DeFi DNS Attack Targets 12 Platforms Using Step Drainer Toolkit
A widespread DNS attack on Halloween compromised at least 12 DeFi websites, prompting urgent security warnings.
A widespread DNS attack on Halloween compromised at least 12 DeFi websites, prompting urgent security warnings. This is an original Token Times brief synthesising 2 outlets (Crypto.news, Unchained), plus live market data, as of Mon, 02 Nov 2026 14:00:01 UTC.
This attack highlights the ongoing vulnerabilities in DeFi platform security and the potential risks for user funds when interacting with compromised websites.
- At least 12 DeFi websites were compromised in a DNS attack on Halloween.
- Blockaid identified the Step Drainer toolkit as the attack vector.
- Affected platforms include Flap, Kintsu, and Origami.
- Users are advised to avoid connecting wallets or signing transactions on affected sites.
Multiple outlets, including Crypto.news and Unchained, confirm that at least 12 DeFi websites were compromised in a DNS attack on Halloween, with Blockaid identifying the Step Drainer toolkit as the primary attack vector. While Flap, Kintsu, and Origami have confirmed their sites were redirected, the identity of the attacker remains disputed. Crypto.news focuses on the technical details of the attack, while Unchained emphasizes the confirmed victims and the ongoing dispute over the attacker's identity.
On Halloween, a significant DNS attack targeted at least 12 DeFi websites, compromising their security and potentially putting user funds at risk. Blockaid, a security firm, identified the Step Drainer toolkit as the primary attack vector used in this incident.
Affected platforms include Flap, Kintsu, and Origami, with Blockaid reporting an additional nine sites that were compromised. The attack involved redirecting users to malicious sites designed to steal sensitive information and funds.
Crypto.news and Unchained both corroborate the core details of the attack, including the number of affected sites and the involvement of the Step Drainer toolkit. However, Unchained notes that while the identity of the attacker is still disputed, the incident has raised concerns about the security measures in place across the DeFi ecosystem.
This attack follows a series of similar incidents in the DeFi space, highlighting the persistent challenges of securing decentralized platforms against sophisticated threats. The Step Drainer toolkit, in particular, has been associated with several high-profile attacks in recent months.
The total crypto market cap remains at $2.68 trillion, with the overall market showing little reaction to the news. 
Bitcoin's price is down 0.04% in the last 24 hours, and the Fear & Greed index stands at 37, indicating a 'Fear' sentiment in the market.
Figures and sectors in this story, checked live against on-chain aggregators · November 2, 2026.
Token Times reads these figures directly from on-chain aggregators (DeFiLlama, mempool.space) at build time — independent of what any outlet reported. Sector totals aggregate every protocol DeFiLlama tracks in that category. Values are live and will change.
DeFi DNS Attack Targets 12 Platforms Using Step Drainer Tool — questions & answers
What is the Step Drainer toolkit?
The Step Drainer toolkit is a malicious software used to compromise websites and steal user information and funds.
How many DeFi sites were affected by the attack?
At least 12 DeFi websites were compromised in the DNS attack.
What should users do if they visited an affected site?
Users are advised to avoid connecting their wallets or signing transactions on affected sites and to monitor their accounts for suspicious activity.
Which outlets reported this story?
This is an original Token Times brief that synthesises reporting from Crypto.news, Unchained, with the key figures cross-checked for agreement across them. It is not a copy of any one article — follow the source links above for the original reporting.
Original summary — not financial advice. This is an original Token Times brief that summarises a development reported elsewhere and adds live market data for context; it is not the original article and reproduces no part of it. Follow the source link above for full details. Crypto is volatile and high-risk — always do your own research.