DNS hijack
2 incidents, 0 live. 191 days since the last new one.
2 drains in the last 12 months
2 drains in the last 12 months
1 drains in 2026
1 drains in 2025
Past
April 2026 1
-
Critical✓Contained
CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals
On 14 April 2026 attackers took control of the domain for swap.cow.fi and sent visitors to a cloned CoW Swap interface that asked for malicious token approvals. CoW DAO paused its backend and APIs and told users to revoke approvals made after 14:54 UTC; the protocol's smart contracts were not affected. Early estimates were about $500K drained; Halborn later put user losses at about $1.2M and said the registrar had been social-engineered.
CoW Swap (swap.cow.fi) users·Ethereum·$1.2M stolen·Since Apr 14, 2026·
November 2025 1
-
Critical✓Contained
Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer
On 21 November 2025 an attacker changed the DNS records for aerodrome.finance and velodrome.finance, sending visitors to a cloned front-end running 'Eleven Drainer' code. Users who signed on the fake site lost tokens: Blockaid tied about $700K to nine attacker addresses, and Halborn put losses above $1M. The smart contracts were not touched. Anyone who signed on either site that evening should revoke approvals they don't recognise.
Aerodrome (Base) and Velodrome (Optimism) web app users·Base, Optimism·$700K stolen·Since Nov 21, 2025·
No drains match these filters.