Step Drainer Attack Spreads to 10 More Sites Including StonkFun, Pickle Finance

The spread of a single drainer kit across ten unrelated front-ends points to a shared tooling or hosting dependency rather than isolated compromises, which is the more uncomfortable signal for Solana DeFi users. StonkFun's claim that on-chain operations were untouched and no users are known to have been impacted suggests the damage window was narrow, but the list spans lending, DEX and staking interfaces, so exposure is broad. Whether other affected projects confirm or deny user losses, and whether SolanaFloor's investigation identifies a common vector, is the open question.