Hackers compromised 15 DeFi project domains between October 30 and 31, redirecting users to fraudulent sites. The attack involved modifying DNS settings to mimic legitimate platforms, including Flap, Kintsu, Pickle Finance, and Origami Finance.
Security firm Blockaid identified that the fake sites utilized a tool called Step Drainer to steal assets from connected crypto wallets. Users were prompted to sign transactions that granted attackers access to their tokens and positions.
Data from Bitquery indicates that 32 wallets across six blockchains lost a total of $202 386. A single wallet on the Monad network accounted for $160 531 of the total losses. The final damage figure remains unknown.
Registrar Name.com confirmed the unauthorized redirection of 15 client domains and has since restored control. Vercel acknowledged that ten of the affected domains were linked to its platform, and investigations into the root cause are ongoing.
