UPDATE: StepDrainer supply-chain DNS attack hits 12 DeFi domains
CIE News ·
Update to Hackers hijack 12 Name.com DeFi domains and steal about $138,000, The Block reports
Based on reporting by The Block; not yet independently confirmed.
Security researchers identified StepDrainer behind a supply-chain DNS breach that hit 12 DeFi sites, leading to ten registrar domain suspensions and $138,000 drained.
Attackers deployed the StepDrainer malware kit in a supply-chain DNS hijack targeting decentralized finance platforms, following earlier reports of compromised Name.com domains. Biggo.com reported that affected platforms include Flap, Kintsu, StonkFun, Pickle Finance, Origami Finance, and Echelon Market, whose frontends were redirected to clone pages that prompted users to sign malicious approvals. By 12:32 UTC on October 31, 2026, ten of the targeted domains were suspended under registrar client hold status, while on-chain tracing identified approximately $138,000 drained across three EVM wallets despite underlying smart contracts remaining intact.
Key facts
- StepDrainer malware identified
- 12 DeFi domains hijacked
- 10 domains placed on client hold
- Approximately $138,000 drained
Read the original at The Block