GoPlus says DNS hijacking hit Flap and Kintsu sites, now restored

The story so far: Kintsu DNS hijack

Kintsu says its website was DNS-hijacked at its domain registrar, warning users who connected wallets or signed transactions since 00:00 UTC on 31 Oct to revoke approvals and move assets. GoPlus now says the hijacking also redirected the Flap site to malicious clones, affecting more than 10 domains; both sites…

1. 31 Oct 202602:21 UTC

   Blockaid warns of front-end attack on Kintsu, Flap and StonkBrokers

   Blockaid says it detected an active front-end attack linked to the StepDrainer kit affecting Kintsu, Flap and StonkBrokers, with malicious scripts that may send users who click connect wallet to a draining page. It is investigating further.

   AltcoinsChainCatcherAIBearish

2. 31 Oct 202603:02 UTC

   Flap founder says domain hijack risk limited to users who connected wallets

   The Flap founder says the project's website domain is pointing to an abnormal address, and that only users who visited the rogue site and connected a wallet or signed an authorisation in the minutes before the notice are affected. Flap says it does not store private keys or seed phrases and has urged users to stay off the site until it is fixed.

   AltcoinsOdailyAIBearish

3. 31 Oct 202604:02 UTC

   Kintsu says website hit by DNS hijack at domain registrar

   Kintsu says its website was DNS-hijacked at its domain registrar, so visitors may be sent to a malicious site. It urged users who connected a wallet or signed a transaction since 00:00 UTC on 31 Oct to revoke approvals and move their assets.

   AltcoinsChainCatcherAIBearish

4. 31 Oct 202604:57 UTC

   Kintsu says domain restored but warns users not to connect wallets yet

   Kintsu says its website domain has been restored and points to normal infrastructure again, but DNS cache clearing may leave some networks reaching a malicious site for up to an hour. It urged users to avoid the site and connecting wallets until it issues a security confirmation.

   AltcoinsOdailyAIBearish

5. 31 Oct 202608:17 UTC

   GoPlus says DNS hijacking hit Flap and Kintsu sites, now restored

   GoPlus said on 31 Oct that DNS hijacking redirected the Flap and Kintsu websites to malicious clones that prompted visitors to sign transactions sending BNB to an attacker or approve ERC-20 spending. More than 10 domains were affected; both sites are restored and the cause is under investigation.

   AltcoinsCoinNessAIBearish