Back Kucoin

CoW Swap Regains Domain Control Following Social Engineering Attack

Kucoin • April 16, 2026

CoW Swap announced on Twitter that it has regained control of the cow.fi domain and has been operating normally on cow.finance for some time, and is now gradually transitioning back to the original domain. The official statement revealed that the attacker obtained control of the cow.fi domain on April 14 by deceiving the domain registrar with forged documents; the attacker deployed a highly convincing phishing site in two stages—first inducing users to sign malicious transactions via a wallet stealer, then stealing seed phrases and passwords through a fake wallet popup. This attack targeted the domain registrar, not CoW Swap’s own infrastructure or private keys. Affected users should use tools like Revoke.cash to revoke all authorizations and consider transferring funds to a new wallet.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CoW Swap Regains Control of cow.fi Domain After Social Engineering Attack On April 14, 2026, CoW Swap's cow.fi domain was compromised through a social engineering attack that deceived the DNS registrar with forged documents. The attacker created a phishing website that operated in two phases: first, tricking users into signing malicious transactions via a wallet drainer, and second, stealing mnemonic phrases and passwords through fake wallet pop-ups. This attack did not exploit CoW Swap's infrastructure or involve any private key leaks. Affected users are advised to use tools like Revoke.cash to revoke all approvals and consider transferring their funds to new wallets. As of April 16, CoW Swap has regained control of the cow.fi domain and is transitioning back from cow.finance. The incident highlights the vulnerabilities in domain registration processes and the importance of user vigilance against phishing attempts. 6 sources 58

Extracted Entities

CoW Swap Regains Domain Control Following Social Engineering Attack

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Domains (1)

MITRE ATT&CK (1)