Attacker socially engineered a GoDaddy employee to hijack SpiritSwap's domain, then deployed a phishing site with modified swap parameters. Before detection and shutdown on May 14, ~$18K was extracted (from 252 BNB total redirected).