DNS hijacks hit 12 crypto sites in drainer campaign
Security & Exploits ·
Security researchers traced a wave of frontend compromises to a wallet-draining tool after Flap and Kintsu reported their domains had been hijacked.
Blockaid first raised an alert on suspicious activity tied to Flap and Kintsu, then expanded its findings to cover ten more domains serving the same malicious script, known as Step Drainer, according to a report. The affected sites include pickle[.]finance, origami[.]finance, and fluxbeam[.]xyz, bringing the total count of implicated websites to 12. Blockaid said the review of the campaign's scope remains active.
Flap and Kintsu both acknowledged that their domain name systems had been tampered with, redirecting visitors away from legitimate infrastructure. Each project told users to steer clear of their sites entirely until further notice, specifically cautioning against linking wallets or approving any pending transactions while the hijacks were unresolved.
Flap's founder, identified as Cedric, said the exposure was limited to a narrow window: anyone who had connected to the real Flap site before the hijack took hold was not at risk. The exposure applied to those who landed on the spoofed version and either linked a wallet or approved a transaction during the tens of minutes before the warning went out.
Kintsu set a firmer timestamp, telling users who had interacted with its site from roughly 00:00 UTC on October 31 onward to treat any approvals as compromised, revoke them, and relocate funds as a precaution. Both teams said they would issue updates once their respective websites could be confirmed safe to use again.
What remains unclear is the full list of the ten additional domains beyond the three named, how the Step Drainer tool was deployed across so many unrelated projects, and whether any funds were actually extracted from affected wallets. Blockaid's ongoing investigation may fill in those gaps as more domains are checked and the drainer's distribution method is mapped.