PANews reported on April 16th that CoW Swap announced on its X platform that it has regained control of the cow.fi domain and that it has been operating normally on cow.finance for some time. It is currently gradually transitioning back to the original domain. On April 14th, attackers gained control of the cow.fi domain by forging documents and deceiving the DNS registrar . The attackers deployed a highly realistic phishing website, implementing the attack in two phases: first, they induced users to sign malicious transactions using a wallet stealer; then, they stole mnemonic phrases and passwords through fake wallet pop-ups. This attack targeted the domain registrar and was not related to CoW Swap's own infrastructure or a private key leak. Affected users should use tools such as Revoke.cash to revoke all authorizations and consider transferring funds to a new wallet.