Everything

DeFi

Security

Domain

Connect

<h2 id="span-span-style-font-size-16px-blockaid-flags-a-wider-stepdrainer-attack-on-crypto-sites-span-span">Blockaid Flags a Wider StepDrainer Attack on Crypto Sites</h2>
This <a href="https://www.coingabbar.com/en/crypto-news-english" rel="noopener noreferrer nofollow">latest crypto news</a> update covers the StonkFun domain attack flagged by security firm Blockaid on October 31, 2026. The firm first warned of a possible frontend attack on flap.sh and kintsu.xyz, then widened its alert to more platforms.
<img alt=" Blockaid Official X Post" src="https://d3iuzwoiyg9qa8.cloudfront.net/webadmin/storage/public/commonEditerImage/rvxPUOubJ9wOpD2j3HiO4nE2vUlTh1WVrMBcTuMn.jpg" width="300" height="574" title=" Blockaid Official X Post">
According to&nbsp;<a href="https://x.com/blockaid_/status/2116368762488107157" rel="noopener noreferrer nofollow">Blockaid on X</a>, the same attack was found on additional websites actively serving the drainer kit:
<ul>
 <li>stonkfun[.]xyz</li>
 <li>pickle[.]finance</li>
 <li>echelon[.]market</li>
 <li>origami[.]finance</li>
 <li>fluxbeam[.]xyz</li>
 <li>stakepoint[.]app</li>
 <li>supswap[.]xyz</li>
 <li>longbow[.]cash</li>
 <li>shprd[.]finance</li>
 <li>apexdefi[.]xyz</li>
</ul>
Blockaid said it is actively investigating and gathering more data. 
<h3 id="span-span-style-font-size-16px-official-response-website-offline-while-on-chain-stays-normal-span-span">Official Response: Website Offline While On-Chain Stays Normal</h3>
StonkFun, a Solana token launchpad that lets creators pair new coins with tokenized stocks or ETFs, confirmed the impact on&nbsp;<a href="https://x.com/LaunchOnSF/status/2116395221428961444" rel="noopener noreferrer nofollow">its official X account</a>. The team asked users not to visit the platform or connect a wallet until it was confirmed safe.
<img alt="StonkFun Official X Post" src="https://d3iuzwoiyg9qa8.cloudfront.net/webadmin/storage/public/commonEditerImage/uihT5Bx4JbogYB7yXXj9cGEa1wND75JE8XJtoSUO.jpg" width="300" height="388" title="StonkFun Official X Post">
It also said only the website was affected. Everything on-chain was working as normal, and no affected users were known at that time.
Later, the team shared a&nbsp;<a href="https://x.com/LaunchOnSF/status/2116413680653087124" rel="noopener noreferrer nofollow">restoration update</a>. The website was taken offline and moved to new infrastructure. Some networks can take up to an hour to pick up the change, so users were told to wait an hour before reconnecting.
<img alt="StonkFun Restoration Update on X " src="https://d3iuzwoiyg9qa8.cloudfront.net/webadmin/storage/public/commonEditerImage/Jd5QOdts5WQhM9SxCiqWN7EvaXXzPTAcjC3K2pKy.jpg" width="300" height="354" title="StonkFun Restoration Update on X ">
<h3 id="span-span-style-font-size-16px-what-is-stepdrainer-and-how-does-the-wallet-drain-work-span-span">What Is StepDrainer, and How Does the Wallet Drain Work?</h3>
StepDrainer is a <a href="https://www.coingabbar.com/en/crypto-currency-news/ms-wallet-drainer-targets-ethereum-bnb-and-evm-chains" rel="noopener noreferrer nofollow">wallet drainer</a> toolkit sold as malware-as-a-service in cybercrime circles. Security reports say it supports more than 20 blockchain networks.
The kit injects malicious scripts into a compromised page. When a user clicks Connect Wallet, the script can request a harmful token approval, often an unlimited allowance, or an off-chain signature such as a Permit2-style permit. Once approved, the attacker can move assets without a seed phrase or private key.
The StonkFun domain attack targeted the website frontend. The smart contracts were not broken, and no private keys were stolen. Early reports suggest the attackers got in through DNS or hosting access, but Blockaid is still investigating, so that detail could change.&nbsp;
<h3 id="span-span-style-font-size-16px-who-is-at-risk-after-the-stonkfun-domain-attack-span-span">Who Is at Risk After the StonkFun Domain Attack?</h3>
Anyone who connected a <a href="https://www.coingabbar.com/en/best-crypto-wallets-october-2026-6-picks-for-secure-holdings" rel="noopener noreferrer nofollow">crypto wallet</a> or signed an approval on an affected domain during the active window may be exposed. Users who never touched a wallet prompt are generally not at risk.
If you interacted with a listed domain, check and revoke token approvals. Tools <a href="https://revoke.cash" rel="noopener noreferrer nofollow">such as Revoke.cash</a> are often suggested for this.
<ul>
 <li>Avoid the listed domains until each project confirms it is secure.</li>
 <li>Revoke unneeded approvals if you connected during the incident.</li>
 <li>Trust only official project accounts for updates.</li>
</ul>
<h3 id="span-span-style-font-size-16px-why-frontend-security-still-matters-for-defi-platforms-span-span">Why Frontend Security Still Matters for DeFi Platforms</h3>
For <a href="https://www.coingabbar.com/en/binance-wallet-new-defi-security-update-bitget-hack-2026" rel="noopener noreferrer nofollow">DeFi security</a>, a safe contract is only half the picture. A hijacked website can still trick users into signing harmful permissions.
The StonkFun domain attack shows that on-chain safety and website safety are separate layers. Blockaid expects to share more technical details, so this news may be updated as the investigation moves forward.
Disclaimer: This article is for educational and informational purposes only and should not be considered financial or investment advice. Always conduct your own research before making investment decisions.

StonkFun Domain Attack: Site Restored After StepDrainer Alert

Table of Contents

Coingabbar

Other articles published on Oct 31, 2026

Join our free newsletter for daily crypto updates!