GoPlus Security 🚦 · 2026-10-31 08:05 UTC

🚨 GoPlus Security Alert: On Oct 31, Flap and Kintsu official sites were hit by a DNS hijack. Attackers most likely compromised a DNS registrar (Flap, Kintsu, and 10+ other domains were affected). They redirected traffic from the official domains to malicious clone sites to drain assets. ⚠️ How funds were drained: Users who clicked “Connect Wallet” on the clone sites were redirected to a malicious wallet connect flow or drainer page. Two drain methods were used (phishing-style, indicators consistent with the #StepDrainer group): 1. Native coin transfer: User signed a transaction sending BNB to the attacker’s Safe. 2. ERC-20 approval drain: User approved tokens to the Safe; attacker then called `transferFrom` to pull the tokens. Attacker-controlled Safe receiving address: `0x24497068cA4166ca32a04ae530ce00Cf79755bD5` Sole Owner / executor of the Safe: `0x33dfc810365193bff54326812d7df34b3e438da3` 🚑 Recovery status: Kintsu has been restored ( ). Flap has been restored ( ) and continues to keep the backup domain available: . Root cause of the DNS hijack is still under investigation. 🛡️ Recommendations: 1. If anything feels off or different from your usual interaction experience, stay alert — you may have landed on a malicious clone due to DNS hijacking. 2. If you signed a suspicious transaction or saw unexpected transfers, investigate immediately and move remaining assets to a fresh wallet. 3. Check and revoke any suspicious approvals using tools such as the GoPlus security plugin.

Loading the story on Tree News…