Blockaid warns of Step Drainer across crypto sites; Flap confirms a DNS attack
Blockaid warns of Step Drainer across 12 crypto sites. Flap confirms DNS hijacking; Flap and Kintsu report restoration. Bitquery estimates $202,386 drained across six chains, excluding Solana/Aptos. Registrar root cause and full recovery remain unconfirmed.
- Disclosed
- Oct 31, 2026
- Updated Nov 1, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Visitors interacting with the affected crypto frontends, especially wallets asked to sign transactions or approvals
- Step Drainer · DNS · crypto
- In the wild
- Yes
- Blockaid reports active drainer delivery, not successful theft from every visitor.
What happened
Blockaid links the ten additional sites to the same attack as its initial alert. Flap is still investigating whether its domain provider was involved; this does not establish a shared registrar or hosting-provider breach. The initial L3 assessment reflected malicious delivery with unquantified outcomes; the research below supports L4 for observed wallet theft, not a smart-contract exploit.
November 1 follow-up: Kintsu’s October 31 original warning attributes its DNS hijack to the registrar and asks anyone who connected or signed since approximately 00:00 UTC that day to revoke approvals and move funds. Its later complete post says the real site has been restored, while work with the registrar continues to confirm the cause. This adds a separate project restoration statement; it does not establish a confirmed shared registrar breach, recovery of all twelve domains, a final loss total or repayment. The approximately midnight threshold is precautionary guidance, not a proven attack-start time.
Research follow-up: Bitquery estimates $202,386 across six chains, with 32 wallets losing at least $1 and 15 additional sub-dollar wallets. Its October 31 18:30 UTC cutoff excludes Solana/Aptos and unlinked drains; site attribution is inferred from chain/token, not recorded in transfers. About $56,600 in queued Kintsu stake is a historical snapshot, not confirmed frozen or repaid. Registrar root cause remains unconfirmed.
Crime-scene timeline
Oct 31, 2026
Blockaid warns about Flap and Kintsu, then lists ten additional sites
Oct 31, 2026
Flap confirms DNS attack and announces domain migration
Oct 31, 2026
Kintsu warns about registrar DNS hijacking, then reports its site restored
The project retains a root-cause investigation and asks affected users to revoke approvals and move funds.
Oct 31, 2026
Flap announces its official website and alternative domain are back online
This is Flap’s restoration statement, not confirmation that the other affected sites have recovered.
Oct 31, 2026
Bitquery publishes a cross-chain loss estimate
Its count covers 32 wallets losing at least $1; it excludes Solana and Aptos and is not a final campaign total.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Blockaid original Flap and Kintsu alertPrimary
- Blockaid expanded Step Drainer domain listPrimary
- Flap original DNS investigation and migration updatePrimary
- Flap original restoration announcementPrimaryThe readable public embed announces that the official website and alternative domain are back online.
- Kintsu original warning, public embedPrimaryReadable opening attributes the DNS hijack to its registrar and gives the approximate interaction window and approval/fund guidance; ending truncates.
- Kintsu original restoration update, public embedPrimaryComplete post says the real site is restored and root cause is still being investigated with the registrar.
- Bitquery original cross-chain investigationPrimaryTransaction-based estimate through October 31 18:30 UTC; sites inferred by chain/token, no confirmed registrar root cause.