Evidence and risk■Verified evidence/▲Documented riskMaterial claims checked against current sources.; those sources document a material risk.
Last reviewedReviewed 5 Sep 2026KYC checked 5 Sep 2026 · unknown jurisdiction · Source → official siteHow to cite this pageSource coverageVerified evidenceRecorded riskDocumented risk
Evidence and facts
Evidence and facts
CUNICULA SCORE 4.0
39/100△Limited evidencePrivacy 21/25 · Control 18/20 · Transparency 12/20 · Security 0/25 · Accountability 2/10 · Cap 39 · Method
JURISDICTIONUnknown
INCIDENTSecurity Incident Post-Mortem active · high · since 2026-05-01 Require current patched releases, preserve the May 1, 2026 incident, and reassess after a complete audit report and remediation record are published.Security Incident Post-Mortem
AUDITED BYNo audit listed
OPERATOR DATAHosted operator recorded
SOURCE COVERAGE
■Verified evidenceSELF-REPORTED2/2Reviewed 5 Sep 2026 · Source → official site
LAST CHECKED2026-08-27
LAST UPDATED2026-09-05
Specs
DOCUMENT CHECKNone recorded
IDENTITY EXPOSURELevel 0/4
KYC TRIGGERSNo account, email or identity KYC in the Bisq protocol; individual fiat payment methods can expose data to counterparties/banks.
FEEBTC fee: 0.15% maker and 1.15% taker; BSQ target: 0.075% maker and 0.575% taker; minimum fees apply
LIMITVaries by payment method, account signing and asset
CATEGORIESP2P / Desktop
COMMON USESMaximum decentralization, BTC/fiat P2P, Privacy-maximalist
FEATURESTor, Non-custodial, Bank/Cash/SEPA
TORYes
REGIONSGlobal availability
Review analysis, source material, related services, and history
About
Decentralized open-source desktop P2P Bitcoin exchange over Tor, with no registration stated as required.
Analysis
OVERVIEW
A desktop exchange with no operator: trades run peer-to-peer over Tor with multisig escrow and security deposits, so there is no company to hold funds, records, or a KYC file.
LIMITS
The fiat leg exposes bank or payment metadata to the counterparty, deposits and confirmation times make trades slower than custodial venues, and liquidity varies by market and payment method.
USEFUL FOR
Bitcoin-fiat trades where removing the operator entirely is worth the desktop workflow and slower settlement.
┌────────────────────────────────────┐
│ Bisq DAO │
│ ──────────────────────── │
│ Owners: traders and contributors │
│ Leadership: no CEO or central team │
│ Revenue: trading fees │
│ distributed through BSQ │
└────────────────────────────────────┘
No identity verification is recorded for typical use. No account, email or identity KYC in the Bisq protocol; individual fiat payment methods can expose data to counterparties/banks.
Which payment methods are accepted?
Please check the provider site for accepted payment methods.
Where is it available?
Recorded availability: GLOBAL.
Is the operator based in a Five Eyes country?
The jurisdiction is not publicly confirmed. Check the provider site for incorporation details.
How are identity, operator, and evidence fields reported?
Identity exposure is level 0 of 4. A hosted operator is recorded. Jurisdiction is shown as context, not a safety verdict. Source coverage is verified evidence, last reviewed 2026-09-05, and recorded risk is danger.
Sources and history
Evidence basis: Claims on this page are linked to published sources for comparison, not certification, audit, endorsement, or recommendation; read the methodology and coverage map before relying on an entry.
Service history
Latest meaningful changes to the facts shown on this provider page.
Review overdue providers against current sources
Fee, KYC last checked, Last reviewed, Limit, and 3 more
Apply full-service rereview and score 4.0
Privacy warning, Recorded risk, Score assessment, Status
Corporate registry information updated
Corporate / Entity type
Full service history
updated
Review overdue providers against current sources
Fee
~0.4% → BTC fee: 0.15% maker and 1.15% taker; BSQ target: 0.075% maker and 0.575% taker; minimum fees apply
KYC last checked
2026-06-22 → 2026-09-05
Last reviewed
2026-06-22 → 2026-09-05
Limit
not set → Varies by payment method, account signing and asset
Privacy warning
Bisq suffered a May 1, 2026 trade-protocol exploit causing 11.59104 BTC in user losses. Victims were reimbursed, but XMR auto-confirmation remained disabled pending audit in June, and August releases v1.10.6 and v2.1.12 were mandatory security updates. Fiat methods may reveal payment metadata to counterparties/providers; do not keep long-term savings in the integrated hot wallet. → Bisq does not perform KYC, but payment-method, account-signing and asset-specific trade limits apply. A May 2026 Bisq 1 altcoin exploit affected 10 users and 11.59104 BTC; Bisq reported all victims reimbursed on June 5. The June update said XMR auto-confirmation remained disabled pending audit work. Use Bisq 1 v1.10.7 or later and Bisq 2 v2.1.12 or later. Fiat payment details are still shared with counterparties, and Bisq should not be treated as a savings wallet.
not set → Outcome: HOLD; Checked at: 2026-08-27; Inputs: Operator data exposure: limited; Control model: decentralized; Source model: open; Audit: Score eligible: no; Reason: Bisq 2 v2.1.12 says vulnerabilities were identified during a recent security audit, but no complete audit citation/scope report was found.
Desktop app and security deposits are required; fiat methods may reveal bank/payment metadata to counterparties. → Bisq suffered a May 1, 2026 trade-protocol exploit causing 11.59104 BTC in user losses. Victims were reimbursed, but XMR auto-confirmation remained disabled pending audit in June, and August releases v1.10.6 and v2.1.12 were mandatory security updates. Fiat methods may reveal payment metadata to counterparties/providers; do not keep long-term savings in the integrated hot wallet.
Recorded risk
standard → danger
Score assessment
not set → Operator data exposure: limited; Control model: decentralized; Source model: open
Decentralized, open-source desktop P2P Bitcoin exchange over Tor. Official site says no registration is required; Bisq wiki documents peer-to-peer fiat/crypto trading and privacy protections. → Decentralized open-source desktop P2P Bitcoin exchange over Tor, with no registration stated as required.
not set → Bisq DAO
────────────────────────
Owners: traders and contributors
Leadership: no CEO or central team
Revenue: trading fees
distributed through BSQ
Public claims
not set → Follow the money: Bisq DAO
────────────────────────
Owners: traders and contributors
Leadership: no CEO or central team
Revenue: trading fees
distributed through BSQ
Peer-to-peer bitcoin trading with Non-custodial. (Light KYC) → Decentralized, open-source desktop P2P Bitcoin exchange over Tor. Official site says no registration is required; Bisq wiki documents peer-to-peer fiat/crypto trading and privacy protections.
Jurisdiction
not set → ??
KYC requirement
light → none
KYC last checked
2025-08-31 → 2026-06-22
Kyc note
No account. No email. Desktop app with Tor routing. Fidelity bonds required from makers. → No account, email or identity KYC in the Bisq protocol; individual fiat payment methods can expose data to counterparties/banks.
Last reviewed
2025-08-31 → 2026-06-22
Privacy warning
Bisq v2 (successor) transitions to P2P network. Desktop app required — no browser interface. Onboarding more technical than RoboSats. → Desktop app and security deposits are required; fiat methods may reveal bank/payment metadata to counterparties.
Source reviewed
older source, not independently verified → official site
General usage → Maximum decentralization, BTC/fiat P2P, Privacy-maximalist
Fee
not set → ~0.4%
Kyc note
Expect unexpected KYC triggers for withdrawals above arbitrary risk thresholds. → No account. No email. Desktop app with Tor routing. Fidelity bonds required from makers.
Privacy warning
not set → Bisq v2 (successor) transitions to P2P network. Desktop app required — no browser interface. Onboarding more technical than RoboSats.
Tagline
A custodial or semi-custodial financial service. → The original decentralized P2P Bitcoin exchange. No company, no server, no KYC.