DNS hijack wave, 31 Oct 2026: 15 real DeFi domains incl. flap[.]sh and kintsu[.]xyz redirected to a wallet drainer via datasprite-cdn[.]com

• Scam type: Phishing
• Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
• Project or site name: datasprite-cdn[.]com drainer (31 Oct 2026 DNS hijack wave)
• Incident date: 2026-10-31
• Reported: 2026-10-31
• Last updated: 2026-10-31

Overnight on 30-31 October 2026 (UTC), visitors to the real websites of 15 DeFi projects were sent to a malicious copy of each site serving a wallet drainer. Coinspect reports the domains are registered through Name[.]com and that the attacker's DNS records pointed them at 31.56.52.52. GoPlus Security says the attacker likely compromised a domain registrar. The root cause has not been publicly confirmed. Affected domains named by Coinspect, which says all 15 are now recovered: flap[.]sh, dooar[.]com, kintsu[.]xyz, stonkbrokers[.]cash, apexdefi[.]xyz, fluxbeam[.]xyz, longbow[.]cash,…