Hackers Hijack 12 DeFi Websites as $138,000 Is Traced to Wallets

• Blockaid identified 12 hijacked sites serving Step Drainer, including Flap and Kintsu.
• All 12 domains shared a registrar, but investigators have not confirmed where attackers gained access.
• The $138,000 traced to three wallets excludes any losses on Solana or Aptos.

Attackers hijacked 12 DeFi websites late Friday, steering visitors from familiar addresses to pages designed to drain their crypto wallets. Security firm Blockaid identified Step Drainer across the affected sites. By Saturday morning, The Block had traced about $138,000 to three wallets. Its estimate excludes any losses on Solana or Aptos, and the number of victims remains unknown. 

How Hijacked DeFi Websites Led Users to Step Drainer

Flap confirmed that its official address redirected visitors to an unauthorized site. A user could type the correct address and still reach the attacker’s page because the underlying domain records had changed.

The drainer prompted visitors to connect a wallet and authorize transactions that moved assets out. The distinction matters: opening one of the DeFi websites was not, by itself, evidence that a visitor lost funds. Kintsu, Origami Finance, FluxBeam and StonkFun said their smart contracts remained unaffected. 

The payment trail showed a consistent pattern. Three wallets received proceeds in shares of 15%, 55% and 30% across several networks. On Robinhood Chain, transaction records showed one wallet withdrawing tokenized Apple and Nvidia shares from Morpho before swapping them for ETH. 

DeFi Websites Shared a Registrar but Used Different Nameservers

All 12 DeFi websites used Name.com as their registrar, according to public records reviewed by The Block. Their nameservers varied across Cloudflare, Vercel and Name.com. The common registrar narrows the investigation but does not establish which company or account the attackers compromised. 

At 8:32 a.m. ET Saturday, 10 domains received a registrar-level hold that stopped their addresses from resolving. Flap and Kintsu were the two exceptions. Origami said it would keep its vaults paused while awaiting findings from Vercel and Name.com. 

StonkFun reported that it took its site offline, moved it to new infrastructure and restored it. Even after that move, the team asked users to wait an hour before connecting wallets. Some networks could still direct visitors to the old destination while their cached records refreshed.

Disclaimer: This article is for informational purposes only and does not constitute financial advice. CoinCryptoNewz is not responsible for any losses incurred. Readers should do their own research before making financial decisions.