dotswap

Another protocol-layer security incident: an older version of a contract for swapping Bitcoin-native assets has been targeted.

According to reports by PANews, good.box, and others, DotSwap V1, the original swap platform of the Bitcoin-native asset trading protocol DotSwap (now rebranded as On Nexus), was attacked on October 25, with losses of approximately 8.5 BTC (around $685,000). All V1 deposits were affected, while trading users’ self-custody wallets were not.

How to read this: Older contracts may still have funds at risk. More importantly, check whether funds can be recovered, what steps the team is taking and what migration guidance it provides, and where the line is between self-custody and protocol custody. The practical takeaway for ordinary users: don’t assume that a project’s rebrand automatically eliminates risks from its old contracts.

#DotSwap #比特币 #安全 #On-chain

【Market Flash】A loophole in the legacy signature mechanism: Bitcoin-native asset protocol DotSwap announced that on October 25, an attacker exploited the V1 server-side signing mechanism to steal approximately 8.5 BTC (about $685,000) in four hours, affecting 99 Rune assets.
All V1 deposits were affected, while self-custody wallets were safe. V1 has been taken offline. During the upgrade, which should be addressed first: the signing mechanism or permission isolation? Join the discussion in the comments.
$BTC $RUNE $ORDI
#比特币 #DotSwap #On-chainSecurity
(Source: Wu Says Blockchain)
⚠️Risk warning: The above is shared for market information only and does not constitute investment advice. Investing involves risk; proceed with caution.

Old platforms don’t die—they just slowly turn into hackers’ ATMs.

DotSwap, an on-chain Bitcoin trading platform, had its old V1 version taken down on October 25. Hackers exploited a legacy server-side signing vulnerability and drained around 8.5 $BTC —roughly $685,000—from liquidity pools and accounts in just four hours. V1 used custodial multisig to manage its pools, so LPs who had deposited coins were affected: all V1 deposits were at risk. Traders who managed their own wallets, however, were safe. Even wilder was the method: automated scripts probed the endpoints one by one and systematically withdrew funds from 99 Runes tokens. The project team itself said the activity looked like the work of AI agents. V1 is now offline, and the team is working to recover the funds and contacting exchanges and blockchain analytics firms. A full postmortem and compensation plan have yet to be announced.

The comments are split: A: Leaving old code in service is just planting a time bomb—it’s bound to blow up sooner or later. B: $685,000 is small potatoes; LPs should just take the loss. Which side are you on?

$ETH $SOL #DotSwap #比特币安全 #Hackers