SpookySwap's frontend domain was compromised on November 18, 2023, with malicious phishing code injected to impersonate legitimate contract interactions. Users accessing the compromised domain were tricked into signing transactions draining their wallets. The attack resulted in $5K in realized losses before the team identified and removed the malicious code.

DEX SpookySwap on Fantom tweeted that the team is investigating a frontend vulnerability on their domain. Please do not execute any transactions on the DEX. On November 19, Spooky updated that a 3rd party JavaScript plugin enabled code injection from npm packages. This enabled replacing the spooky router contract on the Spooky Fi frontend with a malicious contract which sent funds that users attempted to swap to the exploiter.