A coordinated DNS hijacking campaign using the Step Drainer malware toolkit has hit at least a dozen DeFi frontends, with security firm Blockaid tracing roughly $138,000 in stolen funds so far. The affected domains were all registered through Name.com, public registry records show, and ten were suspended at the registrar level on Saturday morning. The incident began late Friday and continued into October 31, 2026.
Among the compromised sites were Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun, StakePoint, Flap and Kintsu. While StonkFun's team moved to new infrastructure and restored its website, several projects said their on-chain contracts were unaffected and no user losses had been confirmed. Kintsu and Origami Finance have publicly blamed cloud infrastructure firm Vercel, though Name.com and Vercel have not provided detailed public explanations.
Blockaid said the hijacked frontends were rigged with Step Drainer, a malware-as-a-service kit that prompts users to approve malicious wallet transfers after they connect. The Block traced payments through BNB Chain, Ethereum, Robinhood Chain and Monad, with proceeds split among three attacker wallets. On Monad, the attackers redeemed Kintsu's staked MON and withdrew from lending protocol Neverland. The scale of losses on non-EVM chains such as Solana and Aptos remains unclear.
