Hackers hijacked 12 DEFI sites and stole crypto from connected wallets A new security incident exposes one of DeFi's most underappreciated weaknesses. The attack does not always have to occur within a smart contract. Sometimes, hackers just need to control a site. According to security firm Hasimah Hasima, the attackers hijacked 12 DeFi-related websites late Friday, including Sour Finance, Origami Finance, Dash and Kintsu. Visitors were presented with malicious wallet interactions designed to steal their assets. According to reports, the attackers deployed the Step Dryer, a malicious toolkit that tricks users into approving transactions that transfer funds from their wallets. Onchain analysis of the block found approximately $138,000 in stolen assets on EVM compatible networks. The actual amount could be higher because the estimate does not include losses on Solana and Aptos. All 12 affected domains were registered through Shem. COM and 10 were subsequently suspended at the registrar level. However, the exact infrastructure weakness responsible for the incident remains under investigation. Several affected projects said their underlying smart contracts were not affected. This is the important distinction. The DeFi protocol can have secure smart contracts while its website directs users towards malicious transactions. No need to hack the blockchain itself. The attacker simply needs the users to sign the false certificate. For DeFi users, the warning is simple: verify unexpected requests to the wallet, especially when interacting with recently dedicated sites. Security issues in a smart contract. But the infrastructure that connects users to these contracts is also part of the security scope.

Hackers hijacked 12 DEFI sites and stole crypto from connected wallets A new security incident exposes one of DeFi's most underappreciated weaknesses. The attack does not always have to occur within a smart contract. Sometimes, hackers just need to control a site. According to security firm Hasimah Hasima, the attackers hijacked 12 DeFi-related websites late Friday, including Sour Finance, Origami Finance, Dash and Kintsu. Visitors were presented with malicious wallet interactions designed to steal their assets. According to reports, the attackers deployed the Step Dryer, a malicious toolkit that tricks users into approving transactions that transfer funds from their wallets. Onchain analysis of the block found approximately $138,000 in stolen assets on EVM compatible networks. The actual amount could be higher because the estimate does not include losses on Solana and Aptos. All 12 affected domains were registered through Shem. COM and 10 were subsequently suspended at the registrar level. However, the exact infrastructure weakness responsible for the incident remains under investigation. Several affected projects said their underlying smart contracts were not affected. This is the important distinction. The DeFi protocol can have secure smart contracts while its website directs users towards malicious transactions. No need to hack the blockchain itself. The attacker simply needs the users to sign the false certificate. For DeFi users, the warning is simple: verify unexpected requests to the wallet, especially when interacting with recently dedicated sites. Security issues in a smart contract. But the infrastructure that connects users to these contracts is also part of the security scope.