Last updated: October 29, 2026
The Wagyu leak is a breach of order data from the no-KYC swap service Wagyu.xyz: about 38,628 order records and 10,139 IP addresses from July 18 to October 26, 2026 were published, linking deposit transactions, Monero receiving addresses and client IPs. Monero itself was not broken — the leak is off-chain metadata the service kept about its users. If you swapped through Wagyu in that period, assume your swap can be tied to your IP, and treat any "refund" or "verification" message about it as a scam. Below: what leaked, what it does and doesn't reveal, and how to choose services that keep less data in the first place.
- 38,628 order records
- 10,139 IP addresses
- ~3 months of data (Jul 18 – Oct 26)
- 4,580 rows linking deposit, XMR address and IP
What happened
| Date (2026) | Event |
|---|---|
| July 18 – October 26 | Period covered by the leaked order records |
| October 27 | A listing tied to the extortion group WhiteArmor names Wagyu.xyz and demands $5 million for the files |
| October 28 | Hudson Rock researchers publish an analysis of the dataset; an account associated with Wagyu confirms that "the last 3 months worth of data" leaked, not the full year of operation |
Wagyu's side says no user funds were lost, swaps kept running and security has been strengthened. How the data was taken has not been disclosed, and the researchers note they could not independently verify where the files came from.
What data leaked
According to Hudson Rock, the main file has 45 columns per order. The fields that matter for privacy:
| Field | What it can reveal |
|---|---|
| Client IP address | Approximate location and internet provider — a lead to a real person |
| Deposit transaction hash | The exact coins you sent, on a public chain like Bitcoin or Ethereum |
| XMR receiving address | Where your Monero went |
| Source and payout addresses, amounts | The full path of the swap in both directions |
| Timestamps, session ID, browser data | Lets different orders be linked to the same visitor |
A second file summarises 10,139 IP addresses with order counts, first and last activity, country and network type. Researchers found 1,328 IPs that used the service both to receive XMR and for other assets, and 261 XMR addresses used from more than one IP. Some orders carry labels linking them to publicised thefts; those labels are unverified.
Is Monero broken?
No. Nothing in the leak touches Monero's cryptography: ring signatures, stealth addresses and hidden amounts work exactly as before (see is Monero traceable?). What leaked is what happens around the chain — the service's own records. That is the key lesson: a swap is only as private as the data the swap service keeps. A service that stores your IP next to your deposit hash and your XMR address creates the link that Monero was designed to prevent.
The leak also has limits. An IP is not a name: VPNs, Tor, mobile carriers and shared networks blur it, and one person can use many IPs. The files don't show where the XMR went after it arrived, or who funded the deposit address. But combined with other records — for example KYC data from an exchange the deposit came from — it can become an investigative lead.
Swapped through Wagyu? What to do now
- Ignore anyone who contacts you about an old order. Researchers warn that real order details make phishing convincing: "refunds", "account recovery" or "verification" messages are the expected next step. Never enter a seed phrase or pay a fee — see fake support scams.
- Treat the swap as linked. Assume your deposit address, your XMR receiving address and your IP from that time are connected in someone's dataset.
- Stop reusing the exposed addresses. Receive future Monero on fresh subaddresses and don't publish the exposed ones anywhere.
- Don't pay for "data removal". Nobody can pull a leaked file back from the internet; paying extortionists or "recovery" services only loses more money — see recovery scams.
- Hide your IP for future swaps with Tor or a VPN — read VPN vs Tor for exchanges.
No KYC is not the same as no logs
Wagyu didn't ask for ID — and still held a dataset that can identify users. Its response was that IP exposure is standard for JavaScript-based sites. A website does see your IP when you connect; storing it next to every order, for months, is a choice. Before you swap, check:
- A specific privacy policy that says what is not stored and for how long anything is kept — see no-logs policies explained.
- The "No-logs policy" and "Logs IP / metadata" attributes on each exchange page, or the filtered list of no-logs exchanges. All attributes are explained on /attributes.
- An onion address: over Tor the service never learns your IP, whatever its policy — no-KYC exchanges over Tor.
- Minimal data by design: no account, no phone — no-registration exchanges.
- Track record: independent user reports and incident history on the no-KYC track record.
Frequently asked questions
What leaked in the Wagyu breach?
About 38,628 order records and a list of 10,139 IP addresses covering July 18 to October 26, 2026. The orders include deposit transaction hashes, Monero receiving addresses, payout addresses, amounts, timestamps, client IPs, session IDs and browser data.
Does the Wagyu leak mean Monero is traceable?
No. Monero's on-chain privacy is intact. The leak exposes the service's off-chain records, which can link a public-chain deposit to an XMR address and an IP — the kind of link a no-logs service would never create.
Were funds stolen in the Wagyu leak?
Wagyu's side says no user funds were lost and swaps continued. The risk for users is privacy exposure and phishing that uses real order details.
How do I know if my swap was in the leak?
If you swapped through Wagyu.xyz between July 18 and October 26, 2026, assume it was. Don't use "leak checker" sites that ask for your addresses or transaction IDs — they can be scams that collect exactly that data.
How can I swap without leaving this kind of trail?
Connect over Tor or a VPN, receive on a fresh Monero subaddress, and pick services with a no-logs policy, no account and an onion address. Compare them on notkyc's no-logs list before swapping.
Compare services by what they log before you swap: start with the no-logs list, then swap on /swap — for example BTC → XMR. No account, no ID, no logs.
Sources: Hudson Rock analysis, ForkLog.