{
  "count": 3,
  "generated_at": "2026-05-21T14:35:20.261Z",
  "docs": "https://www.xmr.club/incidents",
  "items": [
    {
      "provider_id": "haveno",
      "name": "Haveno",
      "category": "exchanges",
      "grade": "A",
      "provider_url": "https://www.xmr.club/exchanges/haveno",
      "incident": {
        "date": "2026-05-20",
        "severity": "high",
        "summary": "Protocol-level exploit using fake arbitrator-ACK messages — approximately 7,000 XMR (~$2.7M) lost from active offers across Haveno operators. Lead developer woodser advised halting all trades network-wide pending a protocol patch.",
        "curator_advice": "Don't open new offers on any Haveno operator (Reto, Mainnet, etc.) until the patch ships and your client reports a min-version bump. If you have outstanding offers, back up your wallet and follow your operator's advisory.",
        "source_url": "https://haveno.exchange"
      }
    },
    {
      "provider_id": "retoswap",
      "name": "RetoSwap",
      "category": "exchanges",
      "grade": "A",
      "provider_url": "https://www.xmr.club/exchanges/retoswap",
      "incident": {
        "date": "2026-05-20",
        "severity": "high",
        "summary": "Affected as a Haveno operator by the protocol-level fake-arbitrator-ACK exploit. RetoSwap's own infrastructure was NOT breached; they banned the attacker's onion address and enforced a minimum client version to pause trading.",
        "curator_advice": "Same as the Haveno protocol advisory — don't open new trades until the patched client ships. Existing balances are safe; offers in flight are at risk.",
        "source_url": "https://retoswap.com"
      }
    },
    {
      "provider_id": "thorchain",
      "name": "THORChain",
      "category": "exchanges",
      "grade": "A",
      "provider_url": "https://www.xmr.club/exchanges/thorchain",
      "incident": {
        "date": "2026-05-15",
        "severity": "high",
        "summary": "TSS-key cryptography flaw exploited — approximately $10.8M drained from POL vaults across BTC/ETH/BNB/Base. Trading + signing paused by the protocol.",
        "curator_advice": "Don't open new trades until THORChain unpauses. XMR pool may resume earlier than EVM legs — confirm pool status on /thorchain or the protocol's own dashboard before swapping.",
        "source_url": "https://thorchain.org/blog/thorchain-exploit-report-1"
      }
    }
  ]
}