RetoSwap

Хроника инцидента · разрешено 2026-06-24

1. 2026-05-20 Trade-protocol vulnerability (negative-value validation gap, shared Bisq lineage) hit the network; RetoSwap liquidity collapsed toward $0.
2. 2026-05-28 Recovery update: RetoSwap operator back online with the patched client; network liquidity recovering.
3. 2026-06-11 Network liquidity confirmed recovered and held (~9,500 XMR, ~2x the ~5k threshold). Incident resolved.
4. 2026-06-17 RetoSwap exploit report received at 18:02 UTC. Team set minimum-client-version 2.0.0 via filter feature + banned attacker onion `…e6wyrtdczsrhtves2jofi2qpad.onion:9999`. Attack distinct from May: arbitrator legitimacy intact, the forced-arbitration flow itself releases XMR after 30 confs with no BTC. Damage contained to large-scale crypto offers; fiat traders unaffected. Affected traders directed to RetoSwap SimpleX group.
5. 2026-06-24 RetoSwap объявляет «снова в строю» (X @RetoSwap). Сеть возобновляет работу на закалённом клиенте, привязанном к Haveno v1.8.0 (выпущен 2026-06-20), который добавляет верификацию подписи арбитра в полях диспутных выплат и принуждение к верифицированному отправителю в сообщениях настройки трейда и депозита — более широкое исправление по сравнению с майским целевым патчем v1.5. Координация восстановления с пострадавшими пользователями продолжается.
6. 2026-06-25 Two-week liquidity recovery check (api.kyc.rip resistance.p2p_liquidity, network-wide Haveno P2P depth): network is trading again on the v1.8.0-hardened line, but depth has NOT re-cleared the ~5k-XMR health threshold. Current reading ~4.78k XMR; the trailing 14 days ranged ~4.0k–5.5k (excluding two obvious data-spike outliers), with the majority of readings below 5k and the latest dipping to ~4.79k. Severity held — depth recovery not yet confirmed; continuing the bi-weekly watch.