LaunchOnSF restores website as StepDrainer attack spreads to 10 more sites
LaunchOnSF has restored its StonkFun website after a StepDrainer attack compromised at least 12 DeFi and token-launch platforms, with no user funds reported lost.
The attack, identified by security firm Blockaid on October 30-31, 2026, targeted decentralized finance (DeFi) and token-launch websites. StonkFun, at stonkfun.xyz, was among the first compromised sites, with pickle.finance, echelon.market, origami.finance and fluxbeam.xyz also affected.
LaunchOnSF confirmed the site was restored quickly, emphasizing there was no on-chain impact and no reported user losses. The attack relied on compromised DNS and domain systems that injected harmful scripts into legitimate websites.
Attack mechanics
Once active, the scripts displayed fraudulent wallet-connection requests designed to harvest token approvals and signatures from users who clicked through. The StepDrainer toolkit operates as malware-as-a-service, available for rent across more than 20 networks.
The attack never touched StonkFun's smart contracts. It went after something more fragile: the trust users place in a familiar web address.
Response and recovery
Blockaid's detection triggered coordinated responses across affected projects, with teams securing services and advising users not to connect wallets. Users were directed to revoke harmful approvals through services like Revoke.cash.
No private keys were stolen, and investigations continue to identify shared vulnerabilities that allowed the simultaneous compromise of multiple sites.
Related
