short
- CoW Swap, an Ethereum-based decentralized exchange aggregator, has warned users to avoid interacting with its protocol after being hit with a front-end settlement.
- Although the scope of the losses was not initially clear, one prominent cybersecurity researcher estimated that $500,000 had been taken from unsuspecting users so far.
- CoW Swap said the attack did not affect the protocol’s core smart contracts, but the decentralized exchange pool was temporarily shut down as a precaution.
Cow swap, and Ethereum-Based on Decentralized exchange The aggregator, on Tuesday, warned users to avoid using the protocol, revealing that its front end had been compromised.
“We are now actively working to resolve the situation,” the project, which is often used by Ethereum co-founder Vitalik Buterin, said in a statement. mail To
CoW Swap indicated that the attackers took control of the website domain that users typically visit before manipulating the protocol. This gave bad actors the opportunity to direct users to a different website where funds could be stolen by agreeing to malicious transfers.
Although the settlement did not affect CoW Swap’s underlying smart contracts, the protocol appears to have remained frozen three hours after the attack was disclosed. Meanwhile, Discord users reported losses within the project’s official server.
“I don’t know what to do anymore,” said one user who claimed to have lost more than $50,000 via CoW Swap’s compromised front-end. “I have no money at all.”
Despite the obvious frustration, the extent of the losses incurred was not immediately clear.
said a borrowed member of the CoW Swap team who goes by the name MooKeeper Decryption That reports are actively investigated and verified. They added that a more complete assessment will be released tomorrow or later this week.
“We have evidence that a small number of users signed malicious consents for very small amounts,” MooKeeper added.
However, a prominent cybersecurity researcher known as Vladimir S. On X He said That nearly $500,000 in digital assets had been “drained from a few addresses so far.”
Martin Kopelman, co-founder and CEO of Gnosis, a decentralized infrastructure provider, noted in a mail To X the attack range appears limited. He said users would likely only be affected if they agreed to interactions with CoW Swap within the last few hours.
Websites that try to scam users by mimicking existing DeFi projects are not exactly common. Last year, for example, the financing curve suffer Second DNS hijack. The first, which occurred in 2022, resulted in losses of $570,000 for users.
Buterin, who has exchanged notable amounts of Ethereum for stablecoins using CoW Swap this year, was involved with the protocol as recently as a week ago, according to data from on-chain analytics firm Arkham Intelligence. Show. In 2024, he also used the decentralized exchange pool discharge Mimi coin collectibles modeled after a baby dwarf hippopotamus from Thailand.
Daily debriefing Newsletter
Start each day with the latest news, plus original features, podcasts, videos and more.
