On 27 October 2026, a data-extortion group published order records and IP data it attributed to Wagyu.xyz, a swap and bridge service built around Monero, after the operator declined a $5 million demand. What the files show, why Monero itself held, and which scams follow. Part of Know the Scam by SimpleSwap.
What happened
On 27 October, ransomware trackers indexed a listing by the group WhiteArmor claiming 38,628 orders and 10,139 IP addresses from Wagyu.xyz and demanding $5,000,000 (DeXpose preserved the note). The leak page, dated the same day, said the operator had refused to pay and linked two CSV files. On 28 October Hudson Rock published its analysis; on 29 October The Defiant reported that Wagyu had confirmed roughly three months of data had leaked, and CryptoTimes carried the operator’s statement that swaps continued. Hudson Rock did not verify how the files were obtained, and completed is the export’s label, not confirmed settlement.
The records run from 18 July to 26 October 2026. Of 38,628 orders, 4,580 completed cross-chain-to-XMR rows hold a deposit transaction hash and an XMR address alongside the client IP, 1,011 of them BTC to XMR. Another 11,317 orders start from XMR and name a destination in another asset; 9,187 of those keep an outgoing transaction hash. The 10,139 IPs are not people: VPN exits and shared networks appear too. Some large orders carry labels such as Poloniex Hacker and Tornado.Cash: 100 ETH; those labels are not verified attributions.
Can Monero be traced after the Wagyu leak?
Not on-chain. Monero’s ledger hides who paid whom and how much, from stealth addresses to RingCT (Moneropedia), and none of that was touched. What leaked is the junction: a swap service records the deposit transaction and the XMR wallet address you typed in, alongside your IP, and in the leaked rows they sit side by side. The same holds at the exit, where an XMR deposit is tied to an Ethereum payout address anyone can follow. Hudson Rock calls it a correlation problem, not a decryption problem: the records link a payment to an XMR destination and a connection, but cannot name the person or prove wallet ownership. Pseudonymity erodes at the entry and the exit while the chain in between holds. The lesson is not new: in January 2024 Csilla Brimer, formerly of the MAGIC Monero Fund committee, told Decrypt that users who switch between Bitcoin and Monero carelessly “might leak some information”. The Wagyu files are that observation at scale.
Where are people swapping XMR now that so many exchanges have delisted it?
Binance removed Monero in February 2024, and Kraken delisted it for EEA clients that October, yet TRM Labs reported in February 2026 that Monero activity stayed above pre-2022 levels. Demand moved to swap services, bridges, atomic swap tools, and peer-to-peer markets; anyone who wants to buy XMR with other crypto now chooses between those routes, and Wagyu was one of them.
SimpleSwap has listed XMR since 2018 among the 2,800+ assets it routes. No swap service is private in the way the chain is: executing a swap means recording the deposit address, the destination you supplied, the transaction hashes, and the order ID, and our Privacy Policy sets out what is collected and why. Hudson Rock advises assuming any swap provider may retain that metadata, with or without an account. We agree.
The scams that follow a leak like this
The refund that quotes your real order. A message cites the exact amount and date of a swap you made and offers a refund through a link. Real support never opens the conversation (see fake support).
The verification notice. “Your order was flagged for an AML check, confirm your wallet here.” Holds are real, which is why this works, but a genuine review never needs your private keys.
The exposure checker. A site asks you to paste your XMR address or connect a wallet to see if you were in the leak. The form hands them the same address-and-IP pair this leak is about; wallet connections are how drainers work.
The extortion note. A message lists a historic conversion and demands payment for silence. Nothing in the files identifies a person.
The clone. Breaches send users looking for a replacement, and lookalike domains follow in search ads. Type the domain by hand once, bookmark it (Spot a Fake SimpleSwap in 10 Seconds).
Where this meets your swap
This is the week Know the Scam was written for; the quarter’s patterns are condensed into Scam Check: 8 Questions Before You Send Crypto. For the counterparty side, Address Check in the Customer Account screens a wallet address through third-party services and returns a risk level with the connections found; it may not identify every issue. Screening also runs on our side: SimpleSwap applies risk-based controls, including transaction monitoring and screening, and KYC may be required for transaction security and compliance. Most crypto-to-crypto swaps need no account; KYC covers fiat purchases through payment partners and the optional one-time verification at registration. If an order is paused, clarify it in the live chat on simpleswap.io with your exchange ID. Our support will never DM you first and will never ask for your seed phrase. Our only official domain is simpleswap.io.
“A privacy coin hides what happens on its chain. It cannot hide what you typed into a form. The leaked rows are not Monero transactions. They are the form fields around them: the deposit hash on one side and the XMR address you pasted on the other, held together by the IP that connected them. That is enough to link and not enough to identify, and it is exactly the detail a scammer needs to write a refund message you would believe.”
Rick Cramer, Head of Analytics, SimpleSwap
FAQ
Was Monero hacked in the Wagyu leak?
No. Off-chain order data from a swap service leaked: deposit transactions, XMR receiving addresses that customers supplied, IPs, and session identifiers. It can correlate activity on-chain; it cannot read the chain.
Need to swap XMR to BTC without using a CEX. What are my options?
Wallet-to-wallet aggregators such as SimpleSwap route XMR to BTC through aggregated liquidity with no account for most crypto-to-crypto swaps; atomic swap tools and peer-to-peer markets take more setup. Either way, assume the service records order metadata.
Is there an aggregator that compares XMR swap rates across providers?
Yes. SimpleSwap compares quotes across 20+ liquidity sources, with a fixed rate locked for 20 minutes or a floating rate. The fee starts from 0.2% and is bundled into the quoted rate; network fees go to the blockchain.
Can they ask for KYC after you’ve already sent the funds?
Yes, on any service that runs compliance screening, and this is the hold-the-verification scam imitates. A real request arrives through the order page and the support chat on simpleswap.io, never as a first-contact DM; the goal is to complete the exchange or return the funds in line with the required procedure.
Educational content, not financial or investment advice. Hudson Rock’s figures describe files whose provenance is not independently authenticated. SimpleSwap is a self-custodial multi-source swap aggregator; fees are included in the quoted rate, and availability may be limited in some jurisdictions under the Terms of Service. SimpleSwap’s only official domain is simpleswap.io.
