Blockaid flags CoW Swap’s cow.fi frontend as malicious, urging users to revoke token approvals and avoid the dApp amid a broader wave of DeFi interface attacks.

Blockchain security firm Blockaid has warned that CoW Swap’s primary website COW.FI has been compromised in a suspected frontend attack, marking the latest high‑profile exploit attempt against a major DeFi trading interface.

In an alert shared on X, Blockaid said its system “has detected a front-end attack targeting Cowswap” and confirmed that the cow.fi domain has been flagged as malicious inside Blockaid‑integrated wallets, advising users “to refrain from signing transactions and avoid interactions with the dApp until the issue is resolved.”

Following the warning, CoW Swap community channels and independent security commentators urged traders who had connected wallets to CoW Swap to immediately revoke any outstanding token approvals and to stop interacting with the platform’s frontend until further notice, even though underlying smart contracts have not been reported as compromised.

Blockaid’s latest alert comes amid a surge in so‑called frontend hijacks, where attackers compromise a project’s website or DNS rather than its on‑chain contracts, silently swapping legitimate transaction prompts for malicious ones that drain user wallets.linkedin+1

In February, Blockaid reported a similar frontend attack on tokenization platform OpenEden, warning users to “refrain from signing transactions and avoid interactions with the dApp until the issue is resolved,” while separate incidents have recently hit lending protocol Curvance and asset manager Maple Finance.

As highlighted in CoW Swap’s own DeFi security guides, these attacks target “people, devices, and transaction behavior instead of only attacking code,” making basic hygiene like checking URLs, using browser bookmarks and monitoring token approvals critical for retail and professional users alike.

Security platforms such as Kerberus and Revoke‑style tools recommend users regularly audit and revoke token approvals after any suspected incident, noting that revocation “only removes future permission for that contract to move your tokens” and cannot recover funds already drained.

For DeFi traders, the CoW Swap incident underscores a lesson that keeps recurring in crypto.news coverage of exchange exploits, bridge hacks and protocol drains: even when audited smart contracts remain intact, a single compromised frontend can still turn a routine swap into a total wallet loss if users sign blind.

Tether today unveiled its self-custodial crypto wallet using the open-source Wallet Development Kit (WDK) developed by the firm. According to an announcement from the firm, tether.wallet supports USDT, USAT, Bitcoin and XAUT, what the firm says represent “the only assets that truly matter for most of the people.”

Tether says the initiative, which it’s dubbing “the People’s Wallet” aligns with its mission to promote financial inclusion globally, particularly in developing countries and regions with high inflation.

Tether CEO Paolo Ardoino was quoted in the announcement on the firm’s aim of preserving self-custody, without compromising on user experience:

“The objective is to remove the complexity that has prevented broader adoption while preserving the properties that make the digital assets technology valuable. Users should be able to send value as easily as sending a message, without relying on intermediaries and without giving up control of their assets.”

As an example, the firm’s announcement notes that the wallet lets users pay fees in the asset being transferred, instead of needing to acquire or hold separate tokens for gas. The wallet also supports easily readable addresses for sending and receiving that look more like an email address, instead of the typical alphanumeric string.

Tether says at launch, the wallet supports USDT and XAUT on Ethereum, Polygon, Plasma, and Arbitrum, and USAT on Ethereum. It also supports Bitcoin both natively and via the Lightning Network. The firm plans to add support for “several other blockchains” in the future.

Last month, Tether announced that it had engaged a Big Four firm to conduct its first ever “full independent financial statement audit.”

This article was written with the assistance of AI workflows. All our stories are curated, edited and fact-checked by a human.

Crypto wallet Zerion revealed that North Korean-affiliated hackers used AI in a long-term social engineering attack to steal about $100,000 from the company’s hot wallets last week. 

The Zerion team released a post-mortem on Wednesday, where it confirmed that no user funds, Zerion apps or infrastructure were affected and that it had proactively disabled the web app as a precaution. 

While the amount was relatively small in crypto hacking terms, it is another incident of a crypto worker being targeted for an “AI-enabled social engineering attack linked to a DPRK threat actor,” Zerion said.

It is the second attack of this nature this month, following the $280 million exploit of the Drift Protocol, which was the victim of a “structured intelligence operation” by DPRK-affiliated hackers. The human layer, not smart contract bugs, has now become North Korea’s primary point of entry into crypto firms.  

AI is changing the way cyber threats work

Zerion said the attacker gained access to some team members’ logged-in sessions and credentials, as well as private keys to company hot wallets. 

“This incident showed that AI is changing the way cyber threats work,” the company said. 

It confirmed that the attack was similar to those that had been investigated by the Security Alliance (SEAL) last week.

Related: Researchers discover malicious AI agent routers that can steal crypto

SEAL reported that it had tracked and blocked 164 domains linked to the DPRK group UNC1069 in a two-month window from February to April.

It stated that the group operates “multiweek, low-pressure social engineering campaigns” across Telegram, LinkedIn and Slack. Malicious actors impersonate known contacts or credible brands or leverage access to previously compromised company and individual accounts.

“UNC1069’s social engineering methodology is defined by patience, precision, and the deliberate weaponization of existing trust relationships.”

Google’s cybersecurity unit Mandiant detailed in February the group’s use of fake Zoom meetings and a “known use of AI tools by the threat actor for editing images or videos during the social engineering stage.”

DPRK’s social engineering is evolving

Earlier this month, MetaMask developer and security researcher Taylor Monahan said North Korean IT workers have been embedding themselves in crypto companies and decentralized finance projects for at least seven years.

“The evolution of the DPRK’s social engineering techniques, combined with the increasing availability of AI to refine and perfect these methods, means the threat extends well beyond exchanges,” blockchain security firm Elliptic said in a blog post earlier this year. 

“Individual developers, project contributors, and anyone with access to cryptoasset infrastructure is a potential target.”

Magazine: How AI just dramatically sped up the quantum risk for Bitcoin