CoW Swap release attack event explanation: The domain was subjected to a social engineering attack, and control of the cow.fi domain has now been regained

CoW Swap tweeted that it has regained control of the cow.fi domain and has been operating normally on cow.finance for some time, and is currently gradually transitioning back to the original domain.

The official statement indicated that the attacker deceived the DNS registrar with forged documents on April 14 to gain control of the cow.fi domain; the attacker deployed a highly realistic phishing website, implementing it in two phases: first, inducing users to sign malicious transactions through a wallet stealer, and then stealing mnemonic phrases and passwords through fake wallet pop-ups; this attack targeted the domain registrar and did not involve a breach of CoW Swap's own infrastructure or private keys. Affected users should use tools like Revoke.cash to revoke all authorizations and consider transferring funds to a new wallet.