Flap and Kintsu: DNS Hijacks Sent Visitors to Malicious Clones

Not stated by either project. Kintsu cites a pending redemption "associated with stolen funds".

Root cause: Kintsu: "an unauthorized nameserver change at our domain registrar (Vercel, which uses Name[dot]com)"; frontend code and contracts not compromised. Flap: DNS hijacking; whether its domain provider was involved is under investigation.

Timeline, as sourced: Per Kintsu: clone served ~00:15 to 04:11 UTC 31 Oct, some networks until ~05:20; sMON deposits and withdrawals paused 06:34 UTC. Flap warning 02:13 UTC; Blockaid alert 02:21 UTC; Flap back online on flap.sh by 07:33 UTC.

Claimed (Kintsu) (update (opens in a new tab)): from about 00:15 to 04:11 UTC on 31 Oct, an unauthorized nameserver change at its registrar redirected kintsu.xyz to a malicious clone; some networks showed the clone until about 05:20 UTC. It paused sMON deposits and withdrawals at 06:34 UTC, blocking redemption through Kintsu, including one pending redemption tied to stolen funds. "The attack used a wallet “delegation” signature, so revoking token approvals alone is not enough." Kintsu is considering admin freeze-and-reassign powers, subject to an independent audit.

Claimed (Flap) (warning (opens in a new tab), update (opens in a new tab)): flap.sh was hit by DNS hijacking and redirected to an unauthorized site; Flap moved users to flap.cool and later said flap.sh was back online (opens in a new tab).

Per Blockaid (alert (opens in a new tab)): a potential frontend attack targeting flap.sh, kintsu.xyz and stonkbrokers.cash (Clutch Markets). No Clutch Markets statement found.

Unconfirmed: SEAL's weekly report (opens in a new tab) describes "a registrar-level DNS hijack" that "hit two protocols at once, again injecting a crypto drainer" that week, without naming them. Whether that refers to Flap and Kintsu is not stated.

Unknown: how the registrar account or nameservers were changed, number of victims, and losses.