Digital Asset
Intelligence
Security Incident · Fantom Ecosystem

SpookySwap Malicious Code Injection Attack: $5.00K Reported Loss

·Historical incident record

Incident Overview

DEX SpookySwap on Fantom tweeted that the team is investigating a frontend vulnerability on their domain. Please do not execute any transactions on the DEX. On November 19, Spooky updated that a 3rd party JavaScript plugin enabled code injection from npm packages. This enabled replacing the spooky router contract on the Spooky Fi frontend with a malicious contract which sent funds that users attempted to swap to the exploiter.

Sources & References

Original incident referencehttps://twitter.com/SpookySwap/status/1725677274718994543 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Attack methodPrivate Key Leakage
    Reported loss$ 657,000
  2. Incident date
    Attack methodUnknown
    Reported loss$ 126,000,000
  3. Incident date
    Attack methodUnknown
    Reported lossNot disclosed
  4. Incident date
    Target

    dYdX

    Attack methodPrice Manipulation
    Reported loss$ 9,000,000
  5. Incident date
    Attack methodMalicious Code Injection Attack
    Reported lossNot disclosed