CoW Swap (CoW Protocol)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·5eP8Q1…NMFXSummary
CoW Protocol (trading interface: CoW Swap) is a decentralized exchange aggregator and MEV-protection protocol spun out of GnosisDAO in 2022. On April 14, 2026, the protocol's cow.fi domain was hijacked via a social engineering attack that exploited registrar Gandi SAS and the Finnish .fi registry authority Traficom using forged identity documents, redirecting users to a phishing interface for approximately 90 minutes and causing confirmed losses of approximately $1.2 million. The protocol's smart contracts were not compromised; CoW DAO subsequently passed CIP-86 in May 2026 to offer discretionary grants reimbursing verified victims up to 100% of their losses.
Connected Entities
1 entities- + 3 more
Community submissions
- Under reviewincriminatingWayback pending6/2/2026, 7:36:57 PM
“Unchained Crypto report documenting the April 14, 2026 DNS hijack at the cow.fi registrar level, $1.2M+ drained, protocol paused — new confirmed incident not previously covered on the CoW Swap page”
— avoid-scout
Timeline(12 events)
April 2021
CoW Swap launches as a proof of concept on Ethereum, developed within Gnosis.
CoW Protocol official blog / The BlockFebruary 2022
CoW Protocol completes $23 million fundraise and formally spins out from GnosisDAO as an independent entity with its own DAO.
The Block14 April 2026
At approximately 14:54 UTC, attacker gains control of cow.fi DNS records via social engineering against registrar Gandi SAS and Traficom (.fi registry) using forged identity documents, redirecting traffic to a phishing interface.
Domain Name Wire / FinanceFeeds / CoinDesk14 April 2026
CoW DAO issues public warning on X advising users not to visit cow.fi and to revoke any wallet approvals; backend protocols and APIs suspended. Team detects issue within ~19 minutes of attack onset.
CoinDesk / Protos14 April 2026
Within approximately 3.5 hours of the attack, CoW DAO completes migration to alternate domain cow.finance, restoring protocol functionality.
Domain Name Wire15 April 2026
cow.fi domain fully recovered. CoW DAO enables RegistryLock on cow.fi, a protection not previously available through Amazon Route 53.
Domain Name Wire17 April 2026
CoW DAO publishes full post-mortem report estimating total user losses at approximately $1.2 million, including a single loss of 219 ETH (~$750K) by one trader.
Bitget News / BingX / Cryptonomist30 April 2026
CIP-86 draft ('Discretionary grants program for victims of the cow.fi domain hijacking') opens for Snapshot vote.
CoW DAO Forum8 May 2026
CIP-86 passes Snapshot vote. CoW DAO authorizes discretionary grants of up to 100% of verified losses to eligible victims, funded from the Legal Defense Reserve.
CoW DAO Forum / CryptoTimes / CoinSpectator14 May 2026
Claim submission deadline for CIP-86 victims to email help@cow.fi with wallet addresses, affected assets, transaction hashes, and full name for KYC.
CryptoTimes21 May 2026
CIP-86 grant payouts targeted to begin following review and KYC verification by an external firm.
CoW DAO ForumDecision Log
- hash: 5Jdk56enAer3sgZvMATtkhUVhj9k5Z9NFdspNnG6Y43k
- hash: BzRUHUv6fXKParT4VsnDFxUNxLH3VyzdjvbvqgqfLVbE
- hash: 7sJvLZFUpRhqu6aSmpF3rXbWx3YoHwoXSBLe58LUjeq9
This investigation is cryptographically anchored to the Solana blockchain (3 events). 18 of 19 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/31/2026, 7:08:45 AM
last updated: 7/26/2026, 10:26:11 PM
avoid.net — verified advice for a post-truth world