Author: Shenchao TechFlow
DeepChain summary: The Bitcoin-native liquidity protocol On Nexus (formerly DotSwap) suffered a sudden security black swan event. On October 27, the official team issued a security advisory confirming that the early-deployed DotSwap V1 trading platform was compromised due to a lingering server-side signature validation vulnerability. Within approximately four hours, the attacker drained about 8.5 BTC (valued at ~$685,000) from the liquidity pools.
Due to the historical use of a custodial multisig architecture in the V1 liquidity pool, all LP assets deposited into the pool were compromised, but ordinary users' self-custody wallets remained unaffected.
This precise strike against the "historical code burden" not only forced the official team to urgently and permanently retire V1, but also prompted collaboration with on-chain security firms like SlowMist to track down the culprits, once again sounding an alarm for the rapidly evolving Bitcoin DeFi ecosystem.
4-hour heist steals 8.5 BTC: Legacy server-side signing becomes fatal vulnerability
As Bitcoin-native decentralized finance (BTC DeFi) continues to move into deeper waters, security vulnerabilities hidden in early historical code have reemerged. On October 27, the Bitcoin-native decentralized liquidity layer On Nexus (formerly DotSwap) issued an urgent security alert via social media, confirming that its early-deployed platform, DotSwap V1, had been precisely targeted by hackers.
On-chain monitoring and official investigations reveal that the attacker precisely exploited a legacy server-side signing mechanism in DotSwap V1—a system no longer maintained but still active. Within a narrow window of approximately four hours, the attacker crafted fraudulent signature data, bypassing the platform’s standard security controls, and quietly drained liquidity from the V1 liquidity pools and associated system accounts, transferring a total of approximately 8.5 BTC, valued at around $685,000 at the prevailing market price.
Unlike modern complex smart contract flash loan or cross-chain bridge replay attacks, this attack on DotSwap V1 was essentially a textbook case of "technical debt harvesting." The hacker did not directly assault the underlying Bitcoin network or modern Schnorr signature algorithms, but instead precisely targeted the centralized server-side auxiliary signing interface, which was originally implemented for processing efficiency, exposing a severe legacy vulnerability resulting from the protocol’s failure to fully decommission old infrastructure during architectural upgrades.
Custodial Multi-Sig vs. Self-Custody: Clarifying the Scope of Compromised Assets and Pool Exposure
After the attack, the nature of the affected assets and the security of ordinary users' wallets became the market's primary concerns. In response, the On Nexus team clearly defined the scope of asset losses in their announcement: the core cause of the theft was the early fund management architecture of DotSwap V1, which utilized a custodial multi-sig mechanism for its liquidity pools.
This custodial multisig design means that when liquidity providers (LPs) initially injected liquidity into the V1 pool, their funds were actually aggregated into a multisig vault controlled by the platform. As a result, during this attack, all unredeemed deposits still remaining in the V1 pool were compromised, and the affected group was entirely limited to LP users who had provided liquidity long-term but failed to migrate their funds in time.
For the broader base of retail traders, the team has provided clear reassurance. Since the frontend interactions and daily exchanges use Bitcoin’s standard non-custodial native transaction system, users’ private keys for their self-custodial wallets were never exposed to the platform’s servers. As a result, bitcoins and assets such as Ordinals and Runes in personal wallets were unaffected by this attack, preventing panic from spreading to a wider user base.
Emergency Shutdown and Coordinated Response: Exchanges Collaborate to Intercept and Implement Follow-up Measures
Upon confirming the anomalous fund outflow, the On Nexus incident response team immediately implemented containment measures, fully taking down and shutting down the DotSwap V1 platform and completely disabling the legacy signature service’s network interfaces to prevent any residual vulnerabilities from being exploited again. Meanwhile, the next-generation Nexus modernized trading channel remains unaffected, and the entire system is under strict monitoring.
Efforts to block and trace the hacker’s money laundering pathways are being comprehensively expanded across multiple dimensions. The team has partnered with professional on-chain security analysis firms such as SlowMist to implement real-time color tracing of the hacker’s Bitcoin UTXOs, and has deployed alert probes on mempool.space and major on-chain monitoring networks. The team is closely coordinating with leading centralized exchanges (CEXs) worldwide to immediately share lists of addresses associated with the hacker, fully blocking potential deposit and cash-out channels.
In safeguarding the legitimate rights of affected LP users, On Nexus emphasizes that the team will not shirk responsibility. The internal audit is currently underway, and once the complete code reverse analysis and full reconstruction of fund flows are finalized, the official team will promptly release a detailed Post-Mortem Report to the community, alongside a dedicated asset resolution and compensation plan for affected liquidity providers, demonstrating the utmost sincerity in rebuilding community trust.
Reflections on the "technical debt" of the BTC ecosystem: Why do legacy codes from older versions keep causing failures?
The compromise of DotSwap V1 has once again placed the rapidly evolving Bitcoin ecosystem on trial for security. Since the 2023 inscription wave ignited the BTC ecosystem, numerous teams have rushed to launch V1 products with centralized compromises, eager to seize fleeting narrative trends before foundational infrastructure was mature. In subsequent brand upgrades and architectural iterations, many teams have focused so intensely on chasing new narratives that they neglected to properly archive and decouple outdated, abandoned services.
In the world of blockchain, any legacy contract or offline interface exposed to the public internet remains a permanent target for attackers. No matter how robust the new architecture may be, as long as real funds still reside in old contracts and legacy APIs retain signing authority for transfers, the短板 of the barrel effect will always linger at the most vulnerable historical point. This also explains why, over the past several years, whether it’s established DEXs on Ethereum or newcomers in the Bitcoin ecosystem, projects frequently fall victim to the same stone: “stolen abandoned versions.”
This $685,000 lesson serves as a wake-up call to the entire Bitcoin development community. For native projects evolving at high speed, technological advancement is not merely about introducing new features—it also demands decisive and ruthless removal of technical debt. Establishing sunset policies for deprecated services early, proactively guiding users through liquidity migration, and permanently destroying signature credentials at version deprecation are the foundational pillars that ensure decentralized finance truly stands the test of time.