CoW Swap hacker milks over 550 BNB using ‘solver’ exploit

Decentralized exchange (DEX) protocol CoW Swap recently suffered an attack, losing at least 550 BNB (BNB) in a contract exploit that approved fund transfers from the protocol.

Blockchain surveyor MevRefund flagged the event and detected that the funds seemed to be moving away from CoW Swap. The MEV searcher warned the DEX and its users of the exploit in a Twitter thread.

According to the Smart contract auditing firm BlockSec, a wallet address was added as a “solver” of CoW Swap by a multisig. Then, the address invoked the transaction to approve DAI (DAI) to SwapGuard, which then led to SwapGuard transferring DAI from the CoW Swap settlement contract to other addresses. 

Blockchain security firm PeckShield estimated that around 551 BNB was lost, worth $181,600 at the time of writing. After stealing the assets, the hacker moved the funds to the infamous crypto mixer Tornado Cash.

Flowchart showing movement of stolen funds from CoW Swap. Source: PeckShield

During the attack, some members of the community panicked and urged users to revoke approvals from the DEX. However, the decentralized finance (DeFi) protocol said that this isn’t necessary.

According to CoW Swap, the settlement contract which was exploited only has access to the fees that the protocol collected in a week. The team said that it is unable to directly access user funds without an order signed by users. 

CoW Swap has not yet responded to Cointelegraph’s request for comment.

Related: Scam alert: MetaMask warns crypto users about address poisoning

Meanwhile, despite the hacks that surround DeFi, the space has had a prolific start in 2023 according to a report from DappRadar. Data showed that protocols saw significant growth in their total value locked in the month of January.

In other news, the United Nations also reported that North Korean hackers have stolen more crypto in 2022 compared to other years. The report estimates that hackers linked to North Korea were responsible for around $630 million to $1 billion in stolen crypto assets last year.

All Dutch and English crypto news!

Chainalysis breaks down how scammers adapt during the bear market

While scammers can also feel the chill of the crypto winter as scam revenue drops by 46%, some continue to adapt and thrive despite the...

Paris Blockchain Week 2023: Second day of the summit kicks off

Paris Blockchain Week (PBW) kicked off its fourth year as one of the world's largest conferences tackling all things blockchain, crypto and Web3. The event...

Aussie crypto exchange hints interest in Hong Kong base, but it’ll depend

Australia-based crypto exchange Independent Reserve is looking at opportunities to set up shop in Hong Kong, as the city continues efforts to become a cryptocurrency...

Coinbase CEO on its Wells Notice: SEC is like soccer referees in a game of pickleball

Brian Armstrong, the CEO and co-founder of crypto exchange Coinbase has compared the Securities and Exchange Commission (SEC) to "soccer refs" in a game of...

Beste exchanges

Koop je crypto bij Bitvavo