{"type":"rich","version":"1.0","author_name":"bisq (npub1sq…t5net)","author_url":"https://nostr.ae/npub1sqn6rpml88nq8khuvvneuqztfmvalpsarr8grkwy837hzdw63ajs6t5net","provider_name":"njump","provider_url":"https://nostr.ae","html":"**Bisq Protocol Exploit Update**\n\nThis is a brief update on what we have learned so far, the current state of reimbursement planning for affected users, and some broader observations about the growing role of AI-assisted attacks.\n\n**Estimated impact**\n\nBased on preliminary estimates from data analysis and reports from affected users, the total amount stolen appears to be approximately **11 BTC**.\n\nThe attacker used a **0.001 BTC** multisig output together with an unusually high **10,000 sat** miner fee in the reported transactions. That combination created a recognizable transaction fingerprint, which helped identify suspicious transactions within the time window in which the attack occurred.\n\nSo far only Altcoin trades have been reported.\n\nThis remains a preliminary estimate. The final amount may change as additional reports are reviewed.\n\n**How are victims getting reimbursed?**\n\nWe are currently discussing several reimbursement options. Our goal is to enable **fast and complete reimbursement with minimal friction for victims**.\n\nThere are, however, practical constraints:\n\n• **Protocol constraints**: victims must open arbitration cases. Arbitration can only be opened after a time lock of **10 days for altcoin trades** and **20 days for fiat trades**.\n• **DAO constraints**: the DAO has limits on how much can be issued per DAO cycle.\n• **DAO governance**: the proposal for the reimbursement has to be confirmed by the DAO via voting. The current DAO cycle will end around 25th of May.\n\nThe current intention is to allow victims to choose between reimbursement in **Bitcoin** or **BSQ**.\n\nAt this stage we cannot make a final commitment on the exact mechanism, but we wanted to share our intentions.\n\nFor Bisq users — whether affected directly or not — discussion is ongoing in the **Matrix channel**: (https://matrix.to/#/%23bisq:bitcoin.kyoto)\n\nAnd on **GitHub**: (https://github.com/bisq-network/bisq/discussions/7628)\n\nThe final reimbursement model will be submitted as a **DAO proposal for voting**.\n\nThe exploit caused a significant challenge for both Bisq and the DAO, but we are confident it is manageable. It was serious, but it was not a fatal blow.\n\n**How did the exploit happen?**\n\nIn short, the exploit was caused by a **missing validation that should have rejected negative input values provided by the taker**.\n\nThe maker and taker must use the same miner fee. That fee value is provided by the taker.\n\nThe attacker supplied a **negative miner fee**.\n\nWhen the maker calculated the multisig output amount — which includes the miner fee for the payout transaction — the negative value reduced the multisig amount to **0.001 BTC**, while the remaining funds were redirected to the taker’s change output.\n\nUnfortunately, the taker change output was a leftover from older protocol versions. It had already been identified as something that should be removed, but that cleanup had unfortunately not happened.\n\n**Was it an AI-assisted attack?**\n\nWe cannot answer that with certainty. However, based on our own experience during the investigation, we think it is likely.\n\nAfter the issue was discovered, one group of developers started manual code inspection to understand how the exploit could have happened.\n\nA second group used AI-assisted analysis.\n\nThe AI-assisted group was faster and identified the exploit path in a relatively short time.\n\nThe first AI-generated attempt turned out to be a false positive, but a second attempt by another developer successfully reproduced the exploit. It also produced both an attack patch and a corresponding fix.\n\nAI tools include safeguards, so simply asking them to identify an exploit will usually not work.\n\nHowever, with enough context, careful prompting, and a degree of social engineering of the model, those safeguards can be bypassed.\n\nBased on our experience, it is reasonable to assume that the attacker may have followed a similar path.\n\n**A warning shot**\n\nSome Bisq developers are highly proficient with AI tools. However, we had not systematically used them as part of an actual security audit process.\n\nOne developer attempted to get Bisq into an external security audit program, but the application was rejected.\n\nIn hindsight, this was a serious failure on our side.\n\nThe mistake was not only the missing validation check. It was also failing to react early enough to the changing security landscape and the increasing practical relevance of AI-assisted vulnerability discovery.\n\nWe must assume that there will be further attempts.\n\nOver the coming weeks we will invest significant effort into hardening the codebase and actively using AI tools ourselves to search for failure modes.\n\nWe are particularly focused on vulnerabilities that could directly affect the wallet.\n\nUntil additional review and hardening are completed, we recommend that Bisq users **do not keep more BTC in their Bisq wallet than is necessary for active trading**.\n\nWe also hope this serves as a useful warning to other projects in the space.\n\nIf our experience helps others identify similar risks earlier and strengthen their defenses, something positive may still come out of it.\n\n**Release plans**\n\nWe have already fixed the immediate vulnerability and are currently working on additional hardening for a hotfix release.\n\nWe expect to publish that release in the coming days.\n\nAfter that, we will continue with a follow-up release focused on further hardening, broader review, and additional security auditing.\n"}