Blockaid Flags a Wider StepDrainer Attack on Crypto Sites This latest crypto news update covers the StonkFun domain attack flagged by security firm Blockaid on October 31, 2026. The firm firs
This latest crypto news update covers the StonkFun domain attack flagged by security firm Blockaid on October 31, 2026. The firm first warned of a possible frontend attack on flap.sh and kintsu.xyz, then widened its alert to more platforms.
According to Blockaid on X, the same attack was found on additional websites actively serving the drainer kit:
stonkfun[.]xyz
pickle[.]finance
echelon[.]market
origami[.]finance
fluxbeam[.]xyz
stakepoint[.]app
supswap[.]xyz
longbow[.]cash
shprd[.]finance
apexdefi[.]xyz
Blockaid said it is actively investigating and gathering more data.
StonkFun, a Solana token launchpad that lets creators pair new coins with tokenized stocks or ETFs, confirmed the impact on its official X account. The team asked users not to visit the platform or connect a wallet until it was confirmed safe.
It also said only the website was affected. Everything on-chain was working as normal, and no affected users were known at that time.
Later, the team shared a restoration update. The website was taken offline and moved to new infrastructure. Some networks can take up to an hour to pick up the change, so users were told to wait an hour before reconnecting.
StepDrainer is a wallet drainer toolkit sold as malware-as-a-service in cybercrime circles. Security reports say it supports more than 20 blockchain networks.
The kit injects malicious scripts into a compromised page. When a user clicks Connect Wallet, the script can request a harmful token approval, often an unlimited allowance, or an off-chain signature such as a Permit2-style permit. Once approved, the attacker can move assets without a seed phrase or private key.
The StonkFun domain attack targeted the website frontend. The smart contracts were not broken, and no private keys were stolen. Early reports suggest the attackers got in through DNS or hosting access, but Blockaid is still investigating, so that detail could change.
Anyone who connected a crypto wallet or signed an approval on an affected domain during the active window may be exposed. Users who never touched a wallet prompt are generally not at risk.
If you interacted with a listed domain, check and revoke token approvals. Tools such as Revoke.cash are often suggested for this.
Avoid the listed domains until each project confirms it is secure.
Revoke unneeded approvals if you connected during the incident.
Trust only official project accounts for updates.
For DeFi security, a safe contract is only half the picture. A hijacked website can still trick users into signing harmful permissions.
The StonkFun domain attack shows that on-chain safety and website safety are separate layers. Blockaid expects to share more technical details, so this news may be updated as the investigation moves forward.
Disclaimer: This article is for educational and informational purposes only and should not be considered financial or investment advice. Always conduct your own research before making investment decisions.
