Hackers Hijack a Dozen DeFi Websites and Steal Around $138,000

Attackers took over twelve DeFi websites late Friday, including Flap, Kintsu, Pickle Finance and Origami Finance, and used them to drain the wallets of visitors. Security firm Blockaid says the pages were loaded with Step Drainer, a malware kit that tricks users into approving transfers once they connect a wallet. Roughly $138,000 has been traced to three wallets on EVM chains, though losses on Solana and Aptos are not counted.

Name.com Domains Suspended

All twelve domains are registered with Name.com. Ten were put on client hold on Saturday morning, including Pickle Finance, Origami Finance, FluxBeam, Echelon, StonkFun and StakePoint, while Flap and Kintsu remained online. Name.com has only asked users to submit an abuse report so far.

How Step Drainer Works and Who Is Blamed

The kit is sold as malware for hire, reportedly for about $750 for full source code. The stolen money was split among the wallets in fixed shares of 15%, 55% and 30%. The affected sites use different DNS providers, and Kintsu and Origami blame Vercel, which has not commented. No project has reported a victim count, and several say their onchain contracts were untouched. Similar attacks hit Aerodrome and Velodrome in 2025 and Galxe in 2023.