LaunchOnSF restores website as StepDrainer attack spreads to 10 more sites

Blockaid flagged a frontend attack hitting at least 12 DeFi and token-launch websites, and StonkFun's operator says no user funds were lost LaunchOnSF, the team behind token-launch platform StonkFun, says its website is back online. The restoration comes after a malicious toolkit called StepDrainer was found injected into its frontend, along with 10 other websites. The attack never touched StonkFun’s smart contracts. It went after something more fragile: the trust users place in a familiar web address. What happened Security firm Blockaid identified the campaign on October 30–31, 2026. By its count, at least 12 decentralized finance (DeFi) and token-launch websites were hit. StonkFun, at stonkfun.xyz, was among the first names on the list. The additional affected sites include pickle.finance, echelon.market, origami.finance and fluxbeam.xyz. LaunchOnSF confirmed the site was restored quickly. It also said there was no on-chain impact and no reported user losses. The mechanics matter here. According to the research findings, the attack relied on compromised DNS and domain systems that slipped harmful scripts into otherwise legitimate websites. Once the scripts were live, visitors sa...