Kintsu and Flap: 12 Crypto Websites Turned Into Wallet Traps Overnight

In the early hours of Saturday 31 October 2026, someone who typed kintsu.xyz or flap.sh into a browser could land on a site that sat at the right address and was built to empty their crypto wallet. Nobody had broken into the two companies' code. Someone had taken over their addresses.

By 03:16 UTC Blockaid, a security company whose software checks crypto transactions before people sign them, had found the same theft kit, which it called the Step Drainer, running on 12 crypto websites. Flap and Kintsu came first. Then stonkfun.xyz, pickle.finance, echelon.market, origami.finance, fluxbeam.xyz, stakepoint.app, supswap.xyz, longbow.cash, shprd.finance and apexdefi.xyz. Kintsu, Flap, StonkFun and Origami said by mid-morning that their addresses were back under their control. By the afternoon of 31 October no project, security firm or blockchain investigator had published a loss figure, and nobody had been named as the attacker.

Kintsu, a staking and lending service, says its address was hijacked "at the registrar level", and that it had bought the address through Vercel Domains, the domain shop of Vercel, an American web-hosting company. That is Kintsu's claim. Vercel had made no public statement by the afternoon of 31 October.

The internet's address book

Every website lives on a computer somewhere, and that computer is reached by a number. People do not type numbers. They type names such as flap.sh. The Domain Name System, or DNS, is the internet's address book: it records which computer each name points to. A registrar is the company that rents out the name and keeps its entry in the book.

Change the entry and the name points somewhere else. It is like someone quietly changing the phone number listed for a stockbroker in the directory. Clients dial the right name, reach a stranger, and the stranger answers in the broker's voice. That is a DNS hijack.

This is what makes the attack nastier than the usual fake website. The standard advice is to check the address bar for a misspelt name. On 31 October the address bar was correct. The name belonged to Flap or Kintsu. The computer behind it belonged to someone else.

The kit waiting there is a drainer: ready-made theft software that criminals buy or rent. It copies the look of the real site. When a visitor connects a crypto wallet, the app that holds coins and signs instructions, the kit asks for signatures. One of them is often an "approval", a standing permission that lets another account move a token out of the wallet, much like a direct debit mandate on a bank account. Once it is signed, the thief can pull the money later without asking again. An early warning from Ogle, a security researcher, described an injected script, crypto.news reported, one that sent visitors who pressed the connect-wallet button to the malicious page.

Origami and StonkFun both said their smart contracts, the code that holds and moves money by itself on the blockchain, were not touched. For them, only the front door was swapped.

Seven hours on a Saturday morning

All times are UTC. Flap, a site for launching new tokens on BNB Chain and Base that CryptoAdventure says is backed by YZi Labs, the investment firm formerly called Binance Labs, raised the alarm first. At 02:13 it warned that flap.sh was "redirecting to an unauthorized website" and asked users not to connect wallets or sign anything. Blockaid's alert on Flap and Kintsu followed at 02:54, and its list of ten more sites at 03:16, all "actively serving the Step Drainer".

At 03:35 Kintsu told anyone who had connected a wallet or signed anything since about 00:00 UTC to cancel their approvals at revoke.cash, a free tool that lists those permissions and cancels them, and to move their funds. That is the window Kintsu set for its users. Exactly when the hijack began has not been published. At 04:11 Kintsu named Vercel and tagged Guillermo Rauch, Vercel's chief executive, and Malte Ubl, its chief technology officer: "It appears to be a supply chain attack outside of our control. Our fix won't propagate and support is a bot." At 04:15 it said the address pointed at its own computers again, though some networks might show the fake for up to an hour while old copies of the address book cleared. At 05:27 it said the real site was back and it was still working with its registrar on the cause.

Echelon, a lending market on the Aptos blockchain, warned at 04:23 that its domain "appears to have been redirected to an unauthorized site". StonkFun, a token launch site, followed at 05:01, saying it was "not aware of anyone affected". By 06:15 it had moved to new infrastructure. Flap opened a second address, flap.cool, at 05:21 and said it was investigating whether its domain provider was involved. The original flap.sh was back at 07:33.

Origami, which runs investment vaults, paused all of them and at 06:53 blamed "an active attack on Vercel-associated Nameservers" for compromising a number of front-ends, the websites people use to reach the code. At 09:31 it said its address had been restored soon after the first warnings, but the vaults would stay paused until Vercel and Name.com, a domain registrar, delivered a root cause analysis. FluxBeam, an exchange on the Solana blockchain, said at 13:15 that its website was offline as a precaution while its service providers investigated.

Who is to blame

Two projects point at Vercel: Kintsu directly, and Origami through its reference to Vercel-associated name servers, the computers that answer address-book lookups. Public domain registration records list the same company, Name.com, Inc., as the registrar of all 12 addresses. A shared supplier is a fact. It is not proof of where the break-in happened. By the afternoon of 31 October there was no statement from the main X accounts of Vercel or Name.com, and no incident on either company's status page.

Not every site has said what happened to it. Flap, Kintsu, Echelon, Origami and StonkFun described a domain problem in their own words. Pickle Finance, StakePoint, SupSwap, Longbow, Shprd Finance and APEX are on Blockaid's list of sites serving the kit, without detail of how each was hit. FluxBeam has said only that its site is offline. CryptoAdventure reported that Flap was working with Blockaid, Vercel and Name.com.

How much was taken

Nobody knows yet. Wu Blockchain, a crypto news service, reported that Flap's founder, Cedric, said people who had used the real site before were not affected, and that the risk was for those who visited the fake and connected or signed in the tens of minutes before the warning. StonkFun said it knew of no victims. ScamSniffer, which tracks drained wallets and posts the big ones daily, had published nothing on the attack. Blockaid said it was still gathering data.

The count may rise later. An approval does not expire when the fake site goes away. Anyone who signed one and has not cancelled it is still exposed until they do.

An old trick in a busy week

Curve Finance, a large exchange run by code, lost control of its curve.fi address twice, both times through its registrar, iwantmyname. In August 2022 about $570,000 was drained from its users. On 12 May 2025 it happened again, and Curve moved to curve.finance. In July 2024 Blockaid flagged a wave of sites, including Compound Finance and Celer Network, whose addresses at Squarespace had been pointed at a kit tied to the Inferno Drainer group.

Two days before this attack, Polymarket's real website drained about $2.65 million from its own traders after a script from an outside company was poisoned. The route was different. The lesson is the same: the right address no longer guarantees the right website.