Trade-protocol flaw exploited; about 11.6 BTC taken from ten users, later reimbursed
Bisq's post-mortem states that missing validation checks in the Bisq 1 trade protocol were exploited from 1 May 2026 by an attacker using a modified client, affecting altcoin trades only. Ten users lost a total of 11.59 BTC, and trading was halted through an emergency version requirement. According to a later project update, affected users were reimbursed with funds advanced by contributors, with the accounting still to be settled through the DAO.
This entry summarises a public report and links to it. It is a record of what was reported, not a finding of wrongdoing. If you represent Bisq, you can
claim the listing and respond here. To correct an error, send a correction.
