Wagyu, a blockchain, where users swap tokens directly from their own wallets without handing custody of their funds to a company.">swap service that turns other coins into Monero without asking for identity documents, has confirmed a leak of its order records, The Defiant reports. The confirmation follows an analysis published on 28 October by Hudson Rock, the cybercrime intelligence firm behind Infostealers.com. According to Hudson Rock, 4,580 completed swaps into XMR sit in rows that hold, side by side, the deposit transaction hash on the public chain, the Monero receiving address and the client’s IP address.
That 4,580 figure is only a subset of the Wagyu leak. The full export Hudson Rock examined holds 38,628 orders and 10,139 IP entries, covering 18 July to 26 October 2026. Neither is a count of victims.
“Monero’s cryptography was not broken,” Hudson Rock writes. What failed, by its reading, is the database the service kept next to the chain. The firm puts it in one line: “Privacy can survive on-chain and still fail in the database sitting next to the chain.”
The firm says the provenance of the files has not been independently authenticated, and that their origin, completeness and authenticity are not established. The Defiant’s report carries no quote from Wagyu. Coindaro could not open Wagyu’s own statement, so we do not know how the company describes the incident or what it is telling customers.
What the leaked Wagyu files contain, according to Hudson Rock
Two files are at the centre of the Wagyu leak. The first, orders.csv, lists 38,628 orders across 45 columns: order status, amounts, timestamps, deposit transaction hashes, destination addresses, client IPs, session IDs, browser headers and source labels among them. The second, users_wagyu.csv, holds 10,139 IP-level entries with order counts, the number of distinct destinations, first and last sighting, risk values, reported countries and network-provider classes. Hudson Rock says the per-IP order totals match orders.csv.
| Item in the export | Count (Hudson Rock) |
|---|---|
| Orders in orders.csv | 38,628 |
| IP entries in users_wagyu.csv | 10,139 |
| Orders naming a native XMR receiving address | 8,137 (6,692 completed) |
| Completed swaps into XMR with deposit hash, XMR address and IP in one row | 4,580 |
| Of which completed BTC-to-XMR orders | 1,011 |
| Swap records with XMR as the input | 11,317 (9,187 completed with an outgoing tx hash) |
| IPs seen in both XMR-output orders and orders paying out other assets | 1,328 |
| Session IDs spanning more than one IP | 130 |
| XMR addresses seen with several IPs | 261 |
| Completed orders with a filled userDeletedAt field, still in the export | 4,002 |
Those last rows are where the linking starts. A session ID that appears under two IPs, or a Monero address paid from several connections, lets whoever holds the file group orders that a customer may have thought were separate.
All 4,002 of the deleted-flagged orders still carry an IP and a destination, and 3,180 also keep a deposit hash. Hudson Rock does not treat this as proof that Wagyu failed to erase data it was obliged to erase: what the field means and what the service’s retention policy was are both unknown.
Orders and IPs are not people either. One customer can place many orders, and one IP can be shared. Hudson Rock’s caution, quoted by GBHackers, is that “neither orders nor IP addresses necessarily represent individual customers.”
Why a Monero swap leak matters when the chain stays private
Monero hides senders, receivers and amounts on its own ledger (our Monero page explains how). A swap service sits at the edge of that ledger. It sees the coin arriving from Bitcoin or another public chain and knows the Monero address it pays out to. If it also logs the customer’s IP, one database row links a public payment, a private destination and a connection.
“The central risk is therefore database exposure at cryptocurrency entry and exit points,” Hudson Rock says, as quoted by GBHackers.
The limits matter as much. According to Hudson Rock, the files cannot decrypt Monero and cannot, on their own, identify the person behind an IP or a wallet. They do not show who first sent XMR to a deposit address, and they cannot follow XMR once it moves on from the address in the record. The firm named no one, published no full addresses or hashes and traced no Monero transactions. It found no evidence that infostealer malware caused the incident.
Hudson Rock still describes what someone holding the files could try, while stressing that none of it is established: phishing that quotes a victim’s real trade, clustering wallets across chains through session or network data, extortion based on the value of past trades, and enriching the records with other leaked databases.
Hacker labels in the data are not proof of crime
Some orders carry labels such as “Poloniex Hacker” or “Theft”. They come from the data itself, and Hudson Rock stresses that they are not verified attributions and that mixer use alone is no evidence of crime. Some clusters overlap, so their totals cannot be added.
By Hudson Rock’s count, the “Poloniex Hacker” label sits on six completed XMR withdrawals worth about $1,025,047 on 11 and 12 October, sharing one source address, one Monero destination and one session ID, from two IPs. A “DCENT Wallet Hacker” label sits on two ETH-to-XMR orders of $651,667 on 13 October; with a third, unlabelled order of $250,960 from the same depositor, destination and IP, the total is about $902,627. Two of those orders are flagged as restricted even though they show as completed.
Another “Theft” label covers 360 completed orders worth about $1,720,820 between 17 September and 17 October, from one depositor to 13 Monero addresses over 20 IPs; 315 of them fall between $4,900 and $5,100. A wider group tagged “Tornado.Cash: 100 ETH” accounts for 25 orders worth about $3,561,386, five of which also belong to a seven-order cluster of about $823,397 placed within roughly 58 minutes on 25 September.
GBHackers notes that DCENT disclosed unauthorised App Wallet transfers in September 2026, which does not establish that these swaps used stolen funds. Hudson Rock adds that some expired orders carry implausibly large dollar values, which is why it does not total the export’s volume.
An extortion listing and a fee dispute
The leak surfaced alongside listings by a group calling itself WhiteArmor. Ransomware trackers indexed one naming wagyu.xyz on 27 October and a second, “wagyu.xyz unfairness”, on 28 October. They accuse the service of unfair coin-flip odds and undisclosed swap fees.
The numbers in that dispute do not match. The actor’s note claims 13,190 orders were charged above the quoted rate; the fee summary in the export, covering 28,840 completed swap and bridge orders, puts 11,098 in its “over” category. Hudson Rock says the listings alone do not prove an intrusion, ransomware or data theft, and that accusations are not proof of misconduct. Whether the listings and the files share a source is not known.
Wagyu says it routed $700 million of XMR this year
In a press release distributed by Chainwire on 14 August, Wagyu.xyz described itself as a cross-chain swap and bridge platform and said it had routed more than $700 million of Monero volume through Hyperliquid’s onchain order book since January 2026. Its published compliance policy says KYC documentation is not requested. The same release says the route screens transactions before execution and sends deposits that fail screening back to the originating address. These are the company’s own figures, in a sponsored release.
What exposed Wagyu users can do now
We found no advice from Wagyu. Hudson Rock’s recommendations apply to anyone who used a no-KYC swap service in the period:
- Assume the provider kept your addresses, amounts, timestamps and connection data, though it never asked your name.
- Treat unsolicited refund, recovery or verification messages that quote a real order as a likely scam.
- Do not share transaction IDs, and do not link the wallets you used to public profiles.
- Check any Wagyu breach notice on its genuine channels before acting.
- Never type a seed phrase or private key into a support link or form.
A VPN or Tor limits how much of your own IP a service sees next time, Hudson Rock notes, but it cannot erase data already handed over. Our guides on spotting crypto scams and keeping a seed phrase safe cover the phishing patterns a leak like this tends to feed.
For swap services and bridges, the firm’s advice is to keep IPs, session IDs, destinations and order mappings together for as short a time as possible, to hold transaction data apart from operational telemetry, and to define what “delete” means across live systems, logs, exports and backups.
No regulator has spoken on the Wagyu leak
We found no statement from a regulator in the US or Europe. Wagyu operates without KYC and, as far as we know, outside the EU’s MiCA licensing regime for crypto service providers. European users already have fewer regulated routes to Monero: Kraken keeps XMR listed but not for EU clients. EU data protection law generally treats an IP address as personal data, though no complaint about Wagyu has been reported.
It is the second personal-data leak on our desk in two days, after Bithumb disclosed that an outsider got into its employee work system. Bithumb collects identities; Wagyu collected none and still kept a trail. Next to watch: Wagyu’s own account of how the files got out, and whether anyone authenticates them.
1 comment