Security
SwapRocket is non-custodial — users keep control of their funds at all times. We apply standard web-application security practices to safeguard the data we handle on the site.
Operating model
SwapRocket is a non-custodial crypto swap service and a marketing/quoting front-end for our liquidity partner's instant swap service. We never custody user funds and never act as a counterparty to user trades.
window.ethereum, window.solana, or window.phantometh_sendTransaction, personal_sign, or eth_signTypedDataThe user selects the asset pair and amount on swaprocket.io.
The user pastes their own destination wallet address — never created or stored by us beyond what is needed to fulfill the order.
Our liquidity partner returns a one-time deposit address.
The user sends crypto to that deposit address from their own wallet, on their own initiative.
The swapped asset is delivered to the destination address the user provided.
At no point does swaprocket.io request or receive control over a user's wallet, signing keys, or private credentials. There is no on-site signing flow that the website could hijack.
Infrastructure
All traffic to swaprocket.io is served over HTTPS (TLS), so the addresses and amounts you enter are encrypted between your browser and our servers.
Swaps run between your own wallet and our liquidity partner. SwapRocket never holds your coins, so there is no SwapRocket balance or hot wallet of yours that could be exposed.
There are no user accounts. We keep only what is needed to process and support a swap, such as the destination address and transaction reference.
Stay safe
If you've discovered a security vulnerability or have concerns about a transaction, please contact our security team immediately.
Thank you to the researchers who reported security issues to us directly and gave us time to fix them.