This weekend's crypto news had less to do with broken code than with broken permissions: a dozen DeFi front ends hijacked at the domain layer, $293 million in stolen XRP on the move, and a ledger permission that lets an account authorized only to burn tokens mint them instead.
A DNS Hijack Drains a Dozen DeFi Front Ends
Late on Friday, October 31, the token launchpad Flap confirmed that flap.sh had suffered a DNS hijacking incident. By 10:54 p.m. ET the security firm Blockaid had flagged Flap and Kintsu, then identified ten more compromised sites, among them Pickle Finance, Origami Finance and Echelon. The hijacked pages served a wallet-draining kit called Step Drainer, which prompts visitors to sign approvals that hand over their assets. At least $138,000 has been traced across Ethereum, BNB Chain, Robinhood Chain and Monad, with Solana and Aptos losses uncounted. All twelve domains were registered through Name.com.
Nothing on the blockchain failed. The contracts behaved as written and every victim signed voluntarily, which is exactly what a defendant will say. That pushes claims toward the infrastructure vendor that lost control rather than the protocol, and registrar and hosting agreements carry liability caps that make that an uphill fight. The root cause is still unconfirmed, so nobody yet knows whose contract governs the loss.
The Binance Attacker Splits $293 Million in XRP Six Ways
On October 29, five Binance wallets sent roughly 233.46 million XRP to a single address in about four minutes. The balance sat untouched until 03:47 UTC on November 2, when the attacker sent six test payments of 1,000 XRP. Within eight minutes, nine transfers moved essentially everything into those six wallets, leaving 23.7 XRP behind. Analysts separately tracked some $242 million through Tron-linked routes and services including Relay, Thorchain and Chainflip, with a Thorchain outage interrupting one path while the FBI pressed node operators to block related transactions.
For victims, the asymmetry between asset types is the whole story. Tether froze about 378.7 million USDT and Ripple froze the stolen RLUSD, because a centralized issuer holds a switch it can throw in hours. Nobody can freeze native XRP or bitcoin, so recovery depends on tracing and on exchanges refusing deposits. U.S. authorities attribute the theft to North Korea, which turns this from a security incident into a sanctions question for any business that touches the funds.
The XRP Ledger Moves to Close a Burn Permission That Mints
The XRP Ledger is preparing to activate an amendment, fixCleanup3_4_0, addressing a flaw in its delegated permissions: under certain conditions, an account granted authority only to destroy an issuer's tokens can create new ones instead. It affects tokens issued on the ledger, including stablecoins, but not XRP itself, and the documentation now tells developers not to grant that permission until the fix is live. A brief dip in validator support on October 21 restarted its two-week countdown, pushing activation to roughly 14:46 UTC on November 4. For a regulated stablecoin issuer, an unintended mint path is a reserve-backing failure waiting to happen, and one-to-one backing is the obligation under the GENIUS Act framework.
How to Protect Yourself
These attacks defeat the usual advice, because the URL in the address bar was correct. Treat a familiar site that suddenly asks you to re-approve a token as a warning sign, read what the approval actually grants rather than the label on the page, and use a wallet that simulates the transaction before you sign. Revoke old approvals you no longer need.
If you have already lost funds, the first hours matter more than anything you do later. Record transaction hashes, wallet addresses and timestamps immediately, report to the FBI's IC3 and to any exchange in the path, and ask about a freeze while the assets are still identifiable, because issuer-controlled tokens can be frozen quickly but only if someone asks. Counsel can send preservation letters, subpoena exchanges, and sue unnamed defendants to unmask an address before the trail goes cold.
At Coin Counsel, we work with individuals and businesses navigating the legal fallout of crypto fraud — whether you're a victim seeking recovery, a company facing regulatory scrutiny, or a project working to stay compliant in an increasingly complex legal landscape. The rules are evolving fast, and the cost of getting it wrong has never been higher. Contact us at coin-counsel.com to speak with a crypto-focused attorney today.
Disclaimer
This blog post is for informational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship between you and Coin Counsel or Franco Law PLLC. The legal landscape surrounding cryptocurrency is rapidly evolving and varies by jurisdiction. Do not act or refrain from acting based on information in this post without first consulting a qualified attorney. If you believe you have been the victim of crypto fraud, contact us at coin-counsel.com for a consultation.
