The operator of Wagyu, a Monero swap service that does not ask users for identity documents, has confirmed that three months of its order data has leaked, including users’ IP addresses. A security firm that examined files said to come from the leak found thousands of orders that tie a deposit on a public blockchain to a Monero receiving address and the IP address that placed the order.
The leak does not mean Monero has been cracked. What leaked is the swap service’s own ledger: the off-chain record a company keeps when it moves coins between a transparent blockchain and a private one. For people who used Wagyu to buy or sell Monero (XMR) between July and late October, that ledger may say more about them than the blockchain does. It is the latest entry for TSN’s crypto hacks and exploits hub.
In brief
- Wagyu’s operator says the “last 3 months” of data leaked, that no money was lost and that swaps are still running.
- Hudson Rock says 4,580 completed orders in the files join a deposit transaction, a Monero address and an IP address in the same row.
- Monero’s on-chain privacy was not broken, Hudson Rock says. How the data was taken and who exactly is exposed are still unknown.
An extortion listing, then an admission
Wagyu was listed on the leak site of an extortion group calling itself WhiteArmor around 27 October. The Crypto Times reported, citing the listing, that the group demanded $5m to keep the data private. The Crypto Times later reported that WhiteArmor’s note said it released files after the operator declined to pay. Wagyu has not commented on any demand.
On the morning of 28 October the operator responded on X through @PerpetualCow, the account that Wagyu’s website links to as its own. “Last 3 months worth of data has been leaked, not the full year Wagyu has been operating,” the post said. On the IP addresses, it argued that collecting them is unavoidable: “Wagyu uses JS, every single website that interacts with JS has your IP. Standard practice.”
The operator said there was “no money lost or anything” and that the “outcome could have been far worse”. The post added that time had been spent “upping up the security to prevent it from happening again” and that “swaps haven’t been impacted at all, the show goes on.” In a reply, the same account said the data was “for the most part” useless. Wagyu has not said how the data was taken or whether it has contacted users, and its website carried no incident notice on the morning of 29 October.
Wagyu says on its site that users can “swap to your own receiving address without creating an account”, trading Bitcoin, Ether, Solana, USDT or USDC for Monero or Zcash and back. It routes the Monero leg through Hyperliquid’s order book.
What Hudson Rock found in the files
Threat intelligence firm Hudson Rock analysed CSV files supplied with the WhiteArmor claim. It counted 38,628 order records spanning 18 July to 26 October 2026, and 10,139 distinct IP addresses. It stresses that these are not 10,139 people: shared connections, VPNs and Tor exit nodes can stand for many users, and one person can use several addresses. It also says the origin of the files has not been independently authenticated.
According to Hudson Rock, 8,137 orders named a native Monero receiving address, and 6,692 of those were marked completed. In 4,580 completed orders that converted another coin into Monero, a single row held the incoming deposit’s transaction hash, the Monero destination and the client’s IP address. Of those, 1,011 were Bitcoin-to-Monero swaps. The link works in reverse too. Hudson Rock found 9,187 completed orders that sent Monero out to another chain and kept the outgoing transaction hash, so a payout on a public chain such as Ethereum can be traced back to a Wagyu order.
The firm also says some large orders carry source labels such as “Theft”. It warns that these labels come from the files themselves and that it has not verified that any wallet belongs to a criminal. WhiteArmor has separately accused Wagyu of unfair coin-flip odds and hidden fees, which the operator disputed in replies on X. Hudson Rock says those claims would need a separate audit and that it has not treated them as proven.
No-KYC does not mean no records
This is TSN’s analysis. Services like Wagyu sell privacy by not asking who you are, and many users take that to mean nothing about them is kept. This leak shows the gap. Monero hides senders, recipients and amounts on its own chain, but a swap service has to know where to send the coins. If it stores that destination next to the deposit hash and the IP address, it has built the very link that Monero exists to prevent. Hudson Rock puts it as a correlation problem, not a cryptography problem, and that is the right frame.
For anti-money-laundering work, the files cut both ways. Records that join a public deposit, a private destination and a network address are the kind of lead investigators usually need a court order to get. Now they may be in the hands of anyone who downloaded the leak. Wagyu’s site promises that “AML runs before the swap”, and the source labels Hudson Rock describes suggest the service did tag some incoming funds. What it did with flagged deposits is a question the operator has not answered.
Deleted orders that were still there
Hudson Rock found 4,002 completed orders with a populated field called “userDeletedAt” that were still in the export, all of them with an IP address and a destination. It is careful to say the field name alone does not show what was deleted or what Wagyu promised. Even so, users who believed they had cleared their history may still be in the files. The more immediate risk is phishing. Hudson Rock warns that someone holding a real order’s amount, time and payout address could write a very convincing fake support or refund message. TSN covered how a single fake alert emptied NGRAVE users’ wallets this month. Anyone who used Wagyu between July and October should treat any message that quotes their past swaps as hostile.
The case also adds to a wider argument about where privacy-coin users are exposed: not on-chain, but at the points where they enter and leave. Exchanges such as Kraken cap Monero withdrawals and have asked buyers to explain themselves, pushing some users towards no-KYC swaps. Zcash developers have been working on a related weak point, one public address that could link private swaps. Wagyu’s leak shows the same problem in a much plainer form, a company database.
Two questions remain open: how the files left Wagyu’s systems, and whether its next statement will tell users what it now keeps and for how long.
Sources
- @PerpetualCow (Wagyu’s operator account), post on X, 28 October 2026
- Wagyu website, wagyu.xyz
- Hudson Rock / InfoStealers, “38,628 Crypto Orders. 10,139 IPs. What Wagyu’s Alleged Leak Means for Monero Privacy.”, 28 October 2026
- The Crypto Times, WhiteArmor listing report, 28 October 2026
- The Crypto Times, follow-up report, 29 October 2026
Related stories
- Kraken Drops Monero Spending Questions but Keeps $1,500 Withdrawal Cap
- NGRAVE Fake App Alert Drained Wallets; Bitquery Estimates $2.65m Taken
- Future Quantum Computers Could Link Private Zcash Swaps. Zakura Proposes a Fix
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
