“Before being taken offline, Ordswap users reported that the compromised website was redirecting users to a phishing link.
Ordswap, a platform enabling users to record, auction, and trade Bitcoin Ordinals, has devised a solution for users to recover their private keys while working tirelessly to regain control of its website domain.
In a Twitter post on October 10th, the official Ordswap account unveiled an online tool, designed to assist MetaMask users in recovering their Ordswap private keys, allowing them to transition to other service providers.
On October 9th, Ordswap issued a stern warning to its users, urging them not to access its domain, as it had temporarily lost control. The blame was placed on Netlify, a web development and hosting company.
Within Ordswap’s Discord server, a team member and users reported an alarming occurrence: the website displayed a button encouraging users to link their crypto wallets, seemingly in an attempt to phish them.
One user on the platform described this button as a “wallet drainer,” a tool increasingly used by crypto scammers. At the time of writing, Ordswap’s website automatically redirected users to a rival platform called RelayX.
An Ordswap team member on Discord assured users that there hadn’t been any compromise of user private keys or assets due to the breach. However, there was a caution that user interactions with the site could potentially compromise their security.
Towards the end of September, the website of the Ethereum-based automated market maker Balancer fell victim to a seemingly similar attack. The attackers managed to abscond with approximately $240,000 worth of funds.
Balancer later disclosed that it believed the attackers had employed a social engineering tactic on its DNS service provider, EuroDNS. This tactic allowed the attackers to insert a prompt that deceived users into approving a malicious contract, effectively draining their wallets.”
