Score: Legit. Bisq does exactly what it claims — strangers trade bitcoin peer-to-peer with no company in the middle, no account, and no ID check, and it has run that way for a decade. The price of that design is real too: thin liquidity, small trade limits, and a trade protocol exploited twice — in 2020 and again in May 2026. Both times, the victims got repaid. Decide which half of that sentence matters more to you.
The Bisq logo. Logo: Bisq project (bisq.network), shown for editorial identification.
Official website: bisq.network
What Bisq actually is
Most "exchanges" are companies with a website, a bank account, and a database of customer funds. Bisq is none of that. It's free, open-source software you run on your own computer, connecting you to a peer-to-peer network of other people running the same software — over Tor, by default. No signup, no account, no KYC, and no central server that ever touches your money; your trade data lives on your own disk.
The project started in 2014, when developer Manfred Karrer began building it as Bitsquare. It launched in April 2016 and renamed to Bisq in 2017. In April 2019 it shipped something no exchange had done before: a DAO — a decentralized autonomous organization — built on top of Bitcoin, to handle governance and funding with no company in charge. A month later Karrer did the Satoshi move: he stepped away from all his roles and removed his own privileges, leaving the DAO running the project. It still does.
So when this review asks the standard BogusAPY question — who gets the money? — the answer has no CEO, no shareholders, and no revenue line. It has a token, a burn, and a monthly vote. First, how a trade works, because that's where the trust actually lives.
The token question, answered early
Every coin/token review on this site states this up front: BSQ is a token, not a coin. It has no blockchain of its own. BSQ is a colored coin — ordinary bitcoin satoshis (1 BSQ = 100 satoshis) that Bisq software marks and tracks as a separate asset on the Bitcoin blockchain. Outside Bisq software it's invisible: send it to a regular Bitcoin wallet and all anyone sees is a few satoshis, and the BSQ value can be lost. Never sold in an ICO: the first 3,657,480 BSQ were issued in a genesis transaction in April 2019 to compensate 200+ contributors for five years of building Bisq. Since then, new BSQ is created only when the DAO approves a contributor's compensation request, and BSQ is burned when traders pay fees with it — the whole funding model, in one sentence.
How a Bisq 1 trade actually works
Bisq 1 is the original app, and its multisig protocol is the heavy-duty option:
- A maker posts an offer (say, "selling 0.05 BTC for dollars, bank transfer"). A taker accepts it.
- Both sides lock bitcoin into a 2-of-2 multisig address: the trade amount from the seller, plus a security deposit from both buyer and seller — 15% of the trade amount by default. Neither side can move those funds alone.
- The buyer sends the fiat directly to the seller — bank transfer, money order, cash in person, whatever the offer specified. Bisq never sees this money. Your bank does, and so does your trading partner, who sees the name on the transfer.
- The seller confirms receipt, both signatures release the payout: the buyer gets the bitcoin, both deposits come straight back.
A trade takes four on-chain transactions; the taker pays miner fees on three — a cost that never shows up in the fee schedule. And the catch for first-timers: you need bitcoin before you can trade bitcoin. Deposits and fees are in BTC, so Bisq's getting-started guide suggests having about 0.01 BTC on hand first. That's the catch-22 Bisq 2 was built to break (below).
If a trade goes wrong, there's a ladder. First, encrypted trader chat. Then mediation: mediators are DAO-approved role holders who post a 10,000 BSQ bond — but hold no key to the multisig. They can only propose a payout, including penalties from the rule-breaker's deposit. If either side rejects it, the last resort is arbitration: a time-locked transaction (publishable 10 days after the deposit for altcoin trades, 20 days for fiat) sweeps the whole escrow to the Burning Men — contributors who burned BSQ and were voted into the role. An arbitrator reimburses the winner and claims it back from the DAO. Deliberately painful for both sides — mutual assured destruction makes strangers behave without a company holding the funds.
Trade limits are small and, after May 2026, smaller: the wiki currently lists maximums of 0.0624 BTC per fiat trade (about $4,900) and 0.50 BTC per altcoin trade. New accounts on riskier payment methods start far lower — unsigned accounts are capped at 0.01 BTC until "signed" by an established peer, and limits rise with account age. That's Bisq's answer to chargeback fraud: reversible payment methods are guilty until proven innocent.
Bisq 1 vs Bisq 2 — the part everyone mixes up
Bisq 2 launched on March 16, 2024, as a separate app, not an upgrade. Its first — and still its only live — trade protocol is Bisq Easy, built for people buying their first bitcoin:
- No security deposit for buyers, and no trading fees.
- Security comes from seller reputation instead of escrow. Sellers build a reputation score by burning or bonding BSQ, by account age, or by importing their Bisq 1 history — and their maximum offer size is tied to that score.
- Trades are capped between $6 and $600. The buyer pays first; the seller's burned/bonded stake is what they lose if they cheat.
That's a genuinely different risk model: Bisq 1 trusts math (multisig + deposits); Bisq Easy trusts a seller's skin in the game, for amounts small enough that the math isn't worth it. The full multisig protocol is being rebuilt for Bisq 2 as a MuSig protocol, but per Bisq's own wiki it is still in development — not live — whatever third-party guides claim. Bisq 1 remains desktop-only. The mobile apps launched in October 2025 — Bisq Easy Mobile (a full node on Android) and Bisq Connect (a light client pairing with a desktop node) — are Bisq Easy only.
The fees: no company, so who gets the money?
Bisq 1's current fee schedule, from Bisq's own wiki, checked November 1, 2026:
| Paid in BTC | Paid in BSQ | |
|---|---|---|
| Maker | 0.15% | 0.1125% |
| Taker | 1.15% | 0.8625% |
| Combined | 1.30% | 0.975% |
Minimums: 0.000075 BTC or 0.03 BSQ. On a real trade — a $3,900 offer, about 0.05 BTC — the taker fee is $44.77 in BTC or about $33.58 in BSQ, plus miner fees on three transactions, which neither number includes.
Two things in that table deserve a harder look.
First, the discount isn't what the old guides say. You'll read everywhere that paying in BSQ costs "about half." That was true when the fee parameter targeted 50%. Current parameters price BSQ fees at 0.975% combined against 1.30% in BTC — a 25% discount, not 50. The BSQ amounts (64.95 BSQ maker, 497.95 BSQ taker, per 1 BTC traded) are reset by DAO vote as the BSQ/BTC rate moves, and the discount has shrunk as BSQ's price slid. Check the wiki's trading-fees page on the day you trade, not a review — including this one.
Second, where the money goes. Nobody collects it. Fees paid in BSQ are burned — destroyed the moment they're paid. Fees paid in BTC fund the DAO side of the system rather than a corporate account. Contributors — developers, mediators, translators, support — do the work first, then file a compensation request, and BSQ holders vote. If it passes, the contributor is issued newly created BSQ, which they can sell on Bisq itself to traders who want the fee discount. Follow the loop and the economics are plain: contributor pay is inflation-funded labor. New BSQ dilutes existing holders; fee burns shrink supply the other way — and at current volumes (next section), trading is far too thin for burns alone to fund a development team. Traders' fee demand subsidizes contributors, BSQ holders absorb the dilution, and no profit is extracted by anyone because there is no one positioned to extract it. Either the cleanest funding model in crypto or a slow leak, depending on the cycle — but the loop is fully visible, and nobody pretends otherwise.
What is BSQ worth? Inside Bisq's own BSQ/BTC market, the last trade on November 1, 2026 printed 0.00001618 BTC — about $1.26 — and the entire previous 24 hours of BSQ volume was 0.0495 BTC, roughly $3,900. BSQ doesn't trade on centralized exchanges; CoinGecko doesn't even maintain a live market page for it. This is a governance-and-discount token with the liquidity of a small-town bulletin board, and its price should be read that way.
The scale: honest, and tiny
We pulled Bisq 1's trade record from its markets API for the 30 days to November 1, 2026. The whole network traded about 74.5 BTC, roughly $5.8 million, in a month:
Bisq 1 volume by market, computed from Bisq's published trade record (markets API), checked November 1, 2026. Bisq 2 / Bisq Easy trades aren't in this data — at a $600 cap per trade, they don't change the picture. Chart: BogusAPY.
The biggest market on the "Bitcoin exchange" isn't a dollar market at all. It's Monero: XMR/BTC did 47.01 BTC of the month's volume — 63% of everything — ahead of BTC/EUR (12.67 BTC) and BTC/USD (7.52 BTC). That fits Bisq's remaining niche: as Monero has been delisted from centralized exchanges, the P2P network is one of the few places left to trade it without an account. (Our Monero review covers why it keeps getting delisted.) Meanwhile Ethereum's pair printed zero volume in the last 24 hours — the long tail of listed altcoins is a ghost town; the Ethereum review is where the actual ETH liquidity story lives.
For calibration: Kraken reported $2 trillion of volume for 2025 — at that pace it clears Bisq 1's entire month in roughly ninety seconds of an average day. Bisq isn't competing on size. It survives because a small number of people specifically want the thing only it sells: bitcoin for fiat with no one's permission.
Who's behind it — and who can change it
The founder check looks different when the founder left on purpose. Karrer built Bisq, then in May 2019 stepped away from all roles — the DAO launch was designed so Bisq would never depend on one person or legal entity again. No CEO, no board, no foundation office to subpoena. Also no venture capital: no ICO, no token sale, no investor allocation. Pre-DAO development ran on donations (over 25 BTC by 2019, which funded the genesis distribution); since 2019 the issuance-for-work model has paid the bills. Contributors are a mix of named and pseudonymous people whose pay requests are public DAO proposals — their skin in the game is the BSQ they earn and hold, and the exit door is selling it into that $3,900-a-day market, which disciplines pay requests all by itself.
Control, honestly stated, is mostly decentralized with a few human-held levers you should know about:
- The code is open source (AGPL-3.0, ~5,150 GitHub stars, active commits this week) and releases are signed — but you choose whether to upgrade.
- The alert key exists. In 2020, developers used a network-wide alert to halt all trading when the exploit was found. In 2026, trading was gated by minimum-version enforcement instead. A small set of role holders can stop the music. Both times they used it to protect users and published why — but "nobody can stop Bisq" is a slogan, not a fact.
- Seed nodes (eight, per the technical docs) bootstrap the P2P network's shared data — run by bonded contributors, not a company. A narrower trust point than a corporate server, not a zero one.
- Governance is BSQ-weighted voting tempered by merit/reputation weighting: the people who did the work hold most of the token, by design.
The record: two exploits, two repayments
April 2020. A flaw introduced in an October 2019 protocol update — the same update that removed arbitrators as key-holders to make Bisq more decentralized — let an attacker set other traders' fallback ("donation") address to his own, then stall trades until the escrow paid out to him. He took about 3 BTC and 4,000 XMR — roughly $250,000 — from 7 victims, all in the XMR/BTC market, over about 12 days. Bisq halted trading for roughly 18 hours, shipped a fix in v1.3.0, and passed a DAO proposal to repay the victims from future trading revenue.
May 2026. The same pattern in new clothes. An attacker running a modified client exploited a missing validation check — the taker-supplied miner-fee value wasn't checked, letting him corrupt the multisig math and sweep funds — and drained 11.59104 BTC from 10 users. Only altcoin trades were hit; fiat trades, Bisq 2, and coins in wallets were untouched, because there is no central pot to drain — every loss on Bisq happens trade by trade, which caps the blast radius. Bisq's post-mortem (May 16, 2026) says the vulnerability was likely found with AI-assisted analysis — a first for this project's incident reports, and a sign of where protocol security is heading. The response: trading halted by version enforcement, a hardening release (v1.10.0), trade limits slashed, a DAO reimbursement vote passed May 25, "Refund Angels" advancing the money, and every affected user who asked was fully repaid in BTC by June 5, 2026. Bisq 1 is on v1.10.10 now, trades were printing again on October 31, 2026 — and the project still warns its built-in wallet is a hot wallet that shouldn't hold long-term savings. Take that advice from the source.
The fair reading: the multisig design kept its core promise — no custodied honeypot has ever been drained, because there isn't one. The trade protocol around it has failed twice, both times a logic bug rather than a custody failure, and both times the DAO made victims whole out of a system with no insurance fund and no legal obligation to do so. Your recourse on Bisq is a community vote, not a claim against a company. So far, the votes have gone the right way.
Privacy: what's actually private
The claims check out, with edges. No identity verification exists to leak — there's no account database. Every node is a Tor hidden service by default, and your data stays on your machine. But "no KYC" doesn't mean "no trail": your bank sees the fiat transfer and your counterparty's name, your counterparty sees your name on the payment, and the bitcoin side settles on a public blockchain where your peer can link the trade to your addresses. On Bisq Easy, seller reputation is built partly by burning BSQ — also public, on-chain. And expect to pay for the privilege: offers are priced as a percentage distance from spot set by each maker, and no-KYC bitcoin normally trades at a premium to centralized-exchange prices. Privacy here is real — but it's privacy from the exchange, mostly because there isn't one.
The score
Bisq suits you if what you're buying is the absence of an intermediary: no account to freeze, no KYC database to breach, no company to go bankrupt holding your coins — and your amounts fit inside small limits, at P2P prices, with the patience a desktop app and a thin order book demand. It doesn't suit you if you want size, speed, or spot prices; a mobile-first experience beyond $600 Bisq Easy trades; or if "the DAO voted to repay them" isn't consumer protection you're comfortable relying on — because on Bisq, that vote is the consumer protection. A decade in, Bisq remains the real thing: the exchange with no company, fees that burn instead of billing, and a funding model you can audit down to the satoshi. Just update the software before you trade — in 2026, that's not boilerplate, it's the lesson of May.
Get posts like this by email: Subscribe to BogusAPY
Follow BogusAPY on X: @BogusAPY
Check it yourself: links and sources
Official website: bisq.network · Docs/wiki: bisq.wiki — start with Trading fees, BSQ, Dispute resolution and Trade protocols · Code: github.com/bisq-network (Bisq 1, Bisq 2, bisq-mobile; signed releases) · Block explorer (BSQ): explorer.bisq.network — BSQ lives on Bitcoin, so the BSQ explorer reads colored-coin data off the Bitcoin chain; for the plain BTC side use any Bitcoin explorer, e.g. mempool.space · Rich list: BSQ has no CoinGecko-style holder chart — CoinGecko carries no live BSQ market page at all (checked November 1, 2026); holders are read address-by-address in the BSQ explorer, and BSQ trades essentially only inside Bisq itself (market data: markets.bisq.network) · Official socials: X @bisq_network · Community: bisq.community forum and bisq.chat (Matrix). Figures checked November 1, 2026: Bisq wiki (fees, BSQ, disputes, protocols, limits); Bisq markets API (30-day trade record by market; BSQ/BTC last trade and 24h volumes; BTC at $77,866 via CoinGecko on the check date); Bisq's security incident post-mortem (May 16, 2026) and June 16, 2026 follow-up; CoinDesk and Decrypt on the April 2020 exploit; Bitcoin Magazine and Nasdaq on the DAO launch and Karrer's departure; GitHub API (Bisq 1 v1.10.10, Oct 24, 2026; Bisq 2 v2.1.14, Oct 15, 2026). Fee parameters, limits and BSQ's price are DAO-set or market-set and change — re-check them in the wiki and the app before trading. Not financial advice.
Comments
Post a Comment