Blockaid warns of Step Drainer across crypto sites; Flap confirms a DNS attack
Blockaid warns against interactions with Flap and Kintsu, then identifies ten more domains serving Step Drainer. Flap confirms a DNS attack and moves to flap.cool; the provider's involvement remains unconfirmed. No aggregate loss or victim count is established.
- Disclosed
- Oct 31, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- Visitors interacting with the affected crypto frontends, especially wallets asked to sign transactions or approvals
- Step Drainer · DNS · crypto
- In the wild
- Yes
- Blockaid reports active drainer delivery, not successful theft from every visitor.
What happened
Blockaid links the ten additional sites to the same attack as its initial alert. Flap is still investigating whether its domain provider was involved; this does not establish a shared registrar or hosting-provider breach. L3 reflects confirmed malicious frontend delivery with unquantified outcomes, not proof of a smart-contract exploit or a particular loss total.
Crime-scene timeline
Oct 31, 2026
Blockaid warns about Flap and Kintsu, then lists ten additional sites
Oct 31, 2026
Flap confirms DNS attack and announces domain migration
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.