CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals
CoW Swap (swap.cow.fi) users
On 14 April 2026 attackers took control of the domain for swap.cow.fi and sent visitors to a cloned CoW Swap interface that asked for malicious token approvals. CoW DAO paused its backend and APIs and told users to revoke approvals made after 14:54 UTC; the protocol's smart contracts were not affected. Early estimates were about $500K drained; Halborn later put user losses at about $1.2M and said the registrar had been social-engineered.
Why this severity: $1.2M reported stolen.
- Started
- Apr 14, 2026
- Closed
- May 13, 2026
- Chains
- Ethereum
- Reported stolen
- $1.2M
At risk
- CoW Swap (swap.cow.fi) users
- Ethereum wallets
What to do now
- Revoke every approval granted after 14:54 UTC on 14 April 2026, on every chain you used (revoke.cash or your wallet's approvals page).
- If tokens already left your wallet, report the transaction through CoW DAO's official channels.
Stay safe
Am I affected?
If you connected a wallet to swap.cow.fi on 14 April 2026 after 14:54 UTC and approved a token or signed a permit.
What to do now
- Revoke every approval granted after 14:54 UTC on 14 April 2026, on every chain you used (revoke.cash or your wallet's approvals page).
- If tokens already left your wallet, report the transaction through CoW DAO's official channels.
How to avoid this
- During an incident, wait for the project's all-clear on its official X account before using the site again.
- Read approval prompts: an unknown spender or an unlimited permit on a swap you didn't expect is a red flag.
- Keep wallet security features (transaction simulation, malicious-site warnings) switched on; they catch many hijacked front-ends.
Timeline 3
Halborn's April review put user losses at about $1.2M and said the DNS registrar had been social-engineered.
SourceA researcher estimated about $500K drained from a few addresses; CoW DAO told users to revoke all approvals made on CoW Swap after 14:54 UTC.
SourceCoW DAO said swap.cow.fi had been hit by a DNS hijacking, paused its backend and APIs, and told users to stay away from the site.
Source
News & write-ups ›3
How this method works
The real website of a dapp you trust is taken over (DNS, hosting or a script it loads) and starts serving a drainer. Read about front-end and dns hijacks →
Follow new drains and updates in your feed reader or Telegram RSS bot.