Key Notes
- Blockaid’s alerts covered twelve crypto-project frontends, with ten additional domains identified as serving Step Drainer.
- Flap, Kintsu and StonkFun later reported restoration, while broader loss and attribution questions remain unresolved.
- Separately, Chainalysis confirmed customer profile data access without finding evidence of access to investigation content or session tokens.
Blockaid flagged twelve crypto-project websites in a frontend attack involving the Step Drainer toolkit overnight on October 31. Flap and Kintsu confirmed DNS hijacks, while the security firm identified ten more domains serving the same drainer.
Some teams subsequently reported restoring their websites. The disclosures do not establish a campaign-wide loss total, a confirmed attacker or a connection to a separate customer-data incident reported by Chainalysis.
Twelve Domains Named in Blockaid’s Alerts
Blockaid’s initial warning identified possible frontend attacks against Flap and Kintsu. Its follow-up named ten additional sites serving Step Drainer. Together, the alerts covered:
- Flap — flap[.]sh.
- Kintsu — kintsu[.]xyz.
- StonkFun — stonkfun[.]xyz.
- Pickle Finance — pickle[.]finance.
- Echelon — echelon[.]market.
- Origami Finance — origami[.]finance.
- FluxBeam — fluxbeam[.]xyz.
- Stakepoint — stakepoint[.]app.
- SupSwap — supswap[.]xyz.
- Longbow — longbow[.]cash.
- SHPRD — shprd[.]finance.
- ApeX DeFi — apexdefi[.]xyz.
The addresses above are deliberately written without clickable links. Blockaid’s list records what it detected at the time of its alerts; it is not a finding that every listed site remained compromised throughout the day.
Flap, Kintsu and StonkFun Report Restoration
Flap said its domain had been hijacked and was redirecting visitors to an unauthorized website. In a later restoration update, it said its original website and alternative domain were back online. Its preceding update said the root cause remained under investigation.
Kintsu reported a registrar-level DNS hijack. It later said its real website had been restored, while work with the registrar to establish the cause continued. An earlier recovery notice warned that DNS caches could temporarily keep directing some visitors to the malicious version.
StonkFun also reported restoration after taking its website offline and moving infrastructure. The team said onchain operations were functioning normally and it was not aware of affected users. That statement concerns StonkFun, not a verified zero-loss result for the whole campaign.
A DNS hijack can redirect a familiar domain to an attacker-controlled frontend. The resulting risk is that users approve token spending or sign harmful transactions on a convincing imitation. A website compromise alone does not establish that a project’s blockchain contracts were exploited.
What Exposed Wallet Users Should Check
Kintsu’s original warning applied to users who connected or signed from approximately 00:00 UTC on October 31. It advised revoking approvals and moving funds. Users of the other flagged sites should check their project’s official incident notices for the relevant exposure window.
- Stop interacting with a suspicious frontend and verify recovery announcements through the project’s established channels.
- Review recent token permissions on the relevant networks using Revoke.cash or the relevant explorer, and revoke suspicious approvals.
- If harmful transactions were signed or unexpected transfers appeared, assess remaining exposure promptly and follow the affected team’s guidance on moving assets to a fresh, secure wallet.
- If a seed phrase or private key was disclosed, create a wallet with a new seed; merely disconnecting the old wallet or revoking approvals does not repair compromised keys.
Revoke.cash’s guidance explains that disconnecting a website leaves existing approvals active. Revocation can limit further misuse of those permissions, but cannot recover assets already stolen.
Chainalysis Discloses a Separate Data Incident
In an October 30 disclosure, Chainalysis said an external actor used offensive agentic techniques to gain unauthorized access to systems and internal tools. It confirmed access to user IDs, full names, email addresses and organization-role labels.
Based on its investigation so far, the company reported no indication of unauthorized access to investigation graphs, notes or cases, transaction or query results, clear-text passwords, MFA secrets or session tokens. It is determining which customer records were accessed and has engaged outside security experts.
Chainalysis explicitly said its incident was unrelated to the Binance crypto theft. Its statement does not link it to Step Drainer or identify which AI models or tools the attacker used. The company advised vigilance toward unexpected authentication prompts and enabling two-factor authentication.
The distinction between wallet permissions and exposed customer information also runs through CoinScreamer’s coverage of recent financial-sector data incidents and the Keystone customer-data breach. Personal-data exposure can support convincing phishing attempts without itself proving that private wallet keys were stolen.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
