A NullMeridian record Andromeda Logs

NullMeridianLog

25 Oct 2026 (UTC, per On Nexus; exact times Unknown)

DotSwap V1: Legacy Server-Side Signing Path Drained ~8.5 BTC

DotSwap V1's legacy server-side signing path was used to drain ~8.5 BTC (~$685K) from custodial V1 pools over ~4 hours on 25 Oct, per On Nexus.

  • Event date
  • Incident typeCustodial pool drain (developing)
  • Bug classNot yet published
  • Published

Loss, as sourced

'roughly 8.5 BTC (~$685k)', per On Nexus. Not verified on-chain.

Traceability

Primary sources

  1. 01x.comOn Nexus thread, 27 Oct 2026 03:13 UTC (opens in a new tab)

In brief

Root cause: Not yet published. Per On Nexus, an attacker used V1's legacy server-side signing path; the exact flaw is not stated. A full post-mortem is promised.

Timeline, as sourced: 25 Oct 2026, over about four hours (per On Nexus; exact times Unknown). Thread posted 27 Oct 03:13 UTC. V1 offline.

Account, as sourced

Bitcoin, 25 Oct 2026. DotSwap V1, the 2024 swap platform of On Nexus (formerly DotSwap).

Per On Nexus (thread (opens in a new tab), 27 Oct 03:13 UTC): an attacker used V1's legacy server-side signing path to drain roughly 8.5 BTC (~$685K) from V1 liquidity pools and V1 accounts over about four hours. V1 held pool liquidity in a custodial multisig, so the loss hit BTC that LPs deposited; all V1 deposits are affected; users' self-custodial wallets were not (2/ (opens in a new tab)). The team describes thousands of scripted requests across 99 rune tickers (4/ (opens in a new tab)). V1 was already scheduled for sunset and is now offline (6/ (opens in a new tab)). The team says it holds a record of every V1 LP position and will publish an LP plan and a full post-mortem (3/ (opens in a new tab), 7/ (opens in a new tab)).

Unknown: the exact flaw in the signing path, attacker addresses, and whether funds were recovered. No independent on-chain analysis checked.

Pattern: a sunset platform that still signs with live keys is a live platform.

Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.

Permalinkhttps://andromeda.observer/e/dotswap-v1-legacy-server-signing-drain