Shocking,” “Breach,” “Exploit,” “Suspended” could work. Maybe start with “Monero DEX RetoSwap Suspends Trading After $2.7M Exploit” but that’s already the original title. Need to make it more sensational. Maybe “Monero DEX RetoSwap Suspends Trading After $

by

Monero DEX RetoSwap Suspends Trading After $2.7M Exploit in Haveno Protocol

Show AI Summary
Attackers exploited a flaw in Haveno’s trade protocol, specifically targeting the multisig process, to drain $2.7 million in XMR.
RetoSwap’s emergency response included blocking the attacker’s onion address and freezing trading within two minutes via a client update.
The exploit involved interfering with Haveno’s trade messaging system, allowing hackers to pose as an arbitrator and gain unauthorized control during trades.

RetoSwap, a decentralized exchange built on Monero, temporarily stopped trading after a security breach. Attackers took advantage of a weakness in the Haveno trading protocol and stole approximately 7,000 XMR, worth around $2.7 million. The exchange announced the incident on X (formerly Twitter) on May 21st, stating that Haveno’s lead developer, woodser, discovered the problem at 2:31 UTC. RetoSwap quickly responded by blocking the attacker’s address and pausing trading with an urgent software update, just two minutes later.

RetoSwap stated the attack didn’t compromise its own systems. Hackers took advantage of a vulnerability within Haveno’s trading system. RetoSwap reports the issue primarily impacted large cryptocurrency trades, with regular money transactions remaining safe. The platform is currently offline while developers identify the problem and create a fix.

Earlier today, at 2:31 UTC, the lead developer of Haveno, woodser, announced that the Haveno trading system was under attack. Just two minutes later, at 2:33 UTC, RetoSwap blocked the attackers’ address and paused trading by requiring all users to update to version 2.0.0 of the software.

— RetoSwap (@RetoSwap) May 20, 2026

Exploit targeted haveno multisig process

RetoSwap explained that the attackers disrupted Haveno’s system for handling trades while transactions were happening. This weakness let the attackers pretend to be an authorized party *before* the funds were securely locked, giving them the ability to take control of trades without permission.

According to woodser, the attack worked by the attacker sending a deceptive message that pretended to be from the system’s mediator. This message tricked the software into updating the mediator’s address to the attacker’s, letting them create a fraudulent wallet before any money was added.

That same day, RetoSwap advised users to immediately create backups of their wallet files, just in case they could recover funds later. They provided instructions for backing up data on Linux, macOS, and Windows, and also suggested using Haveno’s backup feature. RetoSwap emphasized the importance of acting fast to protect user data.

If today’s issue has impacted you, please immediately back up and securely store the following folder. It may be needed to restore your data:

Linux: ~/.local/share/Haveno-reto/xmr_mainnet/wallet
macOS: ~/Library/Application Support/Haveno-reto/xmr_mainnet/wallet

— RetoSwap (@RetoSwap) May 20, 2026

RetoSwap is a platform for direct, peer-to-peer trading that prioritizes privacy by using Tor and the Haveno protocol. Unlike typical exchanges, users trade directly from their own wallets, meaning they never send their funds to RetoSwap. It currently supports Monero, Bitcoin, Ethereum, Litecoin, Bitcoin Cash, and various stablecoins on both the Ethereum and Tron blockchains.

Bridge exploits continue across crypto

The recent RetoSwap hack is part of a larger trend of security problems in the decentralized finance (DeFi) space. Like RetoSwap, MAP Protocol and ButterNetwork were also hit by attacks targeting their bridges, with nearly 1 quadrillion fake MAPO tokens involved. According to blockchain security company Blockaid, these attacks are happening because of flaws in how bridges verify information.

Echo Protocol has recovered an important administrative key after hackers created around $816,000 in fake eBTC tokens. As a precaution, the project temporarily stopped some of its cross-chain functions to check its security settings and contract safety.

In 2026 alone, hackers stole around $328.6 million through attacks targeting cryptocurrency bridges, according to blockchain security firm PeckShield. These increasing losses show that there are still significant security flaws in the systems that connect different blockchains, and even small vulnerabilities can lead to massive theft.

Read More

2026-05-21 11:49