P2P Monero Trading Safety: A 2026 Checklist to Avoid Scams

Peer-to-peer trading is how a large share of Monero changes hands now that most exchanges have stepped back. P2P tools remove the company that could freeze your account, but they also remove the company that would refund you after a mistake. This checklist pulls together the scams and failures Monero traders run into most often, and the habits that prevent them.

Why P2P needs its own safety habits

With an exchange, you trust one company and most risks are about that company. With P2P trading, you deal with a new stranger each time, and your protection comes from three things:

• the software’s escrow, such as Haveno’s 2-of-3 multisig or Bisq’s multisig on Bitcoin,
• the arbitration process, if something goes wrong,
• your own discipline in following the trade flow.

The first two only work if you do the third. Almost every loss story involves someone stepping outside the normal flow.

The main threats

Lessons from May 2026

Two of the main P2P systems had serious incidents within weeks of each other.

Bisq

On 1 May 2026, an attacker used a modified Bisq 1 client to exploit missing validation of a fee value, which caused makers to build incorrect multisig outputs. Open altcoin offers were targeted, and losses totalled about 11.59 BTC across ten users. Bisq shipped fixes in version 1.10.0, affected users were reimbursed in June through a volunteer group, and XMR auto-confirmation was disabled until a security audit is done. Bisq 2 was not affected.

Haveno and RetoSwap

On 20 May 2026, an attacker abused the way the Haveno protocol handled acknowledgement messages during multisig setup. A forged message let them pose as the arbitrator and gain a second key to trade wallets. Losses were estimated at about 7,000 XMR, mainly in large crypto trades. RetoSwap halted trading, blocked the attacker and resumed with patched clients; later Haveno releases added many sender, signature and replay checks.

What traders should take away

• Non-custodial is not the same as bug-free. Escrow designs remove counterparty custody but cannot rule out software flaws.
• Big trades were the targets. Splitting large amounts limits what any single exploit can take.
• Fast reaction helped. Users who pulled their offers when warnings appeared were safer.
• Updates matter. Both projects shipped fixes; running an old client keeps you exposed.

Set up a safer trading environment

Many losses start before the first trade, on a computer that was never fit to hold money. A little preparation removes whole categories of risk.

Use a clean device or user account

Trading clients keep a hot wallet on your machine. Malware that can read your files or your clipboard can steal from it or swap addresses as you paste them. If you can, use a dedicated computer or at least a separate user account that does not run games, pirated software or random browser extensions.

Keep the software current

Turn on update notifications where the client offers them and check the official releases page before each trading session. In 2026 both Haveno and Bisq shipped security fixes within weeks of an exploit; the gap between a fix being released and you installing it is the window attackers rely on.

Back up correctly

Write down the wallet seed on paper and store it somewhere safe and offline. Back up the application’s data directory before upgrades, as RetoSwap’s release notes recommend. A backup you have never tested is a guess, so check you can find and read it.

Protect your clipboard and addresses

Before sending any payment or confirming any address, compare the first and last several characters with what the app shows. Clipboard hijackers rely on people only glancing at the start of an address.

Separate your trading money

Keep only what you plan to trade in the trading client. Hold the rest in a separate wallet, ideally on a hardware device. If something goes wrong with the trading machine, the damage is capped. The wallets section covers suitable options.

The pre-trade checklist

Work through this before every new trade, or at least every new counterparty.

1. Is my client the latest official release? Check the network’s site or GitHub releases page, not a link someone sent you.
2. Did I verify the download? Use the published signatures or hashes if you can.
3. Is my seed written down offline and never typed into any website or chat?
4. Do I understand the trade flow for this payment method, including when I should pay or release?
5. Is the amount one I could afford to lose if something unexpected happens?
6. Does the counterparty have a history on this network? New accounts are not automatically bad, but caution is wise.
7. Is the payment method reversible? If I am selling, can the buyer take the money back later?
8. Have I checked the network’s announcements for any active warnings?

During the trade

1. Never pay before the escrow is funded and confirmed. On Haveno, Monero needs 10 confirmations, about 20 minutes.
2. Pay exactly as specified, from an account in your own name, with the reference the app shows.
3. Keep all communication in the trade chat. Arbitrators can only rely on what they can see.
4. Never release XMR on the strength of a screenshot. Log in to your bank or wallet and check yourself.
5. Check the payer’s name against your trade partner’s name for bank transfers.
6. Do not let anyone rush you. Urgency is a pressure tactic.

Warning: If a counterparty asks you to cancel the trade and “do it directly” to avoid fees, they are asking you to give up the escrow that protects you. Decline and, if they persist, report them to the network’s arbitrators.

If something goes wrong

1. Stay calm and stay in the app. Explain the problem in the trade chat.
2. Gather evidence: payment receipts, transaction IDs, timestamps.
3. Open a dispute if the trade cannot be completed. The arbitrator reviews both sides and signs the payout with the honest party.
4. Ignore private messages from anyone offering to recover funds. “Recovery services” are a well-known second wave of scams.
5. During an active incident, remove open offers and wait for official guidance before trading again.

Cash and classified trades

Classified marketplaces such as XMRBazaar list cash-for-XMR offers alongside goods and services. Listings show whether escrow or a bond is available; uninsured direct-payment listings put all the risk on whoever pays first.

For in-person trades:

• keep amounts small, especially with new contacts,
• meet in a busy public place, ideally with a friend,
• check notes before releasing XMR,
• do not reveal how much XMR you hold or where you live,
• prefer listings with escrow or a bond.

Protecting your identity while trading

P2P trading avoids handing ID to a platform, but your counterparty will often see your bank name or payment-app handle. A few habits help:

• Use Tor-based clients such as Haveno and Bisq, which hide your IP address from peers.
• Use a fresh subaddress for each XMR you receive.
• Keep trading and everyday identities separate where your local law allows.

The Privacy & OpSec section goes deeper into these topics.

Key point: In P2P trading, the software protects you only while you follow its rules. Stay in the app, check payments yourself, keep the client updated, and size every trade so a mistake is survivable.

Quick reference

• Official download only, latest version.
• Seed offline, never shared.
• Escrow funded and confirmed before paying.
• Payment checked in your own account before releasing.
• Payer name matches trade partner.
• No off-platform deals, no “support” DMs.
• Large amounts split into smaller trades.

For guides to specific platforms and routes, see the Buy, Sell & Swap section.