CoW Swap pauses services after DNS hijack redirects swap.cow.fi

The DAO warned users on Tuesday to stop visiting swap.cow.fi after a Domain Name System hijack redirected the site’s frontend to an active exploit. Backend systems and application programming interfaces were paused to limit exposure while the team restores a safe environment.

The incident affected the frontend domain only, the organization indicated, and users were asked not to interact with the compromised site until the team confirms it is safe. No public attribution for the hijack was provided and no timeline was given for restoring DNS records or reopening APIs.

The update was posted on the project’s social channels and described the situation as ongoing and under active remediation. The team noted that protocol smart contracts had not been reported as compromised at the time of the post.

The market reacted to the disclosure: the COW token fell more than 3%, slipping from $0.2229 to $0.2159 after the hijack was reported.

DNS hijacks can redirect users to phishing pages that mimic legitimate services. Other decentralized finance projects have experienced domain attacks in recent years. Security firm Hacken reported that Web3 projects lost $482 million to hacks and scams in the first quarter of 2026, with most incidents tied to phishing and social-engineering attacks.

The DAO advised users to verify contract addresses and to follow official project channels for updates. In its post the organization wrote, “We are now actively working to resolve the situation. Please continue to refrain from using swap dot cow dot fi until we confirm that it is safe to use.”

Users and counterparties should avoid interacting with the compromised domain and wait for the DAO to confirm restoration before resuming use of the frontend.