{
 "slug": "cow-swap-dns-hijack-apr-2026",
 "title": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals",
 "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026",
 "json": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "contained",
 "verification": "verified",
 "chains": [
  "ethereum"
 ],
 "method": "front-end-hijack",
 "product": "CoW Swap (swap.cow.fi) users",
 "tags": [
  "ethereum",
  "front-end-hijack",
  "cow-swap",
  "dns-hijack",
  "registrar",
  "social-engineering",
  "approval-phishing",
  "dex"
 ],
 "amountUsd": 1200000,
 "victims": null,
 "startedAt": "2026-04-14",
 "closedAt": "2026-05-13",
 "updatedAt": "2026-05-13T12:00:00Z",
 "summary": "On 14 April 2026 attackers took control of the domain for swap.cow.fi and sent visitors to a cloned CoW Swap interface that asked for malicious token approvals. CoW DAO paused its backend and APIs and told users to revoke approvals made after 14:54 UTC; the protocol's smart contracts were not affected. Early estimates were about $500K drained; Halborn later put user losses at about $1.2M and said the registrar had been social-engineered.",
 "timeline": [
  {
   "date": "2026-04-14",
   "title": "CoW DAO said swap.cow.fi had been hit by a DNS hijacking, paused its backend and APIs, and told users to stay away from the site.",
   "sourceUrl": "https://cointelegraph.com/news/cow-swap-dao-domain-hijacking"
  },
  {
   "date": "2026-04-14",
   "title": "A researcher estimated about $500K drained from a few addresses; CoW DAO told users to revoke all approvals made on CoW Swap after 14:54 UTC.",
   "sourceUrl": "https://decrypt.co/364377/ethereum-defi-exchange-cow-swap-website-compromise"
  },
  {
   "date": "2026-05-13",
   "title": "Halborn's April review put user losses at about $1.2M and said the DNS registrar had been social-engineered.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-april-2026"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "CoW Swap DAO hit by domain hijacking",
   "url": "https://cointelegraph.com/news/cow-swap-dao-domain-hijacking",
   "publisher": "Cointelegraph",
   "date": "2026-04-14"
  },
  {
   "kind": "news",
   "title": "Ethereum DeFi exchange CoW Swap website compromised",
   "url": "https://decrypt.co/364377/ethereum-defi-exchange-cow-swap-website-compromise",
   "publisher": "Decrypt",
   "date": "2026-04-14"
  },
  {
   "kind": "writeup",
   "title": "Month in Review: Top DeFi Hacks of April 2026",
   "url": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-april-2026",
   "publisher": "Halborn",
   "date": "2026-05-13"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nIf you connected a wallet to swap.cow.fi on 14 April 2026 after 14:54 UTC and approved a token or signed a permit.\n\n## What to do now\n- Revoke every approval granted after 14:54 UTC on 14 April 2026, on every chain you used (revoke.cash or your wallet's approvals page).\n- If tokens already left your wallet, report the transaction through CoW DAO's official channels.\n\n## How to avoid this\n- During an incident, wait for the project's all-clear on its official X account before using the site again.\n- Read approval prompts: an unknown spender or an unlimited permit on a swap you didn't expect is a red flag.\n- Keep wallet security features (transaction simulation, malicious-site warnings) switched on; they catch many hijacked front-ends.",
 "notes": null,
 "agentBrief": "# CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals\n\n- Severity: Critical · Status: Contained (past)\n- Chains: Ethereum · Method: Front-end and DNS hijacks\n- Started: Apr 14, 2026 · Last update: May 13, 2026 · Reported stolen: $1.2M\n- Who/what: CoW Swap (swap.cow.fi) users\n\nOn 14 April 2026 attackers took control of the domain for swap.cow.fi and sent visitors to a cloned CoW Swap interface that asked for malicious token approvals. CoW DAO paused its backend and APIs and told users to revoke approvals made after 14:54 UTC; the protocol's smart contracts were not affected. Early estimates were about $500K drained; Halborn later put user losses at about $1.2M and said the registrar had been social-engineered.\n\n## Am I affected?\nIf you connected a wallet to swap.cow.fi on 14 April 2026 after 14:54 UTC and approved a token or signed a permit.\n\n## What to do now\n- Revoke every approval granted after 14:54 UTC on 14 April 2026, on every chain you used (revoke.cash or your wallet's approvals page).\n- If tokens already left your wallet, report the transaction through CoW DAO's official channels.\n\n## How to avoid this\n- During an incident, wait for the project's all-clear on its official X account before using the site again.\n- Read approval prompts: an unknown spender or an unlimited permit on a swap you didn't expect is a red flag.\n- Keep wallet security features (transaction simulation, malicious-site warnings) switched on; they catch many hijacked front-ends.\n\n## Sources\n- CoW Swap DAO hit by domain hijacking (Cointelegraph, 2026-04-14): https://cointelegraph.com/news/cow-swap-dao-domain-hijacking\n- Ethereum DeFi exchange CoW Swap website compromised (Decrypt, 2026-04-14): https://decrypt.co/364377/ethereum-defi-exchange-cow-swap-website-compromise\n- Month in Review: Top DeFi Hacks of April 2026 (Halborn, 2026-05-13): https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-april-2026\n\nFull record: https://drains.watch/i/cow-swap-dns-hijack-apr-2026 · JSON: https://drains.watch/i/cow-swap-dns-hijack-apr-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}