Swap

2026

April

CoW Protocol

Domain

<p><a href="https://x.com/CoWSwap" rel="noopener noreferrer nofollow">@CoWSwap</a> is reimbursing users affected by the April 14 DNS hijack of its cow.fi domain, even though the underlying protocol was never breached. Affected users have until Thursday, May 14, to file their claims.</p>
<h2 id="what-happened">What Happened</h2>
<p><cite>The hijack was detected at approximately 14:54 UTC on April 14, 2026.</cite><cite>Attackers exploited weaknesses in the .fi domain registrar transfer process through a social engineering campaign targeting Finland's domain registry infrastructure.</cite> The result was a pixel-perfect phishing clone that remained live for roughly 4.5 hours. <cite>Users lost an estimated $1.2 million during the incident after attackers redirected the cow.fi domain to a phishing website that tricked visitors into signing malicious wallet transactions.</cite><cite>That figure includes a single interception of 219 ETH from one trader's wallet.</cite></p>
<p><cite>Critically, the core smart contracts were never touched. This was a frontend attack, not a protocol-level exploit.</cite><cite>A follow-up post at 16:24 UTC confirmed the DNS hijacking and noted that CoW Protocol's backend and APIs were not affected.</cite></p>
<h2 id="the-reimbursement-plan">The Reimbursement Plan</h2>
<p><cite>CoW DAO has approved a proposal to reimburse users affected by the April 2026 cow.fi domain hijacking. The governance proposal authorizes a discretionary grants program for users who lost funds during the phishing attack, which stemmed from a registrar-level domain takeover rather than a compromise of CoW Protocol infrastructure.</cite></p>
<p><cite>The proposal allows eligible victims to receive up to 100% reimbursement for verified losses using funds from CoW DAO's Legal Defense Reserve.</cite><cite>The payments remain voluntary and do not represent an admission of liability or legal fault. The document describes the grants as "ex gratia" payments, meaning CoW DAO provides them as a goodwill gesture rather than a legal obligation.</cite> Users who entered seed phrases into fake prompts are not eligible.</p>
<p>The DAO posted a public reminder Monday urging affected users to submit claims before the May 14 deadline. The broader incident is a pointed reminder of a structural tension in DeFi. <cite>The CoW Swap incident reinforces the mismatch between decentralized execution and centralized access points. Protocols may operate securely on-chain, but user interaction still depends on Web2 infrastructure that remains vulnerable to hijacking.</cite></p>
<p><strong>Sources:</strong><br><a href="https://forum.cow.fi/t/cip-86-discretionary-grants-program-for-victims-of-the-cow-fi-domain-hijacking/3431" rel="noopener noreferrer nofollow">CIP-86: Discretionary Grants Program for Victims of the cow.fi Domain Hijacking, CoW DAO Governance Forum</a><br><a href="https://ambcrypto.com/cow-dao-approves-voluntary-refunds-despite-no-protocol-breach-in-domain-hijack/" rel="noopener noreferrer nofollow">CoW DAO approves voluntary refunds despite no protocol breach in domain hijack, AMBCrypto</a><br><a href="https://news.bitcoin.com/cow-protocol-halts-trading-after-frontend-domain-hijack/" rel="noopener noreferrer nofollow">Cow Protocol Halts Trading After Frontend Domain Hijack, Bitcoin.com News</a></p>

Cow DAO Makes Users Whole After April Dns Hijack, Deadline May 14

Table of Contents

BSCN

Other articles published on May 12, 2026

Join our free newsletter for daily crypto updates!