# PSA: Trade protocol exploit discovered, investigations ongoing **URL:** \ **Category:** Support\ **Created:** [May 1, 2026, 10:14am UTC](https://bisq.community/t/psa-trade-protocol-exploit-discovered-investigations-ongoing/13664 "2026-05-01T10:14:53Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![suddenwhipvapor](https://bisq.community/user_avatar/bisq.community/suddenwhipvapor/32/3291_2.png) [@suddenwhipvapor](https://bisq.community/u/suddenwhipvapor)\ **Post date:** [May 1, 2026, 10:14am UTC](https://bisq.community/t/psa-trade-protocol-exploit-discovered-investigations-ongoing/13664/1 "2026-05-01T10:14:53Z")
Bisq v1 has experienced an exploit in its trade protocol that allowed an attacker to drain a portion of available offers. The impact is limited to offers that were actively taken by the attacker. Funds held in users’ Bisq Bitcoin wallets are not affected. As an immediate mitigation, an emergency mechanism was activated to disable trading by setting the required trading version to 2.0.0 — a version that does not exist. This effectively prevents the attacker from continuing the exploit. The attack appears to have started on May 1 in the early morning hours. We are continuing to investigate the full extent of the damage. Users with trades initiated on or after this time are advised to open mediation by selecting the trade and pressing **Ctrl + O**. A mediator will assess whether their trade was affected. Preliminary investigation indicates that the attacker exploited a missing validation check using a modified client. We are working to reliably reproduce the issue and verify a fix. Once confirmed, we will release a hotfix based on the latest stable version. In parallel, we are conducting a comprehensive security review to identify any related or additional vulnerabilities. For affected users, we are actively evaluating reimbursement options. We recognize that both the exploit and our response are critical to Bisq’s integrity, and we are dedicating all available resources to finding a solution that helps restore confidence. Bisq 2, with the Bisq Easy trade protocol, is not affected. It is a separate codebase with a fundamentally different protocol design. We will continue to provide updates through our official communication channels, including Matrix, the Bisq Forum, Telegram, Reddit, X, and Nostr. We sincerely apologize for the impact this incident has had on our users. We are fully committed to addressing both the root cause and its consequences. ## BEWARE OF SCAMMERS Worried users will be more vulnerable to scammers posing as support agents. ### SUPPORT STAFF WILL NEVER DM YOU FIRST ### NEVER reply to DMs you receive, it will be a scammer trying to impersonate official staff ### NEVER GIVE YOUR SEED TO ANYONE ---
**Author:** ![Borque](https://bisq.community/letter_avatar/borque/32/5_5575768a8748004e209b776fc1b2916d.png) [@Borque](https://bisq.community/u/Borque)\ **Post date:** [May 1, 2026, 2:07pm UTC](https://bisq.community/t/psa-trade-protocol-exploit-discovered-investigations-ongoing/13664/2 "2026-05-01T14:07:36Z")
Hi swv. Just confirming: A popup said to update to latest version, but I understand v2.0.0 doesn’t exist. Should I ignore the update for now until resolved? Thanks. ---
**Author:** ![MnM](https://bisq.community/user_avatar/bisq.community/mnm/32/257_2.png) [@MnM](https://bisq.community/u/MnM)\ **Post date:** [May 1, 2026, 2:37pm UTC](https://bisq.community/t/psa-trade-protocol-exploit-discovered-investigations-ongoing/13664/3 "2026-05-01T14:37:59Z")
Yes, that version was used just as a way to stop further vulnerable offers. ---
**Author:** ![jurkos](https://bisq.community/letter_avatar/jurkos/32/5_5575768a8748004e209b776fc1b2916d.png) [@jurkos](https://bisq.community/u/jurkos)\ **Post date:** [May 1, 2026, 2:43pm UTC](https://bisq.community/t/psa-trade-protocol-exploit-discovered-investigations-ongoing/13664/4 "2026-05-01T14:43:28Z")
There isn’t even an issue report on the project’s GitHub: > **[Issues · bisq-network/bisq](https://github.com/bisq-network/bisq/issues)** > > A decentralized bitcoin exchange network. Contribute to bisq-network/bisq development by creating an account on GitHub. Not to mention a fix. What’s the situation? I made a transfer to someone an hour before the “outage.” What happens now? Will they be able to confirm it? ---
**Author:** ![MnM](https://bisq.community/user_avatar/bisq.community/mnm/32/257_2.png) [@MnM](https://bisq.community/u/MnM)\ **Post date:** [May 1, 2026, 2:48pm UTC](https://bisq.community/t/psa-trade-protocol-exploit-discovered-investigations-ongoing/13664/5 "2026-05-01T14:48:43Z")
Devs are working with this internally, github will show that when the new version is ready. You’ll be able to continue with your trade then, as you were the BTC buyer I suppose it was not directly affected by the attack, which was an exploit against BTC sellers as far as I know. ---
**Author:** ![jurkos](https://bisq.community/letter_avatar/jurkos/32/5_5575768a8748004e209b776fc1b2916d.png) [@jurkos](https://bisq.community/u/jurkos)\ **Post date:** [May 1, 2026, 3:08pm UTC](https://bisq.community/t/psa-trade-protocol-exploit-discovered-investigations-ongoing/13664/6 "2026-05-01T15:08:27Z")
Yes, I know I wasn’t the target. But since the platform is currently down, I’m worried the transaction won’t go through. And I’ve already made the transfer! ---
**Author:** ![Borque](https://bisq.community/letter_avatar/borque/32/5_5575768a8748004e209b776fc1b2916d.png) [@Borque](https://bisq.community/u/Borque)\ **Post date:** [May 1, 2026, 4:44pm UTC](https://bisq.community/t/psa-trade-protocol-exploit-discovered-investigations-ongoing/13664/7 "2026-05-01T16:44:05Z")
Thanks. I disabled an open offer. Am I able to cancel it and move the funds to my wallet until this is resolved? ---
**Author:** ![MnM](https://bisq.community/user_avatar/bisq.community/mnm/32/257_2.png) [@MnM](https://bisq.community/u/MnM)\ **Post date:** [May 1, 2026, 6:18pm UTC](https://bisq.community/t/psa-trade-protocol-exploit-discovered-investigations-ongoing/13664/8 "2026-05-01T18:18:44Z")
Yes, but maybe keeping it disabled is better. By removing it, you lose the trading fee. ---
**Author:** ![suddenwhipvapor](https://bisq.community/user_avatar/bisq.community/suddenwhipvapor/32/3291_2.png) [@suddenwhipvapor](https://bisq.community/u/suddenwhipvapor)\ **Post date:** [May 1, 2026, 6:49pm UTC](https://bisq.community/t/psa-trade-protocol-exploit-discovered-investigations-ongoing/13664/9 "2026-05-01T18:49:31Z")
Trades that are already open can be completed normally, if you’d like a support agent to check whether your trade was affected by the exploit, DM one of them (never answer to DMs you receive first) and share the deposit txid. So, open unaffected trades can be completed normally. ---
**Author:** ![MnM](https://bisq.community/user_avatar/bisq.community/mnm/32/257_2.png) [@MnM](https://bisq.community/u/MnM)\ **Post date:** [May 1, 2026, 7:02pm UTC](https://bisq.community/t/psa-trade-protocol-exploit-discovered-investigations-ongoing/13664/10 "2026-05-01T19:02:51Z")
@Borque Indicates that it’s an open offer, not an open trade. No one will be able to take an open offer until new version is released. As you’ve said, open trades can be completed normally. ---
**Author:** ![suddenwhipvapor](https://bisq.community/user_avatar/bisq.community/suddenwhipvapor/32/3291_2.png) [@suddenwhipvapor](https://bisq.community/u/suddenwhipvapor)\ **Post date:** [May 1, 2026, 9:12pm UTC](https://bisq.community/t/psa-trade-protocol-exploit-discovered-investigations-ongoing/13664/11 "2026-05-01T21:12:39Z")
yes I was actually replying to @jurkos 😅