Quick answer: A DeFi DNS hijack on Oct. 31, 2026 redirected at least 12 crypto websites, including Flap and Kintsu, to pages serving the StepDrainer wallet drainer, per Blockaid. Smart contracts were not hacked. Users who connected or signed on those sites since about 00:00 UTC should revoke approvals and move funds.
A DeFi DNS hijack turned at least 12 crypto websites into wallet-draining traps on Oct. 31, 2026. Security firm Blockaid said the sites, led by token launchpad Flap and Kintsu, were “actively serving the Step Drainer” to anyone who connected a wallet.
The contracts behind these apps were never touched. Instead, attackers took over the web address itself, so typing the correct URL could still land you on a fake page.
What happened in the DeFi DNS hijack?
Flap raised the alarm first. At about 02:13 UTC, it said flap.sh had been hit by a “DNS hijacking incident” and was redirecting to an unauthorized website, as DEGEN NEWS relayed on X. It told users not to visit, connect wallets or sign anything.
At 02:54 UTC, Blockaid issued a community alert about a “potential frontend attack” on flap.sh and kintsu.xyz. Then, at 03:16 UTC, it named 10 more sites running the same kit.
At 03:35 UTC, Kintsu confirmed that its site was “affected by a DNS hijack at our registrar and is currently serving a malicious site.”
Which DeFi sites were hit?
Blockaid listed these domains as serving StepDrainer on Oct. 31, 2026:
- flap.sh and kintsu.xyz (first alert)
- stonkfun.xyz, pickle.finance and echelon.market
- origami.finance, fluxbeam.xyz and stakepoint.app
- supswap.xyz, longbow.cash, shprd.finance and apexdefi.xyz
Blockaid said it was “actively investigating and gathering more data.” So far, no project or security firm has published a confirmed loss total or a count of affected wallets.
How does a DNS hijack drain a crypto wallet?
DNS is the internet’s address book. It maps a name like flap.sh to the server that hosts the site. When an attacker controls that record, the real address quietly points to their server instead.
From there, a drainer kit does the rest. The fake page looks normal and asks you to “Connect Wallet.” Next, it requests a token approval or signature. Once you sign, the attacker can move your tokens without ever seeing your seed phrase. That is why a hardware wallet alone does not save you here: you still approve the transaction yourself.
According to a Crypto Times report, Kintsu said its domain was registered through Vercel Domains and that it escalated the case to Vercel Security and Name.com. Neither company has published a statement on the root cause yet.
Are the affected sites safe to use now?
Not all of them, and not yet. At 05:21 UTC, Flap said it had moved to a new domain, flap.cool, and asked users to avoid flap.sh while the root cause is still under investigation.
Meanwhile, at 10:11 UTC, StakePoint said its domain record was restored and all staked and locked tokens were safe on-chain. However, it warned that “some networks are still caching the hijacked address.” In practice, a fixed record can keep sending some visitors to the fake page for hours.
So the safe rule is simple: wait for each project’s own all-clear on its verified X account before you connect again.
What should you do if you connected a wallet?
If you used any listed site on Oct. 31, 2026, act now:
- Check approvals for every wallet you connected on Revoke.cash and revoke anything unfamiliar or unlimited.
- If you signed something unusual, move the remaining funds to a fresh wallet.
- Ignore “refund,” “claim” or “recovery” links and DMs. Follow-up scams are common after incidents like this. Our guide on how to spot crypto scams covers the usual tricks.
For long-term habits, see our self-custody wallet setup guide.
Market implications: the front end is the weak link
This is the second front-end attack in a week. On Oct. 29, a compromised third-party script led to the Polymarket hack that paused trading. Both incidents left the core contracts intact and went after the website layer instead.
As a result, expect more protocols to lock down registrars, use DNSSEC and registry locks, and push users toward bookmarks or IPFS front ends. For a wider view, read our explainer on DeFi risks and our look at how Q3 crypto hacks topped $1.18B despite audits.
DeFi DNS Hijack FAQ
Were the smart contracts of Flap, Kintsu and the other sites hacked?
No. Blockaid, Kintsu and StakePoint all describe a website and domain attack. The contracts were not changed, but visitors were sent to fake pages that requested malicious approvals.
Who is at risk from the Oct. 31 DNS hijack?
Users who visited an affected domain, connected a wallet and signed an approval or transaction. Kintsu said anyone who connected or signed since about 00:00 UTC on Oct. 31, 2026 should revoke approvals and move funds.
What is StepDrainer?
StepDrainer is the wallet-drainer kit that Blockaid said the 12 hijacked sites were serving. It shows a normal-looking wallet pop-up, then asks for approvals that let the attacker move your tokens.
How much was stolen in the DeFi DNS hijack?
No confirmed total has been published as of 11:00 UTC on Oct. 31, 2026. Blockaid said it was still gathering data, and none of the affected projects has reported a loss figure.
Not financial advice. Crypto assets are volatile and can lose all their value. Always do your own research (DYOR).
Sources
- Blockaid: first alert on flap.sh and kintsu.xyz (Oct. 31, 2026)
- Blockaid: 10 more sites serving StepDrainer (Oct. 31, 2026)
- Kintsu: registrar DNS hijack warning on X
- Flap: progress update and new domain on X
- StakePoint: domain restored, caching warning on X
- Crypto Times: Flap, Kintsu websites hijacked as StepDrainer hits 10 more DeFi sites
