2025-04-20T11:11:20Z https://njump.cloud.vinney.xyz openmonero https://njump.cloud.vinney.xyz/npub139xxrl297wzdmty5snyjc7sypdzsnpglzzhtk86lddfq7u4ry9xqg3g46d https://openmonero.com/images/om-64.webp https://openmonero.com/images/om-64.webp https://njump.cloud.vinney.xyz/nevent1qqst2pl8stx0accjvvjd04kefz8z2g24wj6ftz9pslj6hyx28t5hquqzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5cq5uaad How bad actors try to track Monero<br/><br/>Depending on your operational security, the combination of the various attack types in this article may reduce your privacy significantly, to get the real spend in a ring signature.<br/><br/>These methods have been used to arrest the Incognito Market admin, the operators of Archetyp, a Colombian drug dealer, a Finnish blackmailer, the Bitfinex hacker and 18 Japanese fraudsters.<br/><br/>---<br/><br/># Eve-Alice-Eve attack<br/><br/>This one’s like a sneaky collusion trick. Two parties (both called Eve) team up to figure out who’s behind a transaction with Alice. Eve1 sends Monero to Alice in one transaction; Eve2 receives Monero from Alice in another.<br/><br/>They compare their transaction records, if Eve1’s address shows up in Eve2’s ring signature, or if amounts and times match up, they can pretty confidently say Alice was involved. Repeating this over and over makes their case even stronger.<br/><br/>---<br/><br/># Poisoned output attack<br/><br/>Think of this like &#34;marked bills&#34; in the physical world. Here, the attacker &#34;poisons&#34; some Monero outputs, either with a unique amount or a specific pubkey, and then watches to see if those outputs get sent to someone who knows the identity of those who send them monero, and who has agreed to share data with the attacker to help identify the target.<br/><br/>If the target sends that marked Monero to a known colluder, the attacker can identify who sent it. Repeated use helps build a stronger case.<br/><br/>---<br/><br/># Timing analysis attack<br/><br/>Sometimes, targets try to dodge the poisoned output trap by splitting amounts or churning (sending to new addresses repeatedly). But if they’re doing this on a regular schedule, attackers can catch on by watching the timing between transactions.<br/><br/>For example, if an attacker notices that every Tuesday, a certain person receives Monero and then quickly sends it out again, that pattern can reveal who they are, even if they try to hide it.<br/><br/>Anti-privacy adversaries can leverage timing information to increase the probability of guessing the real spend in a ring signature to approximately 1-in-4.2 instead of 1-in-16.<br/><br/>---<br/><br/># Decoy elimination attack<br/><br/>This trick is handy if someone has a list of transaction IDs and thinks their target sent Monero in those transactions. They might get this list by scanning the blockchain for transactions that include a special kind of public key known to belong to the target, or from someone who’s interacted with the target a few times, like an exchange or a store.<br/><br/>Once they have the list, they can look up those transactions and check the signatures inside them. These signatures include a bunch of public keys used to hide who actually sent the money. The attacker checks if any of those keys are theirs or someone they know. If they find a match, they can ask the owner if they made that transaction. If not, then that key was just a decoy, not the real sender.<br/><br/>This method helps the attacker narrow down the possible real sender. In the worst case, they can remove all the fake keys and figure out exactly who sent the Monero. From there, they might trace the transaction back or forward, using the same or different techniques, to follow the money’s trail.<br/><br/>---<br/><br/># Spy node attack<br/><br/>Monero transactions are broadcast through nodes, some are run by honest users, others by malicious actors (spy nodes). If your wallet sends transactions through a spy node, they might log your IP address, which can then be linked to your transaction and real identity.<br/><br/>Full nodes try to protect you with protocols like Dandelion++, but they’re not perfect. Attackers can exploit this by seeing if a transaction is still in its &#34;stem&#34; phase, which can leak your IP.<br/><br/>---<br/><br/># Tx history lookup attack<br/><br/>If an attacker manages to get hold of your private keys (say, during a raid or if you accidentally share them), they can look up your entire transaction history on the blockchain. This helps them see all the Monero you’ve received and sent.<br/><br/>References:<br/><a href="https://www.getmonero.org/2025/04/05/ospead-optimal-ring-signature-research.html">https://www.getmonero.org/2025/04/05/ospead-optimal-ring-signature-research.html</a><br/><a href="http://openmonero.com/knowledge/how-bad-actors-try-to-track-monero">http://openmonero.com/knowledge/how-bad-actors-try-to-track-monero</a><br/><br/>#Privacy #Markets #HiddenService #News #Work #Monero #Crypto #Hacking #HarmReduction #Guides #Bisq #cakewallet #haveno #retoswap #trading #p2p #escrow #localmonero #dex #cex #moneroju #xmrbaazar #security #agorism #cypherphunk #rugpull #transparency #stats 2025-07-23T08:24:01Z https://njump.cloud.vinney.xyz/nevent1qqsg5e2qsc9ep6qvshvthvjfscfdanjds24vgnnplaxd7anpcu4arsqzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5c7du4wk In reply to <a href='/nevent1qqs8vysmj30emrwrgtkr7lzleqg0w023k4pw2lza950p2jvl25cuyqqpz4mhxue69uhhyetvv9ujuerpd46hxtnfduhswm0e79'>nevent1q…0e79</a><br/>_________________________<br/><br/>Centralization of XMR market and tracking every transaction<br/><br/>Recent research conducted by the Weizenbaum Institute, TRM Labs (San Franciso) and TU Berlin indicate that Retoswap, formerly known as Haveno-Reto, does not provide the privacy protections it advertises. Despite its marketing claims, this platform functions as a sophisticated decoy. The narrative of being non-custodial and decentralized is a carefully crafted illusion designed to attract unsuspecting users and foster a false sense of security.<br/><a href="https://xcancel.com/noosphere888x2/status/1922044150716715102#m">https://xcancel.com/noosphere888x2/status/1922044150716715102#m</a><br/><br/>Darknet operators who assume Retoswap is suitable for laundering should reconsider. Their activities are under constant surveillance. The supposed privacy offered by Retoswap is an illusion.<br/><br/>Retoswap Trades Are Fully Traceable<br/><br/>&gt; To test our findings, we logged Haveno trades for two weeks and executed five test trades within the observation period. For all five transactions, we successfully identified all XMR transactions.<br/>Additionally, we demonstrate that Haveno trades leave detectable on-chain footprints, allowing cross-chain transaction linking.<br/><br/>Source: <a href="https://arxiv.org/pdf/2505.02392">https://arxiv.org/pdf/2505.02392</a><br/><br/>&gt; Haveno has been discussed in greater detail as it evolved to one of the most prominent exchanges in the context of Monero. While strong promises claim privacy with every transaction and independence from any central authority, the current implementation raises uncertainty. Our analysis showed detectable on-chain patterns and weaknesses in the platform that can be exploited to match transactions across chains. <br/><br/>It is noteworthy that some of the most active dark web exchanges, administrators, vendors, and key figures may have already utilized Retoswap to launder illicit gains or transfer substantial amounts of BTC and XMR. These individuals often believe their anonymity is safeguarded due to the platform’s purported decentralization. However, all Retoswap crypto-to-crypto transactions are inherently traceable.<br/><br/>Retoswap has apparently handled over 50 million dollars in transactions, which is pretty impressive considering it’s been around for less than a year. It looks like big players like hackers, darknet admins, and other underground groups are already using it to move big amounts of money.<br/>Source: <a href="https://xcancel.com/RetoSwap/status/1930953817228481022#m">https://xcancel.com/RetoSwap/status/1930953817228481022#m</a><br/><br/>While speculative, there are reasons to suspect that recent LE actions may not be coincidental. Authorities have tracked down major operators, likely due to the on-chain trail left by Retoswap activities. According to haveno.markets, approximately 90% of liquidity involves BTC-XMR swaps, transactions that are fully traceable. Every transaction is publicly recorded on-chain with exact timestamps, amounts, and payment methods, leaving a permanent digital footprint.<br/><br/>&gt; While trade statistics provide valuable metrics for users, their network propagation should be obfuscated to preserve trade privacy.<br/><br/>Source: <a href="https://arxiv.org/pdf/2505.02392">https://arxiv.org/pdf/2505.02392</a><br/><br/>In summary, admins of coin-swap services can easily monitor BTC to XMR trades. But usually, it’s not a big deal because users trust these providers not to share details like timestamps, amounts, or other info. On the flip side, with platforms like Retoswap, anyone can potentially track transactions, it’s not just the admins. That’s because haveno.markets openly shares trade stats, making it easier for third parties to analyze and follow the transactions.<br/><br/>May freeze or seize funds<br/><br/>Retoswap runs on Haveno, which is a decentralized, non-custodial multi-sig exchange. That’s true because your private key is generated locally, so only you have access to your funds in the Haveno wallet.<br/><br/>However, to publish a sell offer, a vendor must lock up coins (15% security deposit and the trade amount). These funds can potentially be frozen or seized because the admin can easily have two keys required to sign a transaction. The haveno FAQ suggests that the admin/arbiter only has one key, but in practice, anyone can become a taker, there is practically nothing preventing the admin from possessing two keys.<br/><br/>Some users have spoken out about this openly on platforms like Nostr, Reddit, and others, raising concerns about potential exit scams in how the system is set up. So, it’s worth being aware of these issues before jumping in.<br/><br/><a href="https://rl.bloat.cat/r/Monero/comments/1h4icot/is_haveno_anymore_secure_than_trading_with_a/">https://rl.bloat.cat/r/Monero/comments/1h4icot/is_haveno_anymore_secure_than_trading_with_a/</a><br/><a href="https://archive.ph/gSRVs#25%">https://archive.ph/gSRVs#25%</a><br/><br/>Centralization of XMR market and tracking every transaction<br/>Retoswaps objective appears to be the centralization of XMR liquidity through their unique setup with pre-funded offers. Furthermore, Woodser (developer associated with Haveno) has not addressed the rugpuller bot issue that I initially identified six months ago. This is not due to incompetence but rather suggests a lack of independence, as the Reto guy has accepted donations from questionable sources. Such actions raise concerns about the integrity of the haveno development process.<br/>Source: link to shortwavesurfer about donations<br/><br/>Quote mister_monster:<br/>&gt; So, Reto has basically no fees right now. They don’t really benefit financially from being the only haveno network with liquidity. Yet, [b]it does seem that they do want to have a monopoly position within our community[b]. <br/><br/><br/>Source: <a href="https://monero.town/post/5172146">https://monero.town/post/5172146</a><br/><br/>Amazon used the same tactic to take over the market, operating at a loss and funded by questionable sources until competitors were pushed out. Now, this new platform is promising decentralization, non-custodial transactions, and privacy. But the reality is, none of that seems to hold up. It&#39;s all about crushing the competition and cornering the XMR market, and tracking every transaction? That&#39;s not exactly a recipe for trust. It might not be a honeypot, but it sure smells a lot like one. Proceed with extreme caution.<br/><br/>Discuss on dread: <a href="http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/be82f1a0c5e0f79f6dbb">http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/be82f1a0c5e0f79f6dbb</a><br/><br/>#Privacy #Markets #HiddenService #News #Work #Monero #Crypto #Hacking #HarmReduction #Guides #Bisq #cakewallet #haveno #retoswap #trading #p2p #escrow #localmonero #dex #cex #moneroju #xmrbaazar #security #agorism #cypherphunk #rugpull #transparency #stats 2025-07-09T17:59:24Z https://njump.cloud.vinney.xyz/nevent1qqs06hzzafd93m7fa0q7r2nk3tnxju8n2xpql7jfv2whe7pntxffv0qzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5cqtnnr8 openmonero.markets VS. haveno.markets<br/><br/>I still can&#39;t get over how haveno.markets shows both the time and amount (XMR) for each trade, which could allow timing attacks and hurt user privacy. On the other hand, openmonero.markets doesn’t show any trade times or amounts.<br/><br/>#Privacy #Markets #HiddenService #News #Work #Monero #Crypto #Hacking #HarmReduction #Guides #Bisq #cakewallet #haveno #retoswap #trading #p2p #escrow #localmonero #dex #cex #moneroju #xmrbaazar #security #agorism #cypherphunk #rugpull #transparency #stats<br/> 2025-07-03T07:58:20Z https://njump.cloud.vinney.xyz/nevent1qqsp7deg7jg48wg3p54dfeq76kyy37hvae45zpv2c320menz2x8xlegzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5c0a0m2a We are pleased to announce the launch of a dedicated statistics and market data page, offering comprehensive information for users.<br/><br/>URL: <a href="https://openmonero.com/markets">https://openmonero.com/markets</a><br/><br/>DONE: xmr/usd, liquidity, top markets, daily volume, sell offers, buy offers, registered users, active vendors, top payment methods, latest trades, total trades, total volume, trades last 30d/24h/yesterday/today, volume last 30d/24h/yesterday/today<br/><br/>COMING SOON: average trade finalization time, top vendors<br/><br/>If you&#39;re worried about timing attacks, I&#39;ve taken out the timestamp, username and amount details from the latest trades table to help protect your privacy. <br/><br/>#Privacy #Markets #HiddenService #News #Work #Monero #Crypto #Hacking #HarmReduction #Guides #Bisq #cakewallet #haveno #retoswap #trading #p2p #escrow #localmonero #dex #cex #moneroju #xmrbaazar #security #agorism #cypherphunk #rugpull #transparency #stats 2025-07-02T13:58:25Z https://njump.cloud.vinney.xyz/nevent1qqsfqxkphj3fs9x3plnzzkw3pc5hstv62kzg4hsk9jtj9vztv7fsvkczyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5cmduyqa In reply to <a href='/nevent1qqs077ye6457dmh5nlysp5vq65arvfay8qw7ryllxydcpmjl3er95mspr4mhxue69uhkummnw3ezucnfw33k76twv4ezuum0vd5kzmp0l6w3qe'>nevent1q…w3qe</a><br/>_________________________<br/><br/>It is easy to fix the rug pull issue if they just disable pre-funded offers and allow each maker to fund the trade after a taker request instead. However, they aren&#39;t interested in doing so, since it would significantly decrease liquidity. 2025-06-18T09:07:04Z https://njump.cloud.vinney.xyz/nevent1qqstfk879j7974mkx3tfspzs70xlm4rk4e5r5q0vupym2u9egm04dvqzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5c7u92rq How can anyone honestly think that locked haveno coins are truly in self-custody? In reality, bad haveno arbiters could easily pretend to be legit takers and get the 2/3 majority needed to approve a transaction, which could lead to theft. Even worse, admin bots could just wipe out the whole haveno order book with ease. This issues has been confirmed by official dread mods and some reddit users.<br/><br/>Quote SaberhagenTheNameless: <br/>...afaict Haveno/Retoswap, in it&#39;s current state, has more at risk from rugpulls than necessary - currently over a million USD at stake.<br/>Sell offers are sitting there waiting to be automatically locked into a 2/3 multisig once taken (from potentially malicious admins controlling arbitrator/taker bots meaning they would have enough keys to steal)<br/>Right now nothing is really preventing admins from sweeping the entire orderbook on the sell side.<br/>Source: <a href="https://primal.net/e/nevent1qqsy7hmx9n2ws94x92ftvc44ylkejyg8ygw9z9pt4eswj44yqewp3jcpzamhxue69uhkvet9v3ejumn0wd68ytnzv9hxgtcppemhxue69uhkummn9ekx7mp0qy08wumn8ghj7mn0wd68yttsw43zuam9d3kx7unyv4ezumn9wshs0gztdf">https://primal.net/e/nevent1qqsy7hmx9n2ws94x92ftvc44ylkejyg8ygw9z9pt4eswj44yqewp3jcpzamhxue69uhkvet9v3ejumn0wd68ytnzv9hxgtcppemhxue69uhkummn9ekx7mp0qy08wumn8ghj7mn0wd68yttsw43zuam9d3kx7unyv4ezumn9wshs0gztdf</a><br/>Cached: <a href="https://archive.ph/JOqDC#25%">https://archive.ph/JOqDC#25%</a><br/><br/>Quote shortwavesurfer2009:<br/>The way it would work would be that an arbitrator would create a bot to take the offers and then use the key from the taker bot and their arbitrator key to steal the escrow which contains the seller&#39;s Monero plus their security deposit.<br/>Source: <a href="https://primal.net/e/nevent1qqs0h2fvwvcsg58l6xw9hwpav4kk3vry933rrm6pparrf0s7p9rel6gpz4mhxue69uhkg6t5w3hjuur4vghhyetvv9uszyrhwden5te0v5hxummn9ekx7mp0qythwumn8ghj7en9v4j8xtnwdaehgu3wvfskuep0mvpr6f">https://primal.net/e/nevent1qqs0h2fvwvcsg58l6xw9hwpav4kk3vry933rrm6pparrf0s7p9rel6gpz4mhxue69uhkg6t5w3hjuur4vghhyetvv9uszyrhwden5te0v5hxummn9ekx7mp0qythwumn8ghj7en9v4j8xtnwdaehgu3wvfskuep0mvpr6f</a><br/>Cached: <a href="https://archive.ph/gSRVs#25%">https://archive.ph/gSRVs#25%</a><br/><br/>Quote /u/WoodenInformation730: <br/>The arbitrators could rug the whole orderbook (all sell offers and security deposits) by taking all the offers at once.<br/>Source: <a href="https://rl.bloat.cat/r/Monero/comments/1l5jkp2/openmonerocom_got_hacked_as_reported_in_their/mwp7yhn/?context=3#mwp7yhn">https://rl.bloat.cat/r/Monero/comments/1l5jkp2/openmonerocom_got_hacked_as_reported_in_their/mwp7yhn/?context=3#mwp7yhn</a><br/>Cached: <a href="https://archive.ph/icuxp#65%">https://archive.ph/icuxp#65%</a><br/><br/>Quote: /u/monero_desk_support: <br/>After some thoughts, I think you are right and that the arbitration system in Haveno doesn&#39;t prevent arbitrators from pulling the funds. They would need to create a bot that takes all the offers and automatically unlock the funds with the key of the taker and arbitrator<br/>Source: <a href="http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/4e7e530582ff902b6903/#c-cac5570453f7fa9f42">http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/4e7e530582ff902b6903/#c-cac5570453f7fa9f42</a><br/><br/>Quote /u/geonic_ (Monero Outreach Producer): <br/>Reto has been around for a few milliseconds basically and nothing stops the network operators from creating fake orders if the pot gets big enough. A network would have to be operating successfully for a few years before I trust it with any significant amounts.<br/>Source: <a href="https://rl.bloat.cat/r/Monero/comments/1h4icot/is_haveno_anymore_secure_than_trading_with_a/m0ae3rk/?context=3#m0ae3rk">https://rl.bloat.cat/r/Monero/comments/1h4icot/is_haveno_anymore_secure_than_trading_with_a/m0ae3rk/?context=3#m0ae3rk</a><br/>Cached: <a href="https://archive.ph/bB1VN#84%">https://archive.ph/bB1VN#84%</a><br/><br/>Quote /u/WoodenInformation730: To post an offer, you have to deposit the amount + security deposit. If an arbitrator acts maliciously, they could take an offer and essentially steal the funds by signing the 2/3 multisig transaction, since they&#39;d have two keys.<br/>Source: <a href="https://rl.bloat.cat/r/Monero/comments/1l5jkp2/openmonerocom_got_hacked_as_reported_in_their/mwj10k3/?context=3#mwj10k3">https://rl.bloat.cat/r/Monero/comments/1l5jkp2/openmonerocom_got_hacked_as_reported_in_their/mwj10k3/?context=3#mwj10k3</a><br/>Cached: <a href="https://archive.ph/icuxp#45%">https://archive.ph/icuxp#45%</a><br/><br/>Quote /u/jossfun:<br/>Haveno relies upon arbitration by the network you’re operating on. In a case where the arbitrators act maliciously they can create trades where they control 2/3 keys to seize funds.<br/>Source: <a href="https://rl.bloat.cat/r/Monero/comments/1h4icot/is_haveno_anymore_secure_than_trading_with_a/">https://rl.bloat.cat/r/Monero/comments/1h4icot/is_haveno_anymore_secure_than_trading_with_a/</a><br/>Cached: <a href="https://archive.ph/bB1VN">https://archive.ph/bB1VN</a><br/><br/>#Privacy #Markets #HiddenService #News #Work #Monero #Crypto #Hacking #HarmReduction #Guides #Bisq #cakewallet #haveno #retoswap #trading #p2p #escrow #localmonero #dex #cex #moneroju #xmrbaazar #security #agorism #cypherphunk #bitcoin #btc #decentralized #nostr #moneroju<br/> 2025-06-17T16:56:20Z https://njump.cloud.vinney.xyz/nevent1qqsyvg9ja8ds9qj4q4n7fyu9lqmu73cllpaqjz9m83p7884w99dz3zszyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5c9pxfpg In reply to <a href='/nevent1qqsqqqyr27hlhcwul5qp5rm5lf8d8kcmhs5z54sg7c0zqwrddznaedgpr4mhxue69uhkummnw3ezucnfw33k76twv4ezuum0vd5kzmp0q0936e'>nevent1q…936e</a><br/>_________________________<br/><br/>2 new repos have been released last week and the code is fully built on top of NOSTR. <br/><br/>Frontend: <a href="http://rf5cqoxqlitdx4umuce5dgihjzabql4hs3zjkvs3em7xzjfa5yyhkeqd.onion/om/openmonero-dex">http://rf5cqoxqlitdx4umuce5dgihjzabql4hs3zjkvs3em7xzjfa5yyhkeqd.onion/om/openmonero-dex</a><br/>Backend: <a href="http://rf5cqoxqlitdx4umuce5dgihjzabql4hs3zjkvs3em7xzjfa5yyhkeqd.onion/om/openmonero-dex-api">http://rf5cqoxqlitdx4umuce5dgihjzabql4hs3zjkvs3em7xzjfa5yyhkeqd.onion/om/openmonero-dex-api</a><br/>Demo: <a href="http://ek72x7tysgkrr754ce4np4e6ce5rtwtxphxibzmesnsbuyco5onlc5id.onion/">http://ek72x7tysgkrr754ce4np4e6ce5rtwtxphxibzmesnsbuyco5onlc5id.onion/</a> 2025-06-17T16:11:15Z https://njump.cloud.vinney.xyz/nevent1qqstjhyx3a03zqru26mwtegh0ufht0zg43kfqvtxrrcvy7afu92s4aqzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5c5z2mqc In reply to <a href='/nevent1qqsy7hmx9n2ws94x92ftvc44ylkejyg8ygw9z9pt4eswj44yqewp3jcpz4mhxue69uhhyetvv9ujuerpd46hxtnfduhsxftykt'>nevent1q…tykt</a><br/>_________________________<br/><br/>The haveno rugpull amount according to my calc is USD 2.5 millions <br/>NOTE: the security deposits from haveno market markers are part of the pot as well<br/><br/>XMR/USD according to haveno.markets<br/>$283.10<br/><br/>Liquidity according to haveno.markets<br/>7,474.47 XMR<br/><br/>15% security deposits = Liquidity x 15/100<br/>1121.17 XMR<br/><br/>rugpull amount = liquidity + 15% security deposits<br/>rugpull amount = 7,474.47 + 1121.17 XMR<br/>rugpull amount = 8595,64 XMR = 2,433,425.68 USD<br/><br/>#Privacy #Markets #HiddenService #News #Work #Monero #Crypto #Hacking #HarmReduction #Guides #Bisq #cakewallet #haveno #retoswap #trading #p2p #escrow #localmonero #dex #cex #moneroju #xmrbaazar #security #agorism #cypherphunk #bitcoin #btc #decentralized #nostr #moneroju 2025-06-17T07:52:15Z https://njump.cloud.vinney.xyz/nevent1qqsp9uqrcvp38c5ch9xaa9u8e3rgq3aurp5qadyqkea5vdutgrnrgdqzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5cjl6sv7 In reply to <a href='/nevent1qqsxcmwkx26f0kmzqy9dmjhjm4j7h26f09v53s6azglwwagd2lvykucpzpmhxue69uhk2tnwdaejumr0dshs7mgkzf'>nevent1q…gkzf</a><br/>_________________________<br/><br/>Haveno’s multi-sig trading only protects trades that have already been accepted, which is about 1% of all the liquidity. The rest, like open offers, aren’t protected and could potentially be taken or misused by the admins. So, it’s confusing why some people still see Haveno as a fully self-custodial exchange, when in reality, it’s more like a centralized liquidity platform.<br/><br/>For a more detailed understanding, please read the section about self-custodial trade funding:<br/><a href="https://openmonero.com/faq#self-custodial-trading-funding">https://openmonero.com/faq#self-custodial-trading-funding</a><br/><br/>#Privacy #Markets #HiddenService #News #Work #Monero #Crypto #Hacking #HarmReduction #Guides #Bisq #cakewallet #haveno #retoswap #trading #p2p #escrow #localmonero #dex #cex #moneroju #xmrbaazar #security #agorism #cypherphunk #bitcoin #btc #decentralized #nostr #moneroju 2025-06-14T23:59:36Z https://njump.cloud.vinney.xyz/nevent1qqsp22enxa4xtw2xksljwhaswt7dwrvmyvhpcev6jvqzdstjujj3rsqzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5cdhyxs3 In reply to <a href='/nevent1qqsxcmwkx26f0kmzqy9dmjhjm4j7h26f09v53s6azglwwagd2lvykucpzpmhxue69uhk2tnwdaejumr0dshs7mgkzf'>nevent1q…gkzf</a><br/>_________________________<br/><br/>How can anyone honestly think that locked haveno coins are truly in self-custody? In reality, bad haveno arbiters could easily pretend to be legit takers and get the 2/3 majority needed to approve a transaction, which could lead to theft. Even worse, admin bots could just wipe out the whole haveno order book with ease. This issues has been confirmed by official dread mods and some reddit users.<br/><br/>Quote /u/WoodenInformation730: <br/>The arbitrators could rug the whole orderbook (all sell offers and security deposits) by taking all the offers at once.<br/>Source: <a href="https://rl.bloat.cat/r/Monero/comments/1l5jkp2/openmonerocom_got_hacked_as_reported_in_their/mwp7yhn/?context=3#mwp7yhn">https://rl.bloat.cat/r/Monero/comments/1l5jkp2/openmonerocom_got_hacked_as_reported_in_their/mwp7yhn/?context=3#mwp7yhn</a><br/><br/>Quote: /u/monero_desk_support: <br/>After some thoughts, I think you are right and that the arbitration system in Haveno doesn&#39;t prevent arbitrators from pulling the funds. They would need to create a bot that takes all the offers and automatically unlock the funds with the key of the taker and arbitrator<br/>Source: <a href="http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/4e7e530582ff902b6903/#c-cac5570453f7fa9f42">http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/4e7e530582ff902b6903/#c-cac5570453f7fa9f42</a><br/><br/>Quote /u/geonic_ (Monero Outreach Producer): <br/>Reto has been around for a few milliseconds basically and nothing stops the network operators from creating fake orders if the pot gets big enough. A network would have to be operating successfully for a few years before I trust it with any significant amounts.<br/>Source: <a href="https://rl.bloat.cat/r/Monero/comments/1h4icot/is_haveno_anymore_secure_than_trading_with_a/m0ae3rk/?context=3#m0ae3rk">https://rl.bloat.cat/r/Monero/comments/1h4icot/is_haveno_anymore_secure_than_trading_with_a/m0ae3rk/?context=3#m0ae3rk</a><br/><br/>Quote /u/WoodenInformation730: To post an offer, you have to deposit the amount + security deposit. If an arbitrator acts maliciously, they could take an offer and essentially steal the funds by signing the 2/3 multisig transaction, since they&#39;d have two keys.<br/>Source: <a href="https://rl.bloat.cat/r/Monero/comments/1l5jkp2/openmonerocom_got_hacked_as_reported_in_their/mwj10k3/?context=3#mwj10k3">https://rl.bloat.cat/r/Monero/comments/1l5jkp2/openmonerocom_got_hacked_as_reported_in_their/mwj10k3/?context=3#mwj10k3</a><br/><br/>Quote /u/jossfun:<br/>Haveno relies upon arbitration by the network you’re operating on. In a case where the arbitrators act maliciously they can create trades where they control 2/3 keys to seize funds.<br/>Source: <a href="https://rl.bloat.cat/r/Monero/comments/1h4icot/is_haveno_anymore_secure_than_trading_with_a/">https://rl.bloat.cat/r/Monero/comments/1h4icot/is_haveno_anymore_secure_than_trading_with_a/</a><br/><br/>#Privacy #Markets #HiddenService #News #Work #Monero #Crypto #Hacking #HarmReduction #Guides #Bisq #cakewallet #haveno #retoswap #trading #p2p #escrow #localmonero #dex #cex #moneroju #xmrbaazar #security #agorism #cypherphunk #bitcoin #btc #decentralized #nostr #moneroju<br/> 2025-06-14T07:07:48Z https://njump.cloud.vinney.xyz/nevent1qqs97jm0jh47gzs4gfjmjyuae2fd3x6tmyqge292tgn3ftdafv9x7kqzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5c6h30ze In reply to <a href='/nevent1qqs0f23s5av3kmg5r8ctcz4tpmqctydxqrg4kp0a8xpq0d94t392r2gpz4mhxue69uhhyetvv9ujuerpd46hxtnfduhsw54mhp'>nevent1q…4mhp</a><br/>_________________________<br/><br/>You can read more about the hack here: <a href="http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/59e5b924658bac9124d0">http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/59e5b924658bac9124d0</a><br/><br/>NOTE: The haveno arbitrators could rug the whole orderbook (2,000,000 USD) despite multi-sig trades. <br/><br/>Ironically, openmonero.com may actually be one of the most secure platforms out there, thanks to its use of non-custodial trade settlements, non-custodial funding, and relatively quick trade finalization (on hour). To date, only about 20k USD of user funds have been stolen, (plus 3k arbiter funds), despite a monthly trade volume of roughly half a million dollars. Had I implemented a setup like haveno, I’d probably have seen at least 2 million USD stolen (good luck trying to refund that).<br/><br/>Additionally, since offers on openmonero.com don’t require any pre-funding, the potential damage remains quite limited (similar to a single McDonald&#39;s salary). A quick note: multi-signature setups typically require JavaScript, and possibly Java, which limits scalability and compatibility, especially with browsers like Tor.<br/><br/>Moreover, multi-sig only secures about 1% of the total liquidity (trades in escrow or accepted), making it largely ineffective. On haveno, if a malicious arbiter manages to take all maker offers, they could potentially wipe out the entire order book (despite multi-sig trades). And having a security deposit doesn’t offer much protection either, since an attacker only needs to hold an amount of XMR equal to the lowest security deposit to take all maker offers. This pattern becomes clear when observing how each taker bot balance grows by a ton (logarithmic growth) after each transaction. More here: <a href="https://simplifiedprivacy.com/openmonero-interview-with-the-dev/compared-to-reto.html">https://simplifiedprivacy.com/openmonero-interview-with-the-dev/compared-to-reto.html</a><br/><br/>This principle has been validated both by my own analysis and confirmed by the official moderator of the dread sub and some reddit users. <br/><a href="http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/4e7e530582ff902b6903/#c-cac5570453f7fa9f42">http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/4e7e530582ff902b6903/#c-cac5570453f7fa9f42</a><br/><a href="https://rl.bloat.cat/r/Monero/comments/1l5jkp2/openmonerocom_got_hacked_as_reported_in_their/mwj10k3/?context=3#mwj10k3">https://rl.bloat.cat/r/Monero/comments/1l5jkp2/openmonerocom_got_hacked_as_reported_in_their/mwj10k3/?context=3#mwj10k3</a><br/><a href="https://rl.bloat.cat/r/Monero/comments/1l5jkp2/openmonerocom_got_hacked_as_reported_in_their/mwp7yhn/?context=3#mwp7yhn">https://rl.bloat.cat/r/Monero/comments/1l5jkp2/openmonerocom_got_hacked_as_reported_in_their/mwp7yhn/?context=3#mwp7yhn</a><br/><br/>#Privacy #Markets #HiddenService #News #Work #Monero #Crypto #Hacking #HarmReduction #Guides #Bisq #cakewallet #haveno #retoswap #trading #p2p #escrow #localmonero #dex #cex #moneroju #xmrbaazar #security #agorism #cypherphunk #rugpull 2025-06-12T10:59:10Z https://njump.cloud.vinney.xyz/nevent1qqsqjpmk2vzpw4chhukgdp8sd9s8qv49mzxp5lvvfw8n555edg4r2jszyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5cjw0u3z In reply to <a href='/nevent1qqs0f23s5av3kmg5r8ctcz4tpmqctydxqrg4kp0a8xpq0d94t392r2gpz4mhxue69uhhyetvv9ujuerpd46hxtnfduhsw54mhp'>nevent1q…4mhp</a><br/>_________________________<br/><br/>I&#39;ve just open sourced the first p2p monero platform that is completely based on NOSTR, with a decentralized reputation system (PGP canaries), a federated orderbook, non-custodial trade funding, non-custodial trade settlements and anyone can setup his own instance since the backend is open source as well. I am telling you once again, haveno is a centralized liquidity exchange, since the admin can take all offers. All that is required for such an exploit is access to the admin key, two bots (taker and arbiter bot), and an amount of XMR equivalent to the lowest security deposit (a mechanism evident from the logarithmic balance growth of each taker bot following each transaction. More here: <a href="http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/4e7e530582ff902b6903/#c-779f1c27e12e98e6af">http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/4e7e530582ff902b6903/#c-779f1c27e12e98e6af</a><br/><br/>#Privacy #Markets #HiddenService #News #Work #Monero #Crypto #Hacking #HarmReduction #Guides #Bisq #cakewallet #haveno #retoswap #trading #p2p #escrow #localmonero #dex #cex #moneroju #xmrbaazar #security #agorism #cypherphunk 2025-06-12T09:49:22Z https://njump.cloud.vinney.xyz/nevent1qqswcvp5te36u6gsecvvq3jmwnp3tgf03kynfng73hxy3dgcppctzpgzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5c6vjecc Check out the new decentralized exchange based on Nostr and OpenMonero/LocalMonero frontend. The code is production ready but I can&#39;t setup a fully working instance right now, since 2 of my servers have been hacked on 6/6/2025. You can checkout the demo below or clone the code and setup your own instance. The Backend has just 4.5k lines of code in a single file and is very easy to audit.<br/><br/>New powerful updates:<br/><br/> Decentralized, new reputation system not locked to any specific location or instance.<br/> Federated and decentralized order book model allows for a combined order book across multiple instances.<br/> All data, including the order book, reputation, profiles, trades, wallet information, and chat, is stored on NOSTR.<br/> Admins do not have access to chat history unless a trade dispute arises (E2EE with NIP-04).<br/> Wallet protection with two-factor authentication (2FA) instead of a traditional password.<br/> Websockets facilitate real-time event updates without requiring a page refresh.<br/><br/>Frontend: <a href="http://rf5cqoxqlitdx4umuce5dgihjzabql4hs3zjkvs3em7xzjfa5yyhkeqd.onion/om/openmonero-dex">http://rf5cqoxqlitdx4umuce5dgihjzabql4hs3zjkvs3em7xzjfa5yyhkeqd.onion/om/openmonero-dex</a><br/>Backend: <a href="http://rf5cqoxqlitdx4umuce5dgihjzabql4hs3zjkvs3em7xzjfa5yyhkeqd.onion/om/openmonero-dex-api">http://rf5cqoxqlitdx4umuce5dgihjzabql4hs3zjkvs3em7xzjfa5yyhkeqd.onion/om/openmonero-dex-api</a><br/>Demo: <a href="http://ek72x7tysgkrr754ce4np4e6ce5rtwtxphxibzmesnsbuyco5onlc5id.onion/">http://ek72x7tysgkrr754ce4np4e6ce5rtwtxphxibzmesnsbuyco5onlc5id.onion/</a><br/><br/>#Privacy #Markets #HiddenService #News #Work #Monero #Crypto #Hacking #HarmReduction #Guides #Bisq #cakewallet #haveno #retoswap #trading #p2p #escrow #localmonero #dex #cex #moneroju #xmrbaazar #security #agorism #cypherphunk 2025-06-11T09:42:16Z https://njump.cloud.vinney.xyz/nevent1qqs0e9mdcpyqj7epuj060zldh6g403dngjum5cf2qyrxfwygl4hf94qzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5cjpyljp In reply to <a href='/nevent1qqs8e59hdnq2a5zw9xpg3etkqk9mq3zwjwg7tqpevjz53ehgwkz3zeqpzamhxue69uhhyetvv9ujuurjd9kkzmpwdejhgtc5s3x0v'>nevent1q…3x0v</a><br/>_________________________<br/><br/>I am looking for a browser that has the following features:<br/><br/>- same anonymity as tor browser<br/>- built-in i2p <br/>- adblocker addon pre-installed to prevent fingerprinting<br/>- option to add whitelist for js and persist after restart<br/> 2025-04-26T08:13:26Z https://njump.cloud.vinney.xyz/nevent1qqst82y964nm06lt4llhqtrxfgumnk797pxf9u7045r4a2x5zmyct8gzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5ccv4el2 In reply to <a href='/nevent1qqsysamp6l4553u7yt5524k6hx8laa6lk7td6gj7fdu67nuh69mu8vgppemhxue69uhkummn9ekx7mp0g558ky'>nevent1q…58ky</a><br/>_________________________<br/><br/>I don’t really recommend any wallet, but if you’re looking for something without bloat, you might want to check out monero-wallet-cli. 2025-04-07T13:46:21Z https://njump.cloud.vinney.xyz/nevent1qqs0mk032cs36adgzxpnqkpwykt5wd5vzayyp2l0xf6dsl8k36hse6gzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5cft9ek0 In reply to <a href='/nevent1qqsg33930gjzmv22eakrjxs6azy6mfduut3fp2prc7wxnnkaf4tjruqppemhxue69uhkummn9ekx7mp0mwtqxf'>nevent1q…tqxf</a><br/>_________________________<br/><br/>I do not have simpleX yet. Could you pls review <a href="https://kycnot.me/service/openmonero">https://kycnot.me/service/openmonero</a> 2025-03-07T23:33:44Z https://njump.cloud.vinney.xyz/nevent1qqsz3tg8hcngc5j2q5q2lfjcdyz0qyrrpdxpt7h6ymnwtw7q7rk30wqzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5caynzts In reply to <a href='/nevent1qqs83x0cnvzg7gq7dv6vh0m7ze4nn6lwq76kz7urzvt6ek9jsxcmmmspzemhxue69uhhqatjwpkx2un9d3shjtnrdakj7krr5su'>nevent1q…r5su</a><br/>_________________________<br/><br/>Let&#39;s be real, nothing comes for free. The fact that there are no arbitration fees on the retoswap network might make you think that users are actually the product. If you dig a little deeper, you&#39;ll find a bunch of issues, with the risk of exit scams being a big one. <br/><br/>A decentralized node network is only secure if there&#39;s no admin who can circumvent the rules. To address the exit scam issue, either eliminate the admin or remove the liquidity. <br/><br/>People want to trade online without the hassle of installing software, which can threaten their privacy. Trusting someone to keep your computer safe isn’t easy, and even open-source code can have hidden risks since most don’t compile it themselves. With OpenMonero, you can avoid those worries because it’s just a website that doesn’t need permissions.<br/><br/>The built-in non-custodial wallet for haveno funds isn’t very secure either, since private keys could be logged, and the project isn’t truly decentralized. The GitHub repo isn’t easy to fork, it’s built in Java and is pretty complicated. The more complex the code is, the tougher it gets for developers to spot vulnerabilities or malicious code. <br/><br/>Haveno is better at resisting censorship than OpenMonero, but this mainly benefits the admin. Without a reputation system, vendors can&#39;t import any stats to other platforms, leaving their accounts on Haveno fairly low in value. It’s unlikely that any former LocalMonero vendor, who has built up their reputation over the years, would want to use this system.<br/><br/>OpenMonero launched in June 2024, and I&#39;ve recently started promoting it on social media. I encourage you to check out our list of over 150 verified vendors, including respected LocalMonero traders. If these vendors have confidence in the platform, users are likely to feel the same way.<br/>Vendor list: <a href="https://nojs.openmonero.com/guides/how-to-import-reputation#cachedUserList">https://nojs.openmonero.com/guides/how-to-import-reputation#cachedUserList</a><br/><br/>Reference: <a href="https://simplifiedprivacy.com/openmonero-interview-with-the-dev/compared-to-reto.html">https://simplifiedprivacy.com/openmonero-interview-with-the-dev/compared-to-reto.html</a><br/>Reference: <a href="https://primal.net/e/nevent1qqsq2pcudt9rdq4wwpk7r784fwr5h0lt4fhzj6cvaeckurla6wg29dqkrrz7a">https://primal.net/e/nevent1qqsq2pcudt9rdq4wwpk7r784fwr5h0lt4fhzj6cvaeckurla6wg29dqkrrz7a</a><br/><br/>#Privacy #Markets #HiddenService #News #Work #Monero #Crypto #Hacking #HarmReduction #Guides #Bisq #cakewallet #haveno #retoswap #trading #p2p #escrow #localmonero #dex #cex #moneroju #xmrbaazar #security #agorism #cypherphunk<br/> 2025-03-04T20:20:24Z https://njump.cloud.vinney.xyz/nevent1qqsfq5ppd2xv4d327dujy2jadt9w8a94qdjqv79dukg4zrmr7sypcmqzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5ch3qpux In reply to <a href='/nevent1qqszmu277pnm67pjcwc58pm767g66qwx9zr65j6mwdf33693mfafgwspzamhxue69uhhyetvv9ujuurjd9kkzmpwdejhgtcy4rhne'>nevent1q…rhne</a><br/>_________________________<br/><br/>Basically, the haveno network operator can give admin roles to both taker and arbiter bots as well, which lets them ignore any rules in place. This speeds up things a lot since there’s no need to put down a security deposit for each taker bot, allowing all maker funds to be unlocked right away. These bots only work on the API level, so they don&#39;t mess with the user interface.<br/><br/>Because of this, it doesn’t really matter if you set up limitations on the frontend or the public API; the admin bots will always be able to access the protected API endpoints. This access is key to getting around rules like security deposits, rate limits, or any other client-side requirements for takers or arbiters.<br/><br/>The admin bots won’t use the public API, since developers would catch any shady changes to it. Instead, they’ll send requests to a protected API run by the network operator on a low-cost VPS for about $5 USD. Only the admin bots (taker and arbiter) will have the keys to access this protected API. This API will basically look like the public API but will have tweaks to bypass all those rules. So, only the maker will use the public API and will have to follow its rules.<br/><br/>To make things work, all you really need is the admin key, a protected API, and a few VPS servers for the taker and arbiter bots. These taker bots will throw the admin keys into the headers of their requests. If a normal taker tries to hit up the protected API without the admin keys, the request won&#39;t work. It’s actually pretty simple, and it might have been overlooked because of that.<br/><br/>Also, it’s good to remember that multi-signature setups only make sense when there’s no admin or network operator. The operator is always a single point of failure and can sidestep any limits on the API using their admin keys. <br/><br/>If anyone has a solid reason why this wouldn’t actually work, I’d love to hear it. When someone has the admin keys for their network, they can pretty much do whatever they want and set the rules while everyone else has to follow along. <br/><br/>To wrap it up, everyone in the haveno network, the taker, the arbiter, and the maker will get a key in the multi-sig trade. But there&#39;s also a fourth key, called the &#34;magic key&#34; that can do a bunch of powerful things, some of which could be a bit risky. <br/><br/><br/>Reference: <a href="https://archive.ph/GsDsn">https://archive.ph/GsDsn</a><br/>Thread: <a href="https://primal.net/e/nevent1qvzqqqqqqyqzqpg8r34v5d5z4ecxmc0c749cwjalaw4xu2ttpnh8zms0lhfepg450s7qlk">https://primal.net/e/nevent1qvzqqqqqqyqzqpg8r34v5d5z4ecxmc0c749cwjalaw4xu2ttpnh8zms0lhfepg450s7qlk</a><br/>Interview: <a href="https://simplifiedprivacy.com/openmonero-interview-with-the-dev/compared-to-reto.html">https://simplifiedprivacy.com/openmonero-interview-with-the-dev/compared-to-reto.html</a><br/><br/>#Privacy #Markets #HiddenService #News #Work #Monero #Crypto #Hacking #HarmReduction #Guides #Bisq #cakewallet #haveno #retoswap #trading #p2p #escrow #localmonero #dex 2025-03-03T02:26:50Z https://njump.cloud.vinney.xyz/nevent1qqsz2sqdprkp9ydyan9sstx05h2dsxdwhp75hjxycdx0g80xvuhje6szyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5cptwy35 In reply to <a href='/nevent1qqsy5v0hwmtd3yy6c8mmhxsxxq5lrjjem0wuer3qk6hu50976vp8z5gppemhxue69uhkummn9ekx7mp0h04dw6'>nevent1q…4dw6</a><br/>_________________________<br/><br/><a href="http://openmonero.i2p">http://openmonero.i2p</a><br/><br/>frontend can be self-hosted as well ( <a href="https://openmonero.com/readme">https://openmonero.com/readme</a>) 2025-03-01T21:52:35Z https://njump.cloud.vinney.xyz/nevent1qqspyj7tnvn7n2zczhcterx3c5ff8h2jj6zanufcyfnrn2ya6xm8yygzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5cxxxdxz In reply to <a href='/nevent1qqstsjcjxmfctxqfpwf4wnq3uskkfgxgy79gmet6uxfvwyqw9mjnmzqpr4mhxue69uhkummnw3ezucnfw33k76twv4ezuum0vd5kzmp0ryjnfc'>nevent1q…jnfc</a><br/>_________________________<br/><br/>I could do shotgun scamming but exit scamming is not really possible due to self-custodial trade fuding (sellers) and self-custodial trade settlements (buyers). Plus the nostr based version is almost finished. 2025-03-01T21:32:32Z https://njump.cloud.vinney.xyz/nevent1qqsg0tucq6q9sfg98cxjdsuje02az06jhjg8zqlhv7207wck56fahggzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5cqr8m74 In reply to <a href='/nevent1qqsyt2a0ywvyactz7hekpxhd3neyt5ngddq35yw0x30m9mxqqw2xwlgpzamhxue69uhky6t5vdhkjmn9wgh8xmmrd9skctcf6e8lv'>nevent1q…e8lv</a><br/>_________________________<br/><br/>The Haveno network operators can steal 3177 XMR, assuming the investment stays safe and comes back to the taker bots. Once the investment returns, the same taker bot can just do the same thing again. In theory, one taker bot with an amount of XMR equal to the highest maker security deposit could clear out the entire order book since its balance goes up with every completed trade. So, it’s really just a matter of time before the whole order book is wiped out. Even worse, if you’ve got multiple taker and arbiter bots working simultaneously, you could clear the whole order book in just a second. All you need.<br/><br/>The reason is that a shady arbiter bot backs the taker bot and will side with them in any disputes. Moreover, the arbiter bot can also hit all the market makers with penalties, taking away their 15% security deposits.<br/><br/>You don&#39;t really need to invest a lot to liquidate the entire order book and my examples are not necessary (unless you want to clear the order book in the first round) as the balance of each taker bot demonstrates substantial, logarithmic growth following each transaction. This is because taker bots always go for the highest maker offer in the pot first.<br/><br/>#haveno #monero #rugpull #scam #hacking #opsec #xmr #retoswap #havenoreto #openmonero #exitscam<br/> 2025-03-01T14:54:11Z https://njump.cloud.vinney.xyz/nevent1qqswlneww0vkhase9xgl2uu4t4sddq9vwv0pku8k6et23npnc8ytvugzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5csqhhg6 In reply to <a href='/nevent1qqszenx83veu8kzly6y4tmpvczlpzpgwgylhwqvu42ltpqa5xw0krkqpzpmhxue69uhk2tnwdaejumr0dshsqt589c'>nevent1q…589c</a><br/>_________________________<br/><br/>If the openmonero website goes down, the damage would be minimal. On the other hand, if the Haveno arbiter bots go rogue, they could rug pull at least 3177 XMR + 15% security deposits of all market makers. The difference is that openmonero&#39;s offers aren’t pre-funded, so there’s not much to steal.<br/><br/>#haveno #monero #rugpull #scam #hacking #opsec #xmr #retoswap #havenoreto #openmonero #exitscam<br/><br/> 2025-03-01T14:29:35Z https://njump.cloud.vinney.xyz/nevent1qqsg8rutmxvt7e6xexzhsqqqfwa4dsspffv8a3fcy3qz4y3utlsa8fqzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5c68qt7x In reply to <a href='/nevent1qqszsdz52xy6a3ef6xekf7yyuqx8yxr8l9n30u2u2resr595k4mdvdspzamhxue69uhky6t5vdhkjmn9wgh8xmmrd9skctc2mgmgj'>nevent1q…gmgj</a><br/>_________________________<br/><br/>That exactly how openmonero works; Quote from the interview recorded on simplifiedprivacy<br/><br/>The minimum requirement of 0.35 XMR security deposit for sellers on OpenMonero is there to help cut down on spam offers. While it’s not really meant to fund an offer, you can still use it for that (or just fund the difference) as long as the buyer’s trade request is no more than the security deposit.<br/><br/>Both the seller and the buyer can cancel a trade request if they feel like the other person isn&#39;t trustworthy since no xmr is locked at this early stage. Right now, the seller is chatting with the buyer and checking out their reputation, looking at things like how long they&#39;ve been registered and what kind of feedback they&#39;ve received. Should all evaluations meet satisfactory criteria, the seller has the option to secure an arbitration bond utilizing either an internal wallet (security deposit) or an external wallet (such as Cakewallet, Moneroju, Feather Wallet, Monero CLI Wallet, etc.)<br/><br/>For big trades, the seller might choose to fund the bond from a separate external wallet to avoid any potential scams from the arbitrator right from the start. On the other hand, for smaller trades, its usually easier for the seller to just use the internal wallet (security deposit) for the bond. By allowing both types of wallets for funding, the platform strikes a good balance between keeping things liquid and secure.<br/><br/>If there weren’t an option for external bond funding, there&#39;s a chance that an arbitrator could run off with all the money. But because funding is done manually, it really cuts down the risk of good exit scams or bots locking up coins.<br/><br/> #haveno #monero #rugpull #scam #hacking #opsec #xmr #retoswap #havenoreto #openmonero #exitscam 2025-03-01T13:58:43Z https://njump.cloud.vinney.xyz/nevent1qqs8lk9zua3hqtw6j2ls0as58rq8etmdhj6xy3awqd95g6d46ny5wdczyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5c0qmhw7 In reply to <a href='/nevent1qqsdcl3vmc6ty8vvy30jxpux6j5anum7wdnjeyryq2hnn2rzake6a2gppemhxue69uhkummn9ekx7mp0f8sx53'>nevent1q…sx53</a><br/>_________________________<br/><br/>Thank you for adding openmonero.com to the list. 🤙 2025-03-01T11:14:29Z https://njump.cloud.vinney.xyz/nevent1qqsq2pcudt9rdq4wwpk7r784fwr5h0lt4fhzj6cvaeckurla6wg29dqzyzy5cc0aghecfhdvjjzvjtr6qs952zv9rug2awclta44yrmj5vs5cxhr7a4 Hello Nostr! I&#39;m the dev behind OpenMonero.com<br/><br/>This is my first post. I&#39;m here to bring transparency and harm reduction. Check out my latest audit for haveno: Shady arbiters can steal the entire liquidity from the order book. All you need is just 2 bots. Its crazy.<br/><a href="https://simplifiedprivacy.com/openmonero-interview-with-the-dev/compared-to-reto.html">https://simplifiedprivacy.com/openmonero-interview-with-the-dev/compared-to-reto.html</a><br/><br/>Issue confirmed by official monero moderator on dread: <a href="http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/4e7e530582ff902b6903/#c-cac5570453f7fa9f42">http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/4e7e530582ff902b6903/#c-cac5570453f7fa9f42</a><br/>Quote from /u/monero_desk_support: After some thoughts, I think you are right and that the arbitration system in Haveno doesn&#39;t prevent arbitrators from pulling the funds. They would need to create a bot that takes all the offers and automatically unlock the funds with the key of the taker and arbitrator<br/><br/>#introductions #Privacy #Markets #HiddenService #News #Work #Monero #Crypto #Hacking #HarmReduction #Guides 2025-02-27T14:22:43Z