CoW Swap (CoW Protocol)
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 50 → 69. Problems weighed by who is responsible: incidents the subject suffered −11.2, problems around the subject, caused by others −4.9; legitimacy credit long-running +10; 1 section(s) set aside until a failed fact-check is resolved; fact-check adjustments (−8) now shown as page reliability, not in the score. Version history →
Why this score
| Every page starts at | 65 |
| Incidents it suffered (e.g. hacks) | -11.2 |
| Problems around it, caused by others | -4.9 |
| Long-running | +10 |
| Sum | 59 |
- 1 section set aside: the claims did not hold up in a fact-check, pending correction.
Score: 69/100 (kept between 0 and 100)
How scoring works →Summary
CoW Protocol (trading interface: CoW Swap) is a decentralized exchange aggregator and MEV-protection protocol spun out of GnosisDAO in 2022. On April 14, 2026, the protocol's cow.fi domain was hijacked via a social engineering attack that exploited registrar Gandi SAS and the Finnish .fi registry authority Traficom using forged identity documents, redirecting users to a phishing interface for approximately 90 minutes and causing confirmed losses of approximately $1.2 million. The protocol's smart contracts were not compromised; CoW DAO subsequently passed CIP-86 in May 2026 to offer discretionary grants reimbursing verified victims up to 100% of their losses.
Connected Entities
4 entities · 60 linked investigations- CoW Swap (CoW Protocol)→mentioned with→Ethereum(65%)
- CoW Swap (CoW Protocol)→mentioned with→Blockchain Capital(80%)
- CoW Swap (CoW Protocol)→mentioned with→Amazon(70%)
1 submission awaiting moderator review.
Timeline(12 events)
April 2021
CoW Swap launches as a proof of concept on Ethereum, developed within Gnosis.
CoW Protocol official blog / The BlockFebruary 2022
CoW Protocol completes $23 million fundraise and formally spins out from GnosisDAO as an independent entity with its own DAO.
The Block14 April 2026
At approximately 14:54 UTC, attacker gains control of cow.fi DNS records via social engineering against registrar Gandi SAS and Traficom (.fi registry) using forged identity documents, redirecting traffic to a phishing interface.
Domain Name Wire / FinanceFeeds / CoinDesk14 April 2026
CoW DAO issues public warning on X advising users not to visit cow.fi and to revoke any wallet approvals; backend protocols and APIs suspended. Team detects issue within ~19 minutes of attack onset.
CoinDesk / Protos14 April 2026
Within approximately 3.5 hours of the attack, CoW DAO completes migration to alternate domain cow.finance, restoring protocol functionality.
Domain Name Wire15 April 2026
cow.fi domain fully recovered. CoW DAO enables RegistryLock on cow.fi, a protection not previously available through Amazon Route 53.
Domain Name Wire17 April 2026
CoW DAO publishes full post-mortem report estimating total user losses at approximately $1.2 million, including a single loss of 219 ETH (~$750K) by one trader.
Bitget News / BingX / Cryptonomist30 April 2026
CIP-86 draft ('Discretionary grants program for victims of the cow.fi domain hijacking') opens for Snapshot vote.
CoW DAO Forum8 May 2026
CIP-86 passes Snapshot vote. CoW DAO authorizes discretionary grants of up to 100% of verified losses to eligible victims, funded from the Legal Defense Reserve.
CoW DAO Forum / CryptoTimes / CoinSpectator14 May 2026
Claim submission deadline for CIP-86 victims to email help@cow.fi with wallet addresses, affected assets, transaction hashes, and full name for KYC.
CryptoTimes21 May 2026
CIP-86 grant payouts targeted to begin following review and KYC verification by an external firm.
CoW DAO ForumDecision Log
- slot 455366549 · hash A8F2SteGq16kVfSW61g6iaDpgP6BbYg4JjiJwkZv8wtT
- slot 445506312 · hash 3KLExMcQLi3kUD5BwWEbJZBZQrzHcYEkeTHmxpwvGsma
- slot 423656069 · hash 5Jdk56enAer3sgZvMATtkhUVhj9k5Z9NFdspNnG6Y43k
- slot 423656066 · hash BzRUHUv6fXKParT4VsnDFxUNxLH3VyzdjvbvqgqfLVbE
- slot 423326208 · hash 7sJvLZFUpRhqu6aSmpF3rXbWx3YoHwoXSBLe58LUjeq9
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 18 of 19 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/31/2026, 7:08:45 AM
last updated: 10/10/2026, 6:46:43 PM
5 viewsavoid.net — verified advice for a post-truth world