According to CoinMeta, THORSwap stated that on September 28th, the third-party customer service platform Mava used by both THORSwap and Metro was subjected to a domain name hijacking at the registrar level. This allowed malicious code to be loaded through the customer service component for a period of time, enticing users to connect to a malicious WalletConnect, which then stole users' entered mnemonic phrases or keystore information and replaced the Direct Swap recharge addresses. The incident resulted in the theft of approximately $58,000 in assets, of which about $54,200 came from affected wallets, and around $3,500 from a tampered Direct Swap. The latter amount has been fully compensated for. THORSwap claimed that their own servers and application code were not compromised, and they have now completely disabled the Mava customer service component.