The CoW Swap DNS Hijack Explained

Video transcript

An attacker who deceived Finland's domain registry took CoW Swap's domain. For about six hours, users typing the right address landed on a wallet drainer.

CoW says its contracts, servers and keys were never compromised. The attacker targeted the layer above: who controls the domain.

Posing as a CoW DAO contributor, the attacker sent Traficom forged documents. On April 14, Gandi's session created a new transfer key. The domain moved to NETIM and pointed to a phishing copy.

The holder email changed about 80 minutes before the phishing site went live, and the window ran close to six hours.

CoW's internal analysis puts the likely loss at about 1.2 million dollars, though every claim is hard to verify. CoW DAO paid all eligible grants by May 31.

CoW says DNS sec, CAA, CSP and subresource integrity would not have helped. The attacker served their own site, so the real site's settings never reached visitors.

The registrar chain is attack surface, and lock options vary by platform. The takeover left public signs. Plan your contacts and keep a backup domain.

Guardian's Managed Security covers domains, DNS and frontends around the clock. Shield runs continuous pentesting, Sentry watches domains and certificates, and a WebApp Pentest tests the app itself.

Read the full article for the complete timeline, or talk to Guardian about who controls your domain.

CoW Swap's contracts, servers and DNS zone were never touched. The attacker went after the layer above them: who controls the name cow.fi.

For about six hours, people who typed the right address landed on a wallet drainer.

This explainer follows CoW's own post-mortem and governance posts. All times are UTC.

What Happened

cow.fi and swap.cow.fi serve the CoW Swap trading interface. CoW's DNS ran on AWS Route 53, which registered the domain through the registrar Gandi SAS.

On April 14, 2026, the domain was moved to another registrar and pointed at nameservers the attacker controlled. Visitors got a phishing copy of CoW Swap.

CoW posted the same day that it had suffered a "DNS hijacking." It told users to stay off swap.cow.fi and paused its backend and APIs, Cointelegraph reported.

CoW moved its services to a second domain, cow.finance, while it worked to recover the name. It got cow.fi back on April 15 and published a post-mortem on April 16.

CoW says these were never compromised:

• Its Route 53 hosted zone, which kept returning correct records.
• Its Vercel frontend, backend APIs and cloud.
• Its settlement contracts, solvers and order flow.
• Any key or credential CoW holds.

How the Attack Worked

Domains sit in layers. Traficom, Finland's communications regulator, runs the .fi registry, the master record. Registrars such as Gandi act for domain holders.

The registrar account that holds a domain can change its nameservers at the registry. The attacker set out to move cow.fi into an account they controlled.

1. The registry dispute

From late March, the attacker posed as a senior contributor related to CoW DAO. They told Traficom that AWS and Gandi had refused to hand over a transfer key.

Traficom's chronology, CoW says, shows forged identity documents, altered company records, fabricated AWS support chats and AI-generated financial documents.

Traficom opened an investigation and asked Gandi to clarify. Citing Traficom, CoW says Gandi did not answer by the April 7 deadline, removing a potential checkpoint.

2. The registrar changes

On April 14, Traficom's registry logs show two actions from Gandi's session:

• 12:16: the holder's contact email changed to an attacker address.
• 12:43: a new registrar transfer key was created.

CoW says neither was authorized. Traficom told CoW it did not change the holder data or tell Gandi to issue a key.

How the attacker got Gandi to act is still under investigation, CoW says.

3. The phishing site

With the key, the attacker moved cow.fi to the registrar NETIM and pointed it at their own Cloudflare nameservers.

They got a wildcard Let's Encrypt certificate and put up a copy of CoW Swap. Clicks triggered wallet prompts that led to malicious transactions.

From about 17:49, fake wallet unlock screens also asked for seed phrases and passwords. When NETIM put cow.fi on hold, the attacker redirected to a fallback domain, swap.cow-s.fo.

Why common web controls did not apply

CoW's post-mortem says DNSSEC, CAA, CSP and Subresource Integrity would not have stopped this attack.

The attacker controlled the delegation and served their own site, not a tampered copy of CoW's. Settings on the real site never reached those visitors.

Timeline and Loss

The phishing window ran from about 13:38 to 19:37, close to six hours. CoW also counts about 4.5 hours from detection until the attacker's nameservers were disabled.

CoW confirmed the compromise 19 minutes after detection. It notes cow.fi may have kept resolving to the attacker after 19:37 while DNS changes spread.

CoW's internal analysis puts the likely loss to its users at about $1.2M. It cautions that verifying every claim is difficult.

Under CIP-86, CoW DAO offered grants of up to 100% of eligible losses from its Legal Defense Reserve. Losses from exposing a seed phrase or private key were excluded, and claimants had to pass KYC.

CoW DAO's May recap says all eligible grants were paid by May 31. A September funding update puts the total at about 1.2M USDC.

CoW has filed an ICANN complaint and said it was engaging Mandiant to review its security across web3 and web2 infrastructure.

What It Shows

The domain is the front door. Audited contracts do not help a user who reaches the wrong site.

• The registrar chain is attack surface. CoW says AWS chose Gandi, not CoW.
• Lock options depend on the platform. CoW says .fi transfer lock was unavailable through Route 53.
• Registry changes came first. The holder email changed about 80 minutes before the phishing site went live.
• The takeover left public signs. It brought a new registrar, new nameservers and a fresh wildcard certificate.
• Plan your contacts. @cow.fi email went dark, and neither Gandi nor NETIM had a working 24-hour abuse line.
• A backup domain buys time. CoW moved its services to cow.finance within hours.

CoW also cautions that a registry lock is only as strong as the registry's own checks. Here, the registry's dispute process was the target.

Our guide to the most secure domain registrars compares those controls. For another protocol's domain incident, read the Curve Finance DNS hijack explained.

A registrar came up again in October, in the Polymarket script attack.

How Guardian Tests This Surface

Guardian's Managed Security lists domains and DNS, and frontends, among the surfaces it covers around the clock.

Within it, Shield is Guardian's continuous coverage of everything facing the internet, including "the names that lead users to you."

Shield runs reconnaissance and penetration testing around the clock. A Guardian researcher verifies what it finds.

Offchain, Guardian's Sentry watches domains, DNS, certificates, cloud and code host. When something fires, a Guardian engineer responds.

A WebApp Pentest covers the application itself: authentication, authorization, value-moving flows and the client-side surface, including bundle supply chain.

Guardian maps the app function by function at every privilege level, then tests each one. Frontend-only and backend-only scopes are available.

Frequently Asked Questions

Was CoW Swap hacked?

Not its systems, CoW says. Its contracts, servers, DNS zone and keys were untouched. The attacker took control of the cow.fi domain through the .fi registry and a registrar, then served a separate phishing site.

How much did CoW Swap users lose?

CoW's internal analysis estimates about $1.2M. Under CIP-86, CoW DAO paid grants to eligible victims from its Legal Defense Reserve, about 1.2M USDC in total, with all eligible claims paid by May 31, 2026.

Would DNSSEC have stopped the CoW Swap hijack?

CoW says no. The attacker controlled the domain's delegation at the .fi registry, so they could publish their own keys or leave the zone unsigned. CoW says CAA, CSP and Subresource Integrity would not have helped either.

How can teams protect their domain?

Use a registry lock where one is offered, and protect registrar accounts with hardware keys. Monitor nameserver, registrar and certificate changes, and keep a backup domain and out-of-band registrar contacts ready.

Sources

• CoW Swap on X: POST MORTEM, Cow.fi Domain Hijack (April 16, 2026)
• CoW DAO Forum: CIP-86, Discretionary Grants Program for Victims of the cow.fi Domain Hijacking (April 23, 2026)
• CoW DAO Forum: CoW DAO Monthly Recap, May 2026 (June 4, 2026)
• CoW DAO Forum: Update on CIP-79, Continued Funding for Development Services (September 7, 2026)
• Cointelegraph: DAO Behind CoW Swap Urges Users to Stay Off Platform After 'Hijacking' (April 14, 2026)
• Domain Name Wire: Domain Hijack Led to Crypto Heist (April 17, 2026)
• Guardian: Managed Security
• Guardian: WebApp Pentest