dotswap

【Market Flash】A loophole in the legacy signature mechanism: Bitcoin-native asset protocol DotSwap announced that on October 25, an attacker exploited the V1 server-side signing mechanism to steal approximately 8.5 BTC (about $685,000) in four hours, affecting 99 Rune assets.
All V1 deposits were affected, while self-custody wallets were safe. V1 has been taken offline. During the upgrade, which should be addressed first: the signing mechanism or permission isolation? Join the discussion in the comments.
$BTC $RUNE $ORDI
#比特币 #DotSwap #On-chainSecurity
(Source: Wu Says Blockchain)
⚠️Risk warning: The above is shared for market information only and does not constitute investment advice. Investing involves risk; proceed with caution.

Old platforms don’t die—they just slowly turn into hackers’ ATMs.

DotSwap, an on-chain Bitcoin trading platform, had its old V1 version taken down on October 25. Hackers exploited a legacy server-side signing vulnerability and drained around 8.5 $BTC —roughly $685,000—from liquidity pools and accounts in just four hours. V1 used custodial multisig to manage its pools, so LPs who had deposited coins were affected: all V1 deposits were at risk. Traders who managed their own wallets, however, were safe. Even wilder was the method: automated scripts probed the endpoints one by one and systematically withdrew funds from 99 Runes tokens. The project team itself said the activity looked like the work of AI agents. V1 is now offline, and the team is working to recover the funds and contacting exchanges and blockchain analytics firms. A full postmortem and compensation plan have yet to be announced.

The comments are split: A: Leaving old code in service is just planting a time bomb—it’s bound to blow up sooner or later. B: $685,000 is small potatoes; LPs should just take the loss. Which side are you on?

$ETH $SOL #DotSwap #比特币安全 #Hackers