Signs of Attacks Found at 12 Overseas Crypto Sites; Users Urged to Be Cautious Linking Wallets

What happened

Blockaid, a blockchain security firm, said it found 10 more compromised sites tied to an incident beyond Flap and Kints. It detected "Step Drainer," a wallet-draining tool, on sites including Pickle Finance, Origami Finance and Fluxbeam. Attackers targeted pages where users connect wallets and approve transactions.

Confirmed

Global impact / market context

Crypto users often approve wallet permissions to use a site, which means giving it the ability to move their funds. If tampered pages capture those approvals, assets can be stolen directly from wallets, raising costs for users and pressure on site operators to protect domain settings.

Analyst inference

Attacks on wallet-connection pages shift risk toward users who sign approvals, not just the affected projects. That can reduce willingness to link wallets to smaller or less-known sites, potentially lowering activity, fee revenue and cash available for those platforms while raising spending on security checks.

Analyst inference

What to watch

1. Blockaid named Pickle Finance, Origami Finance and Fluxbeam among sites where it detected "Step Drainer," a tool that drains wallets through malicious approvals. It said it found 10 additional compromised sites beyond Flap and Kints. Confirmed
2. Users should be urged to check wallet permissions and revoke approvals they no longer need, which means withdrawing a site's ability to move funds. The article itself only says users are urged to be cautious linking wallets. Proposed
3. Watch whether affected projects change domain settings, called DNS information, which routes visitors to a website. Altered DNS can send users to attacker-made pages even when they type a legitimate address, so fixes there would reduce exposure. Analyst inference

Evidence

• en.bloomingbit.io