Flap and Kintsu DNS Hijacks Sent Visitors to a Wallet Drainer

After a DNS hijack at Flap and Kintsu early on Saturday 31 October, anyone who connected a wallet or signed anything on either site should revoke those token approvals now. The attack pointed both projects’ web addresses at malicious copies of their sites for several hours. Kintsu tells anyone who connected or signed “since ~00:00 UTC Oct 31” to revoke approvals and move their funds, and it points users to Revoke.cash to do it.

The attack did not touch either project’s smart contracts, according to the teams. It went after the layer most users never think about: the record that tells a browser where a domain lives. Security firm Blockaid says the same drainer has since appeared on at least ten more DeFi websites, which makes this a wider campaign than two bad nights for two projects.

What to do if you used Flap or Kintsu on 31 October

The advice from all three organisations is consistent. Anyone who connected or signed on kintsu.xyz from about midnight UTC should revoke approvals and move funds to a fresh wallet. For Flap, Cedric, who says on X that he is building the project, said the risk window ran from 01:00 to 05:00 UTC. He asked anyone who connected or signed in that period, or is unsure, to contact him or the Flap team, and said: “We’ll compensate users for any funds stolen as a result of this incident.”

In practice that means three steps:

1. Check your approvals. Open a revocation tool such as Revoke.cash, connect only the wallet you used, and cancel any approval granted on 31 October that you cannot account for.
2. Move what is left. If you signed anything on the fake site, treat that wallet as exposed and move remaining funds to a new address.
3. Hold off on the other listed sites. Blockaid asked users to “refrain from signing transactions” on affected sites until each issue is resolved.

Cedric also said Flap stores no private keys, seed phrases or wallet data, and that users who had only connected to the genuine site before the hijack were not affected. Flap’s token creation, vaults, staking and Locker products were unaffected, he said.

How the DNS hijack unfolded

Flap raised the alarm first. At 02:13 GMT it said flap.sh was “affected by a DNS hijacking incident and is redirecting to an unauthorized website”. Blockaid flagged both sites shortly afterwards.

At 03:16 GMT Blockaid said the same attack had been found on more sites “actively serving the Step Drainer”: stonkfun.xyz, pickle.finance, echelon.market, origami.finance, fluxbeam.xyz, stakepoint.app, supswap.xyz, longbow.cash, shprd.finance and apexdefi.xyz. It said it was still “gathering more data”. TSN has not seen statements from those ten projects.

Kintsu said at 03:35 GMT that kintsu.xyz was “affected by a DNS hijack at our registrar”. At 04:15 GMT it said the domain was pointing to its own infrastructure again, although it warned that some networks could show the malicious site for up to an hour while DNS caches cleared. At 05:27 GMT it said the site “has been restored and is serving our real site again”. Flap moved users to a backup domain, flap.cool, and said at 07:33 GMT that flap.sh was “now back online”.

Kintsu blames its registrar path; Vercel has not commented

Kintsu has gone further than Flap on the cause. At 04:11 GMT it said its domain, “registered through @vercel Domains, is hijacked at the registrar level”. It added: “It appears to be a supply chain attack outside of our control.” It also said it had escalated the matter to Vercel Security and Name.com.

That is Kintsu’s claim. Vercel has not commented publicly on the cause, and its status page showed no domains incident on Saturday morning. Vercel’s chief technology officer, Malte Ubl, replied to Kintsu on X: “Have you filed a ticket? Please DM so we can validate.” Flap said only that it was investigating “whether the recent DNS attack was related to our domain service provider”, and that the root cause “remains under investigation”.

The weak link sat outside the smart contracts

This incident is a reminder that a DeFi project’s security boundary is wider than its audited code. Users who typed the right address and saw a familiar page had no reason for suspicion, because the deception happened upstream of anything they could inspect. The same pattern showed up when Foundation’s own domains were used to send phishing emails after its Cloudflare keys were compromised, and Hacken’s quarterly count found that 77% of crypto losses came via suppliers, unpatched fixes and unreviewed parts.

For compliance teams, the useful questions are about controls, not blame. Who can change DNS records, is that account protected by strong multi-factor authentication and registrar lock, and would anyone notice a change at 1am? Blockaid’s alerts arrived within the hour of Flap’s first post, which suggests outside monitoring is now doing much of the early warning that projects cannot do for themselves. Blockaid was also the firm that put a figure on the zkLink Nova bridge drain earlier this week.

The user side matters just as much. A wallet drainer usually needs a signature, so the habit of reading what a wallet prompt actually requests, and of clearing old approvals regularly, limits the damage when a trusted front end turns hostile. That lesson echoes the NGRAVE fake alert drain: the theft depended on users approving something that looked routine.

What remains unknown

No project has published a loss total or a count of affected wallets. Neither Flap nor Kintsu has said how the registrar-level change was made, and Blockaid has not said whether the ten other sites were hit by the same DNS hijack route. TSN’s crypto hacks and exploits hub tracks related incidents.

The next marker is a root-cause statement from Kintsu’s registrar or from Vercel, which would show whether one shared weakness sits behind all twelve sites.

Sources

• Flap on X: DNS hijacking incident, 31 October 2026
• Flap on X: domain service provider and root cause under investigation
• Flap on X: flap.sh back online
• Cedric (Flap) on X: risk window and compensation
• Kintsu on X: DNS hijack at registrar, revoke approvals
• Kintsu on X: Vercel Domains and supply-chain claim
• Kintsu on X: site restored
• Blockaid on X: frontend attack alert
• Blockaid on X: ten more sites serving the Step Drainer
• Malte Ubl (Vercel) on X: reply to Kintsu

Related stories

• Foundation Revokes All Cloudflare Keys After Passport Phishing Emails
• NGRAVE Fake App Alert Drained Wallets; Bitquery Estimates $2.65m Taken
• Hacken: Crypto Hacks Cost $1.18bn in Q3 2026, Mostly via Suppliers