A coordinated DeFi DNS hijack Step Drainer campaign struck at least 12 decentralised finance websites on October 31, 2026, compromising the domain layer rather than the smart contracts behind the affected protocols. Blockaid, the blockchain security firm, identified the Step Drainer toolkit across affected pages and warned users not to connect wallets or sign transactions while teams investigated. The attack followed the familiar address, making it harder for users to recognise the danger before a wallet prompt appeared.
The campaign ran between October 30 and October 31. Name.com, the registrar involved, said hackers hijacked 15 customer domains, 10 of which were tied to Vercel. Registry records showed that 10 domains were placed on client hold status, which prevents a domain from resolving, before they were restored. Name.com acknowledged that domains had been improperly redirected and advised customers to review their DNS settings and enable two-factor authentication.
Blockaid’s initial alert named Flap and Kintsu as possible frontend attack targets. A later alert listed 10 more domains that it said were actively serving Step Drainer: StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance and APEX. Combined with Flap and Kintsu, the list covered 12 distinct websites.
DeFi DNS hijack Step Drainer: How the DNS hijack reached DeFi users
DNS acts as the internet’s address book. It converts a domain name into the location where a browser should connect. When attackers change those records, a user can enter the correct address, see a convincing website and still be directed to infrastructure controlled by someone else. That was Flap’s reported experience: its legitimate domain redirected visitors to an unauthorised destination without requiring a typo, an unsolicited message or an obvious imitation URL.
An earlier warning from security researcher Ogle described an injected script that sent visitors who clicked a wallet connection button to a malicious drainer page. Step Drainer then used fraudulent token approvals and malicious signatures to authorise asset transfers. The attackers did not need a user’s private key if the user approved the wrong transaction.
Flap confirmed that its official address had been hijacked and asked users to stay away until further notice. The team did not identify the provider responsible for the compromised records or explain how the attacker gained access. It later migrated the platform to flap.cool and asked users to reach the new address directly rather than relying on a redirect from the compromised domain. Flap is a token launch platform backed by YZi Labs.
Kintsu confirmed that its domain had been compromised at the registrar level. It advised anyone who had connected a wallet or signed transactions after midnight UTC on October 31 to revoke suspicious token approvals and move potentially exposed assets to secure wallets. Although the team restored domain routing, it warned that DNS caches could take time to propagate, leaving some visitors on the malicious destination even after records were corrected.
What Step Drainer exploited
The defining feature of the campaign was that the targeted projects’ smart contracts remained intact. There was no confirmed contract flaw, bridge exploit or private-key compromise at the protocol layer. Instead, attackers changed the path between a user and those contracts by compromising DNS records.
That distinction makes the incident a supply-chain attack. The direct targets may have been individual protocols, but the attackers reached them through infrastructure shared by multiple customers. Registrars, domain accounts, hosting controls and nameserver management became the effective attack surface even though the visible consequences appeared on DeFi frontends.
Some teams that moved nameservers to providers such as Vercel or Cloudflare appear to have fared better. Their response shortened the time during which the compromised records could direct visitors to malicious pages. Registry holds also created a period in which affected domains did not resolve, sacrificing access to prevent further exposure.
Exactly how the attackers reached the registrar layer remains unknown. Investigators were still working to identify the entry point, which could have involved compromised internal systems, stolen customer credentials or another method. No confirmed explanation should be treated as final while that work is continuing.
Projects responded with warnings and relocations
StonkFun confirmed that its website had been affected and said its on-chain operations were functioning normally. The project also said it was unaware of any affected users and did not provide a loss estimate or announce compensation. It took the site offline and moved it to new infrastructure, then asked users to wait an hour before connecting a wallet because some networks might need that long to recognise the change.
Flap and Kintsu took different protective approaches because their circumstances differed. Flap focused on directing users to a new domain after the original address began redirecting traffic. Kintsu restored routing but continued warning against wallet interactions while cached records cleared and advised users to examine approvals. These responses show why a restoration announcement alone is not enough. Users need to know whether cached DNS, browser state or a wallet approval creates continuing exposure.
Loss estimates put the on-chain damage at approximately 138,000 dollars. That figure is an estimate rather than a final company-confirmed total, and Blockaid’s initial alerts did not provide an aggregate loss figure or a victim count. StonkFun said it was unaware of affected users, but the available project statements do not establish that no other user connected during the relevant period.
Why familiar URLs are not enough
The uncomfortable part of this campaign is that careful users had very little obvious warning. The domain shown in the browser bar was the legitimate one, and the site could resemble the project users expected. A misspelled address, an unsolicited promotion or an obvious visual mismatch would have provided a clue. Here, the compromise existed at the layer that made the familiar address trustworthy in the first place.
That places greater emphasis on wallet-level controls, readable transaction prompts and transaction simulation. Users should inspect what an approval grants, avoid connecting a wallet merely because a familiar domain resolves, and verify urgent migration notices through a project’s official channels. Revoking suspicious token approvals can reduce exposure, but it does not undo every transfer that has already completed.
For protocol teams, the incident is an operational-security lesson as much as a cybersecurity one. A registrar account should receive stronger controls than a routine administration login. Teams can enable two-factor authentication, use restricted access, monitor DNS changes, maintain an emergency procedure for changing nameservers and publish a verified fallback domain before an incident occurs.
Domain management may sit outside a protocol team’s core engineering work, but users experience a frontend compromise as a failure of the protocol’s brand. The same applies to users who never interact with the smart contract directly and rely only on the website.
A recurring risk for decentralised finance
This was not the first time attackers have used the domain layer to reach decentralised finance users. In May 2025, Curve Finance migrated to a new domain after attackers redirected its original site to a wallet-draining clone. The team said delays in the registrar’s response contributed to its decision. The registrar later froze Curve.fi, and Curve confirmed plans to add an Ethereum Name Service address as another route to its service.
The same week also brought a separate frontend compromise at Polymarket, where malicious JavaScript entered the prediction market’s website through a compromised monitoring provider. That incident drained approximately 2.7 million dollars. Although the entry route differed, both events showed that secure contracts do not guarantee secure access to their interfaces. The DeFi DNS hijack Step Drainer campaign is a reminder that the weakest link in a decentralised finance stack is often the registrar that resolves its name, not the smart contract it points at.
The DeFi DNS hijack Step Drainer campaign reinforces that divide between code and infrastructure. Immutable contracts and trustless settlement can protect funds after a transaction, but they cannot stop a hijacked domain from delivering a malicious interface. Until investigators establish the registrar entry point and affected accounts, the practical response is to treat DNS and domain credentials as critical financial infrastructure. The DeFi DNS hijack Step Drainer campaign is a reminder that users face risk one layer above the blockchain, even when the code behind the protocol remains uncompromised.