This entry covers the legacy joinmarket-clientserver codebase. Its README and final release warn of an unpatched BIP78 PayJoin sending vulnerability in versions v0.7.0–v0.9.12 that can expose the full value of spent coins to a malicious recipient. The maintainers recommend against running this archived software and say the issue will not be fixed. Other JoinMarket implementations need their own assessment.
- Product
- Archived Bitcoin CoinJoin implementation
- Networks
- Bitcoin
- Cost model
- Historical implementation; no current quote
- Mechanism
- Collaborative transaction software
Fees and cost context
Legacy market and mining fee descriptions are historical context. No current fee or use recommendation is provided for this archived implementation.
What to know
- The official README and final-release page document the archive status and the maintainer-reported vulnerability warning.
What to check
- Do not use this legacy client to send PayJoin payments. Its maintainers warn that the full value of spent coins can be lost and recommend not running the software.
- This warning applies to the legacy joinmarket-clientserver implementation; other projects using the JoinMarket name require their own assessment.
Key question
Which JoinMarket implementation and maintenance record does a claim refer to?
References & record details
- JoinMarket project repository ↗JoinMarket contributors
- Final release of joinmarket-clientserver ↗JoinMarket-Org · Published 2026-04-21
Profile details updated 4 Nov 2026. Editorial review recorded 5 Nov 2026. Content reviewed under our editorial standards. Documentation does not establish transaction performance. Read our standards.
Service policies
0 of 6 fields have a sourced policy summary. Published policies are provider statements, not verified practice. Unknown means we have not established the field; it does not mean the service has no requirement.
| Policy | Published terms and evidence |
|---|---|
| Custody / funds control | Historical profile; current service policy is not applicable. |
| Registration | Historical profile; current service policy is not applicable. |
| Identity checks / KYC | Historical profile; current service policy is not applicable. |
| Refund / failed-transfer terms | Historical profile; current service policy is not applicable. |
| Data retention | Historical profile; current service policy is not applicable. |
| Access restrictions | Historical profile; current service policy is not applicable. |
Website uptime checks
Monitoring is not active for this historical or untracked profile.
Profile change history
Field history starts 2026-09-19. Review-only dates and website observations do not create editorial changes. Changes are dated when recorded here, not when a provider first made them.
2026-11-04 09:09:48 UTC · 3 fields changed
| Field | Before | After |
|---|---|---|
| Assessment | This entry covers the legacy joinmarket-clientserver codebase. Its repository was archived on 27 April 2026, and its final release states that no further updates are planned. Other JoinMarket implementations need their own assessment. | This entry covers the legacy joinmarket-clientserver codebase. Its README and final release warn of an unpatched BIP78 PayJoin sending vulnerability in versions v0.7.0–v0.9.12 that can expose the full value of spent coins to a malicious recipient. The maintainers recommend against running this archived software and say the issue will not be fixed. Other JoinMarket implementations need their own assessment. |
| What to check | The maintainers warn against continued use without independent confidence in the code. This status applies to the legacy client, not every project using the JoinMarket name. | Do not use this legacy client to send PayJoin payments. Its maintainers warn that the full value of spent coins can be lost and recommend not running the software. This warning applies to the legacy joinmarket-clientserver implementation; other projects using the JoinMarket name require their own assessment. |
| What to know | The original README and final release document the archive status. | The official README and final-release page document the archive status and the maintainer-reported vulnerability warning. |
References attached to the revised record: JoinMarket project repository · Final release of joinmarket-clientserver
Earlier editorial notes (2)
- — Legacy JoinMarket client: maintainer security warning
The legacy joinmarket-clientserver README and final release warn of an unpatched BIP78 PayJoin sending vulnerability in versions v0.7.0–v0.9.12. A malicious recipient could take the full value of spent coins. Maintainers recommend not running the archived software. The profile now highlights this published warning; it does not apply the finding to every JoinMarket implementation. No exploit reproduction or independent code audit was performed.
- — Archive, fee and availability corrections
The legacy JoinMarket client is now marked archived with a red warning. FlashMixer’s published minimum is corrected to 0.001 BTC. JokerMix’s earlier maintenance notice is no longer displayed; processing remains unconfirmed. Added NEAR Intents’ route-specific withdrawal fee and a BaseScan warning about potentially delayed block data.
These are preserved directory notices, not reconstructed field-by-field diffs.