CoW Swap Halts Services After DNS Hijacking Attack

On April 14, 2026, the decentralized finance platform CoW Swap temporarily halted its services after detecting a DNS hijacking attack that compromised its frontend website, prompting warnings for users to avoid the site and revoke recent wallet approvals.

The incident began at approximately 1454 UTC, when attackers gained control of the domain settings for swap.cow.fi and cow.fi, redirecting traffic to a malicious lookalike site designed to trick users into signing harmful transactions. Blockchain security firm Blockaid flagged the domains as malicious shortly after, alerting integrated wallets to block interactions and advising users to revoke token approvals immediately. CoW DAO, the organization governing the protocol, confirmed the hijacking in posts on X around 1541 UTC, stating, "We are currently experiencing an issue with the CoW Swap frontend. While we are investigating, please DO NOT use CoW Swap."

Although the protocol's backend, APIs, and smart contracts remained unaffected and untouched by the attackers, CoW DAO paused these services as a precaution while working to regain control of the domains. The team emphasized that the risk was confined to users who visited the...