Monero swap service Wagyu confirms data leak: 4,580 XMR orders exposed with IP addresses

Anyone who swapped bitcoin or other coins into Monero (XMR) through the swap service Wagyu.xyz between July 18 and October 26, 2026 may appear in a dataset that is now circulating online. Wagyu has confirmed the data leak. According to an analysis by security firm Hudson Rock, it contains 4,580 Monero swap orders marked as completed in which the deposit transaction, the Monero receiving address and the customer's IP address sit side by side. The Monero blockchain itself is not affected. The risk lies with the service's customers, and above all it means targeted phishing.

This article sets out which data is exposed, what the leak means for Monero as a privacy coin, and where the price and the major FCMP++ protocol upgrade stand, whose test network received a new version on October 26.

Wagyu data leak: which Monero data is exposed

Wagyu.xyz is a so-called swap service. A swap service exchanges one coin for another without the user opening an account with identity checks: you send bitcoin, for example, to a deposit address and receive Monero at an address of your choice. Monero users in particular rely on such services because many large exchanges no longer list XMR.

According to the figures published by Hudson Rock, reported among others by Forklog on October 29 and by the Phemex news portal, the dataset covers 38,628 order records and 10,139 unique IP addresses from the period between July 18 and October 26, 2026. Of these, 4,580 records carry the "completed" flag for Monero swaps. For 1,011 bitcoin-to-Monero orders, the deposit transaction ID, the Monero receiving address and the customer's IP address appear together. Further fields include timestamps, session IDs and browser details.

Hudson Rock itself names two caveats. The company has not independently verified where the files came from. And the number of records does not equal the number of people affected: anyone who connected via VPN, Tor or a shared network shows up with an IP address that many users may share, and one customer may have placed several orders.

Monero cryptography: why the protocol has not been broken

Monero hides the sender, recipient and amount of a transaction on the blockchain. The protocol uses ring signatures, stealth addresses and confidential amounts to do so. A ring signature mixes the real input of a transaction with several decoys, so that an outside observer cannot tell which coin was actually spent.

The leak changes nothing about this technology, as Hudson Rock also stresses: the findings show no weakness in Monero's cryptography. The data comes from a service provider's order management, in other words from outside the blockchain. Even so, the data can build a bridge. The bitcoin deposit is publicly visible on the Bitcoin blockchain, and the dataset links it to a Monero receiving address and an IP address. In Hudson Rock's assessment, that does not identify the owner of a wallet. It does, however, provide leads that can help when combined with other data sources.

That is the real lesson of the case. Monero's privacy ends where a user moves coins through a service that stores data. Off-chain in this context means outside the blockchain, at the provider, on its servers.

Extortion by WhiteArmor: how the data became public

The case came to light through extortion. An archived entry on the RansomLook platform dated October 27, 2026 attributes the data to a group called WhiteArmor and cites a demand of $5 million for access to the files, Forklog reports. According to a blog post by the swap service SimpleSwap, the group published order and IP data after the operator refused to pay.

Wagyu responded on October 28 with a statement via the PerpetualCow account, which Forklog attributes to the service. It said the leak covered the last three months rather than the entire period of operation. IP addresses had been recorded because the website uses JavaScript. No funds had been lost, swaps were continuing and security had been tightened. These statements come from the operator and have not been independently verified.

Phishing with real order data: the biggest risk for those affected

Hudson Rock explicitly warns of a consequence that can hit customers faster than any blockchain analysis: anyone who knows real order details can write convincing messages. A supposed refund, a "verification" because of the leak or a request to enter your own address on a checking site looks far more genuine when the date, amount and address are correct. cryptoticker.io has compiled what such messages look like after a data leak in a guide to spotting phishing after data breaches.

Three principles apply regardless of the provider. No reputable service asks for a deposit to trigger a refund. No reputable service asks for your seed phrase or private key. And sites offering to check whether your Monero address is in the leak should be treated with caution: entering an address there or connecting a wallet may supply exactly the link the dataset did not yet have.

Anyone who swapped through Wagyu should also assume that the Monero receiving address used at the time may be linked to an IP address. For future payments, a new subaddress makes sense. A subaddress is an additional receiving address of the same Monero wallet that cannot be connected to the main address from the outside.

Monero price this week: between $572 and $649

The leak barely shows in the price. According to trading data from the Kraken exchange, Monero cost around $600 early on Monday morning, November 2, and around 537 euros in euro trading. At the start of the week, on Monday, October 26, XMR had opened at $593, which amounts to a gain of just over 1 percent. Data provider Coinpaprika shows a seven-day gain of 1.9 percent.

The week was not calm, though. On October 29, XMR rose as high as $649.40, and on October 30 it fell as low as $572.49, both according to Kraken. The range of almost $77 equals around 13 percent of the current price. According to Coinpaprika, XMR is just under 25 percent short of its all-time high of $797 from January 14, 2026.

FCMP++ stressnet v3.1: the inflation bug on the test network

While the leak unfolded, the technology moved forward. On October 26, version v3.1 of the so-called stressnet for FCMP++ and Carrot was released. FCMP++ is a membership proof across the entire Monero blockchain: instead of hiding a transaction among a small number of decoys, it is meant to be concealed among all outputs on the whole blockchain in future. Carrot is the new address scheme that goes with it. The stressnet is a test network in which the upgrade is tried out under heavy load. It split off from the previous test network on October 5 at block 3,102,800; cryptoticker.io described the background ahead of that date.

According to the release notes on GitHub, v3.1 closes a gap: Carrot outputs are now kept out of ring signatures entirely. The developers describe the problem as a detectable inflation vulnerability that was open during the first 24 hours after the test network split. The release also adds protection against denial-of-service attacks on transaction relay and faster wallet syncing. Hardware wallets, multisig and transaction proofs do not yet work on the stressnet.

For holders on the mainnet, nothing changes for now. No date for activating FCMP++ on the mainnet has been announced on getmonero.org. Finding and fixing an inflation bug on a test network before the upgrade touches real coins is exactly what such a test phase is for.

Buying Monero in Germany: MiCA and the exchange delistings

The Wagyu case also shows why Monero users turn to such services in the first place. As cryptoticker.io counted on October 5, 2026 in an overview of buying Monero in Germany, six major exchanges no longer list XMR. The reason is the EU's Markets in Crypto-Assets Regulation, MiCA. The regulation only allows trading platforms to admit coins with a built-in anonymisation feature if the provider can identify holders and transaction history. Monero is designed to prevent precisely that.

For investors in Germany, this means weighing up the options. An exchange with MiCA authorisation offers segregation of client assets, a competent supervisor and a point of contact, but usually does not list Monero. A swap service without an account offers Monero, but, as Wagyu shows, still stores data and is not subject to any European supervision. Which providers hold an authorisation is shown in the comparison of regulated crypto exchanges. Before any purchase, it is worth checking whether the provider is listed in the ESMA register.

Monero custody, holding period and leverage

Anyone who holds Monero usually keeps it in self-custody. A self-custody wallet is a wallet whose keys are controlled by the user alone. For Monero there are the project's official programs and a few hardware wallets with Monero support; which devices are suitable is set out in the hardware wallet comparison. Important for Wagyu customers: the leak does not involve any keys. If you have never given out your seed phrase, you do not need to move your coins, as long as you have not responded to one of the phishing messages described above.

For tax purposes in Germany, swapping bitcoin into Monero is a private sale under Section 23 of the Income Tax Act. If less than a year passes between purchase and swap, a gain is taxable, provided all private sale gains for the year together reach the exemption threshold of 1,000 euros. After more than a year, the swap is tax-free under current law. Swaps via a service without an account also belong in the tax return, and a dataset like Wagyu's can later show that they took place.

Outside the EU, Monero is also traded with leverage, for example through perpetual futures. On October 30, the daily high and low were around 11 percent apart, according to Kraken. A position with tenfold leverage can be liquidated by a counter-move of less than 10 percent. Liquidation means the exchange forcibly closes the position because the posted collateral no longer covers the loss.

Monero price levels: $572 below, $650 above

Last week produced two levels that traders are watching. On the downside, it is the weekly low of $572.49 from October 30; below that lies the round mark of $550. On the upside, it is the weekly high of $649.40 from October 29, roughly the $650 mark. The fact that the price did not fall below the October 30 low after the leak became known suggests that the market reads the case as a problem of a service provider rather than of the protocol. That is not a forecast; the Monero prediction page offers a longer outlook with scenarios.

Wagyu data leak: anyone who swapped until October 26 is in the dataset

Three steps help Monero holders put the leak into context and set up their own coins properly:

1. Check your custody: Are your XMR in your own wallet, and are you the only one who knows the seed phrase? You can find a hardware wallet with Monero support in the hardware wallet comparison.
2. Choose how you buy: For bitcoin and other coins, authorised providers offer supervision and segregation of client assets. Which exchanges hold a MiCA authorisation is listed in the comparison of regulated crypto exchanges.
3. Document your swaps: Every swap within the holding period counts for tax purposes. A tax tool adds up gains and deadlines; the comparison of crypto tax tools shows a selection.

(As of November 2, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)