Incident Overview
On May 3, 2026, the Bisq P2P exchange suffered an exploit resulting in the theft of approximately 11 BTC. The attack targeted altcoin-to-bitcoin trades by exploiting a logic flaw in how miner fees were validated. The protocol was compromised when an attacker bypassed input checks to inject negative values into trade transactions.
The exploit was caused by a lack of input validation for taker-provided miner fees. By supplying a negative fee value, the attacker manipulated the math used to create trade escrow transactions. This caused the funds intended for the multisig deposit to be reduced to a minimum floor of 0.001 BTC, while the protocol automatically redirected the remaining balance to the attacker’s change output.
The attack specifically targeted altcoin-to-BTC trades and left a distinct transaction fingerprint consisting of a 0.001 BTC multisig output and a 10,000 sat miner fee. The Bisq team identified the flaw using AI-assisted analysis and has warned users to limit wallet balances until additional security hardening is complete.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Bisq, these are the critical security checks that could have prevented this incident (May 2026).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
- 01
- 02
Learn to Prevent the Next Bisq
The Bisq hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.