Bitcoin DEX on Nexus Hacked, Loses 8.5 BTC: Legacy Signature Vulnerability Exploited, V1 Platform Emergency Shutdown
Author: TechFlow
TechFlow Summary: Bitcoin native liquidity protocol On Nexus (formerly DotSwap) has suddenly encountered a security black swan event. The official team released a security advisory on October 27, confirming that its early deployed DotSwap V1 trading platform was attacked due to a legacy server-side signature verification vulnerability. The hackers drained approximately 8.5 BTC (valued at around $685,000) from the liquidity pool within about 4 hours.
Due to V1's historically adopted custodial multi-signature architecture, all LP assets deposited into the liquidity pool were fully compromised, while ordinary users' self-custodial wallets remained unharmed.
This precise strike against "legacy code debt" not only forced the official team to urgently permanently take V1 offline and collaborate with on-chain security firms like SlowMist to track down the perpetrators, but also sounded another alarm for the rapidly iterating Bitcoin DeFi ecosystem.
4-Hour Heist of 8.5 BTC: Legacy Server-Side Signature Becomes Fatal Flaw
As Bitcoin-native decentralized finance (BTC DeFi) gradually moves into deeper waters, the security minefields hidden in early historical code have surfaced once again. On October 27, the Bitcoin-native decentralized liquidity layer On Nexus (formerly DotSwap) published an urgent security incident report via social media, confirming that its early-deployed trading platform, DotSwap V1, was precisely targeted by hackers.
On-chain monitoring and official investigations reveal that attackers sharply identified a "legacy server-side signature mechanism" in the DotSwap V1 architecture that had long been abandoned but remained operational. Within a short time window of approximately 4 hours, attackers crafted illegal signature data, bypassing the system's standard risk control measures, and stealthily continuously drained liquidity from the V1 liquidity pool and related system accounts, cumulatively transferring out about 8.5 BTC, valued at approximately $685,000 at the market price at that time.
Different from modern complex smart contract flash loans or cross-chain bridge replay attacks, this attack on DotSwap V1 is essentially a textbook case of "harvesting technical debt." The hackers did not directly assault the Bitcoin underlying network or modern Schnorr signature algorithms, but precisely locked onto the centralized server-side auxiliary signature interfaces built early on to balance processing efficiency, exposing severe legacy vulnerabilities where the protocol failed to completely dismantle old infrastructure during architectural version iterations.
Custodial Multi-Sig vs. Self-Custody: Clarifying Scope of Compromised Assets and Pool Exposure
After the attack, the nature of affected assets and the security of ordinary users' wallets became the market's most anxious focus. In response, the On Nexus team provided a clear definition of the loss scope in their announcement: the core root cause of the theft lies in DotSwap V1's early fund management architecture, which used a "Custodial Multi-sig Mechanism" for its liquidity pools.
This custodial multi-sig design means that when liquidity providers (LPs) initially injected liquidity into the V1 trading pool, the funds were actually consolidated into a platform-controlled multi-sig vault. Therefore, during this attack, any unretracted deposits still remaining in the V1 pool were completely compromised, with the impacted group entirely consisting of LP users who provided liquidity long-term but failed to migrate in time.
For the vast majority of ordinary trading users, the team offered reassuring guarantees. Since frontend interactions and daily swaps use Bitcoin-standard non-custodial native transaction systems, users' "Self-custodial Wallets" private keys were never exposed to the platform server side. Bitcoin and Ordinals/Runes assets in personal wallets were completely unaffected by this attack, preventing panic from spreading to a broader user base.
Emergency Shutdown and Coordinated Containment: Exchange Joint Interception and Follow-up Response Plans
Upon confirming abnormal fund outflows, the On Nexus emergency response team decisively took loss mitigation measures. The DotSwap V1 platform has now been completely taken offline, and all network interfaces for the legacy signature service have been severed to prevent potential residual vulnerabilities from being exploited again. Meanwhile, the Nexus modernized trading channels targeting the next-generation architecture remain unaffected, with the overall system under strict monitoring.
The containment and recovery efforts targeting the hackers' money laundering pathways are unfolding comprehensively across multiple dimensions. The team stated that they have collaborated with professional on-chain security analysis firms such as SlowMist to conduct real-time color-tagging tracking of the hackers' Bitcoin transfer UTXOs, and deployed alert probes on mempool.space and major on-chain monitoring networks. The team is closely coordinating with mainstream centralised exchanges (CEXs) across the network, pushing lists of hacker-associated addresses to all platforms in real-time to fully block the hackers' possible recharge and cash-out channels.
Regarding the vital interests of compromised LP users, On Nexus emphasized that the team will absolutely not shirk responsibility. Internal audit work is currently progressing intensively; once a complete code reverse-engineering review and full visualization of fund flows are completed, the official team will promptly publish a detailed "Security Incident Post-Mortem Report" to the community, and simultaneously roll out special asset disposal and compensation plans for affected liquidity providers to rebuild community trust with utmost sincerity.
Reflections on "Technical Debt" in the BTC Ecosystem: Why Do Legacy Code Versions Keep Blowing Up?
The fall of DotSwap V1 once again puts the fast-maturing Bitcoin ecosystem on trial for security. Since the inscription craze ignited the BTC ecosystem in 2023, numerous teams rushed to launch V1 products featuring centralized compromises before early infrastructure was fully mature, merely to seize fleeting narrative trends. During subsequent brand upgrades and architectural iterations, many teams were often busy chasing new narratives, neglecting the thorough archiving and decoupling of obsolete, abandoned services.
In the blockchain world, any legacy contract or offline interface exposed on the public network is an eternal target for attackers. No matter how robust the new version's architecture is, as long as real funds remain pooled in old contracts and legacy APIs retain transfer signing permissions, the shortest plank in the bucket effect will forever reside at that most vulnerable historical node. This also explains why, over the past few years, whether established DEXs on Ethereum or newcomers in the Bitcoin ecosystem, projects frequently fall victim to the same rock of "compromised deprecated versions."
This $685,000 lesson has sounded a warning bell for the entire Bitcoin development community. For native projects undergoing rapid evolution, technological advancement is by no means a simple act of replacing the old with the new; it demands decisive severance and ruthless cleanup of "technical baggage." Establishing sunset policies for deprecated services early on, proactively guiding users to complete liquidity migration, and thoroughly destroying signing credentials when versions reach end-of-life are the fundamental bedrock to ensure decentralized finance can truly withstand the test of time.