Gitcoin — Frontend Eleven Drainer Injection

Timeline: T0 (June 20-21, 2026): Blockaid's detection engine identifies a front-end attack on Gitcoin's subdomain files.gitcoin.co. The site is found to contain 'Eleven Drainer' code designed to present a fake wallet-connect modal (Phantom/Solflare) and steal connected users' cryptocurrency assets. T0 (same window): Blockaid publishes a public alert via X (@blockaid_): 'Blockaid's detection engine identified a front-end attack affecting @gitcoin subdomain files[.]gitcoin[.]co. The site contains an Eleven drainer code. We advise users not to interact with the site at this time, as the issue is being investigated and remediated.' June 21-23, 2026: Community amplification on X (multiple accounts warning users to stay away from the subdomain); no victim reports or loss figures surface publicly during this window. June 21, 2026 (last documented activity): Remediation reported as in progress; no confirmed completion date, no post-mortem, no aggregate loss figure ever published by Gitcoin or Blockaid as of report compilation.