The performance of quantum key distribution (QKD) is severely limited by multiphoton pulses emitted by laser sources due to the photon-number splitting attack. Coherent-one-way (COW) QKD has been introduced as a promising solution to overcome this limitation, and thus extend the achievable distance of practical QKD. Indeed, thanks to its experimental simplicity, the COW protocol is already used in commercial applications. Here, we derive simple upper security bounds on its secret key rate, which demonstrate that it scales at most quadratically with the system's transmittance, thus solving a long-standing problem. That is, in contrast to what has been claimed, this approach is inappropriate for long-distance QKD transmission. Remarkably, our findings imply that all implementations of the COW protocol performed so far are insecure.