HackFraudStep Drainer targets 12+ DeFi sites via DNS hijack
Published: 3 Nov 2026 · Worldwide
Coordinated frontend/DNS attack serving Step Drainer malware on multiple legitimate-looking DeFi project domains including flap.sh, kintsu[.]xyz, pickle.finance, origami.finance, fluxbeam[.]xyz, longbow.cash, echelon.market, stonkfun[.]xyz and others. Users connecting wallets or signing tx on compromised sites risk full wallet drain. Projects confirmed hijacks (some via Vercel); revoke approvals a
Who is at risk
Anyone who uses social media, email or messaging apps
How to protect yourself
- Do not click links in unexpected messages, posts or direct messages.
- Check the sender or account through the official website, not through the message.
- Never share passwords, codes or recovery phrases.
Source: Community reports (hackfraud.com)
Language: English Ελληνικά Español Français Deutsch Italiano Português Nederlands Polski Türkçe Русский العربية हिन्दी 中文 日本語