CoW Swap, an anti-MEV decentralized trading protocol, updated the attack details. Last night, a hacker exploited an external solver (solver) and used it to exhaust the settlement contract. The contract holds 7 days of agreement fees, and users are not affected. Cow Swap is also not affected, because the solver's bond will pay all losses. CoW Swap explained that there is a so-called solver competition in CoW Swap, and external parties compete to find the best execution path for CoW Swap users. Every solver has access to the settlement contract, which stores the collected fees (before they are used to reward solvers), usually for a week. 10 days ago, a new solver entered the competition, and after being whitelisted, the solver set an approval against a bad contract, which was deployed 12 days ago, allowing anyone to use this approval to perform transferFrom(settlementContract, arbitraryAddress). A hacker moved a total of $166,000 from settlement contracts to his wallet last night. CoW Swap is protected by solver bonding pools from any loss.