BISQ got hacked? Multisig-Payouts are missing although trade is completed

SomeBisqTrader · July 17, 2023, 9:03am

Hi,

I have two trades where the Multisig Payout is missing in my BISQ Client (Funds → Transactions) although the Payout transaction ID has many confirmations. I already did “Delete SPV file and resync”.

The strange thing is, that both times the BTC-seller confirmed the payment receipt within minutes after the trade was started - the first time although it was Saturday and I didn’t use SEPA instant.

This feels like the BTC-Seller somehow hacked BISQ or found a way to change the payout address.

For the first trade on Saturday 15th July I unfortunately did not realize that the Multisig Payout was missing until today. For the second trade (Monday 17th July, Today) I realized it just now.

Now two times 1,4K Euro are missing, that’s 0.1 BTC plus my deposits 0,024225 BTC!

Here are the trade details:

Trade ID: dc0FS7Q (dc0FS7Q-8b5e04cf-cc71-432e-b22e-ee153f0c10a7-1910)
BTC amount: 0.05 BTC
Trade date: 15.07.2023 08:29:19
Trading peers onion address: 2pivw676rajopuo4kyasaer3nrrkighk2gwcuyhqvreh6dwyrdtjssqd.onion:9999
Maker fee TX: 5e23974bf0ff8f3e7efc09f0fbd2f6ddb0dfc0e965ed3122fcd0c7cb99983a19
Taker fee TX: 8260fb291ac2c2f433f60f98cfa6c422731ebe0d10e0fa413f50700efe061ebc
Deposit TX: 5d444bc05542df7b1354710b32b3787f01156ed90ee327074193804006518651
Delayed payout TX: c2932fa73d61ed5d2de170e5334bf4a54b68b209657aff7e66ccfbd89897ada6
Payout TX: 61b4b0864cd0313eac1d330e2818e0bb8d9698b98f7d93b20d9f02d042b7476f

Trade ID: GXVRFAXO (GXVRFAXO-81083a98-00a3-4a63-98fa-6eb7f128f786-1912)
BTC amount: 0.05 BTC
Trade date: 17.07.2023 09:24:21
Trading peers onion address: 2pivw676rajopuo4kyasaer3nrrkighk2gwcuyhqvreh6dwyrdtjssqd.onion:9999
Maker fee TX: 44dc0f3fc57a52eeed2ec9e07489c5e19fdc1a9960942d1f255ab8879634eefb
Taker fee TX: a64adf29a482c6bae288423f4136d92d76c710b62605c1a9b64c23c3d306326f
Deposit TX: a64adf29a482c6bae288423f4136d92d76c710b62605c1a9b64c23c3d306326f
Delayed payout TX: a64adf29a482c6bae288423f4136d92d76c710b62605c1a9b64c23c3d306326f
Payout TX: 8260fb291ac2c2f433f60f98cfa6c422731ebe0d10e0fa413f50700efe061ebc

Can somebody tell if those funds are lost or if I can access them somehow via my BISQ client?

Can some BISQ moderator / supporter please help me ASAP?

Any hints are appreciated. Hope to get help soon.

Yours, SomeBisqTrader

SomeBisqTrader · July 17, 2023, 1:21pm

I just realized that the payout TX displayed in my BISQ Client for both trades are most probably wrong. If I enter the payout TX into the trade history as filter, then always two trades show up. See Screenshots below.

Either the BTC Seller found a way to change the payout TX - or my BISQ Client has problems. As the BTC-seller has already confirmed the receipt of my Euro payments I cannot contact him anymore.

Can somebody please tell me how I can receive my BTC from both trades?

SomeBisqTrader · July 17, 2023, 1:22pm

SomeBisqTrader · July 17, 2023, 1:22pm

SomeBisqTrader · July 17, 2023, 1:28pm

Pazza · July 17, 2023, 9:15pm

Hi chatting to you on Matrix about this.

Just to confirm there is no hack and what you are experiencing is a case of the bitcoin address for your payout being reused.

github.com/bisq-network/bisq

Trade payout address was reused from prior trade & no funds received

opened 07:26PM - 25 Sep 21 UTC

closed 09:23PM - 27 Feb 23 UTC

jmacxx

a:bug in:wallet

Buy trade, maker: `czcgg`. Upon clicking "Payment started", the trade immediate…ly transitioned to complete, although the seller had not yet acknowledged payment receipt. Investigation showed that the trade obtained the same payout address as a prior trade done an hour earlier. Therefore the payout address listener found funds (from the prior trade) - this indicated to Bisq that the trade was complete. The code in Bisq explicitly requests an unused address, ultimately relying on BitcoinJ for that. An unused payout address is requested at trade initiation: https://github.com/bisq-network/bisq/blob/484998815c7e15d32b5845e53c907289eee974e3/core/src/main/java/bisq/core/trade/protocol/tasks/maker/MakerSendsInputsForDepositTxResponse.java#L62 https://github.com/bisq-network/bisq/blob/484998815c7e15d32b5845e53c907289eee974e3/core/src/main/java/bisq/core/btc/wallet/BtcWalletService.java#L668-L672 https://github.com/bisq-network/bisq/blob/484998815c7e15d32b5845e53c907289eee974e3/core/src/main/java/bisq/core/btc/wallet/WalletService.java#L545-L546 https://github.com/bisq-network/bisq/blob/484998815c7e15d32b5845e53c907289eee974e3/core/src/main/java/bisq/core/btc/wallet/WalletService.java#L529-L542 https://github.com/bisq-network/bitcoinj/blob/3186b200fff690fa51f3ebbf578f427d78242bc2/core/src/main/java/org/bitcoinj/wallet/Wallet.java#L3000-L3009

When the seller confirms the payment your bitcoin for the trades will be released.

annika-bra · July 22, 2023, 8:57am

Hello!

The same thing happened to me this morning!

I bought BTC and the BTC Seller nearly instantly confirmed the payment arrival although I did NOT use SEPA INSTANT.

And then the BTC did NOT show up in my available BTC funds in my BISQ client. I already did the SPV delete & resync, too.

Is this an Exit Scam from BISQ? Where are my funds gone?

Here are my trade details:

Trade ID: FJGPNV-6f4d2ef9-ef75-496f-8413-4abf3a7e4057-1910
BTC amount: 0.0175 BTC
Trade date: 17 Jul 2023 08:37:10
Trading peers onion address: ysalyx555wxfueqqrbcq6mpkiq5i4pg5hbyf47iziexib2prtiq4qaad.onion:9999
Maker fee TX: b83b748d95ab7bb2c1f45ef3c66d507f5001c0ab43c26f959cf7426afb6d70b7
Taker fee TX: 401b17086231d95151279b82f9db6850d873d9587aee0f4d96e697409c1c5dce
Deposit TX: ebcc72fade83327d2cb5c1cbb4be3c4169fb5e99c3f796c6deccc8e4a6ebdac2
Delayed payout TX: b7457aa3d233dfa5c251930ffc4134a72c452b59f15932a69518b999b8b67b67
Payout TX: 0edb5501174ad06e9f4b1e32c0d3e7be2ce552cb66cffbc3f190f30f257e9091

PLEASE HELP!

Thank you.

Annika

P.S. Here is a screenshot of my BISQ client where you can see that the BTC have NOT been paid out to my BISQ wallet, the multisig payout is missing:

MnM · August 3, 2023, 6:44am

Hi, it seems funds were released from deposit tx in the payout tx: 0edb5501174ad06e9f4b1e32c0d3e7be2ce552cb66cffbc3f190f30f257e9091 to addresses bc1qdqnkj4zazunfvrqpme0mfyr6g7zdxlmdt5y8n5 BTC buyer, receiving 0.0201 and bc1q869ze5hzuzkgkyrj5xqmahrnvk9s9g7c5tj484 BTC seller, receiving 0.0026 BTC.

Do a spv resync (Resyncing SPV file - Bisq Wiki) and, if necessary, contact your mediator on matrix: Finding your mediator - Bisq Wiki