Cryptocurrency exchange platform Wagyu has confirmed a three-month data leak that could compromise the privacy of Monero (XMR) users.
Gmoo. 1) Last 3 months worth of data has been leaked, not the full year Wagyu has been operating. 2) Why IP addresses? Wagyu uses JS, every single website that interacts with JS has your IP. Standard practice. 3) What now? We moove.. no money lost or anything. Outcome could have been far worse. Have spent some time upping up the security to prevent it from happening again. But who knows, AI is getting scary and everyone can get hacked these days, this is only going to happen a lot more often. Expect all companies to get hacked within the upcoming years. Swaps haven’t been impacted at all, the show goes on. 🐮 — PerpetualCow.hl (@PerpetualCow) October 28, 2026
1) Last 3 months worth of data has been leaked, not the full year Wagyu has been operating.
2) Why IP addresses? Wagyu uses JS, every single website that interacts with JS has your IP. Standard practice.
3) What now? We moove.. no money lost or anything. Outcome could have been far worse.
Have spent some time upping up the security to prevent it from happening again.
But who knows, AI is getting scary and everyone can get hacked these days, this is only going to happen a lot more often.
Expect all companies to get hacked within the upcoming years.
Swaps haven’t been impacted at all, the show goes on.
— PerpetualCow.hl (@PerpetualCow) October 28, 2026
The account associated with the service, PerpetualCow, stated that user funds were not affected and swaps continued to operate. The team has enhanced security measures.
Researchers from Hudson Rock claim that the leaked files could theoretically link public crypto deposits with Monero receiving addresses and client IP addresses.
Experts reported obtaining a dataset containing 38,628 order records and 10,139 unique IP addresses from July 18 to October 26, 2026. The sample includes 4,580 records marked as “completed” for XMR swaps. Some entries contained both the deposit transaction ID, Monero receiving address, and client IP address. This part of the dataset included 1,011 Bitcoin/Monero orders. Timestamps, session IDs, and browser data were also mentioned.
However, the researchers did not independently verify the origin of the files. Hudson Rock noted that the number of records does not equal the number of affected individuals: one person could access from different addresses, while VPNs, Tor, and shared networks could “merge” different people into one IP.
According to researchers, the dataset allows attempts to link public deposits to Monero receiving addresses but does not prove the wallet owner’s identity. The analysis also does not indicate a compromise of Monero’s cryptography or show where XMR went after entering the network.
Hudson Rock warned of phishing risks: attackers might use real details from old requests to convincingly stage scenarios involving “refunds,” “access recovery,” or “verification.”
An archived RansomLook entry linked to the WhiteArmor group, dated October 27, demands “only” $5 million for access to the leaked files.
In September, hackers demanded 6,000 XMR ($3 million at the time) from Revolut for client data, threatening to pass it to other criminal organizations.
Follow ForkLog on social media
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
