🚨 GoPlus Security Alert: On October 31, the official Flap and Kintsu websites suffered DNS hijacking attacks. The attacker likely compromised a domain registrar, with more than 10 other domains also hijacked alongside Flap and Kintsu. By manipulating DNS, the attacker redirected traffic from official project domains to malicious clone sites to steal assets. ⚠️ How Funds Are Stolen: Users who click “Connect Wallet” on the clone sites are redirected to a malicious wallet-connection or drainer page. The theft takes two forms, with attack characteristics pointing to the #StepDrainer# group: 1. Direct native-token transfers: Users sign a transaction sending BNB to the attacker’s Safe. 2. ERC-20 approval abuse: Users approve the Safe to spend their tokens. The attacker then calls `transferFrom` to move the tokens. Attacker-controlled Safe recipient address: 0x24497068cA4166ca32a04ae530ce00Cf79755bD5 Safe’s sole owner / execution address: 0x33dfc810365193bff54326812d7df34b3e438da3 🚑 Recovery Status: Kintsu is back online ( Flap is also back online ( with remaining available as an alternative domain. The cause of the DNS hijacking is still under investigation. 🛡️ Security Recommendations: 1️⃣ Stay alert to unusual behavior or anything that differs from the site’s usual behavior. DNS hijacking can redirect you to a malicious clone. 2️⃣ If you signed a suspicious transaction or notice a suspicious transfer, investigate immediately and move your remaining assets to a fresh, secure wallet as soon as possible. 3️⃣ Use tools such as the GoPlus security extension to check for and revoke suspicious token approvals promptly.

🚨This is CONCERNING. 12 DeFi websites were hijacked and turned into wallet drainers in just ONE night. Blockaid found the sites "actively serving" Step Drainer, a kit that fakes normal-looking wallet pop-ups to trick visitors into approving transfers. Step Drainer is sold to scammers as a ready-made kit and works across more than 20 blockchains. Once a victim approves, it goes after their most valuable tokens first. Researchers have even seen its prompt show a fake "+500 USDT" so the approval looks like money coming in. Affected projects include Flap, Kintsu, StonkFun, Pickle Finance, Echelon, Origami Finance, FluxBeam, StakePoint, SupSwap, Longbow, Shprd Finance and APEX. About $138,000 has been traced so far, and that excludes losses on Solana and Aptos. All 12 domains were registered with Name(.)com, though how they were hijacked is still unconfirmed. Name(.)com's only public response so far has been asking users to fill out its abuse form, per The Block. Not every affected team has confirmed its site is clean yet.