A wave of frontend hijacks hit DeFi apps overnight, with security firm Blockaid flagging sites that were actively serving the Step Drainer to visitors. The first alert covered flap.sh and Kintsu, and the list later grew to include pickle.finance, echelon.market, origami.finance, fluxbeam.xyz, stakepoint.app and others.

The affected domains rely on different DNS providers, but all of them are registered with Name.com. Developer banteg pointed to the registrar as the likely common point of compromise, which Name.com has not confirmed so far.

At least 12 DeFi frontends were flagged as serving the drainer.

A registrar-level breach would let attackers redirect domains without touching the protocols' smart contracts. Users are advised not to sign transactions on the affected sites until the teams confirm the issue is resolved.