Bisq v1 has experienced an exploit in its trade protocol that allowed an attacker to drain a portion of available offers.
The impact was limited to open offers that were actively taken by the attacker over the last 12 hours. Funds held in users’ Bisq Bitcoin wallets were not affected.
As an immediate mitigation, an emergency mechanism was activated to disable trading by setting the required trading version to 2.0.0 — a version that does not exist. This effectively prevents the attacker from continuing the exploit.
The attack appears to have started on May 1 in the early morning hours. The development team is continuing to investigate the full extent of the damage. Users with trades initiated on or after this time are advised to open mediation by selecting the trade and pressing Ctrl + O. A mediator will assess whether their trade was affected.
Preliminary investigation indicates that the attacker exploited a missing validation check using a modified client. The team is working to reliably reproduce the issue and verify a fix. Once confirmed, a hotfix will be released based on the latest stable version. In parallel, a comprehensive security review is being conducted to identify any related or additional vulnerabilities.
For affected users, reimbursement options are being evaluated. Bisq recognizes that both the exploit and a consequent response are critical to its integrity, and is dedicating all available resources to finding a solution that helps restore confidence.
Bisq 2, with the Bisq Easy trade protocol, is not affected. It is a separate codebase with a fundamentally different protocol design.
Bisq will continue to provide updates through its official communication channels, including Matrix, the Bisq Forum, Telegram, Reddit, X, and Nostr.
Bisq sincerely apologizes for the impact this incident has had on its users, and is fully committed to addressing both the root cause and its consequences.
bisq / Bisq
npub1sq…t5net
2026-05-01 13:29:25 UTC
Author Public Key
npub1sqn6rpml88nq8khuvvneuqztfmvalpsarr8grkwy837hzdw63ajs6t5netPublished at
2026-05-01 13:29:25 UTCEvent JSON
{
"id": "8dc52c4271ea2a9d2ef13b04d413cb13f587b662f4ee5585cd9df9ac07bb1163",
"pubkey": "8027a1877f39e603dafc63279e004b4ed9df861d18ce81d9c43c7d7135da8f65",
"created_at": 1777642165,
"kind": 1,
"tags": [
[
"r",
"wss://relay.damus.io/"
],
[
"r",
"wss://nos.lol/"
],
[
"r",
"wss://relay.mostr.pub/"
],
[
"r",
"wss://nostr.land/"
],
[
"r",
"wss://nostr.wine/"
],
[
"r",
"wss://relay.bitcoinpark.com/"
],
[
"r",
"wss://offchain.pub/"
],
[
"r",
"wss://nostr.oxtr.dev/"
],
[
"r",
"wss://eden.nostr.land/"
],
[
"r",
"wss://relay.nostr.info/"
],
[
"r",
"wss://relay.primal.net/"
],
[
"client",
"Primal Web"
]
],
"content": "Bisq v1 has experienced an exploit in its trade protocol that allowed an attacker to drain a portion of available offers.\n\nThe impact was limited to open offers that were actively taken by the attacker over the last 12 hours. Funds held in users’ Bisq Bitcoin wallets were not affected.\n\nAs an immediate mitigation, an emergency mechanism was activated to disable trading by setting the required trading version to 2.0.0 — a version that does not exist. This effectively prevents the attacker from continuing the exploit.\n\nThe attack appears to have started on May 1 in the early morning hours. The development team is continuing to investigate the full extent of the damage. Users with trades initiated on or after this time are advised to open mediation by selecting the trade and pressing Ctrl + O. A mediator will assess whether their trade was affected.\n\nPreliminary investigation indicates that the attacker exploited a missing validation check using a modified client. The team is working to reliably reproduce the issue and verify a fix. Once confirmed, a hotfix will be released based on the latest stable version. In parallel, a comprehensive security review is being conducted to identify any related or additional vulnerabilities.\n\nFor affected users, reimbursement options are being evaluated. Bisq recognizes that both the exploit and a consequent response are critical to its integrity, and is dedicating all available resources to finding a solution that helps restore confidence.\n\nBisq 2, with the Bisq Easy trade protocol, is not affected. It is a separate codebase with a fundamentally different protocol design.\n\nBisq will continue to provide updates through its official communication channels, including Matrix, the Bisq Forum, Telegram, Reddit, X, and Nostr.\n\nBisq sincerely apologizes for the impact this incident has had on its users, and is fully committed to addressing both the root cause and its consequences.",
"sig": "ede361c42ae302b7615079effe010484ae86ae407e32b1e6e5b18d13c881247d5f140d62994a15d8141d3603cf373057c61c84b2168b9153e020873c0ba67aab"
}