{
 "tag": "cow-swap",
 "name": "Cow Swap",
 "group": "Other",
 "incidents": [
  {
   "slug": "cow-swap-dns-hijack-apr-2026",
   "title": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals",
   "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026",
   "json": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "front-end-hijack",
   "product": "CoW Swap (swap.cow.fi) users",
   "tags": [
    "ethereum",
    "front-end-hijack",
    "cow-swap",
    "dns-hijack",
    "registrar",
    "social-engineering",
    "approval-phishing",
    "dex"
   ],
   "amountUsd": 1200000,
   "victims": null,
   "startedAt": "2026-04-14",
   "closedAt": "2026-05-13",
   "updatedAt": "2026-05-13T12:00:00Z",
   "summary": "On 14 April 2026 attackers took control of the domain for swap.cow.fi and sent visitors to a cloned CoW Swap interface that asked for malicious token approvals. CoW DAO paused its backend and APIs and told users to revoke approvals made after 14:54 UTC; the protocol's smart contracts were not affected. Early estimates were about $500K drained; Halborn later put user losses at about $1.2M and said the registrar had been social-engineered."
  }
 ],
 "changes": [
  {
   "incident": "cow-swap-dns-hijack-apr-2026",
   "incidentTitle": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-05-13",
   "title": "Halborn's April review put user losses at about $1.2M and said the DNS registrar had been social-engineered.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-april-2026",
   "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026"
  },
  {
   "incident": "cow-swap-dns-hijack-apr-2026",
   "incidentTitle": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-04-14",
   "title": "CoW DAO said swap.cow.fi had been hit by a DNS hijacking, paused its backend and APIs, and told users to stay away from the site.",
   "sourceUrl": "https://cointelegraph.com/news/cow-swap-dao-domain-hijacking",
   "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026"
  },
  {
   "incident": "cow-swap-dns-hijack-apr-2026",
   "incidentTitle": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-04-14",
   "title": "A researcher estimated about $500K drained from a few addresses; CoW DAO told users to revoke all approvals made on CoW Swap after 14:54 UTC.",
   "sourceUrl": "https://decrypt.co/364377/ethereum-defi-exchange-cow-swap-website-compromise",
   "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026"
  }
 ]
}