DeFi DNS Attack Hits 12 Sites Using Step Drainer Toolkit
A coordinated attack on Halloween redirected at least 12 DeFi websites, with the Step Drainer toolkit identified as the primary threat.
A coordinated attack on Halloween redirected at least 12 DeFi websites, with the Step Drainer toolkit identified as the primary threat. This is an original TLT brief synthesising 2 outlets (Crypto.news, Unchained), plus live market data, as of Mon, 02 Nov 2026 12:45:02 UTC.
This attack highlights the ongoing security vulnerabilities in the DeFi space, potentially compromising user funds and trust in decentralized platforms.
- At least 12 DeFi websites were compromised in a coordinated DNS attack.
- The Step Drainer toolkit was identified as the primary threat by Blockaid.
- Affected sites include Flap, Kintsu, and Origami, with nine additional sites flagged.
- Users are warned against connecting wallets or signing transactions on affected sites.
Crypto.news and Unchained both report that at least 12 DeFi websites were compromised in a coordinated DNS attack on Halloween, with the Step Drainer toolkit identified as the primary threat by Blockaid. While Flap, Kintsu, and Origami confirmed their sites were redirected, Unchained notes that there is dispute over how the attackers gained access. Crypto.news emphasizes Blockaid's role in flagging the threat, while Unchained highlights the ongoing dispute over the attack vector.
On Halloween, a coordinated DNS attack targeted at least 12 DeFi websites, with the Step Drainer toolkit identified as the primary threat by security firm Blockaid. The attack was first flagged by Blockaid, which warned users against connecting their wallets or signing transactions on affected sites.
Affected platforms include Flap, Kintsu, and Origami, which confirmed their sites were redirected. Blockaid also flagged nine additional sites, though their identities have not been disclosed. The exact method used by the attackers to gain access remains disputed.
The attack underscores the persistent security challenges facing the DeFi sector. Despite advancements in blockchain technology, vulnerabilities in web infrastructure and user interactions continue to be exploited by malicious actors.
The broader crypto market remains relatively stable, with a total market cap of $2.68 trillion and 
Bitcoin trading flat at -0.04% over the past 24 hours. The Fear & Greed Index stands at 37, indicating a 'Fear' sentiment among investors.
The incident serves as a reminder of the importance of robust security measures in the DeFi space. Users are advised to exercise caution and verify the authenticity of websites before conducting transactions. The situation bears watching as investigations continue and more details emerge.
Figures and sectors in this story, checked live against on-chain aggregators · November 2, 2026.
TLT reads these figures directly from on-chain aggregators (DeFiLlama, mempool.space) at build time — independent of what any outlet reported. Sector totals aggregate every protocol DeFiLlama tracks in that category. Values are live and will change.
DeFi DNS Attack Hits 12 Sites Using Step Drainer Toolkit — questions & answers
What is the Step Drainer toolkit?
The Step Drainer toolkit is a malicious software identified by Blockaid as the primary threat in the DNS attack on DeFi websites.
Which DeFi sites were affected?
Flap, Kintsu, and Origami confirmed their sites were compromised, with nine additional sites flagged by Blockaid.
What should users do if they visited an affected site?
Users are advised to avoid connecting their wallets or signing transactions on affected sites and to monitor their accounts for suspicious activity.
Which outlets reported this story?
This is an original TLT brief that synthesises reporting from Crypto.news, Unchained, with the key figures cross-checked for agreement across them. It is not a copy of any one article — follow the source links above for the original reporting.
Original summary — not financial advice. This is an original TLT brief that summarises a development reported elsewhere and adds live market data for context; it is not the original article and reproduces no part of it. Follow the source link above for full details. Crypto is volatile and high-risk — always do your own research.