Home > Piracy >
YggTorrent, the largest francophone torrent community, has shut down permanently following a devastating hack. The cyberattack compromised YggTorrent's infrastructure, wiped key information, and drained the site's crypto wallets. The hacker publicly published the site's data online in a massive 11+ GB archive, noting that this could be of interest to law enforcement.
In recent years, YggTorrent was France’s largest and most active torrent community, serving millions of users.
The torrent site was not a typical torrent indexer. The community is powered by a dedicated tracker, something that’s quite rare these days.
This thriving community was severely tested last December when its operators introduced a paid ‘Turbo Mode’. This triggered a revolt, with users and uploaders actively looking for alternative French torrent trackers.
Just as the storm appeared to have calmed, YggTorrent’s operation was shaken up by a final blow this week, after unknown people breached the site, stole data and funds, and exposed the entire operation.
YggTorrent Shuts Down Following Hack
Today, YggTorrent decided to close its doors for good. This decision comes after the torrent site was severely compromised through an elaborate hack.
According to a statement published by the site’s operators, a secondary pre-production staging server was the entry point. From there, the attackers used a privilege escalation exploit to delete and then exfiltrate the site’s database.
YggTorrent’s message (translated)
In addition to large amounts of site data, the hackers also stole cryptocurrency wallets. YggTorrent’s operators note that these wallets were used exclusively to fund server costs.
The hack bears signs of a targeted attack. YggTorrent notes that there was no warning or attempt at a dialogue before all its data was exposed.
According to YggTorrent, all stored user passwords were hashed and salted. However, the leak suggests that millions of legacy accounts were still stored in MD5 without salts, offering significantly weaker protection.
YggLeak
The hacker has shared a detailed summary of their achievements and findings on a dedicated leak site.
From the leak site (translated)
This website explains that the hackers entered YggTorrent’s infrastructure through a series of critical configuration errors by the administrator, starting at the search engine service (SphinxQL) that was left exposed on the staging server without a password.
The YggLeak site portrays YGGtorrent as a high-revenue “cash machine” rather than a simple sharing community. It claims that the site made millions of euros in revenues in 2025 alone. This revenue was reportedly converted to cryptocurrency.
The data, via Kulturegeek
According to the leak, this conversion was not straightforward. The site allegedly used a plugin called CardsShield to route payments through dozens of fake e-commerce storefronts to disguise the true nature of transactions from PayPal and Stripe. The proceeds then went through a circuit involving USDT, Monero and Ethereum, with funds passed through Tornado Cash to reach anonymous wallets.
While TorrentFreak can’t immediately verify any of these claims, the author of the YggLeak website suggests that the 11+ GB in data archives may be useful for law enforcement
“[N]ow that this data is public, professionals will be able to examine it, gather additional evidence, and perhaps even take legal action against those responsible for the site, as well as against hosting providers or other identified third parties,” the YggLeak author writes.
Fin.
For YggTorrent, this is the end of the road. The site’s operators note that there is a backup of all data, so it would be possible to put the site back online. However, facing a rather hostile environment, the team has chosen to shut down permanently.
“A platform can shut down. A community, however, leaves a lasting legacy. Thank you for these nine years. Thank you for your trust. Thank you for all these shared moments,” YggTorrent says in a closing note.
—
Update: Yggleak now mentions that the torrents are backed up and available through an alternative tracker.
Update: YggTorrent updated the website to suggest that something new, presumably not torrent-related, is coming in twelve days.
Update: YggTorrent posted a new statement countering many claims by the hackers (translated version below).
Instagram Engineering
Shopify Engineering