Bisq's trade arbitration did not verify that the payout address for time-locked fallback transactions was the legitimate Bisq donation address. Attackers posing as sellers set their own donation address, then let trades time out, causing the platform to send the buyer's deposit, payment, and security deposit to the attacker's wallet instead of the Bisq DAO address. Six traders lost a total of 34.86 BTC on March 28 and April 7.

Hacker Exploits Flaw in Decentralized Bitcoin Exchange Bisq to Steal $250K.