Wagyu review: Data Leak Exposes Three Months of Monero Swap Records

Wagyu.xyz, a no-KYC Monero-focused cross-chain swap service, confirmed that three months of order records were exposed following a ransom refusal. The operator stated that the breach covers July 18 to October 26, 2026, and does not include the full history since the service launched earlier that year.

Wagyu Data Leak Timeline and Scope

WhiteArmor listed Wagyu on its extortion site around October 27, 2026, and published files after the service rejected a $5 million demand tied to claims of roughly $907 million in XMR-heavy volume. Operator @PerpetualCow acknowledged the incident on October 28 and noted that only the most recent three months of data were affected. The service continues to operate with no reported loss of funds or disruption to active swaps.

Hudson Rock analyzed the released files and identified 38,628 order records tied to 10,139 distinct IP addresses. Among these were 8,137 orders that named native XMR receiving addresses, including 6,692 marked as completed. The dataset also contained 4,580 completed cross-chain-to-XMR orders that paired deposit transaction hashes with Monero addresses and client IP data in single records. Some entries carried internal labels such as “Poloniex Hacker.”

The exposed information does not break Monero’s on-chain privacy features such as stealth addresses or ring signatures. Instead, the risk stems from the service retaining off-chain database entries that connect visible blockchain deposits to payout addresses and session metadata. The operator described IP logging as standard for JavaScript-based sites and stated that additional security measures have since been implemented.

What the Exposed Records Reveal

The leak provides direct links between public-chain deposits and Monero receiving addresses, along with timestamps, IP addresses, and browser session details. Approximately 4,002 orders included userDeletedAt timestamps, indicating users who believed their history had been cleared. Reverse-direction swaps that accept XMR as input were also present in the files.

Users should note that IP addresses do not automatically identify individuals, because many connections route through VPNs, Tor, or shared networks. A single user may appear under multiple addresses. Still, the combination of deposit hashes, payout addresses, and connection data creates correlation opportunities that privacy-focused users typically seek to avoid.

The following table summarizes key categories of exposed data:

Potential follow-on risks include targeted phishing or fake support messages that reference specific order details. Analysts have advised caution with unsolicited contacts that mention past swaps.

Steps to Limit Exposure After the Incident

Anyone who used Wagyu during the affected period can take several concrete actions. Rotate any Monero addresses that appear in the records and avoid reusing them. Review recent transactions for unexpected patterns that could indicate correlation attempts.

Future swaps on similar platforms benefit from routing all traffic through Tor or a reputable VPN and from assuming that order data may be retained even when users request deletion. Operators in the no-KYC swap space have faced rising attempts at extortion, so users should treat any service that logs connection metadata with the same caution applied to centralized exchanges.

Wagyu stated it has completed additional security work and continues normal operations. No public timeline for a full post-mortem has been released. WhiteArmor remains active with other claims, indicating the threat actor continues to target crypto services.