• CoW Swap, a decentralized finance platform, suffered from a multisig attack on its settlement smart contract.
• Blockchain security auditing firm PeckShield and BlockSec, a smart contract auditing firm, both confirmed the exploit.
• The threat actor used access gained through the multisig to trigger the settlement smart contract and drain 550 BNB into Tornado Cash.

CoW Swap Suffers Multisig Attack

CoW Swap, a decentralized finance platform over which CoW (Coincidence of Wants) Protocol is built, has recently suffered from a multisig attack on its settlement smart contract. This was initially disclosed by MevRefund, a blockchain security researcher and whitehat hacker who noticed funds being moved away from CoW Swap’s protocol.

Security Auditing Firms Confirm Exploit

Blockchain security auditing firm PeckShield later confirmed the exploit and released details of it on Twitter. According to their analysis, an attacker had tricked the GPv2Settlement contract to approve SwapGuard for DAI spending and then triggered it to transfer out DAI from the GPv2Settlement account. BlockSec also provided further details regarding how the threat actor added his wallet address as „solver“ via the multisig in order to gain access to the protocol.

Threat Actor Moves Funds To Tornado Cash

The threat actor was then able to use this access to trigger the settlement smart contract and drain 550 BNB into Tornado Cash – a crypto anonymity funnel that enables users to mask transactions making it harder for anyone else to trace them.

CoW Swap Responds To Exploit

CoW Swaps team has not yet released an official statement regarding this exploit but they claim that they are already working on fixing it. They reassured users that their accounts would remain unaffected by this exploit given how user funds can only be signed through an order executed by a user themselves.

Disclaimer

This article is provided for informational purposes only and should not be used as legal advice or other advice such as tax or investment advice.