to stay away from the domain and to avoid connecting wallets or signing transactions while it worked with security partners to contain the breach.

Blockaid then detected similar activity at Kintsu, a liquid staking protocol built on Monad, and went on to identify 10 more domains serving the drainer kit: stonkfun.xyz, pickle.finance, echelon.market, origami.finance, fluxbeam.xyz, stakepoint.app, supswap.xyz, longbow.cash, shprd.finance and apexdefi.xyz. The security firm said it was still investigating and collecting additional data.

StonkFun confirmed the impact through its official account on X, asking users not to visit the platform or connect a wallet until it could be verified as safe. The team said only the website was affected, that all on-chain operations were functioning normally and that it knew of no affected users at the time. In a later update, it said the site had been taken offline and shifted to new infrastructure, warning that some networks could take up to an hour to register the change.

Kintsu said its domain had been compromised at the registrar level and advised anyone who connected a wallet or signed a transaction after 00:00 UTC on October 31 to revoke suspicious token approvals and move potentially exposed assets to secure wallets. The protocol later restored domain routing but kept warning against wallet interactions while DNS caches propagated the update. Flap, meanwhile, moved its platform to flap.cool and urged users to reach the new address directly rather than rely on redirects from the compromised domain. It said the root cause was still under investigation, including whether the incident originated with its domain service provider, and that it had been coordinating with Blockaid and infrastructure providers Vercel and Name.com.

StepDrainer is sold as malware-as-a-service in cybercrime circles and, according to security reports, supports more than 20 blockchain networks. The kit injects malicious scripts into a compromised page; when a visitor clicks Connect Wallet, the script can request a harmful token approval, frequently an unlimited allowance, or an off-chain signature such as a Permit2-style permit. Once granted, the approval lets an attacker move assets without a seed phrase or private key.

The StonkFun breach targeted the website frontend. Smart contracts were not broken and no private keys were stolen. Early reports suggest the attackers gained entry through DNS or hosting access, though Blockaid's investigation is ongoing and that detail could change.

Unlike a smart contract exploit, DNS hijacking lets attackers point a legitimate web address at infrastructure they control, so visitors can face malicious wallet prompts even after typing a project's recognized domain.

Anyone who connected a crypto wallet or signed an approval on an affected domain during the active window may be exposed; users who never touched a wallet prompt are generally not at risk. Security specialists commonly point to tools such as Revoke.cash for checking and revoking token approvals, and advise avoiding the listed domains until each project confirms it is secure.

The episode follows a frontend compromise at Polymarket earlier in the week that drained roughly $2.7 million after malicious JavaScript entered the prediction market's website through a compromised monitoring provider. DeFi platforms have faced similar problems before: in May 2025, Curve Finance suffered another DNS hijacking incident that briefly exposed visitors to a malicious site even though its smart contracts remained secure.

Investigators have not confirmed a total financial loss or identified the attackers. For DeFi operators, the lesson is that a secure contract covers only part of the risk surface, since a hijacked website can still coax users into signing away permissions. Blockaid said it expects to publish further technical details as its investigation advances.

Note: Domain list as identified by Blockaid on October 31, 2026. Flap subsequently migrated to flap.cool.