Blockaid flagged a frontend attack hitting at least 12 DeFi and token-launch websites, and StonkFun's operator says no user funds were lost
LaunchOnSF, the team behind token-launch platform StonkFun, says its website is back online. The restoration comes after a malicious toolkit called StepDrainer was found injected into its frontend, along with 10 other websites.
The attack never touched StonkFun’s smart contracts. It went after something more fragile: the trust users place in a familiar web address.
What happened
Security firm Blockaid identified the campaign on October 30–31, 2026. By its count, at least 12 decentralized finance (DeFi) and token-launch websites were hit.
StonkFun, at stonkfun.xyz, was among the first names on the list. The additional affected sites include pickle.finance, echelon.market, origami.finance and fluxbeam.xyz.
LaunchOnSF confirmed the site was restored quickly. It also said there was no on-chain impact and no reported user losses.
The mechanics matter here. According to the research findings, the attack relied on compromised DNS and domain systems that slipped harmful scripts into otherwise legitimate websites.
Once the scripts were live, visitors saw fraudulent wallet-connection requests. Those prompts were designed to harvest token approvals and signatures from anyone who clicked through.
How StepDrainer works
StepDrainer is not a one-off script written for this campaign. It operates as malware-as-a-service, meaning criminals can essentially rent the toolkit rather than build their own.
The toolkit reportedly works across more than 20 networks. It leans on common wallet interactions that users perform every day, including unlimited approvals.
Importantly, no private keys were stolen in this incident. The compromise was limited to website frontends, and the damage potential depended entirely on users approving malicious prompts.
No significant aggregate loss figures have emerged so far. Investigations are ongoing to pin down which shared vulnerabilities allowed the attackers into so many sites in the same window.
The response
Blockaid’s early detection and public warning set off a coordinated reaction across the affected projects. Teams moved to secure their services and told users not to connect wallets until further notice.
Users who interacted with any of the affected sites were advised to revoke harmful approvals. Services like Revoke.cash let wallet holders review and cancel token permissions they may have granted.
