Attack on CoW Swap Protocol Revealed: 550 BNB Drained
• CoW Swap, a decentralized finance platform, suffered from a multisig attack on its settlement smart contract.
• Blockchain security auditing firm PeckShield and BlockSec, a smart contract auditing firm, both confirmed the exploit.
• The threat actor used access gained through the multisig to trigger the settlement smart contract and drain 550 BNB into Tornado Cash.
CoW Swap Suffers Multisig Attack
CoW Swap, a decentralized finance platform over which CoW (Coincidence of Wants) Protocol is built, has recently suffered from a multisig attack on its settlement smart contract. This was initially disclosed by MevRefund, a blockchain security researcher and whitehat hacker who noticed funds being moved away from CoW Swap’s protocol.
Security Auditing Firms Confirm Exploit
Blockchain security auditing firm PeckShield later confirmed the exploit and released details of it on Twitter. According to their analysis, an attacker had tricked the GPv2Settlement contract to approve SwapGuard for DAI spending and then triggered it to transfer out DAI from the GPv2Settlement account. BlockSec also provided further details regarding how the threat actor added his wallet address as „solver“ via the multisig in order to gain access to the protocol.
Threat Actor Moves Funds To Tornado Cash
The threat actor was then able to use this access to trigger the settlement smart contract and drain 550 BNB into Tornado Cash – a crypto anonymity funnel that enables users to mask transactions making it harder for anyone else to trace them.
CoW Swap Responds To Exploit
CoW Swaps team has not yet released an official statement regarding this exploit but they claim that they are already working on fixing it. They reassured users that their accounts would remain unaffected by this exploit given how user funds can only be signed through an order executed by a user themselves.
This article is provided for informational purposes only and should not be used as legal advice or other advice such as tax or investment advice.