12 DeFi Websites Hijacked Overnight: Step Drainer Turned Trusted Sites Into Wallet Traps — 7 Checks Before You Connect

12 Trusted Crypto Sites Turned Into Wallet Traps Overnight — And the Real Danger Has Not Ended

In the early hours of Saturday, October 31, 2026, typing a familiar DeFi address into a browser could land you on a page built to empty your wallet. Security firm Blockaid found the same theft kit — called Step Drainer — running on 12 decentralized finance and token-launch websites, and at least $138,000 has already been traced to three wallets linked to the attack. The scariest part is not the number. It is this: the attack never touched a single smart contract, no private keys were stolen, and anyone who clicked "connect" and approved a transaction on a hijacked page is still exposed today — because a malicious approval does not expire when the fake site disappears.

This is the story of the Halloween DeFi hijack, the 12 sites involved, how a shared weak link at the domain layer let one attack spread to a dozen projects at once, and the 7-point checklist to run if you visited any of them. If you use DeFi at all, read the checklist before you connect your wallet to anything else this weekend.

What Happened: The Halloween Frontend Hijack in 60 Seconds

On the night of October 30–31, 2026, attackers compromised the web frontends — the websites themselves, not the underlying blockchain code — of at least 12 DeFi and token-launch projects. Visitors to the projects' real addresses were redirected to unauthorized pages or served injected scripts that pushed fraudulent wallet-connection requests. Anyone who connected a wallet and signed what looked like a routine approval could have handed the attackers permission to move their tokens.

The timeline, pieced together from Blockaid's alerts and project statements, moved fast. Flap, a token-launch platform on BNB Chain and Base, raised the alarm first: at 02:13 UTC on October 31 it warned that its official address was redirecting to an unauthorized website and told users not to connect wallets or sign anything. Blockaid followed at 02:54 UTC with an alert naming Flap and Kintsu, then at 03:16 UTC expanded the list to 10 more sites, all described as actively serving Step Drainer. By Saturday morning, 10 of the 12 domains had received a registrar-level hold that stopped their addresses from resolving; Flap and Kintsu were the two exceptions, and several projects reported regaining control of their domains by mid-morning.

Crucially, this was a website-layer attack. Kintsu, Origami Finance, FluxBeam and StonkFun all said their smart contracts were unaffected. StonkFun's operator, LaunchOnSF, took its site offline, moved to new infrastructure, restored the website, and reported no on-chain impact and no reported user losses on its own platform. No attacker has been publicly named, no victim count has been published, and no project has published a comprehensive loss figure — the $138,000 figure is a partial, traced tally, not a final total.

The 12 Sites Named by Blockaid

Blockaid's expanded alert named 10 additional sites beyond the first two. Together, the full list covers 12 distinct websites across DeFi lending, staking, token launches and trading:

Site	What it does	What happened
Flap	Token launches on BNB Chain and Base	DNS hijack confirmed; warned users at 02:13 UTC; domain later back under project control
Kintsu	Staking and lending (Monad-based liquid staking)	Hijack at the registrar level, via Vercel Domains; domain later back under project control
StonkFun	Token-launch platform	Site taken offline, moved to new infrastructure, restored; no on-chain impact reported
Pickle Finance	DeFi yield strategies	Named in Blockaid's expanded alert as serving Step Drainer
Echelon	DeFi lending market	Named in Blockaid's expanded alert as serving Step Drainer
Origami Finance	DeFi yield platform	Smart contracts unaffected, per project; domain later back under project control
FluxBeam	Trading platform	Smart contracts unaffected, per project
StakePoint	Staking platform	Named in Blockaid's expanded alert as serving Step Drainer
SupSwap	Decentralized exchange	Named in Blockaid's expanded alert as serving Step Drainer
Longbow	DeFi protocol	Named in Blockaid's expanded alert as serving Step Drainer
Shprd Finance	DeFi protocol	Named in Blockaid's expanded alert as serving Step Drainer
APEX (ApeX DeFi)	Trading platform	Named in Blockaid's expanded alert as serving Step Drainer

If you visited any of these addresses between late Friday night and Saturday morning — even if the site looked normal — treat it as a possible exposure and run the checklist below. The count may still rise: Blockaid said its investigation was continuing, and other sites sharing the same weak link may not have been identified yet.

How Step Drainer Works — and Why It Is So Effective

Step Drainer is not a one-off script written for this campaign. It operates as malware-as-a-service: criminals can essentially rent the toolkit rather than build their own, and it reportedly works across more than 20 networks. That rental model is part of why drainers keep reappearing under new names — the barrier to entry for running a wallet-draining campaign is now a subscription, not a coding team.

The mechanics are simple. Once the malicious script is live on a legitimate-looking site, the visitor sees a familiar wallet-connection prompt. Clicking it does not steal a private key or seed phrase. Instead, it asks the user to approve a transaction or grant a token approval — often an unlimited approval — that lets the attacker's contract move tokens out of the wallet later. The theft happens through permissions the user granted themselves, which is why the usual advice ("never share your seed phrase") does nothing against this attack. Nobody asked for a seed phrase. They asked for a click.

That distinction matters for two reasons. First, the damage is not limited to the moment of the visit: an approval granted on Friday night remains valid until the user revokes it, even after the hijacked site is taken down and the real site is restored. Second, the attack scales: one compromised frontend can harvest approvals from every visitor until someone notices, and a dozen compromised frontends multiply that reach. Reports of the payment trail illustrate the point — proceeds were traced to three wallets in shares of roughly 15%, 55% and 30% across several networks, and on one chain, tokenized Apple and Nvidia shares were withdrawn from Morpho and swapped for ETH, according to transaction records cited in coverage of the attack.

The Shared Weak Link: One Registrar, 12 Domains

The detail that turns this from a dozen isolated incidents into a single systemic warning is the registrar. According to public records reviewed by The Block, all 12 domains shared the registrar Name.com, though their nameservers varied across Cloudflare, Vercel and Name.com itself. Kintsu said its address was hijacked "at the registrar level" and that it had bought the address through Vercel Domains. Investigators have not confirmed where exactly the attackers gained access, and the shared registrar alone does not prove a single point of entry — but 12 sites falling in the same hours with the same toolkit points to a shared vulnerability somewhere in the domain layer, not 12 separate coincidences.

This is not a new failure mode. Curve Finance, one of DeFi's largest protocols, lost control of its curve.fi address twice through its registrar, iwantmyname. In July 2024, Blockaid flagged a wave of sites — including Compound Finance and Celer Network — whose addresses at Squarespace had been redirected toward a kit tied to the Inferno Drainer group. The pattern keeps repeating: the smart contract is hardened, audited and battle-tested, while the humble domain registration — the thing that decides which website your browser actually loads — is guarded by a password, an email account, or a registrar support process that attackers have learned to exploit.

For users, the lesson is uncomfortable: "I typed the right address" is no longer a guarantee. DNS and registrar compromises mean the right address can serve the wrong website — and a bookmark points to the same address, so it leads to the trap too.

What Most People Get Wrong About This Attack

Myth 1: "My funds are safe because the smart contracts were not hacked." True for the protocols — and irrelevant to a user who approved a malicious transaction. The drainer did not need to break the contract. It needed your signature, and signatures are the one security layer the user controls alone.

Myth 2: "The sites are back online, so the danger is over." Wrong in the most dangerous way. A token approval does not expire when the fake site goes away. Anyone who signed one and has not revoked it is still exposed until they do. Restoration of the websites fixes the front door; it does nothing about the keys already handed out.

Myth 3: "Only big wallets get drained." Drainers are automated and indiscriminate. They sweep whatever approvals they can get, and the $138,000 traced so far is spread across three wallets on Ethereum-compatible networks alone — a partial tally that excludes possible losses on Solana and Aptos, where some of the affected projects also operate.

Myth 4: "My hardware wallet protects me." A hardware wallet protects your private key from leaving the device — it does not stop you from signing a malicious approval on its screen. If you approved a drainer transaction on a hardware wallet, the approval is just as live. Our guide to whether your hardware wallet is safe in 2026 explains where hardware wallets genuinely help and where they do not.

Myth 5: "If nothing left my wallet yet, I am fine." Not necessarily. Drainers sometimes wait — sweeping wallets hours or days later, when attention has moved on. An unrevoked approval is an open door with no alarm. Check it now, not when funds move.

The 7-Point Checklist: What to Do If You Visited Any of These Sites

Run through this list in order. It takes about 15 minutes and it closes the exact hole this attack opened.

1. Do not connect your wallet to any of the 12 sites until the project confirms its domain is fully restored and the malicious script is gone. If a project has not posted an all-clear, wait.
2. Open a token approval checker such as Revoke.cash and review every approval for the wallet you used. Look for unlimited approvals, approvals to unknown contracts, and any approval granted on October 30–31.
3. Revoke anything you do not recognize, anything unlimited that you do not actively need, and every approval connected to a visit to one of the 12 sites. Revoking costs a small gas fee; leaving a drainer approval open can cost everything in the wallet.
4. Check your recent transaction history for any transaction you do not recognize — especially token approvals and transfers dated October 30–31. If you find one, revoke first, then assess what moved.
5. Move funds to a fresh wallet if you approved anything suspicious and cannot fully account for it. A new wallet with no approvals to the attacker's contracts is the cleanest reset; do not reuse the exposed wallet for large holdings.
6. Verify the real site before your next visit: check the project's official social accounts for an all-clear post, confirm the domain from at least two official sources, and be suspicious of any site that suddenly asks you to re-approve tokens you already approved.
7. Report and warn: if you lost funds, report the attacker wallets and transaction hashes to the project team and to Blockaid or ScamSniffer so the addresses can be flagged for other users. And tell anyone you know who uses these protocols — the people most at risk are the ones who have not heard about the attack yet.

One more rule: treat every connect-wallet prompt as a decision, not a reflex — read what you are approving and reject unlimited approvals by default.

Why This Attack Landed in the Worst Possible Week

Context makes the timing worse. The DeFi hijack broke just two days after Binance disclosed a $6.3 billion hot-wallet breach — the largest theft in crypto history — with roughly $3 billion frozen on-chain and withdrawals paused. Bitcoin fell to about $77,000, spot Bitcoin ETFs posted $643 million in net outflows on October 30, and the Crypto Fear and Greed Index sat at 30, firmly in "fear" territory. Users were already on edge, support teams were already stretched, and scammers were already circling: fake Binance refund claims were spreading within hours of the hack, as we covered in our guide to the 7 fake refund traps.

That pile-up is the real story of crypto security in late October 2026. The biggest exchange breach in history and a 12-site drainer campaign in the same week, through completely different attack paths — one at the exchange's hot wallets, one at the domain layer of DeFi frontends. No single defense covers both. Exchange users need proof of reserves and withdrawal hygiene; DeFi users need approval hygiene and frontend verification. The common thread is that the weakest link is rarely the cryptography. It is the human and operational layer around it: a laptop, a registrar account, a click on a familiar-looking button.

There is one encouraging note. The response this time was fast by historical standards: Flap warned within minutes, Blockaid's list grew within the hour, 10 domains were held at the registrar level by 8:32 a.m. ET on Saturday, and several projects had their domains back by mid-morning. Binance, for its part, said it had replenished about 90% of the stolen assets and published an October 31 reserve snapshot, with full cryptographic proof expected November 3. Fast incident response limited the damage — but it could not undo approvals already granted. That part is up to each user, and it is the part most people skip.

What to Watch Next

Three questions will decide whether this incident fades or grows. First, will the traced loss figure rise once Solana and Aptos activity is included and more victims come forward? The $138,000 tally is explicitly partial. Second, will investigators confirm a single point of entry — and will Name.com or the affected nameserver providers explain how 12 domains fell in one window? Vercel had made no public statement by Saturday afternoon, and the registrar-level hold on 10 domains raises as many questions as it answers. Third, will other projects sharing the same registrar or infrastructure audit their own domain security before they become the next alert? The July 2024 Squarespace wave did not end drainer campaigns; it just moved them to the next weak link.

For everyday DeFi users, the practical takeaway does not depend on those answers. Check your approvals today. Revoke what you do not need. And the next time a familiar site asks you to connect your wallet, pause for five seconds and ask one question: is this the site I think it is, or just an address that looks like it? In the early hours of October 31, for 12 projects at once, it was the second one.

New to DeFi and want the full picture before you connect anything? Start with our beginner's guide to decentralized finance and our comparison of the best crypto wallets for beginners in 2026, and if you are buying your first crypto after this week's chaos, read our 10 checks before you send a dollar.

Frequently Asked Questions

Which 12 DeFi websites were hijacked in the Step Drainer attack?

Blockaid named Flap, Kintsu, StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance and APEX. The first alert covered Flap and Kintsu; the expanded alert at 03:16 UTC on October 31 added the other 10.

How much crypto was stolen in the DeFi website hijack?

About $138,000 had been traced to three wallets as of October 31, according to reports citing The Block. That is a partial tally covering Ethereum-compatible networks only — it excludes possible losses on Solana and Aptos, and no victim count or final total has been published.

Was my crypto at risk if I only visited one of the sites but did not connect my wallet?

No. The attack required users to connect a wallet and approve a transaction or token approval. Simply loading a hijacked page, without connecting or signing, did not by itself expose funds. If you connected or signed anything, run the checklist above.

Do I need to revoke approvals if the site is back online and looks normal?

Yes, if you approved anything during the attack window. Approvals do not expire when the fake site disappears. Revoking is the only way to close an approval you granted to a malicious contract.

What is Step Drainer?

Step Drainer is a wallet-draining toolkit sold as malware-as-a-service, reportedly working across more than 20 networks. It tricks users into granting token approvals or signing transactions that let attackers move funds out of wallets — without ever stealing private keys or seed phrases.

How is this different from the Binance hack?

The Binance breach compromised exchange hot wallets and moved about $6.3 billion in client assets, with roughly $3 billion later frozen. The DeFi hijack compromised website frontends and tricked individual users into approving transfers. Different targets, different defenses — and both happened in the same week, which is why approval hygiene and exchange hygiene both matter right now.

Conclusion

The Halloween DeFi hijack is a warning written in the language every crypto user understands: 12 trusted addresses, one shared weak link, one rented theft kit, and at least $138,000 traced before most people had their Saturday coffee. The protocols held. The websites did not. And the difference between a user who lost funds and one who did not came down to a single click on a familiar-looking button.

Check your approvals now, revoke what you do not recognize, and make the five-second pause before every wallet connection a habit. The next hijack will not announce itself either — but an approval you never granted cannot be used against you. Sources for this article include Blockaid's alerts as reported by Crypto.News, Crypto Briefing, The Crypto Basic, CryptoCompass and Crypto Media Zone.