Hackers hijack at least 12 DeFi websites and plant a wallet drainer, with about $138,000 traced so far

Attackers took over the web addresses of at least 12 decentralized finance sites on Friday night and loaded them with a toolkit designed to trick visitors into approving transfers out of their wallets, according to security firm Blockaid, as reported by The Block, crypto.news and CircleID.

Blockaid first warned about Flap and Kintsu, then named 10 more sites, among them Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun and StakePoint. All of them served Step Drainer, a malware kit that asks users who connect a wallet to sign transactions handing over their funds. Flap said it had suffered a DNS hijack, meaning its domain pointed visitors to an unauthorized site.

The Block reports that all 12 domains were registered through Name.com, and that 10 were suspended at the registrar level at 8:32 a.m. Eastern time on Saturday. Kintsu said its domain was hijacked at the registrar level and that it had escalated the matter to Vercel and Name.com, CircleID reports. As of Saturday morning, Name.com's only public response had been to ask two users on X to fill out its abuse form, according to The Block.

The Block traced about $138,000 in stolen funds to three wallets on EVM chains, a figure that excludes losses on Solana and Aptos. Kintsu, Origami, FluxBeam and StonkFun said their onchain contracts were not affected. No project has reported how many users lost funds.