CoW Swap Halts Services After DNS Hijacking Incident Decentralized exchange aggregator CoW Swap temporarily suspended operations on Tuesday after detecting a DNS hijacking attack targeting its website. The incident, identified at 14:54 UTC, prompted the team to warn users against interacting with the platform until further notice. While the protocol’s backend infrastructure and APIs remained uncompromised, both were paused as a precautionary measure. DNS hijacking where attackers redirect users to malicious sites to steal funds or data has become a recurring threat in decentralized finance (DeFi), particularly for web-based interfaces that interact with secure smart contracts. CoW Swap, governed by the CoW DAO (a decentralized autonomous organization from the Gnosis ecosystem), operates as a DEX aggregator, sourcing liquidity across platforms and using a "Coincidence of Wants" mechanism to match trades directly or batch them for efficiency. The protocol also mitigates maximal extractable value (MEV), a practice where bots manipulate transaction ordering for profit, ensuring fairer execution for users. The team confirmed they were working to resolve the issue and advised users to avoid the platform until security was restored. No further details on the attack’s scope or impact have been disclosed.

Matcha Meta Suffers $16.8M Exploit via SwapNet Security Breach On January 25, 2026, Matcha Meta, a swap and bridge aggregation platform built by 0x, confirmed a $16.8 million loss in digital assets due to a security breach in SwapNet, an external aggregator integrated into its interface. The attack occurred over the weekend, targeting users who had disabled Matcha Meta’s "One-Time Approvals" feature and granted direct token permissions to SwapNet. According to PeckShield, the attacker exploited token approvals to drain funds, swapping 10.5 million USDC from victim addresses on Base (an Ethereum Layer-2) for 3,655 ETH before bridging the assets to the Ethereum mainnet to obscure transaction trails. The breach stemmed from unlimited token allowances, which allowed the attacker to move funds without user signatures once permissions were granted. Matcha Meta clarified that users who relied on its One-Time Approval system which routes permissions through 0x’s AllowanceHolder and Settler contracts were unaffected. The platform has since disabled direct allowance settings for aggregators and urged users to revoke existing permissions on SwapNet’s router contract. The incident follows a $4.13 million exploit of Makina Finance on January 19, where attackers drained a DUSD/USDC liquidity pool on Curve via a compromised pricing oracle. DeFi breaches remain persistent in 2026, with similar attacks reported on platforms like CoWSwap in 2025, where a solver account exploit led to $180,000 in DAI losses. Blockchain analytics firm Elliptic notes that such exploits often leverage coin swap services for money laundering.