YggTorrent Shuts Down After Massive Hack: Official Statement Contradicts “YGGLeak” Claims

For nearly a decade, YggTorrent dominated the French-speaking torrent ecosystem. With an estimated 6.6 million registered accounts, the private tracker survived ISP blocks, domain seizures, and legal scrutiny. Many assumed that if the platform ever disappeared, it would be due to government enforcement.

Instead, its downfall came from a dramatic internal breach.

After a hacker known as Gr0lum published what he called the “YGGLeak” dossier—claiming full infrastructure compromise and data exfiltration—YggTorrent suddenly displayed a “permanent closure” message on its homepage. Hours later, the site’s administration released an official statement offering a very different version of events.

Here’s a full breakdown of what happened, the contradictions between both narratives, and what former members should do now.

The YGGLeak: What the Hacker Claims

Gr0lum alleges he infiltrated YggTorrent’s infrastructure, exfiltrated approximately 19GB of internal data, and destroyed multiple servers before going public.

According to the leaked documents:

• Four servers were compromised, including:
  • The production tracker server
  • The primary database containing 6.6 million user accounts
• Download histories and transaction records were extracted
• 54,776 credit card numbers allegedly passed through the servers in plain text
• Crypto-wallet detection scripts operated in users’ browsers
• A 259MB CSV file tracked browsing habits of 540,000+ members over a year

The hacker also claimed that a portion of user passwords were still hashed using MD5, an outdated algorithm widely considered insecure.

These allegations painted a picture of systemic security failures, controversial monetization practices, and questionable financial operations involving services like Tornado Cash and privacy cryptocurrency Monero.

But the official response tells a different story.

YggTorrent’s Official Statement: A More Limited Breach

Hours after the YGGLeak publication, yggtorrent.org displayed a short “permanent closure” message. Shortly thereafter, the administrators issued a more detailed communiqué explaining their version of events.

According to the YggTorrent team:

• The attack occurred on March 3, 2026 (evening)
• A “malicious group” compromised a secondary pre-production server, not the main system
• The breached server was distinct from core infrastructure
• Privilege escalation followed, leading to database deletion and exfiltration
• Cryptocurrency wallets used for server funding were stolen
  • Estimated losses: several tens of thousands of euros

The admins insist that user passwords were “hashed and salted,” meaning they were not stored in plain text.

This version suggests a contained incident originating from a non-production environment—far less catastrophic than the hacker’s claims.

Pre-Production Server Compromised—Or Full Infrastructure Breach?

The central disagreement lies in scope.

Gr0lum claims he compromised four servers, including production systems and the primary database storing millions of accounts and transaction logs.

The administration insists the breach originated from a secondary pre-production server and escalated from there.

The discrepancy raises key questions:

• Was the production tracker directly accessed?
• Were full user databases exfiltrated?
• How much data was truly exposed?

Without independent forensic verification, the full extent remains uncertain.

Password Security: Salted Hashes vs. MD5 Allegations

Another major contradiction concerns password storage.

The official statement asserts that passwords were properly hashed and salted.

However, materials included in the leaked source code suggest that a portion of accounts may still have relied on MD5 hashing—an algorithm considered obsolete for years and crackable within seconds using modern tools.

If even part of the user base was protected by MD5 alone, account security would be significantly weakened, especially for users who reused passwords across services.

What the Official Statement Does Not Address

Notably, the administrators’ communiqué avoids mentioning several allegations raised in the leaked documents:

• The alleged interception of 54,776 credit card numbers
• The browser script that reportedly detected crypto wallets (MetaMask, Phantom, Trust Wallet)
• The 259MB file tracking browsing behavior of over 540,000 members
• Claims of DDoS attacks targeting competing trackers such as LaCale or Sharewood

The absence of these points does not confirm their validity—but it leaves major questions unanswered.

Financial Operations and Payment Processors

Previous disclosures suggested that payments were routed through shell e-commerce storefronts to avoid detection by processors like PayPal and Stripe.

YggTorrent’s official statement does not address these allegations directly.

However, it does confirm that cryptocurrency wallets used to finance infrastructure were compromised during the breach.

A Closure That Appears Final

In its message, the YggTorrent team stated that backups exist and that rebuilding the platform would technically be possible.

Despite this, administrators decided not to relaunch the site.

According to the statement, continuing operations in an environment of ongoing attacks and escalating tensions no longer made sense.

After nearly nine years online, the closure appears definitive.

What Former YggTorrent Members Should Do Now

Whether the breach was limited or extensive, former members should take immediate precautions:

1. Change Your Passwords

Especially if:

• You reused your YggTorrent password on other services
• Your password was weak or old

2. Enable Two-Factor Authentication (2FA)

Activate 2FA on email accounts and important platforms wherever available.

3. Monitor Bank Statements

If you paid by credit card on the site:

• Consider requesting a new card number as a preventive measure
• Review statements for unauthorized transactions
• Set up fraud alerts if available

4. Watch for Phishing Attempts

Be cautious of:

• Emails claiming to be an official “YggTorrent relaunch”
• Fake clone sites
• Suspicious password reset requests

5. Avoid “Resurrection” Sites

The admins explicitly warn users not to trust any site claiming to be a continuation or official revival of YggTorrent.

The Bigger Picture: Lessons From the YggTorrent Collapse

YggTorrent survived DNS blocking, ISP restrictions, and years of legal pressure—including infrastructure filtering involving companies like Cloudflare and Google.

Yet it ultimately fell not because of external enforcement—but because of internal vulnerabilities and a devastating breach.

Whether the hacker’s full claims are accurate or the official statement reflects the complete truth, the outcome is the same:

• The site is offline.
• Millions of users face uncertainty.
• Trust in the platform has collapsed.

The YggTorrent shutdown underscores a broader reality in the torrent ecosystem: operational security failures can end even the most resilient platforms overnight.

For former members, the priority now is digital hygiene—strong passwords, financial vigilance, and skepticism toward any site claiming to revive the brand.

YggTorrent may live on in archived torrents elsewhere—but the original tracker is officially history.