On Tuesday, April 7, the decentralized cryptocurrency platform Bisq announced that it had been hacked.

Nearly $250,000 worth of bitcoins and moneros have been stolen and the platform has been in maintenance since then to fix the issue and the bug along with a promise to refund victims in full.

Bisq first alerted users to the problem in Tweet Twitter has also suspended all trading on the platform.

A statement published on Wednesday clarified that a hacker exploited a flaw in the Bisq trading protocol, targeting individual trades to steal funds.

She said Company:

We are aware of the theft of approximately 3 Bitcoin and 4000 Monero coins from 7 different victims, the only affected trading pair was XMR/BTC, all affected trades occurred within the last 12 days.

Read:Report: Ripple Sold $890 Million in Ripple (XRP)

The decentralized peer-to-peer BISQ platform, which was launched four years ago, allows users to buy and sell cryptocurrencies directly from each other in exchange for fiat currencies via a desktop interface.

The platform does not have KYC checks so users can maintain privacy.

Also, since it is a decentralized platform, Bisq does not store funds in a website server, or hot wallet connected directly to the Internet, unlike centralized platforms.

Bisq explained in a Twitter thread:

The affected users are only those who are in active trades.

How did the hack happen:

The company said the attacker pretended to be a user on the platform who was selling bitcoin to take advantage of a vulnerability in the system.

Usually, Bisq requires sellers to lock any bitcoin sold into a multiple escrow account in addition to an escrow deposit.

If a trading dispute arises and the broker is unable to reach a resolution, the funds are temporarily sent to a backup address, known as the “donation address.”

This should be a rare occurrence in extreme conditions, Bisq said.

Read:OKEx announces plans to expand to more than 20 new states

But in this event, the hacker was able to set the address of the donation and transfer it to his address, which allowed him to claim the funds.

The platform said:

Instead of going to the rightful owner, the digital assets reached the scammer, along with the buyer’s payment and escrow deposit as well.

The software flaw that allowed this to happen was included in an update released in late October.

The new version was intended to improve decentralization by removing trusted third parties in the multi-account escrow used in bitcoin exchanges, but the solution backfired, giving the hacker access.

Read:The disappearance of a trader who defrauded investors of more than one million riyals of bitcoins, claiming to manage their money and provide high financial returns.

Bisq said it plans to compensate for the losses by creating a smart contract in the “Bisq DAO”, aimed at reimbursing victims with future trading proceeds.

Security has always been Bisq’s top priority, but this incident shows that the platform wasn’t quite perfect. The company stated that the project is evaluating several approaches to further enhance security reviews and practices, and will provide details on them soon.

Read also:

$45 Million Worth of Bitcoin and Bitcoin Cash Stolen by SIM Hacking

Scammers impersonating HitBTC tech support and exploiting a victim to steal 23.2 Bitcoin