DeFi protocol DNS hijack prompts wallet warnings

TLDR

Several DeFi protocols have reported DNS hijacks that redirected their websites to wallet-draining pages, triggering urgent warnings for users to avoid wallet connections and revoke suspicious approvals.

1. Security firm Blockaid found the Step Drainer toolkit on 12 DeFi sites, including Flap and Kintsu, with at least about $138,000 in confirmed theft so far.
2. The attack exploits DNS and frontend redirects, tricking users who connect wallets or sign approvals, while affected projects say their smart contracts and vault funds remain intact.
3. Projects are restoring domains and pausing services, and users are urged to revoke approvals, move funds if exposed, and watch for official all clear notices before reconnecting.

Deep Dive

1. Scope Of The DNS Attacks

On Oct 31, Blockaid reported the Step Drainer toolkit on 12 DeFi websites and warned users not to connect wallets or sign transactions on them, naming Flap, Kintsu, StonkFun, Pickle Finance, Origami Finance, FluxBeam and others as affected frontends linked to active wallet-drainer code. The incident summary from Blockaid was covered by crypto.news.

Subsequent analysis from The Block, relayed via TradingView, found that hijacked sites registered at Name.com were used to trick visitors into approving transfers, with on-chain traces showing about $138,000 in stolen funds, excluding possible losses on Solana and Aptos based projects. Victim counts remain unknown and investigations are ongoing.

2. How The Wallet Drainer Works

Reports describe a classic DNS hijack and frontend compromise, where altered DNS records send users to attacker-controlled pages even when they type the correct project URL, then injected scripts send connect wallet clicks to a drainer site that requests token approvals or signatures. Blockaid and other researchers say the Step Drainer kit is designed to harvest those approvals and move assets from user wallets once harmful permissions are granted.

Flap and Kintsu both confirmed registrar-level DNS hijacks, warning that users who connected wallets or signed transactions during the specified windows should revoke approvals and move funds, while those who only used the legitimate site before the incident are generally not at risk. Kintsus notice, reported by TokenPost, also stressed that the protocols contracts were untouched and the danger was confined to the hijacked frontend.

3. User Precautions And Next Steps

Several affected projects are keeping their frontends down or constrained while they work with infrastructure providers. Origami Finance said DNS is restored but vaults remain paused pending root-cause analysis, and advised users to revoke unfamiliar approvals and wait for an explicit safety confirmation before using the site again, as covered by The Defiant. StonkFun took its site offline, moved it to new infrastructure and told users to wait before reconnecting wallets, noting that on-chain operations stayed normal and no affected users were known yet.

For users who may have visited a compromised domain and clicked connect wallet or signed any approval, the common guidance is to: (1) revoke recent token approvals for those sites using tools such as Revoke, (2) move remaining assets to a fresh wallet if anything suspicious was signed, and (3) avoid returning to the domain until the project issues a clear post-incident security update.

Conclusion

This wave of DNS hijacks highlights that DeFi risk is not only about smart contract bugs, but also about the web and DNS infrastructure that frontends depend on. Attackers are targeting the points where users connect wallets and grant permissions, meaning even safe contracts cannot protect against a compromised interface. Until investigations and fixes are complete, cautious use of approvals, careful URL checking, and close attention to official security notices are key defenses for anyone interacting with DeFi protocols.