12 DeFi Websites Hijacked in One Night, $138,000 Drained From Wallets

Twelve crypto websites turned into traps in a single night. People who clicked the usual connect-wallet button were sent to a drainer instead, and about $138,000 has already been traced to three wallets on EVM chains.

Key points:

• Hackers took over 12 DeFi sites late Friday, all registered through Name.com, and rigged them with a wallet drainer called StepDrainer.
• Ten of the domains were frozen at the registrar on Saturday morning, but Flap and Kintsu were still live when the story broke, so the danger was not over yet.
• If you linked a wallet or signed anything on one of these sites after midnight UTC on October 31, revoke those approvals and move your funds to a fresh wallet.

Security firm Blockaid raised the alarm first. Flap, a token launch platform, warned late Friday that its flap.sh address had been hit by a DNS hijacking incident and was sending visitors to a site it did not control. Soon after, Kintsu, a liquid staking protocol on Monad, said its domain had been hijacked at the registrar level, the company that manages the domain name itself.

Blockaid then found the same drainer running on ten more sites: StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance and APEX. Registry records checked by The Block showed Name.com as the registrar for all 12 hijacked domains. Ten of them were put on client hold, which stops a domain from loading at all, at 8:32 a.m. ET on Saturday. Flap and Kintsu were the two not suspended, and both were still working when the report came out.

Read also: Nomad $186M Hack Suspect Extradited to US — Will He Face 20 Years?

What should you do if you clicked connect?

Kintsu told users who connected a wallet or signed a transaction after 00:00 UTC on October 31 to revoke those approvals through Revoke.cash and move any funds at risk to a safe wallet. Flap moved its platform to flap.cool and told users to type that address in directly, not to follow links from the old domain. StonkFun took its site offline, moved to new setup, and said it did not know of any affected users at the time.

My own read is blunt: this was not a bug in a smart contract. It was the front door itself that got swapped, so even careful users on familiar sites were at risk. Watch for what Name.com and Vercel say about how this happened, and whether more domains surface, because a similar front-end hit drained about $2.7 million from Polymarket earlier in the week. Until there is a clear all-clear, treat any of these 12 sites as unsafe unless the project itself says otherwise.

Read also: Trezor Warns CryptoBilis Buyers After Suspected Safe 5 Hardware Implant Report

— BitByLine News Desk

This post is news only, not financial advice. BitByLine never tells anyone to buy or sell crypto, and whether you buy or not is always your own call and your own risk, so do your own research first. Read our full Disclaimer.

Sources: The Block, Crypto.news