About $685,000 in funds stolen, DotSwap V1 attacked

Odaily reports that according to On Nexus monitoring, on October 25, the legacy DotSwap trading platform DotSwap V1 was attacked. The attacker exploited a server-side signature mechanism left over from V1 and, within about 4 hours, stole about 8.5 BTC from V1 liquidity pools and accounts, involving approximately $685,000 in funds. V1 used custodial multisignature management for liquidity pools, and the losses involved BTC deposited by liquidity providers into V1 pools, with all V1 deposits affected; wallets self-custodied by trading users were not affected. The attack was launched through automated scripts, and the attacker probed all interfaces and gradually carried out fund theft against 99 Runes tokens. On Nexus believes that this incident is consistent with the recent trend of AI agent-driven attacks. Currently, DotSwap V1 has been taken offline. The team is tracing the stolen funds and collaborating with exchanges and on-chain analysis partners, and will later publish a full incident retrospective and user remediation plan. The team also stated that it is working to restore Nexus-related services.