CoW Swap DNS Hijack

CoW Swap is a popular decentralized exchange aggregator that looks for the best price across many exchanges. On 14 April 2026, attackers took control of its cow.fi domain by using social engineering and forged identity documents to fool its domain registrar and the .fi registry. For about four and a half hours, people who visited the real CoW Swap address were sent to a fake copy of the site. It asked them to approve tokens or sign messages that handed their funds to the attackers, and it also tried to get visitors to enter their seed phrase.

Users lost about $1.2M, and the attackers had contracts ready on Ethereum, Base, Arbitrum, BNB Chain, Polygon, Gnosis Chain and other networks. CoW Swap started its emergency response within 19 minutes, warned people not to use the site, temporarily moved to a backup domain and regained cow.fi about a day later with extra protection. Its smart contracts and backend were never hacked. In May 2026, CoW DAO approved a grants program that offered eligible users up to 100% of their losses, with claims due by 14 May 2026. People who entered their seed phrase were not eligible.

We've listed the attacker addresses we know about, but there might be more. Even if the Exploit Checker shows no results, review any approvals you made on 14 April 2026 and revoke anything you do not recognize. If you typed your seed phrase into the fake site, revoking approvals is not enough, and you should move your remaining funds to a new wallet with a new seed phrase. Revoking protects what is still in your wallet, but it does not recover funds that were already stolen.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.