Blockaid Names 12 DeFi Front Ends Serving the Step Drainer

Twelve DeFi websites were serving a wallet-draining script in the early hours of Saturday, on a list the security firm Blockaid published and then widened as the night went on. Two of the projects named, Kintsu and Flap, said their domains had been hijacked at the DNS level and were pointing visitors at a page built to empty any wallet that connected. Flap has since moved to a different domain altogether. Nobody has established how many wallets were drained or for how much, the projects included. The attacker is unidentified.

The list widened through the night

Blockaid's first alert named Kintsu, Flap and StonkBrokers and told users to keep off all three; EconoTimes carried it at 2:27 a.m. UTC. A later post added nine more sites under a flat heading.

"These are actively serving the Step Drainer:" Blockaid wrote.

The twelve on the expanded list are Flap, Kintsu, StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance and APEX. A KuCoin bulletin timed 4:04 a.m. UTC carries the same twelve with three of the names spelled differently, ApeX DeFi and SHPRD among them. crypto.news reported on Saturday morning that the screenshots in circulation did not all carry the same list, which is worth knowing before anyone treats a copy of it as complete. Copies of an earlier warning from the researcher known as Ogle also named stonkbrokers.cash. Ogle described an injected script that routed wallet-connect clicks to a drainer page, and that is the mechanism the rest of the day's reporting describes.

What Kintsu told its users to do

Kintsu said the hijack happened at its domain registrar. Its warning covers anyone who visited the site, connected a wallet or signed a transaction at or after 8 p.m. Eastern on Friday, which is midnight UTC on Saturday. Those users were told to cancel the related token approvals, the standing permissions a wallet grants a contract to move funds on its behalf, and to shift whatever remains into a different wallet. By 5:14 a.m. UTC the project said it had the domain back. It kept the warning up anyway, because DNS records take up to an hour to refresh across networks and a visitor could still land on the malicious page in the meantime. The same month brought a phishing link posted from Coldcard's own X account, another case of an official channel turned against the people who trusted it.

Flap is on flap.cool now

Flap confirmed abnormal redirects on its site and began taking the affected front ends offline at about 4:40 a.m. UTC. Its founder, posting as eth_cedric, said the team was working with Blockaid and had asked Vercel and Name.com for help. An hour later the site had moved to flap.cool, with flap.sh to be avoided, and anyone typing the old address is now routed to the new one. Flap has not established the cause. It is looking at whether its domain provider was involved. The founder also said the exposure is narrow, limited to wallets that connected or signed approvals on the redirected page shortly before the warning, with earlier sessions unaffected. That is the project's own account and no independent party has checked it.

Nobody has put a number on it

StonkFun took its site down and rebuilt on new infrastructure. It asked users to wait an hour before connecting again, said everything on chain had been operating normally and added that it was unaware of anyone affected. That is as close to a loss statement as any of the twelve has come. The pattern itself is old: Curve Finance moved to a new domain in May 2025 after a hijack of the same kind, and Polymarket users lost $3.1 million in June to a front-end supply-chain attack delivered through the site they trusted. We could not establish a single loss figure for Saturday's wave. What would settle it sits on chain, in a drainer address and the sum that reached it, and nobody has published either.