Blockchain security firm Blockaid issued an alert on October 31, 2026, coinciding with Halloween, regarding frontend attacks targeting at least 12 DeFi protocol websites. Hackers injected a balance-draining toolkit dubbed Step Drainer directly into the affected protocols’ official domains.
What makes this attack especially dangerous is not phishing link deception, but the vector itself: users navigated to legitimate domains with authentic addresses. Impacted platforms identified include Flap, Kintsu, StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance, and APEX.
How Wallet Buttons Redirect Users
Security researcher Ogle revealed the exploit planted by the attackers across the victim interfaces. Malicious scripts were embedded directly into crypto wallet connection buttons. Visitors clicking the button to connect their wallets were not taken through standard integration flows, but were instead immediately redirected to Step Drainer malicious sites.
The Flap development team confirmed the incident originated from a domain name system (DNS) hijack. Through this DNS hijack, Flap’s official domain routed users to unauthorized destinations without requiring victims to click external third-party links. Anyone opening the protocol’s authentic address in their browser was immediately served the compromised frontend interface.
Flap urged users to avoid visiting the site, refrain from connecting crypto wallets, and decline signing any transactions until the recovery process is concluded. The advisory was issued to keep users from interacting with interfaces still under attacker control.
StonkFun Protocol Server Migration
The StonkFun protocol confirmed that its domain was also impacted by a similar attack. In response, the development team temporarily took down their website to sever visitor access to pages hosting the malicious script.
StonkFun subsequently migrated its entire infrastructure to a new server to re-establish secure access pathways. The developer team confirmed that on-chain protocol operations continued to function normally throughout the migration, with no user fund losses reported.
What Remains Unknown
Although 12 victim platforms have been documented, the total financial damage from the October 31, 2026 attacks has not yet been determined. As of Blockaid’s warning release, no aggregate loss estimates have been officially disclosed by investigators or affected project teams.
The identities and threat actors behind the deployment of Step Drainer have also not been publicly identified. For DeFi users who visited these protocols on October 31, 2026, guidance from the Flap team serves as a critical benchmark: steer clear of affected domains and reject any transaction signature requests until further clearance is confirmed.
Reported via crypto.news.
Also read: What Is DeFi (Decentralized Finance)?
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
