OpenMonero users were told to stop all payments immediately after a new exploit alert was posted on May 21, adding a second security scare to Monero’s peer-to-peer trading ecosystem in as many days.
The current OpenMonero warning is still thin on confirmed details. Losses are unknown, no final technical cause has been published, and there is no public recovery plan yet. The alert says an exploit was found on May 21 and instructs users to halt payments until the issue is fixed.
OpenMonero operates as a peer-to-peer Monero marketplace where users can buy and sell XMR directly with one another. That makes payment-flow safety critical. If a platform handling buyer-seller trades has an active exploit or escrow-side issue, users can face losses even before a full technical breakdown is available.
The timing is what makes the alert more serious. RetoSwap had already halted trading on May 20 after the Haveno trade protocol was flagged as actively exploited, with early estimates placing the user-fund drain at 7,000 XMR, worth about $2.7 million. That incident involved attackers interfering with Haveno’s trade messaging flow, prompting RetoSwap to ban the exploiter’s onion address and force clients below version 2.0.0 off the network.
OpenMonero’s warning has not been tied to the same exploit path. The two incidents should not be treated as the same attack without more evidence. They do, however, put the same user-risk category under pressure: privacy-focused P2P markets where trade flow, escrow logic, account security and operator response decide whether users can safely complete transactions.
Monero Trading Tools Face Fresh Trust Test
Monero’s privacy design makes XMR attractive for users who want confidential payments, but that same privacy layer can make post-incident tracing and recovery harder once funds leave user control. P2P trading platforms carry an extra burden because users often choose them specifically to avoid centralized exchange surveillance, while still depending on platform rules, dispute handling, payment coordination and escrow controls.
OpenMonero already had security-history baggage. Its KYCnot service record lists a prior 2025 incident in which user and vendor funds of up to 78 XMR were reported stolen, with later refund claims that KYCnot said it could not independently verify. The new exploit alert now reopens questions around payment safety, custody assumptions and how quickly users receive clear information when funds may be at risk.
The immediate guidance is operational rather than speculative. OpenMonero users should stop payments until the platform confirms the issue is fixed, avoid starting new trades, preserve account records and save any trade, wallet or payment evidence tied to open transactions. Anyone already mid-trade should wait for a direct platform update before sending more funds.
The remaining facts are concrete: the current loss amount, the affected component, whether escrowed funds were touched, whether any attacker wallet or account has been identified, whether payments can be reversed or recovered, and when OpenMonero can safely reopen normal activity. Until those details are published, the safest market signal is the one already sent to users: stop payments.
