DotSwap V1 was attacked, approximately 8.5 tokens BTC were stolen; the platform has been taken offline
BIBIBI
AT A GLANCE
DotSwap said the legacy V1 was attacked, approximately 8.5 tokens BTC were stolen, and all V1 pool deposits were affected.
Article
DotSwap V1 was attacked, approximately 8.5 tokens BTC were stolen
PANews October 27 reported that Bitcoin-native asset trading protocol DotSwap (now transitioning to On Nexus) issued a security incident notice stating that October 25 its 2024 original swap platform launched in DotSwap V1 was attacked. The attacker exploited V1 a legacy server-side signing path and, in approximately 4 hours, stole approximately V1 from liquidity pools and V1 accounts, worth approximately 8.5 tokens BTC, valued at approximately 685000 USD。V1 The pool liquidity was held in a custodial multisig, so the losses were borne by liquidity providers who deposited V1 into the pools; all BTC deposits were affected; self-custodial wallets used by trading users were not affected.V1 V1 It had previously been scheduled for decommissioning after the full migration to Nexus and V1 is now offline. DotSwap said it is tracking the funds, cooperating with exchanges and analytics partners, and will publish a full post-mortem analysis.
PANews reported the security incident on October 27.
02
DotSwap issued a security incident notice stating that DotSwap V1 was attacked on October 25.
03
The attacker exploited V1 a legacy server-side signing path and, in approximately 4 hours, stole approximately 8.5 tokens BTC, valued at approximately 685000 USD。
04
The stolen funds came from V1 liquidity pools and V1 accounts.
05
V1 The pool liquidity was held in a custodial multisig, and the losses were borne by liquidity providers who deposited V1 into the BTC pool; all V1 deposits were affected.
06
Self-custodial wallets of trading users were not affected.
07
DotSwap V1 It is now offline.
08
DotSwap said it is tracking the funds and cooperating with exchanges and analytics partners, and will subsequently publish a full post-mortem analysis.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
This was a security incident involving the legacy DotSwap V1 The notice said that the attacker used a legacy server-side signing path to take V1 from the pools and accounts. The affected funds were those deposited into the BTC pool, while wallets self-custodied by trading users were reportedly not affected.V1
Why it matters to readers
Liquidity providers may directly bear losses of approximately 8.5 tokens BTC; the incident also shows that legacy systems and signing paths that have not yet been decommissioned may continue to pose funding risks.
If you previously deposited DotSwap V1 into the BTC pool, you should monitor fund tracking, the post-mortem analysis, and subsequent disposition notices; users who traded solely through self-custodial wallets were reportedly not affected, according to the notice.
Risks and unknowns
The attack path, loss scale, and scope of impact described above are based on the DotSwap notice; the full post-mortem analysis has not yet been published.
It remains unclear whether the stolen funds can be frozen or recovered.
It remains unclear whether compensation or restitution will be provided to affected V1 liquidity providers.
The specific allocation of all affected deposits has not been disclosed.
Related Developments
Loading event timeline…
Related concepts
server-side signing path
This term is not in the glossary yet. Browse related concepts in the glossary.
