Blockaid Identifies Step Drainer on 12 DeFi Sites After DNS Hijacks

A frontend attack served Step Drainer across at least 12 DeFi websites, including Flap and Kintsu. Separately, Blockaid found that protocol, governance and validator controls secured most funds recovered from 60 major exploits.

CryptoMEV Bot NewsroomOct 31, 20264 min read

Illustration of a shield and lock surrounded by icons for computers, mobile devices, and data on a networked background. — Image: Ludovic5442 / Wikimedia Commons (CC BY-SA 4.0)

Key takeaways

Blockaid identified Step Drainer on 12 DeFi websites, including Flap, Kintsu and StonkFun.
Only $9.8 million, or 0.8%, of $1.18 billion stolen in 60 major 2026 exploits had reached victims by September 2.
Protocol, governance and validator controls secured $90.4 million, or 99.1%, of the funds frozen or returned.

Blockaid’s October 31 alerts identified Step Drainer on at least 12 DeFi websites, according to crypto.news. The incidents exposed how a compromised official domain could direct wallet users toward a malicious page without requiring them to visit a misspelled address.

“Seventeen minutes is an incredibly short window for any security team to detect an attack,” — Ido Ben-Natan, Blockaid co-founder and CEO

What did the October report measure?

A Blockaid report released on October 19 examined 60 major on-chain exploits from January through August 2026, according to Tokenpost.

The 60 incidents involved $1.18 billion in stolen funds. As of September 2, $9.8 million, or 0.8%, had reached victims, while another $81.4 million had been frozen but not returned. Only five of the 60 incidents saw any funds frozen or recovered.

Of the $91.2 million frozen or returned, $90.4 million, or 99.1%, was secured through controls operated by protocols, governance bodies or validators rather than token issuers. Major interventions included approximately $71 million frozen by the Arbitrum Security Council after the Kelp DAO exploit, about $9 million in unauthorized Syscoin tokens burned, and $6.9 million quarantined by Stellar validators after the Blend exploit.

For 59 incidents with available movement data, attackers began moving assets after a median interval of 17 minutes. Funds moved within one hour in 40 cases and during the opening minute in 13, according to data cited in the report.

Security measure or incident figure	Reported value
DeFi websites serving Step Drainer	12
Funds stolen in 60 major exploits	$1.18 billion
Funds returned to victims by September 2	$9.8 million (0.8%)
Funds frozen but not returned	$81.4 million
Incidents with any funds frozen or recovered	5 of 60
Funds secured by protocols, governance or validators	$90.4 million (99.1%)
Median attacker movement delay	17 minutes across 59 incidents

How many websites were affected?

Blockaid’s first warning named Flap and Kintsu and asked users not to interact with either site. Its expanded alert added StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance and APEX, bringing the total to 12 distinct websites.

Blockaid said the added sites were serving the same drainer and that its investigation was continuing. The alerts did not identify a confirmed attacker, establish a victim count or disclose an aggregate loss figure.

An earlier warning from security researcher Ogle described injected code that redirected visitors who pressed a wallet-connection button to a malicious drainer page. Copies of that warning included the address stonkbrokers[.]cash, while Blockaid’s later alerts used a different, broader list.

What happened at Flap and StonkFun?

Flap confirmed a DNS hijack that sent visitors from its legitimate domain to an unauthorized destination. The project asked users not to visit the site, connect wallets or sign transactions while restoration work continued, but it did not name the DNS provider or explain how access to the records was obtained.

StonkFun said its on-chain systems remained operational and that it had received no reports of affected users. The project disabled the frontend and shifted it onto replacement infrastructure before restoring the site. It requested a one-hour pause before wallet connections because some networks could take that long to recognize the change. Neither StonkFun update provided a loss estimate or announced compensation.

The incident followed a similar May 2025 response by Curve Finance, which moved to a different domain after its former address was rerouted to a wallet-draining clone. Curve cited delays involving its registrar, which subsequently froze Curve.fi, and said it planned to add an Ethereum Name Service address as another access route.

Which security controls matter to traders?

The report described controls operated by protocols, governance bodies and validators. Blockaid recommended that protocols decide in advance who may freeze funds and what evidence is required.

Blockaid also recommended continued monitoring of compromised addresses because a transfer to an exchange or a freezable asset could create an intervention window. That recommendation addresses post-exploit fund movement and complements the separate risk in the DNS incidents, where the familiar project domain itself could serve a malicious page.

The latest dated disclosure in the sources is Blockaid’s October 19 report on the 60 major exploits.