← CoW Swap (CoW Protocol)reviewed 2026-09-07 · 38 claims checked
Fact-check findings
What an automated fact-checker found when it re-read CoW Swap (CoW Protocol) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
7 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #2[disputed][awaiting moderator]in the summary
“On April 14, 2026, the protocol's cow.fi domain was hijacked via a social engineering attack that exploited registrar Gandi SAS and the Finnish .fi registry authority Traficom using forged identity documents, redirecting users to a phishing interface for approximately 90 minutes and causing confirmed losses of approximately $1.2 million.”
reviewerOn April 14, 2026, cow.fi was hijacked via social engineering against registrar Gandi SAS and Finnish .fi registry authority Traficom using forged identity documents.The page appears to have mistaken the elapsed time to a public status update (90 minutes) for the full duration of user exposure to the phishing site. Independent reporting and the page's own '3.5 hours to migrate' figure both indicate a longer exposure window of roughly 3.5-4.5 hours.Proposed correction (not yet applied)On April 14, 2026, the protocol's cow.fi domain was hijacked via a social engineering attack that exploited registrar Gandi SAS and the Finnish .fi registry authority Traficom using forged identity documents, redirecting users to a phishing interface for approximately 4.5 hours and causing confirmed losses of approximately $1.2 million. - #8[disputed][awaiting moderator]in section: April 2026 DNS Hijacking Attack
“According to post-incident reporting, the attacker impersonated a senior CoW DAO contributor and submitted forged identification documents to Traficom (the Finnish Communications Regulatory Authority, which operates the .fi country-code top-level domain registry).”
reviewerThe attacker impersonated a senior CoW DAO contributor and submitted forged identification documents to Traficom, described as 'the Finnish Communications Regulatory Authority.'The underlying narrative (forged documents submitted to Traficom, dispute against Gandi) is well supported, but the agency's name is outdated/incorrect.Proposed correction (not yet applied)According to post-incident reporting, the attacker impersonated a senior CoW DAO contributor and submitted forged identification documents to Traficom (the Finnish Transport and Communications Agency, which operates the .fi country-code top-level domain registry). - #17[disputed][awaiting moderator]in section: User Losses and Victim Impact
“The single largest confirmed loss involved one trader who lost 219 ETH, valued at approximately $750,000 at the time of the attack.”
reviewerThe single largest confirmed loss involved one trader who lost 219 ETH, valued at approximately $750,000 at the time of the attack.The 219 ETH figure is well corroborated, and the '$750,000' valuation is repeated verbatim across several secondary crypto-news outlets, but it does not reconcile with ETH's confirmed spot price (~$2,370) on April 14, 2026, which implies a value closer to $519,000. This appears to be a widely propagated arithmetic error rather than a genuine 44%+ intraday price spike.Proposed correction (not yet applied)The single largest confirmed loss involved one trader who lost 219 ETH, valued at approximately $520,000 at the time of the attack. - #18[disputed][awaiting moderator]in section: User Losses and Victim Impact
“The phishing interface operated for approximately 90 minutes during which users who visited the official cow.fi URL and connected their wallets were prompted to sign malicious transactions that drained assets to the attacker's drainer contract.”
reviewerThe phishing interface operated for approximately 90 minutes during which users signed malicious transactions.This duplicates the duration error identified in the summary; the page's own Incident Response section states migration alone took ~3.5 hours, which is itself inconsistent with a 90-minute total exposure window.Proposed correction (not yet applied)The phishing interface operated for approximately 4.5 hours during which users who visited the official cow.fi URL and connected their wallets were prompted to sign malicious transactions that drained assets to the attacker's drainer contract. - #27[disputed][awaiting moderator]in the timeline
“2022-02”
reviewerTimeline: CoW Protocol completes $23 million fundraise and formally spins out from GnosisDAO, dated 2022-02.The cited source (The Block) is itself dated March 29, 2022 and describes the spinout as having just occurred; the page's own citation does not support a February 2022 date.Proposed correction (not yet applied)2022-03 - #28[disputed][awaiting moderator]in the timeline
“2022-02-01”
reviewerTimeline: CoW Protocol completes $23 million fundraise and formally spins out from GnosisDAO, date_original 2022-02-01.Same underlying date error as the 'date' field; the vCOW-to-COW tradeability vote (marking the effective spinout) concluded March 28, 2022, per independent reporting.Proposed correction (not yet applied)2022-03-28 - #33[disputed][awaiting moderator]in the timeline
“CoW DAO publishes full post-mortem report estimating total user losses at approximately $1.2 million, including a single loss of 219 ETH (~$750K) by one trader.”
reviewerTimeline: CoW DAO publishes post-mortem estimating $1.2 million losses including a single loss of 219 ETH (~$750K).Same underlying valuation error as the section[3] finding; the $750K figure does not reconcile with ETH's confirmed spot price that day.Proposed correction (not yet applied)CoW DAO publishes full post-mortem report estimating total user losses at approximately $1.2 million, including a single loss of 219 ETH (~$520,000) by one trader.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #20[unverifiable][awaiting moderator]in section: User Losses and Victim Impact
“The number of individual victims beyond the 219-ETH trader has not been publicly disclosed in detail by CoW DAO.”
reviewerThe number of individual victims beyond the 219-ETH trader has not been publicly disclosed in detail by CoW DAO.A negative/absence claim; no source was found either itemizing victims or explicitly stating that no such disclosure exists.
confirmed
30 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“CoW Protocol (trading interface: CoW Swap) is a decentralized exchange aggregator and MEV-protection protocol spun out of GnosisDAO in 2022.”
reviewerCoW Protocol originated within Gnosis and spun out of GnosisDAO as an independent DAO in 2022.The general characterization of CoW Protocol and its 2022 spinout is accurate. - #3[confirmed][no action needed]in the summary
“The protocol's smart contracts were not compromised; CoW DAO subsequently passed CIP-86 in May 2026 to offer discretionary grants reimbursing verified victims up to 100% of their losses.”
reviewerCoW DAO's smart contracts were not compromised in the attack; CIP-86 was passed in May 2026 to reimburse victims up to 100% of losses.Both the no-smart-contract-compromise claim and the CIP-86 characterization are well supported. - #4[confirmed][no action needed]in section: Protocol Overview
“It originated as a product within Gnosis and was formally spun out as an independent DAO in early 2022 following a $23 million fundraise from investors including Blockchain Capital and Cherry Ventures.”
reviewerCoW Protocol formally spun out as an independent DAO in early 2022 following a $23 million fundraise from investors including Blockchain Capital and Cherry Ventures.Investor list and $23M figure independently corroborated. - #5[confirmed][no action needed]in section: Protocol Overview
“The trading interface, CoW Swap, launched as a proof of concept in April 2021.”
reviewerCoW Swap, the trading interface, launched as a proof of concept in April 2021.Date and characterization of the launch are consistent with independent sources. - #6[confirmed][no action needed]in section: Protocol Overview
“The protocol also operates CoW AMM, launched in February 2024, which was marketed as the first live AMM designed to address loss-versus-rebalancing (LVR) for liquidity providers.”
reviewerCoW AMM launched in February 2024 and was marketed as the first live AMM designed to address loss-versus-rebalancing (LVR).Independently corroborated by The Block and CoW DAO's own blog.citedcow.fi/ - #7[confirmed][no action needed]in section: April 2026 DNS Hijacking Attack
“On April 14, 2026 at approximately 14:54 UTC, an attacker gained control of DNS records for cow.fi and swap.cow.fi by exploiting the .fi domain management process.”
reviewerOn April 14, 2026 at approximately 14:54 UTC, an attacker gained control of DNS records for cow.fi and swap.cow.fi by exploiting the .fi domain management process.Time and date consistently corroborated across independent reporting. - #9[confirmed][no action needed]in section: April 2026 DNS Hijacking Attack
“Gandi did not respond to the dispute, which allowed the attacker to gain effective control over the domain's DNS records.”
reviewerGandi did not respond to the registrar dispute, allowing the attacker to gain effective control over the domain's DNS records.Confirmed directly by the cited source. - #10[confirmed][no action needed]in section: April 2026 DNS Hijacking Attack
“Security firm Blockaid detected the breach at 14:54 UTC.”
reviewerSecurity firm Blockaid detected the breach at 14:54 UTC.Confirmed. - #11[confirmed][no action needed]in section: April 2026 DNS Hijacking Attack
“CoW DAO's team identified the issue within approximately 19 minutes and migrated operations to an alternate domain (cow.finance) within roughly 3.5 hours.”
reviewerCoW DAO identified the issue within approximately 19 minutes and migrated to cow.finance within roughly 3.5 hours.Confirmed by an independent source. - #12[confirmed][no action needed]in section: April 2026 DNS Hijacking Attack
“The cow.fi domain was fully restored on April 15, 2026, with RegistryLock subsequently enabled — a protection that had not been available through Amazon Route 53 prior to the incident.”
reviewerThe cow.fi domain was fully restored on April 15, 2026, with RegistryLock enabled, a protection not previously available through Amazon Route 53.Confirmed by two independent sources. - #13[confirmed][no action needed]in section: April 2026 DNS Hijacking Attack
“The attack surface was limited to the front-end interface; the underlying smart contracts, backend systems, and APIs were not compromised.”
reviewerThe attack surface was limited to the front-end interface; smart contracts, backend systems, and APIs were not compromised.Well supported across multiple sources. - #14[confirmed][no action needed]in section: Registrar Security Failures
“Second, Amazon Route 53 — the DNS provider CoW DAO used to manage its .fi domain records prior to the attack — did not support RegistryLock for .fi domains at the time of the incident.”
reviewerAmazon Route 53 did not support RegistryLock for .fi domains at the time of the incident, creating an exploitable gap.Confirmed. - #15[confirmed][no action needed]in section: Registrar Security Failures
“A parallel social engineering attack targeting the easyDNS registrar to hijack the eth.limo gateway was reported around the same period, suggesting a broader pattern of .fi and crypto-adjacent domain attacks using impersonation tactics.”
reviewerA parallel social engineering attack targeted the easyDNS registrar to hijack the eth.limo gateway around the same period.eth.limo attack occurred April 18, 2026, close enough in time to reasonably describe as 'the same period.' - #16[confirmed][no action needed]in section: User Losses and Victim Impact
“Confirmed user losses from the April 14, 2026 attack totaled approximately $1.2 million USD.”
reviewerConfirmed user losses from the April 14, 2026 attack totaled approximately $1.2 million USD.Consistently corroborated across the page's cited sources. Note: an unrelated KuCoin flash-news article reports a conflicting $120,000 figure in its headline while citing $1.2M in its body text, illustrating some secondary-source noise around this number, but the page's cited sources are internally consistent at $1.2M. - #19[confirmed][no action needed]in section: User Losses and Victim Impact
“The CIP-86 governance proposal acknowledged approximately $1.2 million USD in aggregate user losses, funded from a one-time allocation from CoW DAO's Legal Defense Reserve, with the reserve subsequently replenished to 5 million USDC.”
reviewerCIP-86 acknowledged $1.2 million in losses, funded from the Legal Defense Reserve, subsequently replenished to 5 million USDC.Directly confirmed by the official CoW DAO forum post. - #21[confirmed][no action needed]in section: CIP-86: Victim Compensation Program
“The proposal passed on May 8, 2026, after a vote period of April 30 to May 7.”
reviewerCIP-86 passed on May 8, 2026, after a Snapshot vote period of April 30 to May 7.Vote timeline confirmed directly by the official forum thread. - #22[confirmed][no action needed]in section: CIP-86: Victim Compensation Program
“The compensation is explicitly framed as voluntary and ex gratia, not constituting an admission of liability by CoW DAO. By accepting payment, recipients agree to a full and final settlement of any claims against CoW DAO.”
reviewerThe CIP-86 compensation is framed as voluntary and ex gratia, not an admission of liability, with recipients agreeing to a full and final settlement.Characterization matches typical ex gratia settlement framing described in the forum post and secondary reporting. - #23[confirmed][no action needed]in section: CIP-86: Victim Compensation Program
“Claims were submitted to help@cow.fi by May 14, 2026, with KYC verification handled by an external firm. Payouts were targeted to begin May 21, with the program concluding May 31, 2026.”
reviewerClaims were due to help@cow.fi by May 14, 2026, with KYC by an external firm; payouts targeted to begin May 21, concluding May 31, 2026.All dates directly confirmed by the official CoW DAO forum thread. - #24[confirmed][no action needed]in section: Protocol Integrity and Smart Contract Security
“CoW DAO and independent observers consistently confirmed that the April 14, 2026 attack did not compromise CoW Protocol's smart contracts, solver infrastructure, or backend APIs.”
reviewerCoW DAO and independent observers confirmed the attack did not compromise smart contracts, solver infrastructure, or backend APIs.Confirmed across multiple independent outlets. - #25[confirmed][no action needed]in section: Incident Response and Remediation
“CoW DAO published a full post-mortem report approximately three days after the incident.”
reviewerCoW DAO published a full post-mortem report approximately three days after the incident.Consistent with the page's own timeline (post-mortem dated April 17). - #26[confirmed][no action needed]in the timeline
“CoW Swap launches as a proof of concept on Ethereum, developed within Gnosis.”
reviewerTimeline: CoW Swap launches as a proof of concept on Ethereum, developed within Gnosis (2021-04).Date and description confirmed. - #29[confirmed][no action needed]in the timeline
“At approximately 14:54 UTC, attacker gains control of cow.fi DNS records via social engineering against registrar Gandi SAS and Traficom (.fi registry) using forged identity documents, redirecting traffic to a phishing interface.”
reviewerTimeline: attacker gains control of cow.fi DNS records at approximately 14:54 UTC on April 14, 2026.Confirmed. - #30[confirmed][no action needed]in the timeline
“CoW DAO issues public warning on X advising users not to visit cow.fi and to revoke any wallet approvals; backend protocols and APIs suspended. Team detects issue within ~19 minutes of attack onset.”
reviewerTimeline: CoW DAO issues public warning and detects the issue within ~19 minutes.Confirmed. - #31[confirmed][no action needed]in the timeline
“Within approximately 3.5 hours of the attack, CoW DAO completes migration to alternate domain cow.finance, restoring protocol functionality.”
reviewerTimeline: within approximately 3.5 hours, CoW DAO completes migration to cow.finance.Confirmed. - #32[confirmed][no action needed]in the timeline
“cow.fi domain fully recovered. CoW DAO enables RegistryLock on cow.fi, a protection not previously available through Amazon Route 53.”
reviewerTimeline: cow.fi domain fully recovered April 15, 2026, RegistryLock enabled.Confirmed. - #34[confirmed][no action needed]in the timeline
“CIP-86 draft ('Discretionary grants program for victims of the cow.fi domain hijacking') opens for Snapshot vote.”
reviewerTimeline: CIP-86 draft opens for Snapshot vote on 2026-04-30.Confirmed. - #35[confirmed][no action needed]in the timeline
“CIP-86 passes Snapshot vote. CoW DAO authorizes discretionary grants of up to 100% of verified losses to eligible victims, funded from the Legal Defense Reserve.”
reviewerTimeline: CIP-86 passes Snapshot vote on 2026-05-08.Confirmed. - #36[confirmed][no action needed]in the timeline
“Claim submission deadline for CIP-86 victims to email help@cow.fi with wallet addresses, affected assets, transaction hashes, and full name for KYC.”
reviewerTimeline: claim submission deadline 2026-05-14.Confirmed. - #37[confirmed][no action needed]in the timeline
“CIP-86 grant payouts targeted to begin following review and KYC verification by an external firm.”
reviewerTimeline: CIP-86 grant payouts targeted to begin 2026-05-21.Confirmed; no independent reporting found confirming payouts actually occurred on this date (see coverage gap). - #38[confirmed][no action needed]in the timeline
“CIP-86 compensation program scheduled to conclude.”
reviewerTimeline: CIP-86 compensation program scheduled to conclude 2026-05-31.Confirmed as a scheduled date; actual completion was not independently verifiable (see coverage gap).
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.