Kintsu DNS Hijack (StepDrainer Campaign)

On October 31, 2026, Kintsu — the liquid-staking protocol on Monad — warned users that its website had been hijacked at the DNS level and rerouted to a malicious wallet-draining page. Security firm Blockaid said the activity was part of a coordinated StepDrainer campaign that also targeted the front ends of Flap and StonkBrokers. No loss figure was disclosed, and the protocols' smart contracts were never touched.

What happened

Kintsu said the compromise was a DNS hijack at its domain registrar, not a breach of its own systems: the attacker altered the records pointing kintsu.xyz to its servers, so visitors were quietly rerouted to a cloned frontend carrying a wallet drainer. Blockaid flagged suspected frontend attacks across three dApps at once — Kintsu, token platform Flap, and StonkBrokers — linking the activity to the StepDrainer toolkit. The injected pages targeted the "Connect Wallet" flow: users who connected and approved transactions on the spoofed sites could have their assets swept through malicious approval and signature prompts. Kintsu said anyone who connected a wallet or signed a transaction from 8 PM ET on October 30 (00:00 UTC, October 31) onward fell inside the exposure window, and warned that DNS caches could keep routing some users to the malicious page for up to an hour even after the correct records were restored.

Aftermath

Kintsu urged users to avoid the site, revoke any approvals via a tool such as Revoke, and move their assets, and said it would issue a follow-up once it verified the site was safe. Flap reported taking its affected front ends offline and working with Blockaid, hosting provider Vercel, and registrar Name.com; its founder confirmed the team was coordinating the response. StonkBrokers was named only as a site under investigation. Blockaid's probe remained open at the time of reporting, with no confirmed dollar loss or victim count published. Because the attack lived entirely at the DNS and web-serving layer, the on-chain contracts of all three protocols were unaffected — the risk was confined to users who interacted with the spoofed front ends.

Why it matters

The episode is a textbook DNS-hijack-to-wallet-drainer attack, the same pattern that hit Curve Finance in 2022: compromise the domain or its registrar, serve a pixel-perfect clone, and let users sign away their own funds. It landed the same week as the Polymarket supply-chain frontend compromise, reinforcing a recurring catalogue theme — that the web layer, not the smart contract, is now a leading attack surface in DeFi. Registrar-level takeovers are especially dangerous because they bypass every on-chain safeguard and every audit: the contracts can be flawless while users are drained through a hostile frontend. The coordinated, multi-protocol nature of the StepDrainer wave also shows how a single drainer kit can be pointed at an entire ecosystem's front ends at once.