Hackers have claimed a breach of cryptocurrency swap platform Wagyu.xyz, and researchers reviewing the alleged leak say the dataset includes thousands of records linking Monero transactions to public-chain payments and IP addresses.
The dataset reportedly contains 38,628 order records and 10,139 distinct IP addresses, covering activity from July 18 to October 26, 2026. The data’s origin and authenticity have not been independently verified.
The findings illustrate a privacy risk that is separate from cryptocurrency protocol weaknesses: information held by services that move funds between blockchains. Unlike a wallet key compromise, a leaked transaction database can expose financial relationships, timestamps and network data without revealing private keys.
Earlier incidents, such as the Coinbase customer-data breach, showed how exposed account information can create social-engineering risks even when funds themselves are not directly compromised.
Researchers from Infostealers, Hudson Rock’s threat-intelligence publication, published their analysis on October 28. They noted that infostealer malware can capture credentials, browser sessions and cryptocurrency information, but reported no evidence that such malware caused this alleged incident or infected identified Wagyu customers.
Hackers claim Wagyu crypto platform breach
Ransomware-tracking services indexed listings associated with the WhiteArmor actor on October 27–28 that named Wagyu, including an entry titled “wagyu.xyz unfairness.” The listings included allegations about hidden swap fees and unfair odds, but an actor’s listing alone does not prove that ransomware was deployed, data was stolen, or that financial misconduct occurred.
Hudson Rock examined an exported order file and a separate IP-level activity summary. Researchers identified 8,137 orders that named native Monero receiving addresses, of which 6,692 were marked completed.
Within the completed cross-chain subset, 4,580 records contained an incoming transaction hash, a Monero destination address and a client IP address. That subset included 1,011 Bitcoin-to-Monero orders.
This matters because a swap provider must know where to deliver purchased coins. Service-side records can therefore link a visible Bitcoin deposit with a Monero receiving address, timestamps, browser information and session identifiers.
Those records expose relationships that cannot be observed by inspecting Monero’s blockchain alone; the broader privacy risk arises when separate sources of metadata are combined.
As prior reporting on stolen credentials shows, infostealer logs may contain browser sessions and wallet data that could add investigative context. Hudson Rock did not, however, report matching Wagyu records to infected users or to other sets of stolen credentials.
Researchers also identified the reverse direction: 11,317 native-XMR-input swap orders that included service deposit addresses and destinations for other assets. Among these, 9,187 completed records retained outgoing transaction hashes. Those links can reveal a service’s public-chain payouts, though they do not disclose which private Monero wallet originally supplied the deposits.
Some groups of transactions in the dataset carried labels such as “Poloniex Hacker,” “Theft” and “Tornado.Cash: 100 ETH.” Six completed withdrawals labeled “Poloniex Hacker” totaled a recorded value of $1,025,047. These labels are unverified database entries, not confirmed criminal attributions; recorded amounts do not by themselves establish that funds were stolen, and overlapping entries cannot be summed into a reliable laundering total.
Privacy risks, data retention and user protection
The research does not indicate any weakness in Monero’s cryptography. Instead, it shows how information stored and logged by intermediaries can link transaction requests to network activity and client metadata.
An IP address is not a verified identity: VPNs, Tor, carrier- or campus-grade NATs, and other shared or automated networks can represent multiple users, and one individual may use many different addresses.
Hudson Rock reported 4,002 completed orders that contained a populated userDeletedAt field. All of those records retained an IP address and a destination address, and 3,180 also retained deposit transaction hashes. The presence of the field alone does not establish what users deleted, whether backups exist, or whether Wagyu violated any retention promise or legal obligation.
If genuine, the records could enable convincing refund scams, fake support communications or extortion attempts referencing real trades. Separate campaigns that use fake wallet interfaces illustrate why users should never enter recovery phrases into unexpected prompts. Hudson Rock did not report evidence that anyone has exploited the alleged Wagyu data in this way.
Users should verify any messages through official, trusted channels and refuse requests for private keys or recovery phrases. Platforms that handle cross-chain swaps should minimize data retention, restrict database access, and explain how deletion affects logs and backups.
Indicators of compromise (IoCs)
| Type | Source value | Context |
|---|---|---|
| Masked IP | 103.75.xxx.xxx |
Redacted Bitcoin-to-Monero order |
| Masked IP | 146.70.xxx.xxx |
Shared across seven orders |
| Malware hashes | Not published | No confirmed sample |
| Transaction hashes | Withheld | Not available for matching |
Note: IP addresses and domains in reporting have been intentionally defanged (for example, by replacing dots). Re-fang only inside controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.
If you operate a security operations center, integrate vetted threat intelligence to provide alert context and help stop incidents more quickly.
