Users of several decentralised finance platforms were targeted this week in a coordinated attack that hijacked the front-end websites of at least four projects through a shared domain registrar. Flap, Kintsu, Pickle Finance and Origami Finance all saw their websites manipulated, with malicious code prompting visitors to approve transactions that drained their wallets.
The common thread between the affected projects was their domain provider, Name.com. The company confirmed unauthorised access to customer domains and said 15 customer domains were affected in total. Name.com stated that all of the compromised domains have since been restored, and the initially identified affected sites were all registered through its service.
Security firm Blockaid identified the tool used in the attack as "Step Drainer," malware designed to trick users into approving a transaction at the moment they connect their wallet to a site. Once approved, the transaction allows attackers to withdraw cryptocurrency directly from the victim's wallet. The mechanism relies entirely on deceiving the user interface rather than exploiting the underlying protocols.
Multiple affected projects said their smart contracts themselves were not compromised. The attack was confined to the websites used to interact with those contracts, meaning the underlying protocol logic remained intact even as front-end visitors were exposed to the drainer malware.
Scale of losses still unclear
According to The Block, roughly $138,000 in stolen cryptocurrency has so far been traced across three wallets linked to the attackers. Both the total number of affected users and the overall scale of the damage remain unknown at this stage, leaving open the possibility that the final tally will exceed what has been traced so far.
The incident adds to a string of recent security episodes across the crypto industry. Manipulated hardware wallets were recently discovered at Ledger, used to steal cryptocurrency from unsuspecting owners. Separately, Coinbase disclosed that customer data was affected by a data leak at an external service provider. The FBI has also attributed a billion-dollar hack of Binance to North Korean hackers.
For users of DeFi platforms, the episode underscores a familiar risk: even when a protocol's smart contracts remain secure, the website used to access them can become the weak point. Wallet-connection prompts on compromised front ends can look identical to legitimate ones, making it difficult for users to distinguish a genuine transaction request from a malicious one.
