Blockaid detected a frontend attack distributing Step Drainer stealer malware across flap.sh, Kintsu, and 10 other dApps.
Security & Exploits ·
Blockaid identified a frontend compromise serving Step Drainer malware across 12 decentralized applications including flap.sh, kintsu.xyz, pickle.finance, and echelon.market, with users advised to avoid signing transactions on affected sites. Technical analysis traced a JavaScript payload of 1,090,649 bytes uploaded to Irys on October 30, followed by a contract update on Arbitrum at 19:51:22 UTC that rotated the loader pointer via a setDomain function, with the same address controlling the payload upload, contract, and transaction call. Byte-identical loader copies totaling 1.95 MB were recovered from multiple platforms, and a public scan on October 31 at 02:15:35 UTC identified Kintsu's infrastructure matching the malicious hash. Blockaid stated it was investigating and gathering additional data on the ongoing attack.