DotSwap V1 Drained of 8.5 Bitcoin Worth About $685,000 in Legacy Signing Exploit

Published October 27, 2026, 1:45 PM PKT. Based on the On Nexus security incident notice issued October 27, 2026, as reported by PANews on October 27, 2026 (primary source), and a KuCoin/TechFlow report published October 27, 2026 (secondary source). This is MABOnChain's first article on DotSwap or On Nexus.

DotSwap V1, the original swap platform of Bitcoin-native trading protocol DotSwap, now operating as On Nexus, was drained of roughly 8.5 bitcoin worth about $685,000 on October 25, 2026, after an attacker exploited a legacy server-side signing path in the platform, the team said in a security incident notice issued October 27, 2026. PANews, reporting the notice on October 27, 2026, put the theft at about 8.5 BTC taken from V1 liquidity pools and V1 accounts over approximately four hours. KuCoin, carrying a TechFlow report the same day, gave the same figures and the same four-hour window. The loss is small beside the billion-dollar bridge hacks of past cycles, but the mechanism is the warning: the attacker did not break Bitcoin, and did not break the protocol's new system. The attacker used an old door the team had left open.

The four-hour drain through an old signing path

According to the notice, the attacker exploited a legacy server-side signing mechanism in DotSwap V1, an outdated system that was no longer maintained but still active. Within about four hours, the attacker crafted fraudulent signature data, bypassed the platform's standard security controls, and silently siphoned liquidity from the V1 pools and associated system accounts, KuCoin reported. The attack did not target Bitcoin's underlying network or modern Schnorr signature schemes, the report added. It targeted a centralized server-side auxiliary signing interface built early in the project's life for processing efficiency, a shortcut that survived into 2026 because V1 itself survived.

DotSwap V1 launched in 2024, PANews reported, and had already been slated for retirement after the project's full migration to Nexus, its successor platform. The retirement had not yet happened when the attacker struck on October 25, 2026, and the funds still sitting in V1 were still reachable through the old signing path. KuCoin's report called the incident a textbook case of technical debt harvesting: an attacker finding value not in the newest code, but in the oldest code still holding money. The disclosure date matters here. The attack happened on October 25, and the public notice followed on October 27, a two-day gap in which the team confirmed the outflow, scoped the damage and shut the platform down before telling users what had happened.

Who lost money, and who did not

The loss falls on one group only: liquidity providers who had deposited bitcoin into V1 pools and had not migrated to Nexus. V1 held pool liquidity in a custodial multisig, PANews reported, so the loss is borne by the bitcoin liquidity providers deposited into V1 pools, and all V1 deposits are affected. KuCoin's report put it the same way: because V1 pooled deposits into a multisig vault controlled by the platform, every unredeemed deposit still remaining in the V1 pool was compromised, and the affected group consists entirely of liquidity providers who had provided liquidity long-term but failed to migrate their funds in time.

Ordinary trading users were not affected, both reports stressed. Trading on the platform used Bitcoin's standard non-custodial transaction system, so users' private keys were never exposed to the platform's servers, and bitcoin, Ordinals and Runes held in personal self-custody wallets were untouched, KuCoin reported. That distinction is the most important fact for readers who used DotSwap to trade but never supplied V1 liquidity: the notice gives no reason to believe their wallets are at risk from this incident. It is also a narrow reassurance. It says nothing about recovering the providers' funds, and the team has so far promised a plan, not a payment.

V1 shut down for good, Nexus unaffected

On confirming the anomalous outflow, the incident response team took DotSwap V1 fully offline and disabled the legacy signature service's network interfaces, KuCoin reported, closing the exact path the attacker used. The retirement that had been planned is now permanent and immediate: V1 will not reopen. The modernized Nexus trading channel, built on the new architecture, remains unaffected, and the whole system is under strict monitoring, according to the same report. For users of the current Nexus platform, the team's message is continuity. For V1 liquidity providers, the message is finality: there is no V1 left to withdraw from, and any recovery now depends on tracing and on the compensation plan the team says is coming.

The incident also carries a lesson the wider Bitcoin DeFi ecosystem has now been taught repeatedly. Since the 2023 inscription wave, KuCoin's report noted, many teams rushed out V1 products with centralized compromises to catch a narrative, then moved on to new architectures without properly archiving and disconnecting the old services. Any legacy contract or signing interface that still holds funds and still answers on the public internet remains a target, no matter how strong the new system is. DotSwap's V1 is the latest example, and the $685,000 price tag is the cost of leaving a migration unfinished.

Tracing the funds, and what comes next

DotSwap said it is tracing the funds, working with exchanges and analytics partners, and will publish a full post-mortem, PANews reported. KuCoin's report added detail: the team has partnered with on-chain security firm SlowMist to track the attacker's bitcoin transaction outputs in real time, has deployed alert probes on mempool.space and major on-chain monitoring networks, and is coordinating with centralized exchanges worldwide to circulate the attacker's addresses and block deposit and cash-out channels. That is the standard playbook for a bitcoin theft, and it works only if the coins touch a compliant exchange. If they move through mixers or peer-to-peer channels, tracing can map the trail without recovering the money.

Two deliverables are now owed, and readers should judge the team on both. The first is the detailed post-mortem report, promised once the code review and full reconstruction of fund flows are complete. The second is a dedicated asset resolution and compensation plan for affected liquidity providers, which KuCoin reported the team will release alongside the post-mortem, with an internal audit already underway. Until those arrive, the verified facts are the ones in this article: 8.5 BTC, about $685,000, four hours, a legacy signing path, V1 providers affected, self-custody wallets untouched, V1 offline for good, and a tracing effort underway. Anything beyond that, including whether providers get any money back, is still unannounced.

This article is news reporting and is not investment advice.

Sources

• On Nexus Security Incident Notice (October 27, 2026), as reported by PANews, DotSwap V1 Exploited, Roughly 8.5 BTC Stolen (October 27, 2026), primary source
• KuCoin/TechFlow, Bitcoin DEX on Nexus Hit by $685K Hack via Legacy Signature Vulnerability (October 27, 2026), secondary source