$COW A DNS Hijack Drained $1M From CoW Swap — Then the DAO Voluntarily Paid Every Victim Back in Full
On April 14, 2026, attackers seized control of CoW Swap's domain records at the registrar level, redirecting users to a pixel-perfect clone that drained wallets — including a single interception of 219 ETH from one trader. Security firm Blockaid flagged the breach within minutes, but not before at least $1 million in user assets had been siphoned in the first three hours, forcing a full protocol shutdown.
Most DeFi hacks end there — with users left holding the loss. CoW DAO did something different: the community responded with a $1.2 million voluntary reimbursement plan for every affected user — a move that instantly separated CoW Protocol from the long list of projects that simply apologize and move on.
On April 14, 2026, attackers seized control of CoW Swap's domain records at the registrar level, redirecting users to a pixel-perfect clone that drained wallets — including a single interception of 219 ETH from one trader. Security firm Blockaid flagged the breach within minutes, but not before at least $1 million in user assets had been siphoned in the first three hours, forcing a full protocol shutdown.
Most DeFi hacks end there — with users left holding the loss. CoW DAO did something different: the community responded with a $1.2 million voluntary reimbursement plan for every affected user — a move that instantly separated CoW Protocol from the long list of projects that simply apologize and move on.