The address looked familiar. The DeFi website behind it had changed.

Flap and Kintsu reported website hijacks on 31 October, while Blockaid identified the Step Drainer toolkit across a wider group of DeFi front ends. The incident targeted the pages people use to interact with wallets; a common root cause remains unconfirmed.

Blockaid named twelve sites across its alerts. Reporting by The Block connected their registrations to Name.com, but shared infrastructure alone does not establish where access was compromised. Some teams pointed to the Vercel domain-service route; neither that attribution nor a single cause for the whole campaign should be treated as proven.

The practical problem is that a correct-looking address can lead to hostile content after its routing changes. A malicious interface can ask for wallet signatures or approvals even when a project's underlying contracts have not changed. Several affected teams said their onchain contracts were untouched.

Flap and Kintsu subsequently announced restoration, according to their statements collected by TSN. That does not establish that every named service is safe or undo permissions previously granted. Anyone who interacted during the incident should follow the relevant team's recovery guidance through independently verified channels. The full victim count and aggregate losses remain unresolved.