Bisq

Bisq's trade arbitration did not verify that the payout address for time-locked fallback transactions was the legitimate Bisq donation address. Attackers posing as sellers set their own donation address, then let trades time out, causing the platform to send the buyer's deposit, payment, and security deposit to the attacker's wallet instead of the Bisq DAO address.

86 BTC on March 28 and April 7.