Twelve DeFi websites were hijacked on October 31, 2026, after attackers compromised DNS records at a single domain registrar, Name.com. The sites — including Flap, Kintsu, Pickle Finance, and Origami Finance — were loaded with StepDrainer, a wallet-draining toolkit sold as malware-as-a-service fo...
"Just having your assets sit somewhere and forgetting about them and not thinking about them is not actually the solution." — Ido Ben-Natan, CEO and Co-Founder, Blockaid
Twelve DeFi websites were hijacked on October 31, 2026, after attackers compromised DNS records at a single domain registrar, Name.com. The sites — including Flap, Kintsu, Pickle Finance, and Origami Finance — were loaded with StepDrainer, a wallet-draining toolkit sold as malware-as-a-service for $150–$750. On-chain analysis traced approximately $138,000 in stolen funds to three wallets on EVM chains. No smart contracts were breached; the attack was purely front-end.
The incident is the third major DNS-registrar-level attack targeting DeFi protocols in 2026, following a seven-day campaign against five protocols via Namecheap-hosted infrastructure in February and the eth.limo ENS gateway hijack in April. It underscores a structural dependency that protocols marketing themselves as decentralized continue to carry: their user-facing interfaces run on centralized Web2 infrastructure — domain registrars, DNS nameservers, and hosting providers — that can be subverted without touching the underlying blockchain.
CertiK's 2026 tally now stands at a record $9.2 billion in total crypto losses, with front-end and infrastructure-layer attacks accounting for an increasing share versus on-chain exploits. The drainer-as-a-service economy has professionalized, with affiliate-model kits like Inferno Drainer, Angel Drainer, and StepDrainer providing turnkey phishing infrastructure to operators who may lack any cryptographic expertise.
At approximately 00:00 UTC on October 31, 2026, DNS records for twelve DeFi websites registered through Name.com were altered. Blockaid, a transaction-simulation security firm, flagged the first compromised sites — Flap (flap.sh) and Kintsu — at 02:54 UTC. The full list of affected protocols: Flap, Kintsu, StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, Stakepoint, SupSwap, Longbow, SHPRD, and ApeX DeFi.
All twelve domains relied on Name.com's own nameservers. The attacker redirected DNS resolution to infrastructure serving pages visually identical to the legitimate sites, but injected with the StepDrainer wallet-draining script. Users who connected wallets and signed transactions triggered token approvals that transferred assets to attacker-controlled addresses.
Kintsu confirmed the registrar-level compromise publicly and instructed any user who connected or signed since 00:00 UTC to revoke all token approvals and move funds to new wallets. Origami Finance initially attributed the compromise to "an active attack on Vercel-associated Nameservers" before clarifying that vaults would remain paused pending root cause analysis from both Vercel and Name.com. Ten of the twelve affected domains were suspended by early afternoon.
The Block traced approximately $138,000 in stolen funds using on-chain data. The modest dollar figure relative to the attack's scope reflects several factors: the protocols targeted were small to mid-cap, Blockaid's detection occurred within three hours, and wallet-security tools including MetaMask's built-in warnings alerted some users before signing.
StepDrainer is a wallet-draining toolkit that entered the underground market in 2026. It operates across more than 20 blockchain networks, including Ethereum, BNB Chain, Arbitrum, Polygon, and Base. Its business model is malware-as-a-service: operators can purchase the full source code for approximately $750, or license a hosted version for $150 that routes 20% of each theft back to the kit developers via automated smart contract splits.
The toolkit exploits legitimate smart contract standards to disguise malicious transactions. It misuses Seaport (OpenSea's NFT marketplace protocol) and Permit v2 (Uniswap's token-approval standard) to present wallet approval pop-ups that appear routine. The details inside those pop-ups — the destination addresses and approval amounts — are falsified. Once a user signs, the drainer sweeps tokens, NFTs, and native assets.
Key features, according to security researchers who have analyzed the kit:
The distinction between StepDrainer and earlier drainer families is largely commercial rather than technical. The underlying approach — presenting spoofed approval transactions through hijacked or imitation front ends — remains consistent across the drainer-as-a-service ecosystem.
Wallet drainers have evolved from individual phishing tools into a structured underground service economy. The model mirrors legitimate SaaS: kit developers build and maintain the malware platform; affiliates license it and handle distribution through phishing campaigns, compromised websites, or social engineering.
Revenue-sharing structures have standardized. Typical splits start at 80/20 (affiliate keeps 80%, kit developer takes 20%) and scale to 90/10 once an affiliate surpasses $5,000–$10,000 in cumulative theft. Payments flow through automated smart contract mechanisms, eliminating trust requirements between parties who operate pseudonymously.
The ecosystem's major operations in recent years:
| Drainer Kit | Active Period | Estimated Theft | Victims | Revenue Share | |---|---|---|---|---| | Inferno Drainer | 2023–present | 40–45% market share | — | 20% to operator | | Pink Drainer | Mar 2023–May 2024 | $85M | 21,000 | Retired May 2024 | | Angel Drainer | 2023–present | $53.1M | 37,755 | 15% to operator | | StepDrainer | 2026–present | Under investigation | — | 20% to operator |
Flare researchers analyzed approximately 700 underground forum posts related to "Lucifer DaaS" between January 2025 and early 2026. The findings: operators invest in affiliate recruitment, phishing automation, wallet-security bypasses, and infrastructure resilience in ways that parallel venture-backed startups. Newer entrants advertise toolkits that claim to bypass real-time warnings from MetaMask, Phantom, and ScamSniffer.
Aggregate wallet-drainer phishing losses fell 83% between 2024 and 2025, from $494 million to approximately $83.85 million across 106,106 affected wallets, per ScamSniffer data. But the trend reversed in 2026: January alone saw $311 million in phishing losses, the highest monthly total in 11 months. The shift is toward fewer, higher-value targets. Four social-engineering operations in January produced $310 million — roughly 85% of the month's total — including a single victim who lost $284.8 million.
Front-end attacks via domain registrar compromise have established a recurring pattern:
July 2024 — Squarespace campaign. A coordinated attack compromised Squarespace and GoDaddy-registered domains belonging to Compound Finance, Pendle Finance, Celer Network, and dYdX. Over 200 cryptocurrency domains registered with Squarespace were identified at risk. The Inferno Drainer toolkit was deployed.
February 2026 — Namecheap campaign. Between February 16–23, Blockaid detected and responded to five separate front-end compromise incidents over seven days. All delivered the AngelFerno drainer variant. All used the same attacker infrastructure. In at least three of five incidents, the attacker socially engineered registrar support staff into granting unauthorized domain access, redirecting DNS to Namecheap-hosted servers.
April 2026 — eth.limo ENS gateway hijack. On April 18, eth.limo — a primary gateway for Ethereum Name Service domains handling over 1.5 million daily requests — was compromised via DNS registrar attack. EasyDNS, the registrar, acknowledged its first successful social engineering attack in 28 years. Vitalik Buterin warned users publicly, describing Ethereum's reliance on centralized DNS resolution as "a step back in trust."
April 2026 — Protocol-specific attacks. Frontend attacks hit OpenEden, Curvance, Maple Finance, and CoW Swap within weeks. The CoW Swap attack resulted in $1.2 million in losses after forged identity documents were used to trick registrar staff into transferring DNS control.
October 31, 2026 — Name.com campaign. Twelve DeFi sites compromised via a single registrar, deploying StepDrainer. $138,000 traced to date.
The pattern is consistent: attackers identify a shared registrar dependency, compromise credential access at the registrar level (typically via social engineering or credential abuse), redirect DNS to infrastructure serving drainer-loaded clones, and extract funds during the window before detection.
The structural issue exposed by these attacks is straightforward. Smart contracts on Ethereum, Solana, and other networks are immutable, trustless, and verifiable. The interfaces through which users interact with those contracts are none of those things.
A DeFi protocol's front end is typically a React or Next.js web application hosted on Vercel, Netlify, or AWS, with a domain registered through a conventional registrar and DNS resolved through conventional nameservers. This stack introduces at least four centralized trust dependencies: the registrar account, the DNS provider, the hosting platform, and the CDN or deployment pipeline.
The protocols compromised on October 31 passed Vitalik Buterin's "walkaway test" at the smart contract layer — their on-chain code continued functioning correctly throughout the attack. The front ends did not. A user interacting directly with the smart contract via a block explorer or CLI would have been unaffected. A user navigating to the protocol's website — the overwhelmingly common access path — was exposed.
CertiK has emphasized that the combination of IPFS (InterPlanetary File System) and ENS (Ethereum Name Service) demonstrates the potential of decentralized alternatives in reducing DNS hijacking risk. IPFS stores content-addressable files across a distributed network; ENS provides human-readable names resolvable on-chain. Together, they remove the registrar and nameserver from the trust chain.
Adoption remains limited. Deploying front ends to IPFS adds latency and complexity. ENS resolution requires either a gateway (reintroducing DNS trust) or a browser extension. The user experience gap between a Vercel-hosted React app and an IPFS-served interface is substantial. Most protocols optimize for user acquisition over infrastructure security.
The security industry has responded on multiple fronts:
Transaction simulation. Blockaid, which detected the October 31 attack, scans sites for malicious code signatures and JavaScript drainer kits before users sign transactions. It integrates directly with major wallets including MetaMask, Coinbase Wallet, and Rainbow. Its detection flagged 65.4 million address-poisoning attempts between January 2025 and June 2026.
Registrar hardening. The recurring pattern of social-engineering registrar staff has prompted calls for mandatory hardware-key MFA on domain accounts, registrar-lock features that prevent DNS changes without multi-party authorization, and domain monitoring services that alert on unexpected record changes.
Decentralized front ends. Protocols including Uniswap and Aave have deployed IPFS-hosted front ends as alternatives, accessible via ENS names or direct IPFS gateways. ENS domains resolve through Ethereum's contract layer rather than DNS, eliminating registrar-level risk for users with compatible browser configurations.
Multi-signer DNS management. Some projects have implemented multi-signature controls on domain registrar accounts, requiring multiple team members to authorize DNS changes, analogous to multisig treasury management.
User-side protections. Wallet providers have progressively added transaction-preview screens, approval-amount warnings, phishing-domain blocklists, and address-screening integrations. ESMA and the European Banking Authority have recommended that exchanges include prominent risk disclosures regarding front-end phishing alongside leverage warnings.
The October 31 DNS hijacking is notable less for its dollar impact — $138,000 is modest by 2026 standards — than for what it reveals about the sector's unresolved dependency on centralized Web2 infrastructure. Protocols whose entire value proposition rests on trustlessness and decentralization continue to route user interactions through registrar accounts that can be socially engineered, hosting platforms that can be compromised, and DNS nameservers that can be redirected.
The drainer-as-a-service economy compounds the problem by reducing the skill threshold for exploitation. A $150 StepDrainer license provides turnkey phishing infrastructure to operators who need not understand cryptography, smart contracts, or blockchain mechanics. The attack surface — Web2 domain infrastructure — is familiar territory for conventional cybercriminals.
Solutions exist. IPFS-hosted front ends with ENS resolution remove the registrar from the trust chain. Transaction-simulation tools like Blockaid intercept malicious signatures before they execute. Registrar-level MFA and domain-lock features prevent unauthorized DNS changes. The question is not technical feasibility but adoption incentives. Until protocols internalize the cost of front-end insecurity — through regulation, insurance requirements, or sustained user attrition — the mismatch between on-chain and off-chain security will persist.