CoW Swap halts protocol after DNS hijack drains about $500k from users

CoW Swap paused its app on April 14 after attackers hijacked its cow.fi domain and redirected users to a spoofed site that harvested approvals. Losses are estimated near $500,000, with a single user reporting $50,000+, per a CoinSpeaker report.

The issue was the UI only. Smart contracts and backend APIs were not affected, but were paused as a precaution, according to CoinSpeaker. The DEX runs on Ethereum.

CoW DAO said the domain was locked and offline while they worked to regain control. They did not expect it back that night. CoW DAO update.

Felix Leupold later said the frontend was back up and reminded users to only approve the GPv2VaultRelayer address. Frontend status and safe approval.

Mechanism of attack: DNS hijack of cow.fi, redirect to a fake interface, malicious approval prompts, draining transactions. Blockaid flagged the activity; scope remains under review, per CoinSpeaker. CoinSpeaker report.

CoW DAO advised users to revoke any approvals granted after 14:54 UTC on April 14. Aave disabled CoW Swap endpoints for integrators as a precaution. Totals, attacker identity, and the full list of impacted wallets are still unconfirmed, per CoinSpeaker. CoinSpeaker report.

Headline
CoW Swap halts after DNS hijack; frontend redirect drains funds; backend safe, losses under review