GoPlus Security 🚦 · 2026-10-31 08:13 UTC

🚨 GoPlus Security Alert: On October 31, the official Flap and Kintsu websites suffered DNS hijacking attacks. The attacker likely compromised a domain registrar, with more than 10 other domains also hijacked alongside Flap and Kintsu. By manipulating DNS, the attacker redirected traffic from official project domains to malicious clone sites to steal assets. ⚠️ How Funds Are Stolen: Users who click “Connect Wallet” on the clone sites are redirected to a malicious wallet-connection or drainer page. The theft takes two forms, with attack characteristics pointing to the #StepDrainer group: 1. Direct native-token transfers: Users sign a transaction sending BNB to the attacker’s Safe. 2. ERC-20 approval abuse: Users approve the Safe to spend their tokens. The attacker then calls `transferFrom` to move the tokens. Attacker-controlled Safe recipient address: 0x24497068cA4166ca32a04ae530ce00Cf79755bD5 Safe’s sole owner / execution address: 0x33dfc810365193bff54326812d7df34b3e438da3 🚑 Recovery Status: Kintsu is back online ( Flap is also back online ( with remaining available as an alternative domain. The cause of the DNS hijacking is still under investigation. 🛡️ Security Recommendations: 1️⃣ Stay alert to unusual behavior or anything that differs from the site’s usual behavior. DNS hijacking can redirect you to a malicious clone. 2️⃣ If you signed a suspicious transaction or notice a suspicious transfer, investigate immediately and move your remaining assets to a fresh, secure wallet as soon as possible. 3️⃣ Use tools such as the GoPlus security extension to check for and revoke suspicious token approvals promptly.

Loading the story on Tree News…