DeFi Websites Targeted in DNS Attack: User Caution Urged
A recent DNS attack has compromised at least 12 DeFi platforms. Users are advised to avoid interactions until further notice.
Overview of the Attack
This Halloween, a security incident hit numerous decentralized finance (DeFi) websites, with Blockaid identifying a malicious toolkit named Step Drainer. Affected sites include Flap, Kintsu, and ten others, prompting warnings for users against engaging with these platforms.
Identifying the Compromised Sites
Blockaid's alerts initially named Flap and Kintsu as primary targets on October 31. An expansion of this alert revealed an additional ten platforms potentially serving the Step Drainer toolkit. The full list includes:
- Flap
- Kintsu
- StonkFun
- Pickle Finance
- Echelon
- Origami Finance
- FluxBeam
- StakePoint
- SupSwap
- Longbow
- Shprd Finance
- APEX
While the total number of victims and losses remain unclear, users are urged to refrain from connecting their wallets or signing transactions on these sites.
Flap and StonkFun Respond to the Attack
Flap confirmed that their official website had fallen victim to a DNS hijack. Users accessing their site were unintentionally redirected to a fraudulently created webpage. The team advised all users to avoid connecting wallets or conducting any transactions until the issue is resolved.
StonkFun also reported being affected by this attack. They advised users to stay clear of the platform while they worked on rectifying the situation. StonkFun later announced the restoration of their website after transferring it to new infrastructure. They indicated that while the site was back online, users should wait an hour before reconnecting their wallets to allow for network recognition of the changes.
Understanding DNS Hijacking
Domain Name System (DNS) hijacking can undermine user trust by redirecting verified website traffic to unauthorized sources. In this case, users interacting with Flap's legitimate domain were unknowingly routed to a malicious site. Details regarding the entity behind this breach or how it was executed remain undisclosed.
Previous Incidents and Future Precautions
Such attacks are not unprecedented in the DeFi space. In a notable incident back in May 2025, Curve Finance had to migrate to a new domain following a similar attack that duplicated their original website. They engaged security partners during the process and the delays encountered in dealing with their registrar led them to shift their domain entirely. Curve Finance later explored implementing an Ethereum Name Service address as an alternative access method.
The recent attacks highlight the need for ongoing vigilance among DeFi platforms and their users. Ensuring that proper security protocols are in place helps avert future incidents of this nature.