Bisq v1 Trade-Protocol Exploit Causes Losses Valued at 11.59 BTC
An attacker exploited missing validation checks in Bisq v1's trade protocol using a modified client, forcing an emergency halt to trading. Ten users ultimately suffered losses totaling 11.59104 BTC in value, although the exploited trades were altcoin trades and funds held in Bisq Bitcoin wallets were not directly compromised.
On May 1, 2026, Bisq v1 suffered an exploit in its peer-to-peer trading protocol. An attacker used a modified client to exploit missing validation checks while selectively taking open offers. Bisq responded by activating an emergency version-enforcement mechanism that effectively disabled trading while developers investigated the attack.
The distinction between what was and was not compromised is important. Bisq's later post-mortem said the exploit affected active altcoin trades rather than fiat trades, and that bitcoin stored in users' Bisq wallets was not directly drained. Ten users were affected, with total losses ultimately calculated at 11.59104 BTC in value. The attack therefore was not a theft from the Bitcoin protocol or a compromise of Bisq wallet keys; it was a failure in the exchange's trade-validation logic.
The incident nevertheless mattered to Bitcoin because Bisq is a long-running Bitcoin-centered decentralized exchange built around peer-to-peer, non-custodial trading. The emergency shutdown showed that removing a centralized custodian does not eliminate application-layer security risk: a decentralized trading protocol can still contain logic that a modified client can abuse. Bisq later reimbursed affected users and undertook broader security hardening, making the May exploit a useful record of the operational risks faced by Bitcoin-native decentralized market infrastructure.