Haveno Guide: How to Buy XMR Peer-to-Peer on RetoSwap

Since LocalMonero closed and most exchanges dropped XMR, Haveno has become the main place where people trade Monero for euros, dollars, Bitcoin and stablecoins without handing ID to a platform. This guide explains how a Haveno trade actually protects both sides, walks through a first purchase on RetoSwap, and covers the security incident of May 2026 and what changed afterwards.

Haveno, networks and RetoSwap

Haveno is an open-source, Tor-only trading application whose design borrows heavily from Bisq but settles everything on the Monero chain. There is no token and no company in the middle.

One detail confuses newcomers: the Haveno project publishes the software, but its own repository does not connect to a real-money market. Instead, independent operators run networks, each with its own seed nodes, arbitrators and fee settings. The project says plainly that it does not endorse any network.

RetoSwap (previously called Haveno-reto) is the largest of these networks. It offers desktop builds for Windows, macOS and Linux and an Android app, and the public statistics site Haveno Markets draws its trade data from RetoSwap.

Note: Each network is a separate market. Offers, reputation and arbitrators on one network do not carry over to another, so pick one and get the software from that network’s official site.

How a Haveno trade protects you

2-of-3 multisig

When you take an offer, the software creates a Monero multisig wallet with three keys: one for the buyer, one for the seller and one for the arbitrator. Any two keys can move the money.

• In a normal trade, buyer and seller sign together and the arbitrator does nothing.
• If one trader stops responding or cheats, the arbitrator signs with the honest trader.
• The arbitrator alone cannot move funds, because one key is not enough.

Security deposits

Both traders usually lock a deposit on top of the trade amount. If you break the rules, for example by never paying, you can lose it. This is what makes scamming expensive. The exact percentage is set per offer and per network.

Fees

RetoSwap currently lists these trading fees:

The taker fees were raised in a May 2026 release that followed the exploit. Offers themselves are often priced above or below the market rate, so compare the final XMR amount, not just the fee line.

Before your first trade

1. Download from the official site only. Get the RetoSwap client from retoswap.com or its GitHub releases and verify the signature if you know how. Fake builds are a common way to steal funds from P2P traders.
2. Back up properly. The app has its own wallet. Write down its seed and back up the data directory, as the release notes recommend before upgrades.
3. Set a strong password for the application and keep the machine free of untrusted software.
4. Create payment accounts for the methods you will use, such as SEPA, a payment app or a crypto address. Use details you are comfortable sharing with your trade partner, because they will see them.
5. Decide on a starting amount you would be fine losing while you learn the flow.

The chicken-and-egg problem

Because deposits are paid in XMR, someone with no Monero at all could not normally take an offer. Haveno solves this with no-deposit offers: buyers can buy up to 1.5 XMR without posting a deposit. Since there is nothing at stake, sellers protect these offers with a passphrase that they share with you through some other channel. Look for them in the Buy XMR tab.

Step by step: buying XMR with fiat on RetoSwap

1. Open the Buy XMR tab and filter by your currency and payment method.
2. Check the offer. Look at the price relative to market, minimum and maximum amounts, the payment method and the maker’s trade history.
3. Take the offer. Your deposit (if any) and the seller’s XMR are locked into the multisig wallet.
4. Wait for confirmations. Monero deposits need 10 confirmations, roughly 20 minutes, before the trade proceeds. Do not pay before the app tells you to.
5. Send the payment exactly as instructed: correct amount, correct account, and the reference text the app shows (or none, if the seller asks for none).
6. Click “Payment sent” and keep proof such as a bank receipt or screenshot.
7. Wait for the seller to confirm receipt. Once they do, the multisig pays out your XMR and returns your deposit.
8. Move the XMR to your main wallet if you do not plan to trade again soon.

Crypto trades follow the same path, but payments settle on-chain, which is usually faster than a bank transfer.

Warning: Never agree to move a trade outside the app, pay to a different account than the one shown, or “add a note” with crypto words in a bank reference unless the seller explicitly requested it. These are classic signs of a scam or of a seller getting your payment flagged.

Creating your own offer

If you cannot find a good offer, you can become the maker. Makers pay the lower fee and set their own terms.

1. Open the Buy or Sell tab and start a new offer.
2. Pick the payment account you set up earlier.
3. Set the price. A percentage above or below the market price is usually better than a fixed number, because it tracks the market while your offer waits.
4. Set the amount range. A minimum and maximum make it easier for takers to match you.
5. Review the deposit you will lock, then publish.

Your offer only stays visible while your client is online, so leave the app running if you want it to be taken. When someone accepts it, the trade proceeds as described above.

Pricing realistically

P2P prices for XMR often sit a few percent above the market rate for fiat buys, reflecting the effort and risk sellers take on. Crypto pairs are usually closer to market. If your offer sits untaken for days, compare it with recent trades on Haveno Markets and adjust.

Disputes and arbitration

Most problems are delays, not fraud: a slow bank transfer, a weekend, a holiday. Start with the built-in trade chat. If that fails:

1. Open a dispute from the trade screen.
2. Submit evidence: payment receipts, screenshots, transaction IDs.
3. Wait for the arbitrator’s ruling. They decide how the multisig is paid out, using their key together with the trader the ruling favours.

Keep everything inside the app’s chat. Arbitrators can only judge what they can see.

Chargeback risk for sellers

If you sell XMR for fiat, reversible methods such as some payment apps carry chargeback risk: a buyer can claw back the payment after receiving your coins. Sellers often prefer bank transfers from accounts in the buyer’s name, cash by mail with video proof, or crypto.

What happened in May 2026

On 20 May 2026 an attacker exploited a flaw in how the Haveno trade protocol handled acknowledgement messages during multisig setup. By sending a forged message that appeared to come from the arbitrator, they could register their own address in the arbitrator’s place. Combined with the key they held as a trader, that gave them two of three keys. Security firms estimated losses of about 7,000 XMR, roughly $2.7 million at the time, mostly from large crypto trades. Fiat trades were reported as unaffected.

RetoSwap blocked the attacker, halted trading by forcing a client update, and resumed with patched versions. The Haveno and RetoSwap releases since then have:

• verified arbitrator signatures and dispute senders,
• required verified senders for trade setup messages,
• added replay protection for dispute messages,
• tightened payout address and fee validation,
• blocked peers on the wrong Haveno network.

The current RetoSwap desktop release at the time of writing is v1.12.0-reto.

Key point: Non-custodial means no company can run off with your money. It does not mean the code cannot have bugs. Update promptly, and size each trade so that a single failure would hurt but not ruin you.

Haveno compared with other P2P options

Bisq’s own May 2026 incident drained about 11.6 BTC from altcoin offers; affected users were reimbursed and XMR auto-confirmation was disabled pending an audit.

Practical tips from experienced traders

• Check liquidity first. Some fiat currencies have only a few offers. Haveno Markets shows recent trade counts per market.
• Trade during banking hours if you use bank transfers.
• Use a dedicated payment account if your bank dislikes crypto-related transfers.
• Keep the app running while a trade is open so messages and confirmations arrive.
• Read the network’s rules on penalties and dispute timelines before your first trade.

For other routes into XMR, see the Buy, Sell & Swap section. For hardening the computer you trade on, see Privacy & OpSec.