Before it was taken down, Ordswap users said the compromised website directed users to a phishing link.