Reported second protocol-level exploit; all trading suspended
Press coverage reports that RetoSwap suspended all trading in mid-June 2026 after confirming that the underlying Haveno protocol was being actively exploited again, about a month after the first incident. The team is reported to have forced a minimum client version and blocked the attacker's address. The size of any loss in the second incident was not stated in the coverage reviewed. New client releases were published afterwards.
This entry summarises a public report and links to it. It is a record of what was reported, not a finding of wrongdoing. If you represent RetoSwap, you can
claim the listing and respond here. To correct an error, send a correction.
According to press reports, an attacker exploited a flaw in the Haveno trade protocol used by RetoSwap and drained roughly 7,000 XMR, about $2.7 million at the time, from trades in progress. The network operators said the flaw was in the upstream protocol rather than their own infrastructure and that fiat trades were not affected. The directory kycnot.me states that the funds were not recovered and that no reimbursement had been confirmed.
