Drift

Swap

CoW Protocol

CoW Swap reported frontend problems and a DNS hijacking. The protocol called all traders to revoke permissions and avoid losing assets from connected wallets.&nbsp;
CoW Swap, one of the leading DEX trading routing protocols, reported frontend problems. Later, the issue turned out to be a malicious DNS hijacking, allowing bad actors to exploit trader wallets.&nbsp;
The protocol team discovered a DNS hijacking from 14:54 UTC, with the attack lasting over 90 minutes. The backend and APIs were not affected, but the entire routing app was paused.&nbsp;
CoW Swap advised all traders to stop using the main site until further notice.&nbsp;
<blockquote class="twitter-tweet">
 🚨🚨
 UPDATE: CoW Swap experienced a DNS hijacking at 14:54 UTC (approximately 90 minutes ago).
 The CoW Protocol backend and APIs were not impacted, but we have paused them temporarily as a precaution.
 We are now actively working to resolve the situation. Please continue to…
 — CoW DAO (@CoWSwap) <a href="https://twitter.com/CoWSwap/status/2044089359058501893?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">April 14, 2026</a>
</blockquote>
DNS hijacking is extremely risky for Web3, as the attack can go unnoticed and drain connected wallets. The CoW Swap frontend is one of the trusted links to DEX trading, which could steal funds even without a backend exploit.&nbsp;
Within three hours of the attack, the compromised site led to <a href="https://etherscan.io/tx/0xcee016925c0d8025266733e9db8de82e1c686bfaf0c953b67b9d59f5328e238f" rel="noopener noreferrer nofollow">$1M</a> in stolen funds. One of the flagged addresses managed to intercept <a href="https://etherscan.io/address/0xafb2423f447d3e16931164c9970b9741aab1723e#internaltx" rel="noopener noreferrer nofollow">219 ETH</a> from a trader’s wallet. The exact size of the exploit depends on how many more wallets interact with the protocol, and if permission has exposed a whale wallet.
<h3 id="span-how-does-a-dns-attack-affect-cow-swap-users-span">How does a DNS attack affect CoW Swap users?&nbsp;</h3>
The CoW Swap official address was compromised at the domain level, affecting anyone who used the site as an entry point.&nbsp;
Swap.cow dot fi could be redirecting users to a malicious site, which can then be used to extract wallet credentials, permissions, or even seed phrases from users. The site could have been compromised at a deeper level, allowing it to redirect traffic to a malicious web server.&nbsp;
Users still see the official address, which looks legitimate. The Cow Swap contracts are not affected, and the APIs are still usable in theory, but the protocol team warned against using the app until it is deemed safe.&nbsp;
For recent interactions, the best action is to revoke all permissions made through the site, using services like Revoke Cash. Traders can use the service to check the list of wallet permissions and disconnect all unknown connections or CoW Protocol permissions.&nbsp;
<h3 id="span-cow-protocol-attack-reveals-another-web3-weakness-span">Cow Protocol attack reveals another Web3 weakness</h3>
Cow Swap has been one of the main hubs for Web3 trading. The router handled around $3.8B in volumes for March and around $1.22B in April to date. Weekly volumes have established a baseline of around $700M.&nbsp;
The protocol is the most active router for the best DEX pricing, used widely on EVM-compatible chains. Cow Protocol is active on Ethereum, Gnosis, Arbitrum, Base, Polygon, Avalanche, and Lens Network. In recent months, CoW Protocol has been more widely used for BNB Chain trading.&nbsp;
<figure class="wp-caption alignnone"><img src="https://www.cryptopolitan.com/wp-content/uploads/2026/04/CowSwapShareApr142026.png" alt="CoW Swap experienced DNS hijacking" width="886" height="523">
 <figcaption>
 CoW Protocol emerged as the leading DEX aggregator, after a recent growth of activity on BNB Chain. | Source: <a href="https://dune.com/cowprotocol/cow-swap-home" rel="noopener noreferrer nofollow">Dune Analytics</a>
 </figcaption>
</figure>
The recent DNS attack follows a series of Web3 attempts, often resulting in significant losses. The case gained additional attention after the recent <a href="https://www.cryptopolitan.com/experts-slam-drift-after-280m-hack/" rel="noopener noreferrer nofollow">Drift Protocol</a> hack. Web3 attacks are becoming more common, leaving analysts to suspect the involvement of AI in monitoring weaknesses.
There’s a middle ground between leaving money in the bank and rolling the dice in crypto. Start with this free video on <a href="https://www.cryptopolitan.com/defi-passive-income-training-video/?utm_source=syndication&amp;utm_medium=inlineads&amp;utm_campaign=defioptin" rel="noopener noreferrer nofollow">decentralized finance</a>.

CoW Swap reports a DNS attack, advising all traders not to interact with the protocol

Table of Contents

Cryptopolitan_News

Other articles published on Apr 14, 2026

Join our free newsletter for daily crypto updates!