A cyber attack compromised domains of 15 DeFi projects, leading to theft of over $200K in digital assets.
A cyber attack has targeted 15 decentralized finance (DeFi) projects, redirecting users to fraudulent pages in an effort to steal digital assets. Cybersecurity firm Blockaid reported the incident, which occurred overnight on October 30-31.
🚨 Community Alert: Our system has detected a potential frontend attack targeting @flapdotsh and @Kintsu: Please refrain from signing transactions and avoid interactions with these dApps until the issue is resolved.
— Blockaid (@blockaid_) October 31, 2026
The affected projects include Flap, Kintsu, Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun, and StakePoint. Initially, Blockaid identified malicious pages on 12 sites, later confirmed by Name.com, which managed the domain names and reported unauthorized redirections.
We’re aware a number of domains at https://t.co/4CEHuFgI4A were improperly redirected... The affected domains have been restored.
— name.com (@namedotcom) October 31, 2026
Name.com has since regained control over the compromised domains and is enhancing security for customer accounts while investigating the breach.
Details of the Attack
Attackers manipulated DNS settings, allowing legitimate domain names to redirect users to counterfeit sites. On these fraudulent pages, Blockaid discovered a malicious tool called Step Drainer, designed to siphon cryptocurrencies from connected wallets.
Victims were prompted to authorize operations that seemed legitimate within the DeFi protocols but actually enabled hackers to withdraw tokens or gain control over user positions.
Step Drainer was marketed as malware-as-a-service, with its source code valued at approximately $750. Alternative options were cheaper but provided developers with a 20% cut of stolen funds. Onchain data indicated that the stolen assets were distributed among three wallets.
The total losses across 32 wallets on six blockchains were estimated at $202,386, with a single wallet on Monad suffering losses of $160,531, accounting for about 79% of the total damage.
For several hours on 31 October, 12 DeFi websites registered... led visitors to copies run by an attacker... Four in five of those dollars came from a single Kintsu staker on Monad, who lost $160,531.
— Bitquery.io ( Bloxy ) (@Bitquery_io) November 1, 2026
Some stolen tokens remained in a staking withdrawal queue as of the evening of October 31, with Kintsu tokens valued at around $56,600 still unclaimed by the hackers.
The full extent of the losses is unclear, as the Bitquery estimate does not account for potential thefts on Solana and Aptos networks.
Investigation Underway by Name.com and Vercel
All initially reported sites were registered through Name.com, using various DNS infrastructure providers, including Cloudflare and Vercel. Kintsu indicated that the issue arose from Vercel, while Origami Finance reported attacks on associated name servers.
Vercel has acknowledged that ten of the affected domains were tied to its platform, and Name.com has restored their functionality while assisting with the investigation. The root cause of the compromise remains unknown, and no company has detailed how attackers gained access to modify domain settings.
Developers from Kintsu, Origami Finance, FluxBeam, and StonkFun confirmed that their smart contracts were unaffected by the incident. This comes on the heels of another security breach on October 29, where attackers stole over $2.73 million from users of the Polymarket prediction market by exploiting a compromised software supplier.
