The old version was never taken offline, which was like leaving the door unlocked. On Nexus just lost 8.5 BTC this time.
On October 25, DotSwap V1, the legacy platform of On Nexus, a Bitcoin-native liquidity protocol, was compromised. The team published a security announcement on October 27. The attacker exploited a server-side signing mechanism that had been left in place on V1, and withdrew about 8.5 BTC from V1 liquidity pools and related accounts over roughly four hours—worth about $685,000 at the time. PANews, KuCoin Flash News, and Odaily all reported consistent figures for the amount and duration.
V1 was an older trading platform launched in 2024. The project had since moved to a new architecture, Nexus, and V1 was already slated for retirement. The problem was that retirement was only a plan: the service was still running, and its signing permissions were still active. The attacker crafted invalid signature data to bypass the platform’s usual risk controls and withdraw funds from the pools. According to official monitoring cited by Odaily, the attack used automated scripts to probe the interface and then withdraw funds gradually, affecting 99 Runes tokens. The team also said the method was consistent with a recent trend in automated attacks. That is the team’s assessment, and there is no independent evidence yet, so for now I’ll treat it as one party’s account.
The official statement was clear about who lost money and who didn’t. V1’s liquidity pools used custodial multisig, with funds first gathered in a multisig vault controlled by the platform. That means all deposits still in V1 pools were affected, and the liquidity providers who had not moved their funds in time took the loss. Regular traders’ self-custody wallets were unaffected because day-to-day trading used Bitcoin-native self-custodial transactions, and private keys were never stored on the platform’s servers. The same incident, two kinds of wallets, completely different outcomes. The dividing line was who held the funds.
After the incident, V1 was taken completely offline, and the network interface for the old signing service was dismantled. Trading channels on the new Nexus architecture were unaffected. The team said it was tracking the funds with SlowMist and sending hacker-linked addresses to major trading platforms. A full post-mortem and response plan are still in progress and had not been made public at the time of writing, so don’t say the response plan has already been finalized.
For retail investors, the lesson here is concrete. A project moving to a new version doesn’t mean the old version automatically becomes safe. As long as real money remains in old contracts and old interfaces still hold signing permissions, attackers don’t need to break into the new system—they can just find the oldest door. More troublingly, many people don’t even know they haven’t migrated their funds. By the time an announcement comes out and they check, the pool may already be empty.
My view is straightforward. The next time you hear a project say it has migrated, check two things first: whether there’s an official announcement that the old version has been taken offline, and whether you still have a balance in it. If there’s no announcement that the old version is offline, don’t leave your funds there. Even if you’ve already migrated, don’t just focus on how smoothly the new version is running. Until an announcement confirms the old version is offline, the matter isn’t settled.
Have you ever left funds behind in an old version of a project without migrating them? When did you last confirm it had been taken offline?
#BTC #比特币生态 #安全复盘 #DotSwap #DeFi Security
—— web3 Leek Kai
This content is compiled solely from publicly available information and does not constitute investment advice. The amounts mentioned are based on the official On Nexus announcement and public reporting by PANews, KuCoin Flash News, and Odaily. Any subsequent statements from the project should be verified through official channels.
On October 25, DotSwap V1, the legacy platform of On Nexus, a Bitcoin-native liquidity protocol, was compromised. The team published a security announcement on October 27. The attacker exploited a server-side signing mechanism that had been left in place on V1, and withdrew about 8.5 BTC from V1 liquidity pools and related accounts over roughly four hours—worth about $685,000 at the time. PANews, KuCoin Flash News, and Odaily all reported consistent figures for the amount and duration.
V1 was an older trading platform launched in 2024. The project had since moved to a new architecture, Nexus, and V1 was already slated for retirement. The problem was that retirement was only a plan: the service was still running, and its signing permissions were still active. The attacker crafted invalid signature data to bypass the platform’s usual risk controls and withdraw funds from the pools. According to official monitoring cited by Odaily, the attack used automated scripts to probe the interface and then withdraw funds gradually, affecting 99 Runes tokens. The team also said the method was consistent with a recent trend in automated attacks. That is the team’s assessment, and there is no independent evidence yet, so for now I’ll treat it as one party’s account.
The official statement was clear about who lost money and who didn’t. V1’s liquidity pools used custodial multisig, with funds first gathered in a multisig vault controlled by the platform. That means all deposits still in V1 pools were affected, and the liquidity providers who had not moved their funds in time took the loss. Regular traders’ self-custody wallets were unaffected because day-to-day trading used Bitcoin-native self-custodial transactions, and private keys were never stored on the platform’s servers. The same incident, two kinds of wallets, completely different outcomes. The dividing line was who held the funds.
After the incident, V1 was taken completely offline, and the network interface for the old signing service was dismantled. Trading channels on the new Nexus architecture were unaffected. The team said it was tracking the funds with SlowMist and sending hacker-linked addresses to major trading platforms. A full post-mortem and response plan are still in progress and had not been made public at the time of writing, so don’t say the response plan has already been finalized.
For retail investors, the lesson here is concrete. A project moving to a new version doesn’t mean the old version automatically becomes safe. As long as real money remains in old contracts and old interfaces still hold signing permissions, attackers don’t need to break into the new system—they can just find the oldest door. More troublingly, many people don’t even know they haven’t migrated their funds. By the time an announcement comes out and they check, the pool may already be empty.
My view is straightforward. The next time you hear a project say it has migrated, check two things first: whether there’s an official announcement that the old version has been taken offline, and whether you still have a balance in it. If there’s no announcement that the old version is offline, don’t leave your funds there. Even if you’ve already migrated, don’t just focus on how smoothly the new version is running. Until an announcement confirms the old version is offline, the matter isn’t settled.
Have you ever left funds behind in an old version of a project without migrating them? When did you last confirm it had been taken offline?
#BTC #比特币生态 #安全复盘 #DotSwap #DeFi Security
—— web3 Leek Kai
This content is compiled solely from publicly available information and does not constitute investment advice. The amounts mentioned are based on the official On Nexus announcement and public reporting by PANews, KuCoin Flash News, and Odaily. Any subsequent statements from the project should be verified through official channels.
