StonkFun’s website was hit by a frontend attack overnight on October 31, 2026. Security firm Blockaid found the Step Drainer kit on stonkfun.xyz and 11 other crypto sites. However, the attack never reached StonkFun’s smart contracts, and the team says no users are known to be affected. The site is back online now after a move to new infrastructure.
It caps a wild few days in crypto. First came the Polymarket hack. On the same day, the Binance hack turned into the biggest exchange hack in history. Yesterday, Trezor then warned buyers about a tampered device sold through CryptoBilis. Now a wave of domain attacks has hit a dozen DeFi sites in one night.
What Happened to StonkFun
Blockaid raised the first alert overnight. Its system detected a potential frontend attack on two dApps, Flap and Kintsu. Shortly after, the firm widened the alert to 10 more sites, all actively serving the Step Drainer.
Here is the full list of affected domains:
- flap[.]sh
- kintsu[.]xyz
- stonkfun[.]xyz
- pickle[.]finance
- echelon[.]market
- origami[.]finance
- fluxbeam[.]xyz
- stakepoint[.]app
- supswap[.]xyz
- longbow[.]cash
- shprd[.]finance
- apexdefi[.]xyz
StonkFun confirmed the hit on its official X account. The team asked users to stay off the site and not connect a wallet until it was safe again. It also stressed that only the website was affected. Everything on-chain kept working as normal.
What Is Step Drainer?
Step Drainer is a wallet drainer sold as malware-as-a-service. In other words, criminals rent the kit instead of building their own. Once it sits on a real site, the page looks exactly the same. As soon as you connect a wallet and sign, though, the drainer tries to empty it.
That’s why these attacks hurt so much. You type the right address and still land on a trap. Kintsu said attackers took over its domain at the registrar level, so they controlled where the address pointed. Flap, for its part, moved to a new domain altogether.
Is StonkFun Safe to Use Now?
StonkFun says its site is restored on new infrastructure. On-chain operations stayed unaffected, and the team knows of no affected users. Some networks can take up to an hour to pick up the change. For that reason, StonkFun asked users to wait an hour before reconnecting.
My advice: give it a bit longer than that. Follow updates only from StonkFun’s official X account. Also, double-check the URL before you sign anything, and reject any approval that looks strange.
New to the platform? Our StonkFun explainer covers how the launchpad works.
What to Do If You Connected During the Attack
If you visited an affected site overnight, take these steps:
- Revoke any token approvals you signed there. Kintsu flagged anything after 00:00 UTC on October 31 as suspect.
- Move your remaining funds to a fresh wallet if you signed a transaction you don’t recognize.
- Never enter your seed phrase on any site, whatever it claims.
- Check each dApp’s official account before you return.
On the other hand, if you only held STONK or StonkFun coins and never opened the site, you have nothing to do. The drainer sat on the website, not in your wallet. We track incidents like this one in our security news section.
Keep This Content Free
Four security incidents in three days, and we covered every one of them for free. If you’d like to help keep it that way, sign up through our OKX link or our Bybit link. It supports our work at no extra cost to you.
Final Words
This one ended well. StonkFun reacted fast, kept its contracts out of reach and had the site back within hours. Still, a dozen sites falling in one night shows how fragile the web layer is. Your wallet can be perfectly safe while the page in front of it isn’t.
After this week, I’m treating every dApp link with extra suspicion. Slow down, verify the URL and read what you sign. As always, we’ll keep flagging these attacks the moment we spot them, and the Binance hack post mortem shows how fast a single weak point can spiral.
FAQ
Was StonkFun hacked?
Only its website. Attackers injected the Step Drainer into the StonkFun frontend overnight on October 31, 2026. The smart contracts and on-chain operations kept working normally.
Did anyone lose funds on StonkFun?
StonkFun says it isn’t aware of any affected users. So far, no loss figures have surfaced for the other 11 sites either.
Is StonkFun safe to use again?
The team says the site is restored on new infrastructure. Wait at least an hour, check the official X account and verify the URL before connecting.
Which other sites did Step Drainer hit?
Flap, Kintsu, Pickle Finance, Echelon, Origami and FluxBeam were among them, along with five smaller DeFi sites. You’ll find the full list above.
What should I do if I signed something on an affected site?
Revoke the approval right away and move your funds to a fresh wallet. Above all, never share your seed phrase with anyone.
Credit: Source link
