{"id":8414,"date":"2026-04-15T07:54:36","date_gmt":"2026-04-15T07:54:36","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=8414"},"modified":"2026-04-15T07:54:36","modified_gmt":"2026-04-15T07:54:36","slug":"cow-swap-hit-by-dns-attack-users-urged-to-stay-away-amid-ongoing-exploit","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=8414","title":{"rendered":"CoW Swap Hit by DNS Attack, Users Urged to Stay Away Amid Ongoing Exploit"},"content":{"rendered":"<p><\/p>\n<div>\n<div id=\"blockquote-block_772c4d25973d3a1f3d723de6bdc46c36\" class=\"blockquote-container\" style=\"border-color: #5100fc\">\n<div class=\"blockquote-text\">\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Cow DAO paused all protocol services after attackers hijacked the DNS records for swap.cow.fi at 14:54 UTC on April 14, redirecting users to a wallet-draining frontend.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">At least US$1 million (AU$1.45 million) in funds was stolen within three hours, including 219 ETH intercepted from a single trader\u2019s wallet.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Smart contracts and on-chain infrastructure were not compromised, but the protocol remained offline as Cow DAO investigated and urged users to revoke approvals via revoke.cash.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<p>CoW Swap paused its protocol on April 14 after attackers hijacked the DNS records of its frontend, redirecting users to a malicious site that drained at least US$1 million (AU$1.45 million) in crypto assets.<\/p>\n<p>The exploit was detected at 14:54 UTC, with Cow DAO issuing a public warning at 15:41 UTC and confirming the DNS compromise at 16:24 UTC. The team halted the protocol shortly after, although backend systems and smart contracts were not directly affected.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">\ud83d\udea8\ud83d\udea8<\/p>\n<p>UPDATE: CoW Swap experienced a DNS hijacking at 14:54 UTC (approximately 90 minutes ago). <\/p>\n<p>The CoW Protocol backend and APIs were not impacted, but we have paused them temporarily as a precaution. <\/p>\n<p>We are now actively working to resolve the situation. Please continue to\u2026<\/p>\n<p>\u2014 CoW DAO (@CoWSwap) <a href=\"https:\/\/twitter.com\/CoWSwap\/status\/2044089359058501893?ref_src=twsrc%5Etfw\">April 14, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n<p>The attack targeted the domain swap.cow.fi at the registrar level, redirecting traffic to a cloned interface designed to trick users into connecting wallets and approving transactions. CoW Swap operates as a non-custodial protocol, meaning funds remained in user wallets and no contract-level breach occurred.<\/p>\n<p>On-chain data shows at least US$1 million (AU$1.45 million) was extracted within three hours. One flagged address alone received 219 ETH from a single wallet. The total impact remains uncertain, however.<\/p>\n<p><strong>Read more: Quantum Threat to Crypto? XRP Ledger Shows Surprising Resilience<\/strong><\/p>\n<h2 class=\"wp-block-heading\" id=\"h-losses-and-user-response\">Losses and User Response<\/h2>\n<p>Cow DAO instructed affected users at 16:33 UTC to revoke all token approvals using revoke.cash.\u00a0<\/p>\n<p>Security firm Blockaid flagged the malicious domains, including swap.cow.fi and cow.fi, during the incident. The team continued monitoring activity until around 18:15 UTC and requested transaction hashes from potentially impacted users.<\/p>\n<p>Similar exploits have affected platforms such as Curve Finance and Balancer.<\/p>\n<p>CoW Swap, part of the Gnosis ecosystem, processes trades using batch auctions and \u201cCoincidence of Wants\u201d matching, a system that pairs users directly to reduce reliance on external liquidity and limit MEV (maximum extractable value).\u00a0<\/p>\n<p>The protocol remained offline at the time of reporting, with no confirmed timeline for restoration or post-incident analysis released.<\/p>\n<p><strong>Read more: Aave DAO Approves $25M Grant Despite Internal Pushback<\/strong><\/p>\n<\/p><\/div>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>Cow DAO,Hackers#CoW #Swap #Hit #DNS #Attack #Users #Urged #Stay #Ongoing #Exploit1776239676<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cow DAO paused all protocol services after attackers hijacked the DNS records for swap.cow.fi at 14:54 UTC on April 14, redirecting users to a wallet-draining frontend. At least US$1 million (AU$1.45 million) in funds was stolen within three hours, including 219 ETH intercepted from a single trader\u2019s wallet. Smart contracts and on-chain infrastructure were not<\/p>\n","protected":false},"author":1,"featured_media":8415,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[1280,4029,4030,664,114,252,2106,2462,4031,360],"class_list":{"0":"post-8414","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-bitcoin","8":"tag-attack","9":"tag-cow","10":"tag-dns","11":"tag-exploit","12":"tag-hit","13":"tag-ongoing","14":"tag-stay","15":"tag-swap","16":"tag-urged","17":"tag-users"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.6 (Yoast SEO v26.6) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>CoW Swap Hit by DNS Attack, Users Urged to Stay Away Amid Ongoing Exploit - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=8414\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CoW Swap Hit by DNS Attack, Users Urged to Stay Away Amid Ongoing Exploit\" \/>\n<meta property=\"og:description\" content=\"Cow DAO paused all protocol services after attackers hijacked the DNS records for swap.cow.fi at 14:54 UTC on April 14, redirecting users to a wallet-draining frontend. At least US$1 million (AU$1.45 million) in funds was stolen within three hours, including 219 ETH intercepted from a single trader\u2019s wallet. Smart contracts and on-chain infrastructure were not\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=8414\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-04-15T07:54:36+00:00\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=8414\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=8414\",\"name\":\"CoW Swap Hit by DNS Attack, Users Urged to Stay Away Amid Ongoing Exploit - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=8414#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=8414#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/dns-attack.jpg\",\"datePublished\":\"2026-04-15T07:54:36+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=8414#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=8414\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=8414#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/dns-attack.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/dns-attack.jpg\",\"width\":1920,\"height\":1080},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=8414#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CoW Swap Hit by DNS Attack, Users Urged to Stay Away Amid Ongoing Exploit\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto &amp; Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"CoW Swap Hit by DNS Attack, Users Urged to Stay Away Amid Ongoing Exploit - Crypto News: Latest Cryptocurrency News and Analysis","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=8414","og_locale":"en_US","og_type":"article","og_title":"CoW Swap Hit by DNS Attack, Users Urged to Stay Away Amid Ongoing Exploit","og_description":"Cow DAO paused all protocol services after attackers hijacked the DNS records for swap.cow.fi at 14:54 UTC on April 14, redirecting users to a wallet-draining frontend. At least US$1 million (AU$1.45 million) in funds was stolen within three hours, including 219 ETH intercepted from a single trader\u2019s wallet. Smart contracts and on-chain infrastructure were not","og_url":"https:\/\/cryptonews.uk.com\/?p=8414","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-04-15T07:54:36+00:00","author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=8414","url":"https:\/\/cryptonews.uk.com\/?p=8414","name":"CoW Swap Hit by DNS Attack, Users Urged to Stay Away Amid Ongoing Exploit - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=8414#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=8414#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/dns-attack.jpg","datePublished":"2026-04-15T07:54:36+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=8414#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=8414"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=8414#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/dns-attack.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/04\/dns-attack.jpg","width":1920,"height":1080},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=8414#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"CoW Swap Hit by DNS Attack, Users Urged to Stay Away Amid Ongoing Exploit"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto &amp; Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/8414","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=8414"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/8414\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/8415"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8414"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8414"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8414"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}