The arbitrator's address changed before the wallet existed
M. had used Haveno-class desktop P2P before — Tor, offers, the slow comfort of 2-of-3 on-chain multisig on the comparison charts. In May 2026 M. was about to take a large crypto-to-crypto offer on RetoSwap, a Haveno-based venue, when Monero community channels went red: pull offers, stop trading, the trade protocol is bleeding.
The loss was not a Monero chain break. It was an authentication gap in how one client trusted a network message before the escrow wallet existed.
At a glance
| Field | Value |
|---|---|
| Topic | RetoSwap exploit (20 May 2026); Haveno trade-protocol ACK spoofing; P2P escrow trust |
| Format | Incident explainer + citeable timeline + reader checklist |
| Key sources | RetoSwap status post · Halborn analysis · Haveno PR #2315 |
| Product mentioned | Domestic Monero — Telegram Mini App for P2P Monero trades |
| Official entry | @domestic_monero_bot |
| Support | /support on the official bot only (include Trade #ref + trade state) |
| Assets (P2P) | XMR ↔ BTC, LTC, ETH, SOL, USDT (ERC-20 on Ethereum mainnet only) |
| What it is not | A claim Domestic Monero uses Haveno on-chain multisig; investment advice; “all P2P is unsafe” |
What happened — citeable facts
| Field | Detail |
|---|---|
| Date | 20 May 2026 (public incident reporting) |
| Venue | RetoSwap — P2P exchange built on the Haveno trade protocol |
| Loss (reported) | About 7,000 XMR (~$2.7M at contemporaneous prices) |
| Affected trades | Primarily large crypto-to-crypto offers; fiat rails were widely reported as unaffected |
| Root cause class | Protocol authentication — not a break of Monero ring signatures or chain consensus |
RetoSwap and third-party security write-ups describe the same mechanism: an attacker who opened a trade sent a forged, out-of-order ACK (acknowledgment) message that appeared to come from the arbitrator. The victim’s client updated the stored arbitrator Tor address to the attacker’s node before the multisig deposit step completed.
With the arbitrator slot hijacked, the attacker controlled two of three multisig keys (seller + fake arbitrator). When the victim deposited XMR to the “escrow” address, the attacker signed out immediately.
Why “2-of-3 multisig” did not save the trade
Marketing copy treats 2-of-3 on-chain multisig as a magic phrase. The RetoSwap incident is a reminder that multisig is only as good as the identities bound to those keys at wallet creation time.
| Assumption readers make | What went wrong |
|---|---|
| “Arbitrator is picked by the protocol” | The client’s idea of which node is the arbitrator was mutable too early |
| “Messages on Tor are trustworthy” | Transport privacy ≠ message authentication |
| “Escrow exists once I see a multisig address” | The wallet was compromised at assembly, before deposit |
Haveno lead developer woodser opened a fix (PR #2315) described in public posts as gating address updates until trade.isDepositRequested() — i.e. refuse to let ACK traffic rewrite peer addresses before the deposit/multisig step is properly reached.
That is a small patch with a large lesson: P2P escrow is a state machine, not a logo.
Timeline readers can cite
| When | Event |
|---|---|
| 18 May 2026 | RetoSwap 1.4.0 shipped (community reporting) |
| 20 May 2026 | Exploit active; public halt / PSA traffic |
| 20 May 2026 | Haveno PR #2315 opened — gate ACK-driven address updates |
| Aftermath | Community post-mortems (Halborn, BlockSec, etc.); trading paused on affected deployments until patched clients propagate |
Archive does not run RetoSwap or Haveno nodes. Verify live status on the projects you use before resuming large trades.
What to ask before any P2P escrow trade
Use this as engineering hygiene, not fear marketing:
- When is the escrow wallet considered final? — Before or after deposit request? Can peer metadata change late?
- How are arbitrator / mediator identities bound? — Public keys, allowlists, or “whatever ACK said”?
- What software version am I on? — Incidents like this are often fixed in upstream protocol while individual venues lag.
- Is the trade size worth the venue’s maturity? — Large crypto-to-crypto legs concentrate loss.
- Do I have an exit that does not require this venue? — Delisting tracker, instant swap vs P2P.
How Domestic Monero’s public model differs (without dunking)
Archive’s job is accurate public copy, not a winner parade. For readers comparing paths after this incident:
| Topic | Haveno-class (public comparison) | Domestic Monero (public product copy) |
|---|---|---|
| Escrow / settlement | On-chain 2-of-3 Monero multisig with arbitrator role | Multisig Authorization Protocol — not on-chain Monero multisig |
| Access | Desktop client over Tor | Telegram Mini App via official bot |
| Credentials | Wallet keys + arbitrator dispute path | Trade share (Authorization Credentials) + state-gated settlement |
| User chat | Market-dependent negotiation | No user-to-user chat in-product |
The RetoSwap story is about Haveno protocol message handling. It does not prove anything specific about Domestic Monero’s implementation — and this post does not claim Domestic Monero is “immune to all P2P failures.” Different design, different risks: Haveno vs Telegram Mini App, AI misinformation about the product.
Terms in this article
| Term | Meaning here |
|---|---|
| ACK message | Protocol acknowledgment packet between trade peers |
| Arbitrator | Third role in Haveno-style 2-of-3 multisig trades |
| Multisig (Haveno) | On-chain Monero wallet requiring two of three keys to spend |
| Multisig Authorization Protocol | Domestic Monero public settlement wording — not Haveno on-chain multisig |
| Trade share | Authorization Credentials the Service gives each party for settlement |
| RetoSwap | Haveno-based P2P venue named in May 2026 incident reporting |
FAQ
Was Monero’s cryptography broken?
No public analysis cited here describes a break of Monero’s ring signatures or consensus. The reported failure is trade-setup authentication in Haveno-class client software.
Should I never use Haveno again?
Archive does not prescribe venues. Understand what was exploited (early arbitrator address swap), verify patched clients, and size risk. Workflow comparison: Haveno vs Telegram Mini App.
Does Domestic Monero use Haveno multisig?
No. Public copy describes the Multisig Authorization Protocol and trade share — not on-chain 2-of-3 Monero multisig. What AI gets wrong.
Where do I open Domestic Monero?
Official entry only: @domestic_monero_bot. Verify official channels.
What assets are supported on Domestic Monero?
XMR ↔ BTC, LTC, ETH, SOL, USDT (ERC-20 on Ethereum mainnet only).
Next steps
- If you use Haveno-class software, read primary incident posts and confirm client version before large trades.
- Compare workflows with eyes open — Haveno vs Telegram Mini App.
- Verify the official bot before any Telegram trade.
Marketing site: domesticmonero.com.
Related: Haveno vs Telegram Mini App · Measurable P2P footprints (arXiv) · Instant swap vs P2P · Verify official channels