Alleged Wagyu.xyz swap leak claimed by WhiteArmor: 38,628 orders and 10,139 IPs could link Monero users to addresses

Linha do tempo

1. gbhackers.com ↗ · pub. 29/10/2026 05:47 · coletado 29/10 06:00

   Alleged Wagyu.xyz crypto swap leak links 4,580 completed swaps, Monero addresses and client IPs

   ler a análise desta fonte ocultar

   An alleged data leak from the cryptocurrency swap service Wagyu.xyz reportedly contains 4,580 completed cross-chain swaps that tie incoming transaction hashes, Monero receiving addresses and client IP addresses together. The dataset reportedly holds 38,628 order records from July 18 to October 26, 2026, plus an activity index of 10,139 distinct IP addresses. Hudson Rock has not independently authenticated the breach provenance, and orders or IPs do not necessarily map to individual customers. Ransomware trackers indexed WhiteArmor listings naming Wagyu on October 27-28, tied to accusations of unfair gambling odds and undisclosed swap fees. These claims do not establish intrusion, ransomware deployment or financial misconduct.

   Technical Details

   • Hudson Rock identified 8,137 orders naming native Monero destinations, of which 6,692 were marked completed. Within the completed cross-chain subset, 4,580 records retained the transaction-address-IP combination, including 1,011 Bitcoin-to-Monero orders.
   • The records reportedly combine deposit transactions, destination addresses, timestamps, browser information, session identifiers and IP addresses.
   • Another 11,317 native-Monero-input orders contain service deposit addresses and destinations for other assets; 9,187 of these completed records retained outgoing transaction hashes.
   • The companion IP index reportedly reconciles with the order export. 130 session identifiers appear across multiple IPs, and 261 Monero receiving addresses were used from multiple IPs.
   • Several large orders carry labels such as "Poloniex Hacker" (six completed bridge withdrawals, about $1.03M), "DCENT Wallet Hacker" (part of three linked Ethereum-to-Monero orders, about $903K), "Theft" (360 completed orders, about $1.72M, 315 clustered near $5,000) and Tornado Cash (25 orders, $3.56M, some overlapping other totals). These labels do not authenticate wallet attribution or prove criminal activity.
   • Hudson Rock states the findings expose off-chain privacy failures, not a compromise of Monero's cryptography. The correlation does not prove legal identity or wallet control, and VPNs, Tor, shared networks, custodial destinations and automated integrations complicate attribution.

   Remediation

   • Swap services should minimize retention of destination addresses, IPs and session metadata, and should separate or expire these logs.
   • Users should avoid assuming no-KYC swaps are unlinkable and should use separate addresses and network hygiene.
   • Independent blockchain evidence and authenticated service logs are needed before treating these records as proof of ownership or wrongdoing.
2. infostealers.com ↗ · pub. 28/10/2026 14:52 · coletado 28/10 16:01 primeiro registro

   WhiteArmor-linked Wagyu.xyz leak: 38,628 swap orders and 10,139 IPs could deanonymize Monero users

   ler a análise desta fonte ocultar

   Hudson Rock reviewed purported transaction data from the no-KYC swap service Wagyu.xyz, supplied alongside a claim attributed to WhiteArmor. Ransomware trackers indexed WhiteArmor listings naming Wagyu.xyz on October 27-28, 2026, but the breach provenance, ransomware deployment and exfiltration are unverified. The files (orders.csv with 38,628 rows, covering July 18 to October 26, 2026, and users_wagyu.csv with 10,139 IP-level entries) link public-chain deposits, Monero (XMR) receiving addresses, payout hashes, IPs and session IDs. Hudson Rock stresses this is not a flaw in Monero's cryptography. It is an off-chain correlation risk at the swap service. Records could support investigative leads, targeted phishing or extortion, but they do not by themselves identify users or trace XMR after it enters the network.

   Technical Details

   • Hudson Rock isolated 8,137 native-XMR-destination records (6,692 completed). In 4,580 completed cross-chain records, a deposit hash, a Monero address and a client IP appear in the same row, including 1,011 completed BTC to XMR orders.
   • 11,317 XMR-input swap records were found, of which 9,187 completed records kept an outgoing transaction hash. This lets an XMR to ETH exit be tied to a transparent-chain address.
   • 4,002 completed orders carry a populated userDeletedAt field yet remain in the export with IP and destination; 3,180 also have a deposit hash.
   • Source labels in the export ("Poloniex Hacker", "DCENT Wallet Hacker", "Theft", "Tornado.Cash: 100 ETH") are unverified. Examples include six bridge withdrawals totaling about $1.03M, three ETH to XMR orders totaling about $903K, and one "Theft" depositor with 360 orders to 13 XMR destinations. Another 25 Tornado-labeled orders total about $3.56M, which overlaps with other cases.
   • WhiteArmor's allegations of hidden fees and rigged coin-flip odds are unproven. Its fee figures (13,190 orders above the quoted rate) differ from the attached summary (11,098).
   • IPs may be shared, VPN or Tor, so the 10,139 entries are not 10,139 unique users. No evidence links infostealers to this incident.

   Remediation

   • Swap services should minimize retention of IPs, sessions, destination addresses and order mappings together, segregate sensitive data, apply least privilege and encryption, and verify that deletion covers logs, exports and backups.
   • Users should assume swap providers retain addresses and metadata even without KYC, distrust unsolicited refund or recovery messages that cite real orders, and never enter seed phrases into support links.