THORSwap Loses Approximately $58,000 Due to Customer Service Plugin Hijacking

THORSwap and Metro Exchange's third-party customer service platform Mava was hijacked at the domain registrar level on September 28, resulting in the injection of malicious code into the customer service plugin. This led to the theft of user mnemonic phrases and keystore information, as well as the replacement of the Direct Swap deposit address. The incident caused a loss of approximately $58,000, of which about $54,200 came from stolen wallets and $3,500 from the tampered Direct Swap, which has fully compensated affected users. THORSwap stated that its servers and application code were not affected, and the related website has now been restored to safety. Users who used its dApp between 01:50 and 03:40 on September 29, imported mnemonic phrases, copied or scanned the Direct Swap deposit address, or connected to a malicious WalletConnect prompt should immediately transfer their assets to a new wallet and revoke existing token authorizations.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.