Bisq Hack

On May 3, 2026, the Bisq P2P exchange suffered an exploit resulting in the theft of approximately 11 BTC. The attack targeted altcoin-to-bitcoin trades by exploiting a logic flaw in how miner fees were validated. The protocol was compromised when an attacker bypassed input checks to inject negative values into trade transactions.

The exploit was caused by a lack of input validation for taker-provided miner fees. By supplying a negative fee value, the attacker manipulated the math used to create trade escrow transactions. This caused the funds intended for the multisig deposit to be reduced to a minimum floor of 0.001 BTC, while the protocol automatically redirected the remaining balance to the attacker’s change output.

The attack specifically targeted altcoin-to-BTC trades and left a distinct transaction fingerprint consisting of a 0.001 BTC multisig output and a 10,000 sat miner fee. The Bisq team identified the flaw using AI-assisted analysis and has warned users to limit wallet balances until additional security hardening is complete.