CoW Swap Halts Services After DNS Hijacking Attack Targets DeFi Interface

Decentralized trading platform CoW Swap temporarily suspended its services on Tuesday following the discovery of a DNS hijacking attack targeting its website. The incident highlights a growing vulnerability at the front-end layer of decentralized finance platforms, where web-based interfaces remain exposed even when underlying smart contracts are secure.

The CoW Swap team announced via X that the breach was detected at 14:54 UTC, urging users to immediately stop interacting with the platform. Although the protocol's core backend and APIs were not directly compromised, both were proactively shut down while the team investigated and worked to restore safe operations. Users were advised to stay away from swap.cow.fi until an official all-clear was issued.

DNS hijacking is a cyberattack method where hackers redirect traffic from a legitimate website to a fraudulent lookalike, typically designed to steal cryptocurrency or sensitive user data. This attack vector has emerged as a recurring threat across the DeFi ecosystem, exploiting the gap between secure on-chain infrastructure and the web-based portals users depend on to access it.

CoW Swap functions as a decentralized exchange aggregator, pulling liquidity from multiple sources and using a "Coincidence of Wants" model to directly match compatible trades or batch them for optimized execution. Orders are fulfilled by competing solvers designed to minimize slippage and protect traders from maximal extractable value (MEV) — a blockchain exploit where automated bots manipulate transaction ordering to siphon profits at the expense of regular users.

Governed by CoW DAO, a decentralized autonomous organization with roots in the Gnosis ecosystem, the platform has built its reputation around delivering fairer trade execution and stronger user protections in DeFi. The team confirmed it was actively working to resolve the situation and urged the community to monitor official channels for updates before resuming any activity on the platform.