YggTorrent Shuts Down After Massive Hack: 6.6 Million Accounts Impacted in Dramatic Collapse

For nearly a decade, YggTorrent stood as the largest French-language torrent tracker on the web. With an estimated 6.6 million registered accounts, the platform had survived ISP blocks, DNS seizures, domain changes, and mounting legal pressure. Many assumed that if it ever went offline, it would be due to regulatory action or a court order.

Instead, the site’s downfall came from within.

In early 2026, YggTorrent suddenly displayed a “permanent closure” message. The cause wasn’t a government agency or a lawsuit—it was a hacker operating under the alias Gr0lum, who claims to have infiltrated the site’s entire infrastructure, exfiltrated 19GB of internal data, and destroyed its servers before publishing significant portions of the stolen information.

Here’s what happened—and what it means for torrent users worldwide.

What Is YggTorrent?

YggTorrent was the largest Francophone BitTorrent tracker, offering movies, TV shows, software, music, eBooks, and more. Like many private torrent trackers, it relied on a ratio-based system, encouraging users to upload as much as they downloaded.

Over eight years, the platform became a central hub for French-speaking file-sharing communities. Despite repeated attempts to block it—including DNS restrictions involving companies like Google and Cloudflare—YggTorrent remained accessible through domain shifts and technical workarounds.

Until now.

The “Turbo Mode” Controversy That Sparked the Backlash

The beginning of the end reportedly started in December 2025 with the launch of a paid feature called Turbo Mode.

Under this new system:

• Free users were limited to five downloads per day
• A mandatory 30-second delay was added between downloads
• Removing restrictions required:
  • €14.99 per month
  • €85.99 for lifetime access

The torrent community reacted immediately. Prominent uploader groups publicly criticized what they viewed as aggressive monetization of a piracy platform.

Two of the most active teams—Team QTZ (3,300+ torrents) and Forward (35,000+ uploads)—published open letters condemning the move.

The site administration responded by banning critics and disabling the shoutbox (the site’s chat feature), further escalating tensions within the community.

Ironically, Turbo Mode may have boosted short-term revenue—but it also triggered scrutiny that exposed much deeper issues.

Millions in Revenue—and Alleged Payment Laundering

According to documents released by Gr0lum, YggTorrent generated between €5 million and €8.5 million in revenue between 2024 and 2025. January 2026 alone reportedly brought in nearly €490,000, with income surging after Turbo Mode’s launch.

To process payments discreetly, administrators allegedly used fake e-commerce storefronts. Transactions were routed through shell online shops so payment processors like PayPal and Stripe would interpret the payments as regular product purchases instead of torrent subscriptions.

After collection, funds were reportedly converted to cryptocurrency and funneled through Tornado Cash, a blockchain mixer designed to obscure transaction origins. The assets were then converted into Monero, known for its privacy-focused architecture and enhanced anonymity.

If accurate, this indicates a highly structured financial system built to avoid traceability.

54,776 Credit Card Numbers Allegedly Intercepted

One of the most serious allegations involves a file named Security.php found in the site’s source code.

According to the hacker:

• Full credit card numbers
• CVV security codes
• Expiration dates

were intercepted before being transmitted to payment processors.

In total, 54,776 credit cards reportedly passed through YggTorrent’s servers in plain text.

While Gr0lum stated there’s no definitive proof the data was used fraudulently, multiple Reddit users have reported suspicious charges. One user claimed nearly €4,000 in unauthorized audio equipment purchases following a PayPal transaction on the site.

If confirmed, this would represent not just piracy—but large-scale financial risk for users.

Hidden Browser Script Targeting Crypto Wallets

The breach revealed another troubling component: a script disguised as ImageCarouselManager.

This code allegedly ran in visitors’ browsers and scanned for installed cryptocurrency wallets such as:

• MetaMask
• Phantom
• Trust Wallet

When detected, the script reportedly notified YggTorrent’s servers without user knowledge.

Additionally, a 259MB CSV file was discovered containing detailed browsing activity from over 540,000 users collected across a one-year period.

The findings suggest user monitoring extended far beyond torrent ratio tracking.

A Hack Made Possible by Basic Security Failures

Perhaps most shocking is how the hack occurred.

Gr0lum claims the attack did not rely on advanced zero-day exploits. Instead, the breach was made possible by a chain of elementary configuration errors.

The pre-production server was reportedly identified through a favicon hash indexed publicly on Shodan, a search engine that catalogs internet-connected devices.

From there, the hacker discovered:

• Publicly accessible SphinxQL without authentication
• A forgotten Windows file containing admin credentials in plain text
• Disabled Windows Firewall
• Disabled Windows Defender
• Plaintext server credentials stored in FileZilla

Within days, all four primary servers were compromised, databases extracted, and infrastructure destroyed.

After surviving ISP blocks and legal threats for years, YggTorrent ultimately collapsed due to preventable technical mismanagement.

What Happened to the Torrent Library?

Before wiping the infrastructure, Gr0lum claims to have preserved the full torrent catalog with help from the U2P (Utopeer) project team.

The archive is now reportedly accessible at ygg.gratis without account registration or download limits.

Users who were already seeding torrents allegedly do not need to reconfigure their clients, as tracker migration was handled automatically.

Were User Data and Passwords Protected?

According to the hacker:

• IP addresses, emails, and passwords were removed prior to publication
• Roughly 50% of passwords were still hashed using MD5, an obsolete and insecure algorithm

While an 11GB archive containing source code and internal documentation has been released, personally identifiable data was supposedly excluded.

However, given the credit card revelations, affected users should consider:

• Monitoring bank statements
• Canceling cards used on the platform
• Enabling fraud alerts
• Changing reused passwords immediately

Who Was Behind YggTorrent?

Leaked documents reportedly identify two individuals connected to the administration:

• Francisco (based in Morocco)
• Vladimir (based in France)

These claims have not been independently verified, but the disclosures add a new layer to the story.

The Fall of an Iconic Torrent Tracker

YggTorrent survived nearly eight years of legal pressure, domain seizures, and DNS blocks. Ironically, it wasn’t law enforcement that brought it down—it was internal decisions, controversial monetization, weak cybersecurity practices, and a single determined hacker.

The YggTorrent shutdown serves as a cautionary tale for torrent users and site operators alike. In the digital underground economy, operational security is everything. One overlooked configuration file, one exposed credential, or one poorly secured payment system can bring down an empire overnight.

While the torrent catalog may live on elsewhere, the original YggTorrent era has officially come to an end.

Here is the full interview with Gr0lum; it’s interesting