Key Highlights
- CoW Swap said its frontend incident was caused by a DNS hijacking.
- The project said its backend and APIs were not impacted by the attack.
- CoW DAO has paused backend systems as a precaution and urged users not to use swap.cow.fi yet.
CoW Swap has confirmed that the issue affecting its frontend was a DNS hijacking attack, prompting the DeFi protocol to warn users not to use swap.cow.fi until further notice. In an update shared on X, CoW DAO said the incident occurred at 14:54 UTC and added that while the frontend was compromised, the CoW Protocol backend and APIs were not impacted.
The team said it has temporarily paused the backend and APIs as a precaution while it works to resolve the situation. Users have been told to continue avoiding the frontend until CoW DAO officially confirms that the website is safe to use again.
The attack was initially flagged by Web3 security firm Blockaid, which said its system had identified a front-end attack on CoW Swap and flagged cow.fi as malicious. Blockaid urged users to revoke approvals immediately if their wallet had been connected and to avoid any interaction with the dApp.
Also Read: How to Revoke Token Approvals and Permissions from dApps
So far, CoW DAO has not publicly detailed the exploit path or confirmed whether any users lost funds. Based on the public statements available at publication time, the team is still investigating and has not yet issued an all-clear.
As of publication, no recovery timeline had been shared by the project. Users should treat the site as unsafe until CoW DAO confirms the issue has been fully contained.
CoW Protocol had already faced routing scrutiny
This is not the first time CoW Protocol has come under scrutiny this year. In March, The Crypto Times reported that an Ethereum wallet appeared to lose more than $50 million in an Aave collateral swap routed through CoW Protocol, with the incident raising questions around routing quality in thin-liquidity DeFi pairs.
The report noted that the trade likely went through Aave’s collateral swap flow, while DeFi commentator YAM blamed poor routing across aggregators rather than a price display issue specific to CoW Swap.
Also Read: Hyperbridge Responds to $237K Exploit, Pauses Bridge Activity
