KyberSwap Classic Hack

On September 1, 2022, attackers stole about $265,000 from a KyberSwap user by injecting malicious JavaScript into the KyberSwap website. KyberSwap's smart contracts were not affected. The script showed wealthy visitors a fake "Increase Allowance" prompt that approved an attacker-controlled address instead of KyberSwap's contracts; it targeted only wallets holding more than $1M, later lowered to more than $100K.

KyberSwap's post-mortem traced the access to a phishing attack. The attacker registered the look-alike domain cioudflare.net in September 2021, a phishing email reached KyberSwap's devops mailbox on October 28, 2021, and on October 29 an SRE who was still employed (they left in April 2022) was phished, letting the attacker log in to Cloudflare and take the Global API key. The attacker first uploaded the malicious script through Cloudflare Workers on August 6, 2022. On September 1 at 08:13 UTC they re-uploaded the scripts and created routes applying them to kyberswap.com. KyberSwap noticed the fake prompt at 08:22 UTC and disabled public access to the site at 08:45 UTC, but two Polygon wallets approved the attacker at 08:37 and 08:43 UTC. KyberSwap removed the attacker's routes and scripts from its Cloudflare zone on September 4. Initial reports on September 1 attributed the injection to Google Tag Manager.

Of the two whale wallets that approved the attacker, one lost $265,000 directly plus $49,000 in resulting liquidations; the other revoked its approval before funds moved. KyberSwap reimbursed the affected user $314,000, revoked the compromised keys and ex-employee access, and added anti-phishing 2FA and hardware tokens for production access.