Wagyu data leak: 4,580 Monero orders with IP addresses

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

Anyone who swapped bitcoin or other coins into Monero (XMR) through the swap service Wagyu.xyz between July 18 and October 26, 2026 may appear in a dataset that is now circulating online. Wagyu has confirmed the data leak. According to an analysis by security firm Hudson Rock, it contains 4,580 Monero swap orders marked as completed in which the deposit transaction, the Monero receiving address and the customer's IP address sit side by side. The Monero blockchain itself is not affected. The risk lies with the service's customers, and above all it means targeted phishing.

This article sets out which data is exposed, what the leak means for Monero as a privacy coin, and where the price and the major FCMP++ protocol upgrade stand, whose test network received a new version on October 26.

Wagyu data leak: which Monero data is exposed

Wagyu.xyz is a so-called swap service. A swap service exchanges one coin for another without the user opening an account with identity checks: you send bitcoin, for example, to a deposit address and receive Monero at an address of your choice. Monero users in particular rely on such services because many large exchanges no longer list XMR.

According to the figures published by Hudson Rock, reported among others by Forklog on October 29 and by the Phemex news portal, the dataset covers 38,628 order records and 10,139 unique IP addresses from the period between July 18 and October 26, 2026. Of these, 4,580 records carry the "completed" flag for Monero swaps. For 1,011 bitcoin-to-Monero orders, the deposit transaction ID, the Monero receiving address and the customer's IP address appear together. Further fields include timestamps, session IDs and browser details.

Hudson Rock itself names two caveats. The company has not independently verified where the files came from. And the number of records does not equal the number of people affected: anyone who connected via VPN, Tor or a shared network shows up with an IP address that many users may , and one customer may have placed several orders.

Monero cryptography: why the protocol has not been broken

Monero hides the sender, recipient and amount of a transaction on the blockchain. The protocol uses ring signatures, stealth addresses and confidential amounts to do so. A ring signature mixes the real input of a transaction with several decoys, so that an outside observer cannot tell which coin was actually spent.

The leak changes nothing this technology, as Hudson Rock also stresses: the findings show no weakness in Monero's cryptography. The data comes from a service provider's order management, in other words from outside the blockchain. Even so, the data can build a bridge. The bitcoin deposit is publicly visible on the Bitcoin blockchain, and the dataset links it to a Monero receiving address and an IP address. In Hudson Rock's assessment, that does not identify the owner of a wallet. It does, however, provide leads that can help when combined with other data sources.

That is the real lesson of the case. Monero's privacy ends where a user moves coins through a service that stores data. Off-chain in this context means outside the blockchain, at the provider, on its servers.

Extortion by WhiteArmor: how the data became public

The case came to light through extortion. An archived entry on the RansomLook platform dated October 27, 2026 attributes the data to a group called WhiteArmor and cites a demand of $5 million for access to the files, Forklog reports. According to a blog post by the swap service SimpleSwap, the group published order and IP data after the operator refused to pay.

Wagyu responded on October 28 with a statement via the PerpetualCow account, which Forklog attributes to the service. It said the leak covered the last three months rather than the entire period of operation. IP addresses had been recorded because the website uses JavaScript. No funds had been lost, swaps were continuing and security had been tightened. These statements come from the operator and have not been independently verified.

Phishing with real order data: the biggest risk for those affected

Hudson Rock explicitly warns of a consequence that can hit customers faster than any blockchain analysis: anyone who knows real order details can write convincing messages. A supposed refund, a "verification" because of the leak or a request to enter your own address on a checking site looks far more genuine when the date, amount and address are correct. cryptoticker.io has compiled what such messages look like after a data leak in a guide to spotting phishing after data breaches .

Three principles apply regardless of the provider. No reputable service asks for a deposit to trigger a refund. No reputable service asks for your seed phrase or private key. And sites offering to check whether your Monero address is in the leak should be treated with caution: entering an address there or connecting a wallet may supply exactly the link the dataset did not yet have.

Anyone who swapped through Wagyu should also assume that the Monero receiving address used at the time may be linked to an IP address. For future payments, a new subaddress makes sense. A subaddress is an additional receiving address of the same Monero wallet that cannot be connected to the main address from the outside.

Monero price this week: between $572 and $649

The leak barely shows in the price. According to trading data from the Kraken exchange, Monero cost around $600 early on Monday morning, November 2, and around 537 euros in euro trading. At the start of the week, on Monday, October 26, XMR had opened at $593, which amounts to a gain of just over 1 percent. Data provider Coinpaprika shows a seven-day gain of 1.9 percent.

The week was not calm, though. On October 29, XMR rose as high as $649.40, and on October 30 it fell as low as $572.49, both according to Kraken. The range of almost $77 equals around 13 percent of the current price. According to Coinpaprika, XMR is just under 25 percent short of its all-time high of $797 from January 14, 2026.

FCMP++ stressnet v3.1: the inflation bug on the test network

While the leak unfolded, the technology moved forward. On October 26, version v3.1 of the so-called stressnet for FCMP++ and Carrot was released. FCMP++ is a membership proof across the entire Monero blockchain: instead of hiding a transaction among a small number of decoys, it is meant to be concealed among all outputs on the whole blockchain in future. Carrot is the new address scheme that goes with it. The stressnet is a test network in which the upgrade is tried out under heavy load. It split off from the test network on October 5 at block 3,102,800; cryptoticker.io described the background ahead of that date.

According to the release notes on GitHub , v3.1 closes a gap: Carrot outputs are now kept out of ring signatures entirely. The developers describe the problem as a detectable inflation vulnerability that was open during the first 24 hours after the test network split. The release also adds protection against denial-of-service attacks on transaction relay and faster wallet syncing. Hardware wallets, multisig and transaction proofs do not yet work on the stressnet.

For holders on the mainnet, nothing changes for now. No date for activating FCMP++ on the mainnet has been announced on getmonero.org. Finding and fixing an inflation bug on a test network before the upgrade touches real coins is exactly what such a test phase is for.

Buying Monero in Germany: MiCA and the exchange delistings

The Wagyu case also shows why Monero users turn to such services in the first place. As cryptoticker.io counted on October 5, 2026 in an overview of buying Monero in Germany , six major exchanges no longer list XMR. The reason is the EU's Markets in Crypto-Assets Regulation, MiCA. The regulation only allows trading platforms to admit coins with a built-in anonymisation feature if the provider can identify holders and transaction history. Monero is designed to prevent precisely that.

For investors in Germany, this means weighing up the options. An exchange with MiCA authorisation offers segregation of client assets, a competent supervisor and a point of , but usually does not list Monero. A swap service without an account offers Monero, but, as Wagyu shows, still stores data and is not subject to any European supervision. Which providers hold an authorisation is shown in the comparison of regulated crypto exchanges . Before any purchase, it is worth checking whether the provider is listed in the ESMA register.

Monero custody, holding period and leverage

Anyone who holds Monero usually keeps it in self-custody. A self-custody wallet is a wallet whose keys are controlled by the user alone. For Monero there are the project's official programs and a few hardware wallets with Monero support; which devices are suitable is set out in the hardware wallet comparison . Important for Wagyu customers: the leak does not involve any keys. If you have never given out your seed phrase, you do not need to move your coins, as long as you have not responded to one of the phishing messages described above.

For tax purposes in Germany, swapping bitcoin into Monero is a private sale under Section 23 of the Income Tax Act. If less than a year passes between purchase and swap, a gain is taxable, provided all private sale gains for the year together reach the exemption threshold of 1,000 euros. After more than a year, the swap is tax-free under current law. Swaps via a service without an account also belong in the tax return, and a dataset like Wagyu's can later show that they took place.

Outside the EU, Monero is also traded with leverage, for example through perpetual futures. On October 30, the daily high and low were around 11 percent apart, according to Kraken. A position with tenfold leverage can be liquidated by a counter-move of less than 10 percent. Liquidation means the exchange forcibly closes the position because the posted collateral no longer covers the loss.

Monero price levels: $572 below, $650 above

Last week produced two levels that traders are watching. On the downside, it is the weekly low of $572.49 from October 30; below that lies the round mark of $550. On the upside, it is the weekly high of $649.40 from October 29, roughly the $650 mark. The fact that the price did not fall below the October 30 low after the leak became known suggests that the market reads the case as a problem of a service provider rather than of the protocol. That is not a forecast; the Monero prediction page offers a longer outlook with scenarios.

Wagyu data leak: anyone who swapped until October 26 is in the dataset

Three steps help Monero holders put the leak into context and set up their own coins properly:

Check your custody: Are your XMR in your own wallet, and are you the only one who knows the seed phrase? You can find a hardware wallet with Monero support in the hardware wallet comparison .

Choose how you buy: For bitcoin and other coins, authorised providers offer supervision and segregation of client assets. Which exchanges hold a MiCA authorisation is listed in the comparison of regulated crypto exchanges .

Document your swaps: Every swap within the holding period counts for tax purposes. A tax tool adds up gains and deadlines; the comparison of crypto tax tools shows a selection.

(As of November 2, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)

Frequently asked questions Monero and the Wagyu data leak

No. According to Hudson Rock, the Wagyu data leak shows no weakness in Monero's cryptography. The exposed data is order data from the swap service Wagyu.xyz that was stored outside the Monero blockchain.

According to Hudson Rock, the dataset covers 38,628 order records and 10,139 unique IP addresses from July 18 to October 26, 2026. For 4,580 completed Monero swap orders, the deposit, the Monero receiving address and the IP address appear together.

Wagyu customers should not respond to any message asking for a refund, verification or deposit, and should never give out their seed phrase or private key. For new Monero payments, a fresh subaddress makes sense.

Monero cost around $600 on November 2, 2026, just over 1 percent above the start of the week. During the week, XMR moved between $572.49 and $649.40, according to Kraken.

No date has been announced for FCMP++ on the Monero mainnet. The upgrade is being tested on the stressnet, whose version v3.1 was released on October 26, 2026 and closed an inflation bug on the test network.

Transparency note: This article was produced with the assistance of artificial intelligence and reviewed by our editorial team before publication. All figures and claims were checked against the primary sources linked in the text. The feature image was generated with AI.

Section: All crypto hacks and scams at a glance

Monero Price Analysis 2026: From $800 Peak to Regulatory Support Test

Monero Price Explodes: XMR Hits New All-Time High After 20% Surge

Waltio Confirms Brevo Breach Touched Its User Emails: Here Is What To Do Now

Crypto Wallet Provider Ledger Hacked: Data Leak Results in Phishing Scams

Monero climbs to $644, leaving it 24 percent short of January's record

Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

August 22, 2026 4:13 AM

SafePal Data Breach: 39,798 Customers Exposed With Names, Addresses and Phone Numbers

SafePal confirmed a data breach on August 16, 2026: the names, delivery addresses, phone numbers and order details of 39,798 customers were exposed. Seed phrases and private keys were not affected, but the phishing risk is substantial.

November 7, 2025 3:36 PM

Top 5 Privacy Tokens to Watch Before 2026

Zcash jumps 78% in a week, leading a major rally in privacy coins. Here are the top 5 privacy tokens by market cap in 2025.

Trump Attempts to Salvage Crypto with Bullish Promises, But Crypto Crashes Hard Anyway

Donald Trump made a major push to salvage crypto market sentiment by promising he will "never let crypto down," but Bitcoin and major altcoins crashed anyway.

June 24, 2024 10:37 AM

Bitcoin Price Prediction: Can BTC Price Fall Below 50K?

The profitability of Bitcoin futures cash-and-carry trades has plummeted amid a significant crypto market selloff. What are the reasons behind the decline and what can traders expect ?

September 20, 2026 4:15 PM

Crypto Phishing After a Data Breach: The Warning Signs in a Fake Exchange Email

After every major data breach, the number of phishing emails sent in the name of crypto exchanges and wallet manufacturers rises. This article shows you how to recognise such a message, which data a reputable provider never requests by email, and what to do in the first hour after a click.

September 19, 2026 4:34 AM

Monero Jumps 11 Percent to $575: What XMR Holders in Germany Should Check Now

Monero gained 11.19 percent in 24 hours and is outrunning the wider market. For German holders, however, the decisive date is July 10, 2027: from then on, authorized exchanges may no longer carry XMR.

September 1, 2026 10:22 AM

Crypto News Today: Bitcoin Stalls While Zcash and Monero Steal the Show

Crypto news today: Bitcoin cools after its best week in three years, Saylor buys again, and privacy coins keep running. Here are the prices and levels.

March 9, 2026 10:20 AM

Crypto Market News: Bitcoin Price Battles $67k as US CPI and CLARITY Act Loom

Bitcoin recovers to $67,500 while the market eyes US CPI data and the CLARITY Act. Discover the key events driving crypto prices week.

August 22, 2019 9:55 AM

Here’s why you should skip ’s Crypto: Instagram Data Breach

It’s practically similar to stating the sky is blue yet we have another Data Leak close by influencing a huge number of clients. This time around, it includes the data of in excess of 49 million Instagram Accounts […]

August 1, 2026 12:56 PM

Crypto Prices Today: Bitcoin Holds $63,000 as Hyperliquid and Privacy Coins Break From the Pack

Bitcoin is down 28% this year and most majors are worse. Three assets are still green in 2026. Here is the full market picture today.

November 19, 2018 12:11 PM

Brazilian Crypto Investment Platform Atlas Quantum Hacked, Data Of 264,000 Users Leaked

Atlas Quantum, Brazilian crypto investment platform has been hacked and the data of more than 264,000 of its customers has been leaked.

October 11, 2026 4:50 AM

90 Crypto Kidnappings and Robberies in 7 Months: Why France Is the Most Dangerous Country for Bitcoin Holders

France logged 90 crypto kidnappings, extortions and violent thefts this year, one every 2.5 days. Leaked tax data is to blame. Here is how to protect yourself.

April 25, 2026 9:55 AM

France Crypto Kidnappings Crisis: Pavel Durov Blasts Data Leaks and New Surveillance Laws

Pavel Durov exposes a surge in crypto-related kidnappings in France, blaming tax data leaks and warning against new social media surveillance laws.

October 17, 2026 1:17 PM

Monero price at $558 after the 0.18.5.4 update: the level that decides

Monero has released point version 0.18.5.4, fixing bugs in DNSSEC, checkpoints and block lists. At the same time XMR sits at the top of its weekly range with a gain of 6.93 percent, while the rest of the crypto market gives ground.

October 4, 2026 4:39 PM

Why the Monero fork on October 5 leaves your XMR untouched: FCMP++ hits the stressnet

On October 5, 2026 a network forks at Monero, but not the main network: it is the FCMP++ and Carrot stressnet, at block height 3102800. For holders that means nothing to do on the day, and the rebuild behind it still has no mainnet date.

September 18, 2026 5:29 PM

Bitcoin Price Reclaims $80,000 as the Entire Crypto Market Turns Green

Bitcoin is back above $80,000 after a 5.75% daily jump, and almost every major coin followed. Here is what is driving the move and which altcoins lead.

September 12, 2026 4:12 PM

Revolut Data Breach: Am I Affected, and What My Bitcoin History?

After a forged government request, Revolut handed identity documents, account statements and complete Bitcoin transaction histories to an unauthorised party. Here is how to establish whether you are affected, and which protective measure actually achieves anything in this case.

August 24, 2026 12:34 AM

Is Monero a Good Buy at Current Prices?

Monero broke above the level we named in September as the test for a trend change. What the breakout, an overbought RSI and EU rules mean now: is Monero a good buy at current prices?

September 1, 2024 1:30 PM

Bitcoin Price Prediction: How Will September Unfold For BTC Price?

Bitcoin price is facing significant market volatility, as it hovers around $58,000. What are the key indicators and on-chain data shaping the future of BTC Price, and how will September unfold?

August 21, 2026 1:33 PM

Bitcoin With No Cost Basis: How Austria Taxes the Sale

Bitcoin purchase price no longer provable? How Austria works out the capital gains tax, when a flat-rate cost basis applies and what investors can do.

March 21, 2026 9:14 AM

Why is Crypto Crashing Today? 3 Reasons Behind the Bitcoin Crash

Bitcoin and altcoins are facing a sharp sell-off today. From Middle East tensions to hot PPI data, here is why the crypto market is crashing.

January 14, 2026 2:47 PM

Crypto Markets on Edge on 14 January 2026: US PPI Surprise Ahead of the Tariff Ruling

Hot US producer prices and a pending Supreme Court tariff ruling kept crypto on edge on 14 January 2026. The ruling came on 20 February, and the Fed later raised rates.

October 18, 2026 10:26 PM

Monero gains 8.1 percent to $592 while Zcash falls 3.7 percent: outperforming the market

Monero climbs to around $592 while Zcash loses 3.7 percent and the wider market slips. Where the gap comes from, what Article 79 of the EU anti-money-laundering regulation changes from 2027 and what that means for custody.

August 16, 2026 9:05 AM

Crypto Weekly Recap: Bitcoin Slips Below $63,000 as CPI Relief Never Arrives

Bitcoin sits near $62,990 and down 2.7% on the week, ETF flows turned negative and XRP broke $1. Your Sunday crypto recap.

August 13, 2026 4:59 PM

Trezor Data Breach: First 13,689 Customers, Then Roughly 67,000 More Exposed

A breach at Trezor shipping partner ShipMonk exposed names, phone numbers and addresses of 13,689 customers in August; in September Trezor reported roughly 67,000 more in the US. Devices are safe, phishing risk is not.

Why Did Bitcoin Price Crash below 80k Today?

The crypto market is in turmoil as Bitcoin and Ethereum lose critical support levels. What triggered the sudden price collapse?

Top 10 Altcoins to Buy in May 2026 as Bitcoin Recovers

Here are the top 10 altcoins to buy in May 2026 as Bitcoin rebounds near $80K and market momentum shifts.

More from CryptoTicker