CoW DAO

User protection is a core promise of CoW Swap. We are therefore proposing a discretionary grants program so that victims of the April 14 DNS hijacking incident can be made whole as quickly as possible. Proposal details can be found on the CoW DAO forum, here: forum.cow.fi/t/cip-draft-di… Note that because of the high sums involved in the incident, this proposal will need to pass governance to go into effect. Please signal your support or give feedback directly in the forum.

#CoWGlossary: TWAP Order (Time-Weighted Average Price)⏳ If you are buying a massive amount of tokens, dumping it all at once will crash the price (high price impact). TWAP is a strategy that breaks your big order into many small pieces and executes them over a set period of time. Example: instead of buying 100 ETH instantly, you buy 1 ETH every 10 minutes. Why use it: It smooths out volatility and ensures you get the "average" market price over that time period, rather than suffering from a price spike caused by your own trade.

@BoarBreeder @TeeLew87035 x.com/CoWSwap/status…

@TeeLew87035 @CoWSwap Any word or response on what they are going to do about this yet...sorry for your loss...I'm trippin over 4k...could only imagine what you're going through

🚨🚨 UPDATE: CoW Swap experienced a DNS hijacking at 14:54 UTC (approximately 90 minutes ago). The CoW Protocol backend and APIs were not impacted, but we have paused them temporarily as a precaution. We are now actively working to resolve the situation. Please continue to refrain from using swap dot cow dot fi until we confirm that it is safe to use.

Thanks to everyone building solvers and trading with us - these improvements exist because the ecosystem keeps pushing. Moooooo. 🐮 END OF THREAD.

🤔 What this means in practice: → Solvers compete more directly for your trades → Order execution gets more efficient → Pricing stays consistent for users trading the same token pairs Cleaner mechanics. Better fills.📷✨

CoW Upgrade news! 📰 Two solver infrastructure updates just went live - both aimed at strengthening solver competition and execution flow. Let's explain. 🧵

@R___Kane @tydrohq @Ponzinomix @xStocksFi Hey @R___Kane, could you tell us which wallet are you using? This will help us debug faster.

@tydrohq @Ponzinomix @xStocksFi @CoWSwap I can't swap. What could it be this problem "signature is invalid"? (I'm using USDC)

Have you traded @xStocksFi on Tydro yet? Swaps are live on Tydro via @CoWSwap. Phase 2: Borrow & lend against your XStocks soon Phase 3: TBA 😏

Update: CoW Swap has received communication from Vercel stating, “At this time, we do not have reason to believe your Vercel credentials or personal data have been compromised.”

We’ll continue monitoring as Vercel’s investigation progresses. We have no indication CoW Swap was among the impacted customers. However, we still completed all recommended remediation steps: ✅ Rotated all tokens ✅ Audited deployments -> no malicious code ✅ Reviewed activity logs -> no suspicious access CoW Swap is safe to use.

@0xInitialAce @Pybast No

@Pybast Is this related to the @CoWSwap attack?

Sorry to announce more bad news. I would advise to stop interacting with ANY DeFi dApp for the coming days as there is an ongoing incident on Vercel related to stolen Github and NPM keys. We still don't know enough but if the claims are true, frontends could get compromised from Github or from supply chain attacks. These are the attack vectors used to hack bybit or compromise Ledger’s Connect Kit. Stay safe!

@RunnerXBT Yes, safe to use

is CoWswap safe to use again? or just avoid forever

@KazumaxCrypto To clarify: remediation or compensation to users does not depend on recovering stolen funds; there is still SOME information missing on this topic and we expect more developments in the coming days. If CoW DAO covered with its own funds it would need to be voted on by the DAO

Cow Swapのドメインハックで合計損失額（Cow側の計算）が1.2Mドルで、 Cow側が自社資金を出して補填するというよりも、仮にすでに取られた資産を復元できたら返還するような形.... 個人的にはハッキングされる数時間前まで使ってて、被害はないが、全く補填なしという対処は痛いだろうな Approveする時、立ち上げ数日ぐらいのコントラクトを検知してくれるウォレット、サイン解析アプリはほぼ必須と思います。 あとはもちろんコールドウォレット。

Post-mortem: April 14 domain hijack What happened, what we’ve confirmed, and what’s next. Transparency matters — here’s the full breakdown ↓ x.com/CoWSwap/status…

@onedigitnumbers Yes

@CoWSwap wallets that were connected before that time and had resting orders are safu then? just want to double check my assumption.

UPDATE: We now have full control of the cow.fi domain. CoW Swap has been working as normal at cow.finance for some time now, and we are now working to transition it back to it's original domain. In the meantime, here is an update on we know about the incident so far and what you should do if you were impacted. 👇🧵

After yesterday's CoW Swap compromise, we've added an exploit checker that checks for known addresses belonging to the exploiters. Keep in mind that there are likely more addresses than the ones we know of, so best to revoke any recent approvals you don't recognise. Check it below 👇 revoke.cash/exploits/cowsw…

A full post-mortem from CoW Swap - including root cause analysis, confirmed impact, and all hardening measures - will be published in the next few days, after we receive the post-mortem from our registrar. Thank you for your patience.

⚠️⚠️ If you connected your wallet to cow.fi between ~13:00 and ~20:00 UTC on April 14, you should: - Treat your wallet as compromised - Revoke all approvals with revoke.cash or a similar service - Consider moving funds to a new wallet - Do not enter your seed phrase anywhere (Note that the suggested time window has been padded as an extra precaution.)