StepDrainer Targets 12 Crypto Websites in DNS Attack
StepDrainer, a wallet-draining toolkit, was detected across at least 12 cryptocurrency websites on October 31 after attackers compromised domain infrastructure. Affected projects include Flap, Kintsu and StonkFun, as well as several DeFi applications. The attacks targeted website frontends, not the underlying smart contracts, and could expose visitors to deceptive wallet connections, transaction approvals or signatures. Kintsu urged users who interacted with its site after 00:00 UTC to revoke suspicious token approvals and move potentially exposed assets. Flap moved its platform to flap.cool, while teams investigated how the domains were compromised. No confirmed estimate of losses or identified attackers has been reported. The StepDrainer incidents follow a separate Polymarket frontend compromise that reportedly drained about $2.7 million earlier in the week, highlighting the risks of DNS and other web infrastructure attacks in crypto.
Bearish
The incidents are bearish for near-term sentiment toward affected DeFi projects and the wider crypto ecosystem because users may face wallet-draining prompts even when visiting familiar domains. Traders may respond by avoiding affected sites, revoking token approvals, withdrawing liquidity or reducing exposure to related tokens. The risk is heightened by uncertainty over the number of compromised users and the absence of a confirmed loss estimate. The article also cites a Polymarket frontend compromise that reportedly caused about $2.7 million in losses, as well as a previous Curve Finance DNS hijacking incident. These cases show that smart contracts can remain intact while weaknesses in conventional web infrastructure put users and funds at risk. In the short term, news of further compromises or losses could increase volatility and pressure sentiment across DeFi. Over the longer term, the impact on the broader market may be limited if affected domains are secured and losses remain contained. Stronger domain security, monitoring and user warnings could help restore confidence, but repeated attacks may prompt traders to demand higher security standards and apply a risk discount to vulnerable platforms.