Flap’s official website domain suffers DNS hijacking; team migrates to flap.cool and promises compensation for stolen funds
BNB Chain token launch platform Flap, invested in by YZi Labs, announced on X on October 31 that its official website flap.sh had suffered DNS hijacking and was being redirected to an unauthorized website. The team urged users not to visit the old domain, connect wallets, or sign any transactions for the time being, and said it was handling the matter urgently.
Later, Flap’s official account and founder Cedric (@eth_cedric) posted an update saying they were investigating whether the DNS attack was related to the domain service provider, and that the root cause was still under investigation. To improve security, the team has moved the official website to the new domain flap.cool and advised users to access it directly through the new domain; users visiting the old domain flap.sh will be redirected to the new domain, but they are still advised to avoid wallet interactions on the old domain. Cedric said the risk mainly concerns users who accessed the abnormal site and connected wallets or signed transactions during a specific period before the announcement, roughly UTC 1:00 to 5:00; users who had previously connected normally are not affected. Flap does not store users’ private keys, seed phrases, or wallet data, and its token creation, treasury, staking, and Locker functions were not affected.
In a follow-up post, Cedric explicitly said that they would assist in checking the situation of affected users and compensate users whose funds were stolen due to this incident. Security company Blockaid the same day linked the related attack to the StepDrainer toolkit and pointed out that multiple DeFi sites, including Kintsu and others, had suffered similar front-end hijacking. The Flap team is working with Blockaid and other partners, and is seeking assistance from Vercel and Name.com.
Original sources:
Title: Our official website... is currently affected by a DNS hijacking incident Publisher: Flap (@flapdotsh) Publication date: 2026-10-31 URL: https://x.com/flapdotsh/status/2116352828734050339 Source type: official project post Verification status: the full warning content was read in this read-through, verification date 2026-10-31 Supporting content: confirmed DNS hijacking, redirection to an unauthorized website, and warned users not to visit, connect wallets, or sign.
Title: Progress Update / 进展更新 Publisher: Flap (@flapdotsh) Publication date: 2026-10-31 URL: https://x.com/flapdotsh/status/2116400269445509360 Source type: official project post Verification status: the migration statement and investigation note were read in this read-through, verification date 2026-10-31 Supporting content: confirmed migration to flap.cool, investigation of the domain service provider, and advice to avoid interactions on the old domain.
Title: For now, please use https://flap.cool/board... Publisher: Cedric (@eth_cedric) Publication date: 2026-10-31 URL: https://x.com/eth_cedric/status/2116402242517385551 Source type: project founder post Verification status: the risk window and compensation commitment were read in this read-through, verification date 2026-10-31 Supporting content: confirmed the risk to users who connected/signed during a specific period, that functions were not affected, and that if funds were stolen due to this incident, Flap would be responsible for compensation.
ABAB AI Insight
Flap, a BNB Chain meme launch platform backed by YZi Labs, had its official website flap.sh suffer DNS hijacking on October 31, causing users who entered the correct domain to potentially be routed to a fake front end. Such an attack manipulates domain resolution so that a phishing page appears in the browser as the official site; if users connect a wallet and sign, assets can be transferred. The founder limited the affected scope to users who operated on the abnormal site during the hours before the announcement and promised compensation for funds stolen due to the incident.
On the technical side, Flap is investigating whether the issue is related to an upstream domain service provider and has switched to flap.cool. Blockaid linked the incident to the StepDrainer toolkit and to multiple other DeFi front-end cases, suggesting a broader attack at the domain/registrar level rather than a vulnerability in a single project. Flap’s contract-side functions (token creation, treasury, and so on) were said to be unaffected, with the risk concentrated in front-end interactions.
A comparable historical case is DeFi front-end theft caused by DNS or CDN hijacking. The similarity is that users see the correct domain but enter a malicious page; the difference this time is that multiple projects were affected at once, and the Flap team proactively announced a compensation commitment. The background of YZi Labs’ investment and CZ’s interactions made the incident draw high attention in the community, but the compensation scope and implementation details still depend on future announcements from the team.
This incident changes the front-end trust model: even if the domain is correct, a compromise at the DNS layer can still lead to asset losses. For users, what can be observed is the compensation application process and the actual coverage; for the project, it is whether the domain service provider investigation results are disclosed. Public information has not confirmed concrete evidence that the hacker had been lying in wait for over a month, nor has it disclosed a confirmed amount of losses.
ABAB News · Cognition Law
A correct domain does not mean the page has not been hijacked; a DNS-layer attack can make an official address point to a fake site.
A team’s compensation promise does not mean a specific loss amount or the full scope of affected users has already been confirmed.
Multiple projects experiencing similar front-end issues at the same time does not automatically prove that a single registrar or service provider is the only entry point.