CoW Swap hit by DNS hijack, warns users to stay clear of site

CoW Swap, the decentralized exchange aggregator used by Vitalik Buterin to sell millions of dollars worth of Ethereum, is warning users to avoid interacting with its site after suffering a front-end attack. 

“We are currently experiencing an issue with the CoW Swap frontend,” the firm posted on X earlier today, adding, “While we are investigating, please DO NOT use CoW Swap.” 

CoW Swap later revealed that it was victim to “a DNS hijacking at 14:54 UTC.”

Read more: Aave Labs faces backlash over CoW Swap integration

It said, “The CoW Protocol backend and APIs were not impacted, but we have paused them temporarily as a precaution.” 

“We are now actively working to resolve the situation. Please continue to refrain from using swap dot cow dot fi until we confirm that it is safe to use,” CoW Swap added.

Crypto security firm Blockaid also claimed its alert system was able to detect “a front-end attack,” and warned users with connected wallets to “revoke approvals and avoid any interactions with the dApp immediately.”

Vitalik Buterin moves millions through CoW Swap

CoW has previously been used by Ethereum co-founder Vitalik Buterin to sell 3,100 Ethereum, which was worth over $6.1 million at the time.

It was integrated with Aave Protocol last December. Days later, a delegate called “EzR3aL” noted that the partnership resulted in funds being diverted away from the Aave treasury.

A months-long governance battle followed. 

The partnership would supposedly offer “better prices… and protection against MEV attacks” and allow users to “repay borrow positions using their collateral, swap between different collateral types, change their debt positions, or withdraw and swap assets.”

CoW Swap’s integration also saw a more unfortunate swap that involved a crypto user swapping $50 million of (Aave-wrapped) USDT to just $35,000 of (Aave-wrapped) AAVE. 

Both CoW Swap and Aave pledged to return the fees.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.