CoW Swap (CoW Protocol)
Summary
CoW Protocol (trading interface: CoW Swap) is a decentralized exchange aggregator and MEV-protection protocol spun out of GnosisDAO in 2022. On April 14, 2026, the protocol's cow.fi domain was hijacked via a social engineering attack that exploited registrar Gandi SAS and the Finnish .fi registry authority Traficom using forged identity documents, redirecting users to a phishing interface for approximately 90 minutes and causing confirmed losses of approximately $1.2 million. The protocol's smart contracts were not compromised; CoW DAO subsequently passed CIP-86 in May 2026 to offer discretionary grants reimbursing verified victims up to 100% of their losses.
Connected Entities
1 entities · 10 linked investigations- + 3 more
Timeline(12 events)
2021-04-01
CoW Swap launches as a proof of concept on Ethereum, developed within Gnosis.
CoW Protocol official blog / The Block2022-02-01
CoW Protocol completes $23 million fundraise and formally spins out from GnosisDAO as an independent entity with its own DAO.
The Block2026-04-14
At approximately 14:54 UTC, attacker gains control of cow.fi DNS records via social engineering against registrar Gandi SAS and Traficom (.fi registry) using forged identity documents, redirecting traffic to a phishing interface.
Domain Name Wire / FinanceFeeds / CoinDesk2026-04-14
CoW DAO issues public warning on X advising users not to visit cow.fi and to revoke any wallet approvals; backend protocols and APIs suspended. Team detects issue within ~19 minutes of attack onset.
CoinDesk / Protos2026-04-14
Within approximately 3.5 hours of the attack, CoW DAO completes migration to alternate domain cow.finance, restoring protocol functionality.
Domain Name Wire2026-04-15
cow.fi domain fully recovered. CoW DAO enables RegistryLock on cow.fi, a protection not previously available through Amazon Route 53.
Domain Name Wire2026-04-17
CoW DAO publishes full post-mortem report estimating total user losses at approximately $1.2 million, including a single loss of 219 ETH (~$750K) by one trader.
Bitget News / BingX / Cryptonomist2026-04-30
CIP-86 draft ('Discretionary grants program for victims of the cow.fi domain hijacking') opens for Snapshot vote.
CoW DAO Forum2026-05-08
CIP-86 passes Snapshot vote. CoW DAO authorizes discretionary grants of up to 100% of verified losses to eligible victims, funded from the Legal Defense Reserve.
CoW DAO Forum / CryptoTimes / CoinSpectator2026-05-14
Claim submission deadline for CIP-86 victims to email help@cow.fi with wallet addresses, affected assets, transaction hashes, and full name for KYC.
CryptoTimes2026-05-21
CIP-86 grant payouts targeted to begin following review and KYC verification by an external firm.
CoW DAO ForumDecision Log
- hash: 7sJvLZFUpRhqu6aSmpF3rXbWx3YoHwoXSBLe58LUjeq9
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/31/2026, 7:08:45 AM
last updated: 5/31/2026, 7:31:41 AM
avoid.net — verified advice for a post-truth world