DNS Hijack Targets 12 DeFi Sites via Step Drainer Toolkit

The security breach manipulated DNS records to funnel visitors from legitimate project domains to unauthorized, fraudulent interfaces. Blockaid first raised alarms on October 31, naming Flap and Kintsu as initial targets before expanding their list to include StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance, and APEX. Security researcher Ogle noted that the attack specifically targeted the wallet connection process, injecting scripts that funneled users into drainer pages upon interaction.

Project teams responded by taking affected infrastructure offline. Flap confirmed its official domain was compromised and redirected traffic, urging users to ignore the site until restoration was complete. Meanwhile, StonkFun successfully migrated to new infrastructure, reporting that while its frontend was compromised, on-chain operations remained secure. Neither project has provided a confirmed victim count or loss estimate. This incident follows a pattern of DNS-based exploits, mirroring the 2025 attack on Curve Finance that ultimately forced a permanent domain migration.