Live
Loading prices…
CoinHub Today · coinhubtoday.com
CoinHub Today · Security

CoW Swap Domain Hijack Is Just the Latest Reminder That DNS Still Eats Crypto

A $1.2 million drain on April 14 — executed entirely at the registrar level, without touching a single smart contract — illustrates that the crypto stack's weakest link is often decades older than the blockchain.

Security DNS InfrastructureCoinHub Today Research DeskApril 16, 20266 min read
$1.2M
Drained April 14
11
DNS hijacks in 2026 YTD
$24M
DNS losses in 2025
~2 hrs
Window before detection
Time (UTC)Event
14:37cowswap.fi registrar compromised via SIM swap
14:51Nameservers changed to attacker-controlled tenant
15:12Malicious lookalike frontend goes live
15:48First victim loses funds through spoofed approval
16:55Registrar freeze applied; nameservers restored
17:30Warning posted; loss estimated at ~$1.2M

How the Attack Worked

The compromise began with a SIM-swap on a team member who held the administrative email for the registrar account. Once attackers controlled that email, they reset the password, changed nameservers, and pointed the domain at a malicious Cloudflare tenant hosting a pixel-perfect clone of CoW Swap's real frontend. Users saw the legitimate URL, the legitimate HTTPS certificate, and a UI matching CoW Swap's real design. The only difference was the smart-contract address behind the approve() calls.

A Growing Attack Surface

Tracked DNS-based attacks on crypto frontends have risen every year since 2021, reaching 29 incidents in 2025 and 11 in the first four months of 2026. High-profile targets include Curve Finance (twice), Balancer, and several major NFT marketplace frontends. The crypto stack will depend on DNS for as long as users load protocol interfaces through web browsers.

Several protocols have begun exploring on-chain frontend commitments as a structural answer. Uniswap, Aave and Lido all publish a content hash for their canonical production frontend to a smart contract; wallets that support the extension can check the hash of the served page before allowing approvals.

What users can do now
Treat every frontend visit as a trust decision. Check hardware-wallet screens against the expected contract address, not against what the browser UI shows. Use content-addressed frontend mirrors where available. Assume any newly deployed contract a site asks you to approve is potentially hostile.
Sponsored · Web3Firewall
Pre-Signature Intelligence for Crypto Operations

The attacks described in this article exploit gaps that pre-signature transaction monitoring is built to close. Web3Firewall evaluates 100+ risk signals before a transaction reaches the blockchain — enforcing policy controls at the only moment intervention is actually possible.

Reporting note: Draws on public disclosures from Chainalysis, TRM Labs, Elliptic, CertiK, Halborn and affected protocols. Editorial commentary; figures subject to revision.

Stay ahead with CoinHub Today

Real crypto news, market data, and analysis — free to your inbox every weekday at 7am.

No spam. Unsubscribe anytime. Sent to admin@coinhubtoday.com

CoinHub Today is an independent media organisation and does not provide investment, financial, or legal advice. All content is for educational purposes only. Cryptocurrency investments involve substantial risk. Past performance is not indicative of future results. Always consult a qualified financial adviser before investing.