Author: Shenchao TechFlow
DeepChaohao summary: The Bitcoin-native liquidity protocol On Nexus (formerly DotSwap) has suffered a security black swan event. On October 27, the official team issued a security advisory confirming that the early-deployed DotSwap V1 trading platform was compromised due to a lingering server-side signature validation vulnerability. Within approximately four hours, the attacker drained approximately 8.5 BTC (valued at ~$685,000) from the liquidity pools.
Due to the historical use of a custodial multisig architecture in the V1 liquidity pool, all LP assets deposited into the pool were compromised, but ordinary users' self-custody wallets remained unaffected.
This precise strike against the "historical code burden" not only forced the official team to urgently and permanently retire V1, while collaborating with on-chain security firms such as SlowMist to track down the perpetrators, but also served as another wake-up call for the rapidly evolving Bitcoin DeFi ecosystem.
4-hour heist steals 8.5 BTC: Legacy server-side signing becomes fatal vulnerability
As Bitcoin-native decentralized finance (BTC DeFi) continues to move into more complex territory, security vulnerabilities hidden in early historical code have reemerged. On October 27, the Bitcoin-native decentralized liquidity layer On Nexus (formerly DotSwap) issued an urgent Security Incident Notice via social media, confirming that its early-deployed trading platform, DotSwap V1, had been precisely targeted by hackers.
On-chain monitoring and official investigations reveal that the attacker precisely exploited a legacy server-side signing mechanism in DotSwap V1—an outdated system no longer maintained but still active. Within a narrow window of approximately four hours, the attacker crafted fraudulent signature data, bypassing the platform’s standard security controls, and silently siphoned liquidity from the V1 liquidity pools and associated system accounts, ultimately transferring approximately 8.5 BTC, valued at around $685,000 at the prevailing market price.
Unlike modern complex smart contract flash loan or cross-chain bridge replay attacks, this attack on DotSwap V1 was essentially a textbook case of "technical debt harvesting." The hacker did not directly assault the underlying Bitcoin network or modern Schnorr signature algorithms, but instead precisely targeted the centralized server-side auxiliary signing interface, built early on for processing efficiency, exposing a severe legacy vulnerability caused by the protocol’s failure to fully decommission old infrastructure during architectural upgrades.
Custodial Multi-Signature vs. Self-Custody: Clarifying the Scope of Compromised Assets and Pool Exposure
After the attack, the nature of the affected assets and the security of ordinary users' wallets became the market’s primary concerns. In response, the On Nexus team clearly defined the scope of asset losses in their announcement: the core cause of the theft was the early fund management architecture of DotSwap V1, which used a custodial multi-sig mechanism for its liquidity pools.
This custodial multisig design meant that when liquidity providers (LPs) initially injected liquidity into the V1 pool, their funds were actually aggregated into a multisig vault controlled by the platform. As a result, during this attack, all unredeemed deposits still remaining in the V1 pool were compromised, with the affected group entirely consisting of LP users who had provided liquidity long-term but failed to migrate their funds in time.
For the vast majority of ordinary trading users, the team has provided clear reassurance. Since the frontend interaction and daily exchanges use Bitcoin’s standard non-custodial native transaction system, users’ private keys for their self-custodial wallets have never been exposed to the platform’s servers. As a result, bitcoins and assets such as Ordinals and Runes in personal wallets were not affected by this attack, preventing panic from spreading to a broader user base.
Emergency Shutdown and Coordinated Response: Exchanges Collaborate to Intercept and Implement Follow-up Measures
Upon confirming the anomalous fund outflow, the On Nexus incident response team immediately implemented containment measures, fully taking down and shutting down the DotSwap V1 platform and completely disabling the legacy signature service’s network interfaces to prevent any residual vulnerabilities from being exploited again. Meanwhile, the Nexus modernized trading channel built on the new architecture remains unaffected, and the entire system is under strict monitoring.
Efforts to block and trace the hacker’s money laundering pathways are being comprehensively expanded across multiple dimensions. The team has partnered with professional on-chain security analysis firms such as SlowMist to implement real-time colorization and tracking of the hacker’s Bitcoin UTXOs, and has deployed alert probes on mempool.space and major on-chain monitoring networks. The team is closely coordinating with leading centralized exchanges (CEXs) worldwide to immediately distribute lists of addresses associated with the hacker, aiming to fully block potential deposit and cash-out channels.
In safeguarding the legitimate rights of affected LP users, On Nexus emphasizes that the team will not shirk responsibility. The internal audit is currently underway, and once the complete code reverse analysis and full reconstruction of fund flows are finalized, the official team will promptly release a detailed Post-Mortem Report to the community, alongside a dedicated asset resolution and compensation plan for affected liquidity providers, demonstrating the utmost sincerity in rebuilding community trust.
Reflections on the "technical debt" of the BTC ecosystem: Why do legacy codes from older versions keep failing?
The compromise of DotSwap V1 has once again placed the rapidly evolving Bitcoin ecosystem on trial for security. Since the 2023 inscription wave ignited the BTC ecosystem, numerous teams rushed to launch V1 products with centralized compromises, eager to seize fleeting narrative trends before foundational infrastructure was mature. In subsequent brand upgrades and architectural iterations, many teams have been preoccupied with chasing new narratives, neglecting to properly archive and decouple outdated, abandoned services.
In the world of blockchain, any legacy contract or offline interface exposed to the public internet remains a permanent target for attackers. No matter how robust the new architecture may be, as long as real funds still reside in old contracts and legacy APIs retain signing authority for transfers, the短板 of the barrel effect will always linger at the most vulnerable historical point. This also explains why, over the past several years, both established DEXs on Ethereum and newcomers in the Bitcoin ecosystem have repeatedly fallen victim to the same pitfall: “stolen abandoned versions.”
This $685,000 lesson serves as a wake-up call to the entire Bitcoin development community. For native projects evolving at high speed, technological advancement is not merely about introducing new features—it also demands decisive and ruthless elimination of technical debt. Establishing sunset policies for deprecated services early, proactively guiding users through liquidity migration, and permanently destroying signature credentials upon version deprecation are the foundational pillars that ensure decentralized finance truly stands the test of time.