A wave of Step Drainer attacks has targeted at least ten decentralized finance (DeFi) and crypto-related websites, raising security concerns across the Solana and Ethereum ecosystems. Security monitoring service SolanaFloor confirmed the breach of several popular domains on October 31, 2026, as malicious actors continue to deploy sophisticated wallet-draining scripts to siphon assets from unsuspecting users.
List of Affected Platforms and Current Status
The investigation by security analysts has identified a specific group of platforms compromised by the malicious code. The targets include a diverse range of services, from decentralized exchanges to yield farming protocols.
- stonkfun.xyz and pickle.finance
- echelon.market and origami.finance
- fluxbeam.xyz and stakepoint.app
- supswap.xyz, longbow.cash, shprd.finance, and apexdefi.xyz
Following the detection, StonkFun representatives announced that they have successfully migrated to a new infrastructure to eliminate the threat. According to their official statement, the attack targeted the frontend interface rather than smart contracts, meaning on-chain operations remained secure and no users have been reported as victims during this specific transition.
Mechanism of the Step Drainer Attack
The Step Drainer is a type of malicious script typically injected into a website's frontend via supply chain attacks or compromised third-party dependencies. Once a user connects their wallet to a compromised site, the script prompts the user to sign a transaction that, if approved, grants the attacker permission to transfer all supported tokens and NFTs to a private address.
SolanaFloor stated that they are actively investigating and collecting more data regarding the breadth of the Step Drainer campaign.
Security experts recommend that users of DeFi protocols remain vigilant when interacting with web interfaces and utilize hardware wallets or browser extensions that provide transaction simulation to detect unauthorized asset transfers before they are executed.
As the investigation into the Step Drainer incident continues, the affected projects are working to harden their web security and verify the integrity of their domain name systems (DNS). While some platforms like StonkFun have already restored services, users are advised to clear their browser cache and verify official communication channels before reconnecting their wallets to any of the aforementioned platforms.
Frequently Asked Questions
Quick answers to the most common questions about this topic.
For educational purposes only. Nothing here constitutes financial or investment advice. Crypto markets are highly volatile — always DYOR before making any decisions.
Fact-checked per our editorial policy. We maintain strict independence from advertisers. Spot an error? Let us know.