CoW Swap released a report on the attack incident, stating that the domain was hijacked for several hours, resulting in an estimated loss of 1.2 million dollars

According to official news, the CoW Swap attack incident review report states that its domain cow.fi suffered a supply chain attack on April 14, 2026. The attackers infiltrated the .fi domain registration process through social engineering techniques and hijacked DNS resolution, causing users to be directed to a phishing website when accessing swap.cow.fi within a few hours.

During the affected period, the attackers deployed a counterfeit trading interface and attempted to lure users into connecting their wallets and signing malicious transactions. The report indicates that this incident did not affect the on-chain contracts of the CoW Protocol, backend systems, or the safety of user funds; the core infrastructure and services such as AWS / Vercel were not compromised. The attack occurred during the domain registration and transfer phase, where the attackers gained control through forged identity documents and vulnerabilities in the registration process, briefly modifying the domain's pointing.

The team confirmed the anomaly within 19 minutes and initiated an emergency response, subsequently migrating to cow.finance and completing the domain recovery in about 26 hours. The CoW team stated that the affected users were mainly those who visited the official website during the domain hijacking, with preliminary estimated losses of approximately $1.2 million. Currently, cow.fi has been reactivated and security measures such as RegistryLock have been added. Meanwhile, the team has initiated external security audits, legal accountability, and potential user compensation plans. The official emphasized that the vulnerability has been fixed and plans to enhance the security of domain infrastructure through governance and industry collaboration.