Flap And Kintsu Alerts Separate Website And Wallet Recovery
Kintsu's 31st October warning and its later recovery notice separate website restoration from the permissions visitors may have granted.
Flap and Kintsu's 31st October 2026 recovery statements concerned access to their websites. Kintsu's earlier warning also addressed actions visitors might already have authorised through a malicious page.
Kintsu reported its real website restored at 05:27 UTC that day, while saying it was still investigating the cause with its registrar. Flap's recovery notice followed at 07:33 UTC. It said its official and alternative domains were available and monitoring would continue.
The Warning Covered Earlier Interactions
In its 03:35 UTC warning, Kintsu said its domain was serving a malicious site. It told users who had connected or signed since approximately 00:00 UTC on 31st October to revoke approvals and move funds. That was the team's precautionary window, not a verified time for the first harmful transaction.
Flap's earlier notice described a Domain Name System (DNS) hijack that redirected visitors to an unauthorised website. DNS maps names to network addresses. Flap asked users to avoid visiting, connecting wallets or signing while it worked on restoration.
Security provider Blockaid separately reported detecting a potential frontend attack targeting both projects. The frontend is the website interface used to interact with an application. Its alert advised avoiding interaction and signing until resolution. This independently corroborated the reported website threat.
Our CeFi and DeFi guide distinguishes the website interface from the contracts carrying out transactions.
Permissions Can Outlast A Website Session
Ethereum's security guidance explains that a smart contract, a program controlling operations on the network, can receive permission to spend a wallet's tokens. An unlimited allowance can expose the permitted tokens to that program. Keeping a wallet's secret keys private does not, by itself, cancel an allowance already granted.
The site's token-access guide makes the operational distinction explicit: disconnecting a wallet from a project leaves existing token permissions intact. Revocation requires a separate transaction and a network fee. The guide also notes that permission tools display contracts for the selected network, so an Ethereum view does not inventory permissions on every other chain.
Our wallet guide explains how token allowances can expose assets without revealing a private key.
Those general mechanics explain Kintsu's separate warning about approvals. They do not establish that every visitor signed an allowance, that every malicious interaction used this mechanism, or that any particular wallet remains exposed. The project recovery notices do not supply a wallet-by-wallet assessment.
Blockaid's expanded alert at 03:16 UTC identified other sites serving what it called Step Drainer, software used to steal crypto assets. The later Flap and Kintsu statements covered their own websites, not the recovery status of every site in that alert.
