CoW Swap releases full post-incident report on domain hijacking event, user losses estimated at approximately $1.2 million

Foresight News reports that CoW Swap has released the full post-event report on the domain name hijacking incident. The nature of this event was a supply chain attack: the attacker used social engineering techniques targeting the .fi domain registry Traficom and the registrar Gandi SAS, successfully redirecting the domain's DNS to a Cloudflare server controlled by the attacker, and for several hours provided a phishing website to users.

CoW Protocol's smart contracts, backend API, solver network, and signing infrastructure were unaffected; the attack occurred entirely at the domain registration supply chain layer. The team detected the issue within 19 minutes and completed service migration to cow.finance in about 3.5 hours. The domain was fully restored on April 15th, with RegistryLock enabled. Preliminary analysis shows user losses of approximately 1.2 million US dollars.