-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0292
============================================================

Advisory-ID:  0xCERT-2026-0292
Severity:     Medium
Published:    2026-10-31T00:00:00.000Z
Updated:      2026-10-31T07:23:32.643Z
Chains:       Other / Multi-chain
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0292

Title: Kintsu DNS Hijack (StepDrainer Campaign)

Summary
- -------
Kintsu's website was hijacked via a registrar-level DNS attack and rerouted to a StepDrainer wallet-drainer page, in a campaign that also hit Flap and StonkBrokers.

Details
- -------
Summary
Kintsu's website was hijacked via a registrar-level DNS attack and rerouted to a StepDrainer wallet-drainer page, in a campaign that also hit Flap and StonkBrokers.

Incident
- - Victim: Kintsu
- - Date (UTC): 2026-10-31
- - Chain(s): Monad
- - Attack type: front-end compromise
- - Funds status: unknown

Recommended actions
- - Revoke token approvals granted to Kintsu contracts until the project confirms they are safe
- - Integrators: pause or delist affected assets and monitor for attacker fund movements
- - Beware of follow-on phishing: ignore unofficial "refund", "recovery", or "claim" links and DMs; use the project's verified channels only

Source & attribution
Full analysis on Blockchain Breaches, 0xCERT's incident archive: https://www.blockchainbreaches.com/en/breaches/kintsu-2026. Primary sources: https://econotimes.com/Kintsu-Urges-Wallet-Users-to-Revoke-Approvals-After-DNS-Hijack-1767489 ; https://www.tokenpost.com/news/technology/45297 ; https://econotimes.com/Blockaid-Probes-Suspected-Wallet-Attacks-at-Kintsu-Flap-and-StonkBrokers-1767462.

References
- ----------
- - https://www.blockchainbreaches.com/en/breaches/kintsu-2026
- - https://econotimes.com/Kintsu-Urges-Wallet-Users-to-Revoke-Approvals-After-DNS-Hijack-1767489
- - https://www.tokenpost.com/news/technology/45297
- - https://econotimes.com/Blockaid-Probes-Suspected-Wallet-Attacks-at-Kintsu-Flap-and-StonkBrokers-1767462

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrlyAIJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcme7tq3+qrbuwmh+b1C63Ed0Agwv1appqjC6zdBi
hjbkFxYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAAPhAEAwI5wxGf/8fuNWj0W
MKYLGVGMb9BclcMh383ZemJpT/wA/iv6sTMnGDbXYJ1qR5jovSwytDyH4ZzB
3JZ+Wz77mwgF
=MqIo
-----END PGP SIGNATURE-----