At least 12 cryptocurrency websites were hit in a coordinated wave of frontend attacks on October 31, after attackers compromised the domain infrastructure serving decentralized finance protocols and token launch platforms and injected malicious code that redirected visitors to wallet-draining pages.

The affected projects include Flap, Kintsu and StonkFun, alongside several other decentralized finance applications. Blockchain security firm Blockaid linked the incidents to StepDrainer, a malicious toolkit built to steal cryptocurrency through fraudulent wallet connections and transaction approvals.

The attacks targeted website infrastructure rather than the underlying blockchain protocols. No comprehensive loss estimate has been confirmed, and investigators have yet to establish whether the affected domains share a single point of compromise.

Blockaid Identifies StepDrainer Across 12 Crypto Websites

Flap, a token launch platform backed by YZi Labs, was the first to sound the alarm, warning that its original domain, flap.sh, had been hijacked and was redirecting visitors to an unauthorized website. In a post on X, the team instructed users to avoid the domain and refrain from connecting wallets or signing transactions while it worked with security partners to contain the incident.

Shortly afterward, Blockaid detected similar activity targeting Kintsu, a Monad-based liquid staking protocol. The security firm subsequently identified 10 additional websites serving StepDrainer, including stonkfun.xyz, pickle.finance, echelon.market, origami.finance, fluxbeam.xyz, stakepoint.app, supswap.xyz, longbow.cash, shprd.finance and apexdefi.xyz, and disclosed the findings in a post on X.

The malicious infrastructure exploited the websites' frontend interfaces, potentially presenting visitors with deceptive transaction requests through otherwise familiar application pages.

Unlike smart contract exploits, DNS hijacking allows attackers to redirect legitimate web addresses toward infrastructure they control, meaning users can encounter malicious wallet prompts even when navigating to a project's recognized domain. StepDrainer can then exploit token approvals and malicious signatures to authorize asset transfers without requiring attackers to obtain private keys. Token approvals are standing permissions that let an address or contract move specified assets on a user's behalf, which is why revoking them is the standard first response projects recommend once an exposure is suspected.

Kintsu confirmed that its domain had been compromised at the registrar level — the layer that controls where a domain's records point — and advised users who connected wallets or signed transactions after 00:00 UTC on October 31 to revoke suspicious token approvals and move potentially exposed assets to secure wallets. The protocol later restored its domain routing but continued warning against wallet interactions while DNS caches propagated the changes, as cached records can keep serving outdated destinations until they expire.

Flap Migrates to New Domain as Investigation Continues

Flap subsequently migrated its platform to flap.cool, recommending that users access the new address directly rather than relying on redirects from the compromised domain. The project said the root cause remained under investigation, including whether the incident originated from its domain service provider, and its team has been coordinating with Blockaid and infrastructure providers Vercel and Name.com.

StonkFun also confirmed that its website was affected, while maintaining that its on-chain operations continued functioning normally. The platform said it was unaware of any affected users at the time of its announcement.

The wave of attacks follows a Polymarket frontend compromise that drained approximately $2.7 million earlier in the week, after malicious JavaScript entered the prediction market's website through a compromised monitoring provider. Similar vulnerabilities have hit DeFi platforms before: in May 2025, Curve Finance suffered a DNS hijacking incident that temporarily exposed visitors to a malicious website even though its underlying smart contracts remained secure.

The incidents underscore a persistent weakness in decentralized applications: blockchain contracts may remain uncompromised while attackers exploit conventional web infrastructure to target users. In each of these cases, the on-chain layers stayed intact while the compromise played out in conventional web components — domain infrastructure in this week's wave, a third-party monitoring provider for Polymarket, and DNS records for Curve.

Investigators have not confirmed the total financial impact or identified the perpetrators, and it remains undetermined whether the affected domains share a single point of compromise or a common registrar or DNS provider. Affected users remain advised to avoid the compromised domains until their respective teams confirm that access is safe.

This article originally appeared on Crypto Adventure.