<ul>
 <li>Blockaid identified 12 hijacked sites serving Step Drainer, including Flap and Kintsu.</li>
 <li>All 12 domains shared a registrar, but investigators have not confirmed where attackers gained access.</li>
 <li>The $138,000 traced to three wallets excludes any losses on Solana or Aptos.</li>
</ul>
Attackers hijacked 12 DeFi websites late Friday, steering visitors from familiar addresses to pages designed to drain their crypto wallets. Security firm<a href="https://x.com/blockaid_/status/2116368762488107157" rel="noopener noreferrer nofollow"> Blockaid identified Step Drainer</a> across the affected sites. By Saturday morning, The Block had traced about $138,000 to three wallets. Its estimate excludes any losses on Solana or Aptos, and the number of victims remains unknown.<a href="https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">&nbsp;</a>
<h2 class="wp-block-heading" id="how-hijacked-defi-websites-led-users-to-step-drainer">How Hijacked DeFi Websites Led Users to Step Drainer</h2>
<a href="https://x.com/flapdotsh/status/2116352828734050339" rel="noopener noreferrer nofollow">Flap confirmed</a> that its official address redirected visitors to an unauthorized site. A user could type the correct address and still reach the attacker’s page because the underlying domain records had changed.
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet">
 Our official website, <a href="https://t.co/9FwWnFw4KX" rel="noopener noreferrer nofollow">https://t.co/9FwWnFw4KX</a> , is currently affected by a DNS hijacking incident and is redirecting to an unauthorized website. Please do not visit the site, connect your wallet, or sign any transactions until further notice. We are actively working to restore it…— Flap (@flapdotsh) <a href="https://x.com/flapdotsh/status/2116352828734050339?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 31, 2026</a>
 </blockquote>
 </div>
</figure>
The drainer prompted visitors to connect a wallet and authorize transactions that moved assets out. The distinction matters: opening one of the DeFi websites was not, by itself, evidence that a visitor lost funds. Kintsu, Origami Finance, FluxBeam and StonkFun said their smart contracts remained unaffected.<a href="https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">&nbsp;</a>
The payment trail showed a consistent pattern. Three wallets received proceeds in shares of 15%, 55% and 30% across several networks. On Robinhood Chain,<a href="https://robin.etherscan.io/tokentxns?a=0x5aff449b63c033Df386aF0C45384cd20c5918dBf" rel="noopener noreferrer nofollow"> transaction records</a> showed one wallet withdrawing tokenized Apple and Nvidia shares from Morpho before swapping them for ETH.<a href="https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">&nbsp;</a>
<h2 class="wp-block-heading" id="defi-websites-shared-a-registrar-but-used-different-nameservers">DeFi Websites Shared a Registrar but Used Different Nameservers</h2>
All 12 DeFi websites used Name.com as their registrar, according to public records reviewed by The Block. Their nameservers varied across Cloudflare, Vercel and Name.com. The common registrar narrows the investigation but does not establish which company or account the attackers compromised.<a href="https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">&nbsp;</a>
At 8:32 a.m. ET Saturday, 10 domains received a registrar-level hold that stopped their addresses from resolving. Flap and Kintsu were the two exceptions.<a href="https://x.com/origami_fi/status/2116463174652457332" rel="noopener noreferrer nofollow"> Origami said</a> it would keep its vaults paused while awaiting findings from Vercel and Name.com.<a href="https://www.theblock.co/news/defi/2026-10-31-hackers-hijack-a-dozen-defi-websites-all-registered-with-name-com-and-steal-about-138000-432251?utm_source=chatgpt.com" rel="noopener noreferrer nofollow">&nbsp;</a>
StonkFun <a href="https://x.com/LaunchOnSF/status/2116413680653087124" rel="noopener noreferrer nofollow">reported</a> that it took its site offline, moved it to new infrastructure and restored it. Even after that move, the team asked users to wait an hour before connecting wallets. Some networks could still direct visitors to the old destination while their cached records refreshed.
<pre class="wp-block-preformatted">Disclaimer: This article is for informational purposes only and does not constitute financial advice. CoinCryptoNewz is not responsible for any losses incurred. Readers should do their own research before making financial decisions.</pre>
&lt;p&gt;The post <a rel="noopener noreferrer nofollow" href="https://coincryptonewz.com/hackers-hijack-12-defi-websites-as-138000-is-traced-to-wallets/">Hackers Hijack 12 DeFi Websites as $138,000 Is Traced to Wallets</a> first appeared on <a rel="noopener noreferrer nofollow" href="https://coincryptonewz.com">Coin Crypto Newz</a>.&lt;/p&gt;

Hackers Hijack 12 DeFi Websites as $138,000 Is Traced to Wallets

Table of Contents

CoinCryptoNewz

Other articles published on Oct 31, 2026

Join our free newsletter for daily crypto updates!