DeFi DNS attack hits 12 sites as Blockaid flags Step Drainer

A Halloween attack has targeted at least 12 DeFi websites, with Blockaid identifying the Step Drainer toolkit across affected pages and teams warning users against connecting wallets or signing transactions. Summary Blockaid identified Flap, Kintsu, and 10 more websites in alerts about the frontend attack. Flap confirmed a DNS hijack that redirected its official domain to an unauthorized website. StonkFun restored its website after moving infrastructure and said it was unaware of affected users. The alerts identify compromised websites, while the number of victims and any losses remain unestablished. Blockaid’s initial warning named Flap and Kintsu as targets of a potential frontend attack on Oct. 31. In a subsequent alert, the blockchain security company listed 10 additional domains that it said were actively serving Step Drainer. The affected teams began issuing their own warnings as the incident unfolded. Flap confirmed that visitors to its official address were being redirected elsewhere, while StonkFun later reported that it had restored its website after taking it offline and moving to new infrastructure. Blockaid identifies Step Drainer across 12 DeFi sites In its initial al...