CoW Swap releases post-incident report, determining supply chain domain hijacking: attackers used social engineering against the .fi registry Traficom and registrar Gandi SAS to point DNS to attacker-controlled Cloudflare servers, providing phishing sites to users. The core system was unaffected; the attack was limited to the domain registration chain. Discovered in 19 minutes, switched to cow.finance in 3.5 hours, domain restored and RegistryLock enabled on April 15. Preliminary losses are approximately $1.2 million.

MeNews

2026-05-20 10:31:03

Abstract generation in progress

ME News Report, April 17 (UTC+8), CoW Swap releases a full post-incident report on the domain hijacking event.
The incident was a supply chain attack: attackers used social engineering tactics targeting the .fi domain registry Traficom and registrar Gandi SAS, successfully redirecting the domain DNS to attacker-controlled Cloudflare servers, which provided phishing websites to users for several hours.
CoW Protocol smart contracts, backend API, solver network, and signature infrastructure remained unaffected; the attack occurred entirely at the domain registration supply chain level.
The team detected the issue within 19 minutes and migrated services to cow.finance in about 3.5 hours.
The domain was fully restored on April 15 and RegistryLock was enabled.
Initial estimates suggest user losses of approximately $1.2 million. (Source: Foresight News)

COW4.02%

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

7 Likes

Reward
7
9
11
Share

Comment

Add a comment

SushiLatency

· 6m ago

.fi Registry Traficom, this blame is well deserved; the top-level domain manager has become a critical weakness.

View OriginalReply0

DrinkWaterBeforeTheMarket

· 5h ago

Domain layer security must be included in the audit checklist going forward; just focusing on the contract is not enough.

View OriginalReply0

RektRecoveryCoach

· 15h ago

The most difficult to defend against on the user side is DNS hijacking; even experienced users can fall victim. Bookmarking habits can save the day.

View OriginalReply0

Semi-MatureGovernanceVote

· 16h ago

Even established registrars like Gandi can be targeted; in the future, choosing a domain registration provider will require an additional layer of scrutiny.

View OriginalReply0

HypeVaccinated

· 16h ago

The attack chain is clearly laid out, and CoW’s transparency this time is quite good—other projects should take notes and learn from it.

View OriginalReply0

0xCandleQuiet

· 16h ago

RegistryLock should have been implemented earlier; fixing it afterward always makes people sweat.

View OriginalReply0

GasFeesForNightRuns

· 16h ago

Finding it in 19 minutes is considered fast, but it took 3.5 hours to switch the domain name, and the users were really panicked at that time.

View OriginalReply0

FragmentedSilverStarMap

· 16h ago

1.2M dollars worth of lessons learned; the core system is fine, which is a stroke of luck in misfortune.

View OriginalReply0

Stop-LossLineForTheEveningGlow

· 16h ago

Supply chain attacks are hard to defend against, even the registry can be social engineered, and Web3 security boundaries are more fragile than imagined.

View OriginalReply0

Trending Topics
View More
#
TradfiTradingChallenge
208.76K Popularity
#
GrayscaleBuysAndStakesOver510KHYPE
8.89M Popularity
#
DailyPolymarketHotspot
1M Popularity
#
SpaceXOfficiallyFilesforIPO
734.02K Popularity
#
GateSquarePizzaDay
571.51K Popularity

Pinned

Sitemap

CoW Swap releases a full post-incident report on domain hijacking, with user losses totaling approximately $1.2 million

Trending Topics

TradfiTradingChallenge

GrayscaleBuysAndStakesOver510KHYPE

DailyPolymarketHotspot

SpaceXOfficiallyFilesforIPO

GateSquarePizzaDay

Pinned