Blockaid Flags 12 DeFi Websites; Flap Reports DNS Hijack
Blockaid flagged 12 project websites in alerts about a frontend attack, but the notices do not show that every site was compromised in the same way. Flap said its official domain redirected visitors to an unauthorized site. StonkFun said its website was affected, but its on-chain operations continued normally.
- Blockaid said 10 sites were actively serving Step Drainer; its first alert named Flap and Kintsu.
- Flap confirmed a DNS hijack. StonkFun moved its website to new infrastructure and restored it.
- No attacker, victim count or aggregate loss figure has been disclosed.
What Blockaid reported
Blockaid’s first alert named Flap and Kintsu and told users to avoid interacting with them. In a later alert, the security company said 10 more websites were actively serving the Step Drainer toolkit: StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance and APEX.
That brings the total across the alerts to 12 distinct websites. The wording matters. Blockaid said the 10 additional sites were actively serving Step Drainer, while its initial warning about Flap and Kintsu described a potential frontend attack. The alerts do not show that all 12 sites suffered the same technical compromise.
Coverage dates the initial warning to Oct. 31. Blockaid’s embedded post is dated Oct. 31, 2026, but the available references do not establish a consistent year for the incident.
A frontend attack targets the website or interface people use to access a service, rather than necessarily exploiting its smart contracts. A compromised interface can still put users at risk by sending them to a malicious page or displaying deceptive wallet prompts.
Flap and StonkFun respond
Flap said its official domain had been affected by a DNS hijack and was sending visitors to an unauthorized destination. DNS, or the Domain Name System, directs a browser from a domain name to the infrastructure hosting a website. Flap told users not to visit the site, connect wallets or sign transactions until further notice. The team said it was working to restore access.
Flap did not name the provider involved or explain how the redirection happened. Its statement confirms what happened to its domain, but does not show that the other sites were affected through DNS.
StonkFun said its website was affected, but its on-chain operations continued to function normally. The team said it knew of no affected users, then reported taking the site offline, moving it to new infrastructure and restoring it. It asked users to wait an hour before connecting a wallet, saying some networks could take that long to recognize the change. The team did not explain the technical reason for that timing.
StonkFun did not estimate losses or announce a compensation process. Its statement that it knew of no affected users does not prove that nobody visited the site or lost funds.
How a website attack can put wallets at risk
Security researcher Ogle circulated an earlier warning about an injected script that sent visitors to a drainer page after they clicked a wallet-connection button. Copies of the warning included stonkbrokers[.]cash, though the screenshots in circulation did not all show the same list as Blockaid’s later alerts.
That warning describes a possible attack method. It does not independently confirm what happened on every named site. Connecting a wallet alone does not necessarily transfer funds. The bigger danger is being tricked into signing a transaction or token approval that authorizes an asset transfer.
If you may have visited a flagged site, do not connect your wallet or sign anything there. Check for unexpected wallet activity. If you signed an unfamiliar token approval, consider revoking it through a trusted wallet or approval-checking service. Use verified project channels to reach teams. A familiar domain or saved bookmark does not prove the destination is safe.
A previous website incident offers a comparison
Curve Finance faced a similar domain problem in May 2025, when its original website redirected visitors to a wallet-draining clone. According to crypto.news, delays in the registrar’s response contributed to Curve’s decision to move to a new domain. The registrar later froze Curve.fi, disabling the malicious drainer.
Crypto.news also reported that Curve planned to offer an Ethereum Name Service (ENS) address as another way to access the project. ENS provides blockchain-based names, but using an alternative name does not guarantee that a website’s code or wallet prompts are safe.
The Curve incident shows how a website can become a weak link even when a protocol’s smart contracts are not targeted. It does not establish that the sites Blockaid flagged shared an attacker, vulnerability or infrastructure with Curve.
Key questions and answers
-
Which websites did Blockaid identify?
Its alerts named Flap, Kintsu and 10 additional sites. Blockaid specifically said those 10 additional sites were actively serving Step Drainer.
-
Were users’ funds stolen?
No confirmed victim count or aggregate loss figure has been disclosed. That does not prove that no funds were lost.
-
Were the underlying protocols compromised?
The alerts concern websites and user-facing interfaces. StonkFun said its on-chain operations were functioning normally. The available information does not establish the status of every named project’s contracts.
-
What should users do now?
Avoid the flagged sites. Do not connect a wallet or sign prompts there, and use verified project channels for updates. If you signed an unexpected approval or transaction, check your wallet activity and take appropriate steps to revoke suspicious approvals.
-
Who was responsible, and how did the attacker gain access?
No attacker has been identified, and the access method remains unknown. Flap confirmed a DNS hijack but did not name the provider or explain how the redirection happened.
Blockaid has also partnered with TRON DAO to strengthen security for users.
Blockaid’s funding has drawn attention from crypto investors.
