A coordinated wave of frontend attacks hit at least 12 cryptocurrency websites on October 31, with malicious code steering visitors toward wallet-draining pages after attackers seized control of domain infrastructure used by DeFi protocols and token launch platforms.

Blockchain security firm Blockaid tied the incidents to StepDrainer, a malware toolkit that steals crypto by inducing fraudulent wallet connections and transaction approvals. The compromised sites include StonkFun, a Solana token launchpad that lets creators pair new coins with tokenized stocks or ETFs, along with Flap and Kintsu and nine other platforms.

Flap, a token launch platform backed by YZi Labs, was first to raise the alarm, saying its original domain, flap.sh, had…