CoW Swap Publishes Post-Mortem After April Domain Hijack Recovery
CoW Swap Publishes Post-Mortem After April Domain Hijack Recovery
🔐 When hackers strike back
CoW Swap has released a full post-mortem following the April domain hijacking incident that temporarily compromised cow.fi.
What happened:
- Attackers used social engineering to hijack the domain from the registrar
- A phishing site was deployed to steal wallet credentials and seed phrases
- The team recovered control and moved operations to cow.finance during the incident
Response measures:
- Real-time communication throughout the crisis
- Full transparency report published
- Discretionary grants program proposed to compensate affected users
The team emphasized that CoW Protocol's backend and APIs were never compromised—only the frontend domain was affected.
🚨🚨 We are currently experiencing an issue with the CoW Swap frontend (swap.cow.fi). While we are investigating, please DO NOT use CoW Swap.
We’ll continue monitoring as Vercel’s investigation progresses. We have no indication CoW Swap was among the impacted customers. However, we still completed all recommended remediation steps: ✅ Rotated all tokens ✅ Audited deployments -> no malicious code ✅ Reviewed activity
We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems, impacting a limited subset of customers. Please see our security bulletin: vercel.com/kb/bulletin/ve…
Sometime after 13:00 UTC yesterday, an attacker gained enough control over cow.fi to create a new SSL certificate and serve malicious content to CoW Swap's primary domain. They were able to do this by convincing our DNS registrar that they were a CoW Swap team
Update: CoW Swap has received communication from Vercel stating, “At this time, we do not have reason to believe your Vercel credentials or personal data have been compromised.”
User protection is a core promise of CoW Swap. We are therefore proposing a discretionary grants program so that victims of the April 14 DNS hijacking incident can be made whole as quickly as possible. Proposal details can be found on the CoW DAO forum, here:
4/ We also had a domain hijack in April. cow.fi was socially engineered away from our registrar. We recovered it, communicated in real time, and published a full post-mortem covering what happened and the steps taken afterward. Accountability matters.
UPDATE: The swap dot cow dot fi domain is currently locked and not accessible. We are working with security experts to assert control over the domain while it is locked, but we *do not* expect it to be live again tonight. For those who rely on CoW Swap daily, we have spun up a
We have a new instance of CoW Swap live now at cow.finance to allow safe usage of the protocol. Please remain cautious and continue to refrain from using swap dot cow dot fi until the team signals it is safe to use.
Once they had control of the domain, the attacker deployed a phishing site designed to look exactly like CoW Swap. The attack escalated in two phases: - Phase 1: wallet drainer (connected wallets prompted to sign malicious transactions) - Phase 2: fake wallet modals harvesting
🚨🚨 UPDATE: CoW Swap experienced a DNS hijacking at 14:54 UTC (approximately 90 minutes ago). The CoW Protocol backend and APIs were not impacted, but we have paused them temporarily as a precaution. We are now actively working to resolve the situation. Please continue to
UPDATE: We now have full control of the cow.fi domain. CoW Swap has been working as normal at cow.finance for some time now, and we are now working to transition it back to it's original domain. In the meantime, here is an update on we know about
CoW DAO Maintains Negative Net Emissions with 77.8M Token Buybacks
CoW Protocol's DAO has successfully passed **CIP-85**, continuing its deflationary token model. **Key Metrics (April 2024 - April 2026):** - Total buybacks: 77.8M $COW tokens - Total rewards distributed: 66.2M $COW - Net emissions: **Negative every quarter** - Cumulative net reduction: 11.6M $COW The protocol has maintained a **deflationary token supply** for eight consecutive quarters, with buybacks consistently exceeding emissions. This marks a continuation of the trend established in March, where the gap between buybacks and emissions has grown each quarter. The governance proposal CIP-85 passed, setting the framework for continued buyback operations through May 2026. [Read the full April recap](https://cow.fi/learn/cow-dao-monthly-recap-april-2026)
CoW Protocol April Metrics: Nearly 300K Trades and $4B Volume
**CoW Protocol's April Performance:** - **292,947 trades** executed across the platform - **47,700 active wallets** participated in trading activity - **$4 billion in monthly volume** processed The protocol launched new integrations and partnerships during April, continuing its expansion as cross-chain execution infrastructure. **Context:** These figures represent steady growth for CoW Protocol, which previously recorded $11.2 billion in volume on Ethereum alone during September 2025 - its second-largest month on record.
CoW Protocol Expands Reach with New Integrations Across DeFi
CoW Protocol continues expanding its ecosystem with several key integrations: - **Lido Finance** now routes fast swaps through CoW Protocol - **xStocks** brought 50+ tokenized stocks and ETFs to BNB Chain via CoW Protocol settlement - **auto.fun** users gained access to MEV-protected swaps, limit orders, and cross-chain functionality - **cbMEGA** launched on Base with Day 1 CoW Swap support These integrations build on recent infrastructure upgrades, including Atomic Bundles - a smart contract template enabling complex, multi-step DeFi workflows. The feature supports lending loops, collateral swaps, perpetual trading flows, and payment operations. All trades benefit from CoW Protocol's solver competition model, which finds optimal prices while protecting users from MEV exploitation.
CoW Swap Hits $200B Volume Milestone in Fifth Year
CoW Swap celebrated its fifth anniversary in April while crossing $200 billion in cumulative trading volume. **Key Milestones:** - Five years since launch with focus on fairer trading - $200,000,000,000 total volume processed - Continued user growth across the platform The protocol previously set an all-time high monthly volume record of $9 billion in July 2025. CoW Swap protects traders from MEV (Maximal Extractable Value) while finding optimal prices across multiple exchanges and aggregators.