Security firm Blockaid identified a coordinated frontend attack affecting at least 12 decentralized finance and token-launch websites on October 30–31, 2026. The malicious toolkit, called StepDrainer, was injected into sites including StonkFun, pickle.finance, echelon.market, origami.finance, and fluxbeam.xyz.
LaunchOnSF, which operates StonkFun, confirmed that its website was restored and reported no on-chain impact or user losses. The attack compromised website frontends rather than underlying smart contracts.
Attack mechanism
The campaign exploited compromised DNS and domain systems to inject harmful scripts into legitimate websites. Once deployed, the scripts displayed fraudulent wallet-connection requests designed to harvest token approvals and signatures from visitors who interacted with them.
StepDrainer operates as malware-as-a-service, allowing criminals to deploy the toolkit across multiple targets. The toolkit reportedly functions across more than 20 blockchain networks and targets common wallet interactions, including unlimited token approvals.
Critically, no private keys were stolen during the incident. The compromise was limited to website frontends, meaning damage depended entirely on users approving malicious prompts.
Response and mitigation
Blockaid's early detection prompted a coordinated response from affected projects. Teams secured their services and instructed users not to connect wallets until restoration was complete.
Users who interacted with compromised sites were advised to revoke harmful token approvals using services like Revoke.cash. Investigations are ongoing to identify the shared vulnerabilities that allowed attackers to compromise multiple sites simultaneously.
No significant aggregate loss figures have been reported so far.
