What happened
SpiritSwap's May 2022 website compromise changed swap parameters so transaction outputs went to an attacker-controlled address. SpiritSwap reported approximately $18,000 stolen and disabled swapping.
Technical root cause
The compromised frontend altered the destination of swap outputs. SpiritSwap's initial statement pointed to AWS, while reporting also discussed domain compromise; the precise entry point was not established. The incident did not demonstrate a flaw in the exchange's smart-contract logic.
How it happened
- The attacker compromised the website infrastructure used to serve SpiritSwap's trading interface.
- Modified swap parameters redirected outputs to an attacker-selected recipient.
- SpiritSwap detected the problem and disabled swapping to limit further losses.
Protocol details
Classification
Exchange (DEX) / Frontend & Infrastructure
Protocol Type
Exploit/Phishing
Affected asset / contract
SPIRIT
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
