Thanks to Daniela Brozzoni (and bitcoin red team) for a scan that picked up several bugs in the old joinmarket-clientserver repo, one in particular that was an especially big deal - a direct funds loss of a sender in the old payjoin implementation (bip78). Thank god very few if any people really used that but we did include it directly in the client software, so I'm sure at least a few tried it here and there (with btcpayserver e.g.). I've now changed the repo from "archived; don't recommend you use this" to "archived and DO NOT USE THIS and BIG SCARY WARNING about funds loss" and repeated the warning on every release page just in case.

Worth mentioning that both I and, to a larger extent, @m0wer , did a fair bit of scanning of the joinmarket repos looking for bugs a few months back; we found quite a few but nothing with direct funds loss like that one ^ . So this was extremely valuable extra scanning.

https://github.com/JoinMarket-Org/joinmarket-clientserver/blob/master/README.md

I recommend joinmarket-ng if you want to do joinmarket coinjoins, but bear in mind, I do not work on Joinmarket any more. The general meta comment is of course that "don't use unmaintained software in 2026" is good advice, because most things with any complexity are broken unless actively audited.