DeFi Website Hack Hits a Dozen Sites as Attackers Hijack Domains to Drain Wallets

A DeFi website hack that unfolded late on Friday, October 30, and into October 31 has become one of the clearest reminders yet that decentralised finance does not live only on blockchains. The attack did not break a smart contract, exploit a lending pool, or find a flaw in a protocol’s code. Instead, it struck the ordinary web layer that sits in front of those protocols, the domain names and websites that users trust when they click through to trade, stake, or lend. Security researchers at Blockaid flagged malicious code on at least a dozen DeFi websites, and the incident quickly drew attention across the industry because of how quietly it worked and how familiar its targets looked.

According to the reports, the affected websites were carrying a malicious toolkit known as StepDrainer, a crypto wallet drainer designed to trick visitors into approving transactions that empty their wallets. Users who visited a compromised site during the window of exposure and connected a wallet could have been presented with what looked like a routine interaction, only for that interaction to hand control of their funds to the attacker. The scale of the confirmed losses so far is about $138,000, traced on EVM networks across three wallets. That figure is described as a partial tally, because it does not include any possible losses on other networks such as Solana or Aptos, where activity may not yet have been traced or confirmed.

The list of named sites gives a sense of how broad the campaign was. Blockaid identified at least 12 DeFi websites carrying the malicious toolkit, including Flap, Kintsu, Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun, and StakePoint, along with four others. These are not household names to the wider public, but within DeFi they are working applications with real users, real liquidity, and real communities. That is precisely what makes a campaign of this kind so dangerous. Attackers do not need to compromise the most famous protocol in the space if they can compromise a dozen smaller front ends at once and harvest approvals from users who have no reason to suspect that a familiar website has changed hands behind the scenes.

How the DeFi website hack unfolded

The common thread linking all 12 sites was their domain registrar. Every one of the domains identified by Blockaid was registered through Name.com, a subsidiary of Identity Digital. That shared detail quickly became the focus of the investigation, because it suggested a single point of failure rather than a dozen separate breaches. If an attacker gains a foothold at the registrar level, or in the accounts that manage those domains, they can redirect traffic, alter the content served to visitors, or point a domain at infrastructure they control. For users, nothing about the familiar web address changes, which is why the deception can be so effective.

The response from the registrar side came on the morning of October 31. Around 8:32 a.m. ET, 10 of the affected domains were placed under a registrar “client hold” suspension, a status that stops the domain from resolving in the Domain Name System. In practical terms, that meant visitors could no longer reach the compromised websites through those addresses, cutting off the attacker’s supply of new victims. Two domains, however, were not suspended at that stage. The domains belonging to Flap and Kintsu remained operational when the incident was first reported, leaving a window in which users could still reach those sites and potentially interact with malicious content.

Name.com later said that 15 customer domains were affected, a larger number than the 12 identified by Blockaid. In its statement, the company said it had identified unauthorised activity late on Friday, October 30, that redirected a number of domains. It added that it had restored all affected domains, was working with account holders, was investigating the incident, and was taking steps to secure accounts. By late Saturday morning, the suspensions had been lifted, the domains were resolving again, and transfer locks had been applied. That sequence matters, because it shows both how quickly a registrar can contain this kind of incident and how much damage can still be done in the hours before containment.

What StepDrainer malware does to wallets

StepDrainer is described as a multichain malware-as-a-service kit, a product sold or rented to criminals rather than built from scratch by each attacker. Research from LevelBlue’s SpiderLabs has documented the toolkit operating across more than 20 chains, which helps explain why investigators are cautious about treating the $138,000 figure as a final total. A kit that works across many networks can be deployed wherever victims are found, and tracing losses across all of those networks takes time, especially when some chains have different tooling and different levels of public visibility.

The core trick of a crypto wallet drainer is social and technical at the same time. A drainer does not usually need to steal a private key or a seed phrase, although phishing pages often try to do that as well. Instead, it presents a transaction that looks legitimate and asks the user to approve it. That approval may grant permission to move tokens, or it may exploit token standards that allow a third party to transfer assets on a user’s behalf once permission has been given. Once the approval is signed, the attacker can drain the approved assets, often in a single transaction or a rapid series of transactions, before the victim realises what has happened.

Why the domain layer is DeFi’s weak spot

Decentralised finance is often described as trustless, but in practice most users still reach it through very traditional, centralised infrastructure. They type a domain name into a browser, they trust the Domain Name System to take them to the right server, and they trust the website they see to be the genuine front end of the protocol they want to use. Smart contracts may be immutable and transparent, but the website that helps a user interact with those contracts is not. It can be changed, redirected, or replaced, and the user may have no easy way to tell.

This DeFi website hack is a reminder that the attack surface of a protocol includes everything around it: the domain registrar account, the email account used to recover that registrar account, the hosting provider, the content delivery network, and the people who hold credentials for each of those services. A single compromised account at the registrar level can affect many projects at once, as this incident shows. It also means that a project’s security posture cannot be judged by its smart contract audits alone. Audits matter enormously, but they say nothing about whether the project’s domain account uses strong authentication, whether its team members are protected against phishing, or whether its registrar supports locks and alerts that would slow an attacker down.

What users were told to do after the attack

Kintsu, one of the two projects whose domain was not suspended in the first wave, gave users detailed guidance that is worth repeating because it applies well beyond this single incident. The project advised users who had interacted with its site after midnight UTC on October 31 to revoke ERC-20 allowances and Permit2 authorizations through Revoke.cash, a tool that lets users inspect and cancel token approvals. It also advised those users to move any remaining assets to fresh, hardware-backed addresses, and to wait for DNS caches to flush before reconnecting to the site.

Each part of that advice addresses a different part of the risk. Revoking allowances removes the standing permission that a drainer relies on to move tokens after the initial approval. Moving assets to a fresh address, ideally one controlled by a hardware wallet, reduces the chance that a compromised approval or a leaked piece of information can still be used against the same wallet. Waiting for DNS caches to flush recognises that even after a domain is restored, some internet providers and devices may still hold the old, malicious routing information for a period, and reconnecting too early could send a user back to the attacker’s infrastructure.

A pattern the industry has seen before

This is not the first time attackers have targeted DeFi through the domain layer, and that history is part of why the incident has resonated. In November 2025, Aerodrome and Velodrome were hit in a similar kind of incident, and in October 2023, Galxe suffered an attack linked to a Dynadot account compromise. In each case, the underlying smart contracts were not the point of failure. The failure was in the web infrastructure around them, and the victims were ordinary users who trusted a familiar front end.

FAQ

What happened in this DeFi website hack?

Attackers hijacked domains belonging to at least a dozen DeFi websites registered through Name.com and placed malicious StepDrainer code on those sites, tricking visitors into approving transactions that drained their wallets. About $138,000 has been traced so far on EVM networks, and that total may rise as investigators check other chains.

Were the DeFi smart contracts hacked?

No. The smart contracts were not compromised in this incident. The attack hit the Web2 and domain layer, meaning the websites and domain routing that users rely on to reach the protocols, rather than the on-chain code of the protocols themselves.

What should I do if I visited one of the affected sites?

If you interacted with an affected site after midnight UTC on October 31, follow the guidance issued by Kintsu: revoke ERC-20 allowances and Permit2 authorizations via Revoke.cash, move remaining assets to a fresh hardware-backed address, and wait for DNS caches to flush before reconnecting. Checking your token approvals is a sensible precaution even if you are unsure about the timing.

How can I avoid wallet drainers in future?

Slow down at the approval screen and read exactly what a transaction authorises before signing it. Be suspicious of unexpected approval requests, especially on a site that has recently reported an incident, and verify official website addresses through a project’s trusted channels rather than relying on a single link or search result.

Source: The Block via TradingView

Related reading on MM Crypto Analysis Web

• Aave Reopens All Markets After Binance Hack, Keeps Nine Tokens at Zero LTV
• Chainlink Falls 21% in October Despite 18 Days of Exchange Outflows
• Hifi Finance Governance Attack Drains $1 Million in User Collateral

More in DeFi on MM Crypto Analysis Web.