SECURITY ALERT

The address bar was right.

The website behind it was not.

At least a dozen decentralised finance websites, including the token launchpad Flap and the staking protocol Kintsu, were serving a wallet drainer early on Saturday after their domains were hijacked, security firm Blockaid said on X.

A drainer is a fake site that asks you to sign a transaction or approval, then uses it to empty your wallet.

No losses have been reported yet.

Only Flap and Kintsu have confirmed the hijacks themselves. The other ten sites are on Blockaid’s list, which it says it is still building.

What we know so far

  • 02:13 UTC. Flap says its official website is affected by a DNS hijacking incident and is redirecting to an unauthorised site. DNS is the system that points a web address to a server.
  • 02:21 UTC. Blockaid issues a community alert naming flap.sh, kintsu.xyz and stonkbrokers.cash. At 02:54 UTC it edits the alert to name only Flap and Kintsu.
  • 03:16 UTC. Blockaid says the same attack is on ten more sites, all “actively serving the Step Drainer”: stonkfun.xyz, pickle.finance, echelon.market, origami.finance, fluxbeam.xyz, stakepoint.app, supswap.xyz, longbow.cash, shprd.finance and apexdefi.xyz.
  • 03:35 UTC. Kintsu confirms a DNS hijack at its registrar and tells anyone who connected or signed since about 00:00 UTC to revoke approvals and move funds.
  • 04:11 UTC. Kintsu says its domain, registered through Vercel Domains, was hijacked “at the registrar level” in what “appears to be a supply chain attack outside of our control”.
  • 04:15 UTC. Kintsu says its domain is restored, but some networks may show the malicious site for up to an hour. It asks users to stay away until it posts an all-clear.
  • 04:27 UTC. Flap’s founder, who posts as Cedric, says the team is working with Blockaid and contacting Vercel and the registrar Name.com. “Other protocols may also be affected,” he wrote.

The link to Vercel is Kintsu’s assessment.

We found no public statement from Vercel on X as of 04:50 UTC.

Flap’s founder said in an earlier post, in Chinese, that the risk is limited to users who opened the redirected site and connected or signed in the tens of minutes before Flap’s warning. Flap does not store keys or recovery phrases, he said.

If a project fixes its records and the old address still loads the trap for an hour, when is it safe to go back?

What to do

If you connected a wallet or signed anything on one of these sites since about 00:00 UTC on 31 Oct, revoke token approvals with a tool such as Revoke.cash and move your funds to a fresh wallet, as Kintsu advises.

Do not open the sites until each project posts an all-clear on its official account.

This is the second front-end compromise in three days, after the Polymarket incident on Thursday, where the attack came through a third-party script.

Protect yourself

  • Treat any unexpected “approve” or “permit” request as hostile, even on a site you use every day.
  • Read what a signature does before you sign it. A swap should not ask for unlimited spending of every token you hold.
  • Keep long-term holdings in a wallet that never connects to DeFi sites; our wallet security guide explains how to split them.
  • Check the project’s official X account before you connect after an outage.

Twelve addresses. Twelve signposts turned the wrong way.

How many users signed before the first warning went out?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.