DNS Hijacking Affects 12 DeFi Frontends on BSC
On October 31, 2026, at least 12 DeFi websites experienced DNS hijacking, resulting in a loss of $138,000. Users who interacted with the malicious frontends had their assets drained by a wallet-drainer kit.
On or around October 31, 2026, at least 12 decentralized finance (DeFi) websites, including Flap and Kintsu, were targeted in a DNS and registrar-level hijacking incident. This attack redirected traffic from the legitimate sites to malicious frontends that utilized the StepDrainer wallet-drainer kit. Users who connected their wallets and signed transactions on these compromised sites had their assets stolen, while the underlying smart contracts remained intact and were not compromised.
The incident resulted in a total loss of approximately $138,000. The attack primarily affected websites registered through Name.com, indicating a vulnerability at the registrar level that was exploited to facilitate the hijacking. Users were likely unaware of the redirection and interacted with the fraudulent sites, leading to the theft of their funds.
This incident occurred on the Binance Smart Chain (BSC), which means that any transactions made during the hijacking can be traced on the chain. The use of the StepDrainer kit suggests a specific technique employed by the attackers to drain wallets, highlighting the need for users to be cautious when interacting with DeFi platforms. The on-chain record may contain addresses associated with the stolen assets, which could provide further insights into the flow of funds post-incident.