Wagyu Confirms Data Leak Exposing Monero Swap Records

Monero swap service Wagyu.xyz confirmed that three months of data had leaked, exposing transaction and connection records that researchers say can link public crypto deposits to Monero receiving addresses.

Threat intelligence firm Hudson Rock said its review found 4,580 cross-chain-to-$XMR orders marked completed that contained a deposit transaction identifier, a Monero receiving address and a client IP address in the same row. That included 1,011 Bitcoin-to-Monero orders.

The exposure cuts across Wagyu's pitch of swapping into Monero privately without creating an account. A service still needs the customer's requested receiving address to deliver the coins; retaining that address alongside deposit and connection details creates a trail outside the private blockchain.

In an October 28 statement, PerpetualCow, the account linked as Wagyu's social channel on its website, said: “Last 3 months worth of data has been leaked.” The operator said no money had been lost, swaps had not been affected and additional security work had been undertaken.

An October 27 WhiteArmor listing archived by RansomLook demanded $5 million.

What the Records Reveal

Hudson Rock counted 38,628 order records and 10,139 distinct IP addresses in files spanning July 18 through October 26, 2026. The files also contained timestamps, session identifiers and browser information. The firm reviewed material supplied alongside a WhiteArmor-associated claim and said it had not independently authenticated the files' provenance.

Those figures do not establish how many people were affected. One person can use several IP addresses, while VPNs, Tor exit nodes and shared networks can place multiple people behind one address. Nor does every order represent a completed trade; Hudson Rock's completed-order counts reflect the files' status labels, not independently verified settlement.

The linkages are recoverable from the supplied records, Hudson Rock said, but they do not establish a customer's legal identity or prove that the person requesting a swap owns the receiving wallet. The analysis does not demonstrate a breach of Monero's cryptography or reveal where $XMR moves after entering the network.

Hudson Rock advised users to be skeptical of unsolicited refund, recovery or verification messages referencing a real historical order: exposed trade details could make impersonated support messages more convincing.