Skip to content
StepDrainer Malware Targets 12 Crypto Websites in Coordinated Attack

StepDrainer Malware Targets 12 Crypto Websites in Coordinated Attack

First seen 31 Oct 2026, 21:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 31, 2026 at 22:12 UTC
  • •StepDrainer malware affected 12 cryptocurrency websites on October 31, 2026.
  • •Attackers compromised domain infrastructure to redirect users to malicious sites.
  • •Affected platforms include StonkFun, Pickle Finance, and Kintsu, with ongoing investigations.

On October 31, 2026, a coordinated wave of frontend attacks impacted at least 12 cryptocurrency websites, including StonkFun and Pickle Finance. Attackers used StepDrainer malware to redirect users to wallet-draining pages after compromising domain infrastructure. Blockchain security firm Blockaid linked the incidents to StepDrainer, a malware toolkit that facilitates fraudulent wallet connections and transaction approvals. Affected platforms included Flap, Kintsu, and others, with StonkFun confirming its website was compromised but stating that on-chain operations remained unaffected. Users were advised to avoid connecting wallets or signing transactions during the incident. The attack's scope continues to be investigated, with security firms working to gather more data and restore affected services.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-31
Frontend attacks detected on crypto websites
At least 12 cryptocurrency websites were attacked using StepDrainer malware, redirecting users to wallet-draining pages.
Finance.Biggo
2026-10-31
StonkFun confirms website compromise
StonkFun reported its website was compromised but stated on-chain operations were unaffected and advised users to avoid connecting wallets.
Finance.Biggo
2026-10-31
Kintsu advises users to revoke approvals
Kintsu confirmed its domain was compromised and advised users to revoke suspicious token approvals and move assets to secure wallets.
Finance.Biggo

More articles in this cluster (2)

Following this threat?

Track Step Drainer and Pickle Finance in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 3

Common questions

Which websites were affected by the StepDrainer attack?
The attack impacted at least 12 cryptocurrency websites, including StonkFun, Pickle Finance, and Kintsu.
What should users do if they interacted with compromised sites?
Users should revoke any suspicious token approvals and move assets to secure wallets.
Is the StepDrainer malware still active?
Yes, the malware is actively being exploited, and investigations are ongoing.