On 14 April 2026, at about 14:54 UTC by CoW DAO’s count, the address blockchain, where users swap tokens directly from their own wallets without handing custody of their funds to a company.">swap.cow.fi stopped being CoW Swap. For about 4.5 hours the name pointed to a clone of the site, and wallets that signed there were drained. The core team of CoW DAO estimates users lost about 1.2 million USDC. Its post-mortem says the contracts were not touched, nor the backend, nor the solvers that fill its orders. The attacker went after the paperwork of a domain name.
That is an odd way to start a lesson on the DEX aggregator, a piece of software whose whole purpose is to get you a better price than a single smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool would. But the episode shows the two halves of the subject. The clever half is the routing and the auctions, which save real money on a large trade. The other half is a new set of parties you now depend on: a router contract holding your approvals, a website, a group of professional market makers.
What a DEX aggregator does between your click and the block
A decentralised exchange is a set of pools or an order book, and each one quotes its own price. If that is still new, read our guide to DEXs and automated market makers first. A DEX aggregator owns no pool of its own in the classic design. It reads prices across many venues, works out where your order should go, and sends it there through one transaction, or hands it to someone who will.
The reason is price impact. In a constant-product pool the price moves against you as your trade grows relative to the reserves, and the derivation in our lesson on x·y=k shows the cost rising faster than the size. Do not confuse that with your slippage tolerance, the safety limit you set yourself: our guide to using a DEX safely draws the line between the two, and covers approvals and sandwich attacks too.
The word has a second meaning. A yield aggregator moves deposits between lending markets and farms to chase a return, which is a different product and a later lesson. Here the word only means swaps.
Three designs now share the name, and they arrived roughly in this order: routers that split your trade across pools, auctions in which competing parties fill what you signed, and wallets that wrap either of those behind a swap button and add their own fee.
Routing: how an aggregator finds the best path
Splitting a trade works because price impact is convex
Take a worked example with invented round numbers. You want to swap 200,000 USDC for ether, priced at 2,000 dollars in this example. Two constant-product pools charge a 0.30% fee. Pool A holds 2,000 ETH and 4,000,000 USDC. Pool B holds half as much: 1,000 ETH and 2,000,000 USDC.
| Route (example figures) | USDC sent | ETH received | Average price |
|---|---|---|---|
| All through pool A | 200,000 | 94.97 | 2,106 dollars |
| Split: two thirds to A, one third to B | 133,333 + 66,667 | 64.33 + 32.16 = 96.49 | 2,073 dollars |
| Difference | 1.53 ETH more | about 3,050 dollars at 2,000 |
The split earns about 1.6% more ether, before gas. Nothing magic happened. Dividing the order in proportion to the reserves makes the two pools behave like a single pool of 3,000 ETH and 6,000,000 USDC, and you can check that a swap of 200,000 USDC against those combined reserves gives the same 96.49 ETH. The gain shrinks fast with size: on a 2,000 USDC swap in these same pools the difference would be about 33 cents, and an extra leg of gas could wipe it out.
Hops, gas and the search for a path
Real routes are stranger than a two-pool split. An aggregator treats tokens as points on a graph and pools as the lines between them. A swap from USDC to a small token may go through ETH, or through a stablecoin pool on Curve and then a concentrated-liquidity pool, because the Curve and Balancer pools of our previous lesson price some pairs far more tightly than a general pool does. Each pool type has its own pricing formula, so the search cannot use one simple equation across the graph.
Every extra leg costs gas, and that is the real brake. On Ethereum mainnet a route with many legs can lose to a simpler one once gas is priced in. On Solana, where fees are far lower, routers can afford more legs. So a good pathfinder optimises the amount received after gas, not the headline rate.
The search itself runs off-chain, on the aggregator’s servers. It returns a quote, you sign, and the transaction lands some moments later on a chain whose prices may have moved. That gap is why every router quote comes with a minimum received, and why the transaction reverts if it cannot be met.
The search is also where the marketing lives. 1inch says the Pathfinder version it described on 10 June 2025 can merge intermediate tokens from two paths before the last leg, and gave results “up to 6.5% better” than its previous version on more than 30,000 real-time trades. That is a self-reported maximum, not a typical gain.
1inch, Velora and Jupiter: who routes the volume
DefiLlama counted 65.6 billion dollars of aggregator volume over the 30 days to 30 October 2026. Its category is wide, mixing routers, wallets and intent systems, so read the table as a rough map.
| Aggregator (DefiLlama name) | 7 days | 30 days |
|---|---|---|
| All aggregators | 14.11 bn dollars | 65.63 bn dollars |
| Jupiter Aggregator | 2.71 bn | 12.89 bn |
| DFlow Aggregator | 1.66 bn | 8.16 bn |
| 0x Aggregator | 1.05 bn | 5.81 bn |
| OKX Swap | 1.10 bn | 5.77 bn |
| KyberSwap Aggregator | 1.25 bn | 5.38 bn |
| LiquidMesh | 0.47 bn | 4.10 bn |
| Uniswap Aggregator | 0.99 bn | 3.40 bn |
| 1inch Swap | 0.75 bn | 3.37 bn |
| CoWSwap | 0.86 bn | 3.12 bn |
| Binance Wallet | 0.31 bn | 2.21 bn |
| Bebop Aggregator | 0.47 bn | 1.56 bn |
| Velora | 0.40 bn | 1.37 bn |
Source: DefiLlama, as of 30 October 2026. Volumes are for the periods shown and move quickly. Summing DefiLlama’s daily series gives a peak of about 263 billion dollars in January 2025, a low of about 52 billion in May 2026, and between about 74 and 82 billion a month from June to September 2026. An aggregator trade executes on DEXs, so it can be counted twice across categories: do not divide these figures by total DEX volume to get a market share.
1inch: from classic routing to resolvers
The 1inch project now offers two different things under one brand. Through its aggregator route, your own transaction goes on-chain, you pay the gas and the Pathfinder picks the path. Through Fusion, you sign an order and resolvers compete to fill it, which we cover below. It also runs limit orders, filled by takers. Its business documentation listed 18 networks when we read it on 30 October 2026, Solana among them.
Velora, the former ParaSwap
Search for ParaSwap and you will land on Velora. The rename came in 2025 and the token followed: a 1:1 swap from PSP to VLR opened on 16 September 2025, with a migration window of at least a year, according to The Block. The team told the outlet that PSP “will still remain transferable and usable, but it will no longer be officially supported”. If you still hold PSP from an older airdrop or staking position, check whether the migration is still open: the window was a minimum, and that year has now passed. With 1.37 billion dollars over 30 days, Velora sits in the lower part of the table above.
Jupiter on Solana: a router of routers
Jupiter is the largest name on the table, with 12.89 billion dollars over 30 days, or about 20% of everything DefiLlama counts as aggregator volume. On Solana alone, Jupiter and DFlow together made up about 80% of a 26.17 billion dollar total.
The product has changed under its users. On 31 March 2026 Jupiter unified its Ultra and Metis APIs into Swap API V2. The old APIs still work, but the Ultra page now says it has been superseded. Older tutorials are out of date on this point. In the current design, each quote request sets four sources against one another: Metis, Jupiter’s on-chain router; JupiterZ, where market makers quote privately; DFlow; and OKX. Jupiter then lands the transaction for you, so the wallet user sees one button.
JupiterZ is the interesting part. It is a request-for-quote system, closer to asking a dealer for a price than to walking an order through pools. Market makers have the last look at the order, and Jupiter’s documentation claims they often beat on-chain routing by “5-20bps on major pairs”, with no method published. The same documentation describes gasless swaps: Jupiter can sponsor gas when the taker has little SOL, and a market maker can pay on its own quote.
KyberSwap, 0x, OKX and the wallets
The rest of the table shows how the business has moved. Many users never open an aggregator: they press swap in a wallet, and the wallet calls one or several aggregators behind the scenes. Binance Wallet and OKX Swap appear in DefiLlama’s list for that reason. KyberSwap and 0x remain large independent routing names. An aggregator of aggregators sits one level higher still, which adds a fee layer you can only see on the quote screen.
CoW Swap: batch auctions instead of a transaction
You sign what you want, not how to get it
A router builds a transaction and you send it. On CoW Swap you sign a message saying what you will give and the least you will accept, and professional parties decide how to execute it. That signed wish is an intent. Our lesson on cross-chain liquidity and intents covers the idea when the two sides sit on different chains; this section stays on a single chain.
Solvers, batches and one price per pair
CoW Protocol collects these orders off-chain and auctions them to solvers, third parties that compete to fill them. A solver can bid on one order or on a group, and the protocol throws out batched bids that would leave an order worse off than its available alternatives. It then selects the combination of bids that returns the most surplus to users. The batch auction did not start with this product. CoW Protocol was previously known as Gnosis Protocol v2, which launched in April 2021 with CowSwap as its first app, and CoW’s older documentation describes batch auctions on its predecessor, v1, used mostly for token sales.
When one pair appears several times in an auction, it settles at one uniform price for each direction. CoW’s documentation calls these Uniform Directed Clearing Prices. That is the core of its defence against ordering games: if everyone in the batch gets the same price, being placed first in the block is worth little.
Coincidence of wants is an opportunity, not the norm
The name CoW stands for coincidence of wants. If Alice sells ETH for USDC while Bob sells USDC for ETH in the same auction, a solver can match part of the two orders directly, with no pool involved, no pool fee and no price impact on that part. It is an elegant idea and easy to oversell. The documentation speaks only of an opportunity for a peer-to-peer swap, and solvers also fill orders through on-chain liquidity. We found no published share of volume matched this way, so do not assume your order will find a counterparty.
What the MEV protection covers, and what it does not
A sandwich needs to see your transaction in a public mempool and place trades either side of it. A signed order that is not a transaction in the mempool gives a bot nothing to surround, and the uniform price removes much of the gain from reordering. CoW’s documentation goes as far as saying that transaction order becomes irrelevant within the block.
Two limits remain. Solvers see your order, so your protection against them is the auction itself: a rival solver should outbid one that treats you badly. And the protection is against ordering games, not against a bad limit: a loose minimum received can still be filled at a poor price. These claims come from the project’s documentation. We did not find independent measurement of them.
A DAO with a legal reserve
CoW DAO governs the protocol, and its token holders vote on proposals on Snapshot. The fees are set out in the fee table further down. The DAO also keeps a Legal Defense Reserve, which it used after the April 2026 hijack.
UniswapX and 1inch Fusion: Dutch auctions with fillers
A price that falls until someone takes it
UniswapX, which Uniswap Labs began rolling out as an opt-in beta on Ethereum on 17 July 2023, runs auctions one order at a time, without a batch. You sign an off-chain order through Permit2. In Uniswap’s documentation, “the order starts at a maximum price and decays down to a minimum price over time”. The price starts good for you and worsens step by step until a filler decides that the order pays, takes it and settles it on-chain.
“Anyone can fill orders on UniswapX”, say the docs. Fillers pay the gas, so the swapper needs no native token for that and a failed attempt costs nothing, a real difference from a router transaction that reverts and still burns gas. In a design where the filler pays the gas and takes the inventory risk, that cost does not disappear: it is priced into the rate you get.
In practice many orders never reach the public auction. An exclusive request-for-quote filler can take the swap before the auction starts. Uniswap’s blog said on 17 October 2025 that, historically, “80% of the time” a UniswapX swap settled at a better price than quoted. The figure is the company’s own and comes without a method.
Fusion, the same idea from 1inch
1inch Fusion uses the same mechanic under different words. You are the maker, and resolvers are the takers. The rate starts high and falls until a resolver fills the order, the price drops below your tolerance, or the order expires. Resolvers pay gas, and an expired order can be resubmitted at no extra cost. The filler set is narrower than on UniswapX as 1inch describes it: a resolver is an approved address that stakes 1INCH, and the help centre mentions a maximum of 10 listed resolvers.
Fusion+ stretches the auction across chains: the winning resolver locks funds in escrows on both chains, tied together by a secret, with a safety deposit as an incentive to finish. 1inch says that “100% of the gas fees are covered by the resolvers”. The cross-chain lesson linked above explains why those escrows matter.
Routing versus intents, side by side
| Question | Router (1inch aggregator route, Velora) | Batch auction (CoW Swap) | Dutch auction (UniswapX, Fusion) |
|---|---|---|---|
| Who executes? | You, with a transaction | A winning solver | A filler or resolver |
| Who pays gas? | You | Taken in the sell token if the trade executes | The filler, priced into the rate |
| Failed trade | Reverts, gas may be lost | No fee, per CoW | Order expires, no cost |
| Who sees your order first? | The public mempool, unless you use private routing | Solvers | Fillers and resolvers |
| Main weak point | Price moves after the quote; sandwiches | Solver competition; off-chain order flow | Filler competition; a filler may not take the order |
How often an auction order stalls is hard to say from outside. Uniswap’s blog says “In most cases, swaps settle in a single block”, and we found no independent measure of fill times. Its filler documentation does name two limits: “Very small orders may not be economical to fill” because of gas, and extremely large ones can exceed what quoters hold. 1inch says that an order no resolver takes in time “will expire, and you will have to resubmit it”.
The next step is our own reasoning, not a measured result. In a fast market a filler has less reason to commit to a price that may already be stale, so an auction may give a better price, or no trade, where a router gives a yes or no within a block.
Who pays whom: fees and hidden costs
An aggregator is a business, and the figures below show how varied the model is. All were read on the official pages on 30 October 2026; most pages show no effective date, and fees can change.
| Service | Fee on the swap | Notes |
|---|---|---|
| MetaMask swaps | 0.875% | Plus network fee; gasless on some chains |
| Phantom | 0.85% on most swaps | Plus network fee; some Cash and perps flows exempt |
| Jupiter (Swap V2 order path) | 0 to 10 bps by pair; 50 bps on tokens under 24 hours old | 2 bps SOL-stablecoin; a gasless recoup may be added; integrator fees of 50 to 255 bps replace it |
| CoW Swap | 2 bps volume fee; 0.3 bps on correlated assets | Plus 50% of quote improvement, capped at 0.98% of volume |
| 1inch | No percentage stated | Gas, possible infrastructure fees, surplus: see below |
| UniswapX | Not stated in the docs we opened | Gas paid by the filler |
MetaMask lists its 0.875% beside the quote rate and the network fee. Set against Jupiter’s line in the table, the gap is plain: a wallet fee on a 10,000 dollar swap comes to 87.50 dollars at MetaMask’s rate, and 85 dollars at the rate of Phantom, against 10 dollars at Jupiter’s 10 bps. Those are different services on different chains, and the fee is one line among several, so compare the amount received.
Jupiter’s model is the most detailed. It charges nothing for pegged pairs such as stablecoin to stablecoin, or for buying its own tokens JUP, JLP and jupSOL with SOL or stablecoins. A wallet or app that integrates it can add its own fee, and “Jupiter takes 20% of your integrator fee”.
CoW takes its fee inside the order. Its documentation is direct: “Fees are not charged as separate transfers.” You simply receive a little less, or pay a little more. Its quote-improvement fee means that when a swap beats its quote, half the difference goes to the protocol, up to the 0.98% cap.
1inch publishes no percentage. Its help centre says fees depend on the interface: gas you pay directly on its Pro route, resolvers usually cover gas on Swap, with exceptions for Solana swaps, swaps from native tokens and some very small trades. Some swaps may also carry infrastructure fees, applied automatically and with no amount stated: the taker covers them on Swap and limit orders, you cover them on aggregator-routed swaps. Surplus, the extra when execution beats the quote, is kept by the API provider layer run by 1inch Business. So the absence of a fee line on your screen does not mean a free swap.
How to read a quote before you sign
- Start from the amount you will receive, after all fees, and compare that figure across two or three services at the same moment.
- Read the price impact line. If it is high, the pools are thin for your size, and a smaller or split order may do better.
- Read the fee line, and ask whether the wallet adds a percentage on top of the router underneath.
- Look at the minimum received. That is the true worst case, and it depends on the tolerance you set.
- Find the network fee, and who pays it: you, or a filler who will price it into your rate.
- Check the spender address and the amount of any approval before you sign it.
The risks an aggregator adds to a swap
Every extra layer between you and a pool is one more thing that can fail. Five dated cases cover the main failure types.
| Date | Target | What failed | Reported loss | Who lost |
|---|---|---|---|---|
| 9 April 2023 | Sushi RouteProcessor2 | Router contract flaw | About 3.3 million dollars | Wallets that had approved it |
| 16 July 2024 | LI.FI | New facet lacked validation | About 11.6 million dollars | 153 wallets with infinite approvals |
| March 2025 | 1inch Fusion v1 resolvers | Bug in old resolver contracts | About 5 million dollars | Resolvers, no end users |
| 14 April 2026 | CoW Swap (cow.fi) | Domain taken by social engineering | About 1.2 million USDC (estimate) | Users who signed on the clone |
| May 2026 | TrustedVolumes | Attacker registered as allowed signer | About 6.7 million dollars | A market maker |
Approvals to a router
To swap a token through a router, you first allow a contract to spend it. A flaw in that contract then reaches every wallet that left a large approval open, even wallets that have stopped using the service. Sushi’s RouteProcessor2 was the clean case. Sushi’s post-mortem dates its soft launch to 8 April 2023, on 14 networks, and the contract could be neither upgraded nor paused. On 9 April an attacker used it to pull tokens from wallets that had approved it. CoinDesk put the loss at about 3.3 million dollars, apparently from one trader, and Sushi counts about 1,800 WETH drained from a single wallet.
LI.FI repeated the pattern on 16 July 2024 at a larger scale. A newly deployed facet allowed unvalidated calls, and the company puts the loss at about 11.6 million dollars across 153 wallets on Ethereum and Arbitrum. Its report says the flaw “did not affect finite approvals”, which is the default in its own tools. So the defence is plain: approve the exact amount, and revoke what you no longer use, as our guide to safe DEX use explains step by step.
The website: CoW Swap, April 2026
This case is the opposite of the two above: no contract failed. Two accounts of the entry point are on record, and they stop at different places. CIP-86, the DAO’s grants proposal, says the registrar Gandi, used through Amazon Route 53, “was exploited” in a social engineering attack. CoW’s post-mortem of 16 April starts earlier, and Domain Name Wire reports it the same way: the attacker impersonated a senior contributor and sent falsified documents to Traficom, the Finnish regulator that runs the .fi registry, which led to a dispute against the registrar. According to Traficom, as CoW relates it, Gandi did not answer by the 7 April deadline.
Registry logs cited in the post-mortem show the holder’s contact email changed to the attacker’s address at 12:16 UTC on 14 April, and a transfer key created at 12:43 UTC. CoW said it had not established how those changes were made, and that it was waiting for post-mortems from AWS and Gandi. We found no public account from Gandi or Traficom, so that chain of events is CoW’s version.
The address bar showed the right address, and the post-mortem says the attacker obtained a Let’s Encrypt certificate, which is why the usual advice to check the URL did nothing. The DAO told users not to use the site, then to revoke any approval made on CoW Swap after 14:54 UTC, using a tool such as revoke.cash. It says its backend and APIs stayed secure, and it paused them as a precaution. At about 17:49 UTC the clone began showing fake wallet unlock windows that asked for seed phrases. The domain was recovered about 26 hours after detection, with a registry lock that the post-mortem says Route 53 had not made available before.
CoW DAO then passed CIP-86, announced on 8 May 2026: voluntary grants of up to 100% of verified USDC losses, drawn from its Legal Defense Reserve, for wallets with a prior CoW Swap history whose owners passed KYC. People who gave away a seed phrase were excluded. Claims closed on 14 May. The sources then disagree. The DAO’s May recap says “all grants paid by May 31”, while its May treasury report says the execution of CIP-86 did not happen in May. Neither gives a total paid.
Resolvers and fillers are companies too
Intent systems move risk away from you and on to market makers, and those firms get hacked. In March 2025, 1inch disclosed a bug in old Fusion v1 resolver contracts. About 5 million dollars left resolvers, including TrustedVolumes, according to Rekt News, and most of it came back, with the attacker keeping about 450,000 dollars. In 1inch’s words, reported by Rekt News, “No end-user funds were at risk”.
TrustedVolumes was hit again, as reported on 7 May 2026, for about 6.7 million dollars by its own count (Blockaid first estimated about 5.87 million). CertiK said the attacker registered as an allowed order signer through a public function. Blockaid said the vulnerability was a different one, with the same operator reportedly behind both. 1inch replied that “neither 1inch nor any of the 1inch protocols are involved”. The practical lesson for a swapper is indirect: no end-user loss was reported in either case, but fewer solvent professionals would mean thinner competition, and your price depends on that competition. That link is our reasoning, not a measured effect.
Fake aggregators
Look-alike sites of well-known aggregators can reach you through search ads and links in social posts. Reach them from a bookmark you saved yourself, read what your wallet asks you to sign, and treat any request for your seed phrase as theft. A signature for a token permit can be as dangerous as a transaction, even though it costs no gas. As the CoW case shows, a bookmark is not a full defence, so keep large balances in a wallet that has no open approvals.
Matching the tool to the trade
No service wins every trade, and the volume table is no ranking of quality. These are the questions we would ask before each swap, not a recommendation.
| Your situation | What tends to matter | Worth checking |
|---|---|---|
| Small swap on a layer 2 or Solana | The fee line, more than routing | Whether the wallet adds a percentage |
| Large swap on Ethereum | Price impact and sandwich exposure | An auction quote against a router quote |
| New or thin token | Whether liquidity exists at all; token safety | The 50 bps new-token fee on Jupiter; contract checks |
| Stablecoin to stablecoin | Pool depth and the small fee | Zero or near-zero fee tiers |
| No native gas token | Who sponsors gas | Gasless conditions on each service |
Nothing here says which token to buy, or whether to trade at all. The cost of the swap is only one of your costs, and tax may be a larger one.
Tax: a routed swap is still a swap
Routing changes nothing for the tax return. In the United States, the IRS lists exchanging a digital asset for another digital asset among the events that require a yes on the digital asset question, and our guide to US crypto taxes shows how the gain is worked out. Final broker rules put reporting on Form 1099-DA for transactions from 1 January 2025, but the IRS says they exclude brokers known as decentralized or non-custodial. So expect no form from a router, and keep your own records of each swap.
In the United Kingdom, HMRC’s Cryptoassets Manual counts “exchanging tokens for a different type of token” as a disposal for capital gains. Our guide to UK crypto taxes covers the rest. A split route may show many legs on a block explorer, so keep the amount given, the amount received and the time in dollars or pounds. Neither page addresses routed legs or wrapped tokens: that is a question for a tax adviser.
The aggregator takes a pool as given. The next lesson of the path turns to the people on the other side of your swap, the liquidity providers whose deposits make every one of these routes possible.
