At least 12 DeFi websites were hijacked via DNS vulnerabilities at the registrar level, leading to approximately $138,000 being drained using the Step Drainer toolkit. The smart contracts were not breached, but users were redirected to malicious sites. Some affected teams have recovered by migrating their domains to different nameservers.
A malicious toolkit called StepDrainer was injected into the frontends of at least 12 DeFi and token-launch websites, including LaunchOnSF, pickle.finance, and echelon.market. The attack harvested token approvals and signatures through fraudulent wallet-connection requests. LaunchOnSF has restored its website, and no user funds were reported lost.
