Overview
- Blockaid said on Oct. 31 that it had identified the Step Drainer toolkit actively served on 12 DeFi and token-launch websites and issued emergency alerts asking users not to interact with the named domains.
- Flap confirmed a DNS hijack that redirected its official domain to an unauthorized site and warned users not to visit, connect wallets, or sign transactions while it works to restore safe access.
- StonkFun took its site offline, moved to new infrastructure, and later restored service while advising users to wait an hour before reconnecting wallets to allow networks and DNS changes to propagate.
- Security researcher Ogle and incident reports show Step Drainer works by injecting frontend scripts that redirect wallet-connection clicks into malicious flows that request token approvals rather than stealing private keys directly.
- Investigations are ongoing with no confirmed attacker, victim count, or loss total so far and teams have urged users to revoke suspicious approvals, follow official project channels, and avoid the listed domains until explicit all-clear notices appear.