LaunchOnSF restores website as StepDrainer attack spreads to 10 more sites

Blockaid flagged a frontend attack hitting at least 12 DeFi and token-launch websites, and StonkFun's operator says no user funds were lost LaunchOnSF, the team behind token-launch platform StonkFun, says its website is back online. The restoration comes after a malicious toolkit called StepDrainer was found injected into its frontend, along with 10 other websites. The attack never touched StonkFun’s smart contracts. It went after something more fragile: the trust users place in a familiar web address. Security firm Blockaid identified the campaign on October 30–31, 2026.