DotSwap V1 Exploited, Roughly 8.5 BTC Stolen

October 27 — Bitcoin-native asset trading protocol DotSwap (now pivoted to On Nexus) issued a security incident notice stating that on October 25 its original swap platform DotSwap V1, launched in 2024, was attacked. The attacker exploited a legacy server-side signing path in V1 to steal roughly 8.5 BTC, worth about $685,000, from V1 liquidity pools and V1 accounts over approximately four hours. V1 held pool liquidity in a custodial multisig, so the loss is borne by the BTC liquidity providers deposited into V1 pools, and all V1 deposits are affected; trading users' self-custody wallets were unaffected. V1 had already been slated for retirement following a full migration to Nexus, and V1 is now offline. DotSwap said it is tracing the funds, working with exchanges and analytics partners, and will publish a full post-mortem.