Alleged Wagyu.xyz leak ties Monero swaps to client IP addresses
First merged summary.
An unverified Wagyu.xyz order export links thousands of Monero swaps to IPs; Hudson Rock has not authenticated it.
Researchers reviewed an alleged export from crypto swap service Wagyu.xyz containing 38,628 order records from July 18 to October 26, 2026, and 10,139 IP addresses. Within completed cross-chain swaps, 4,580 records combine transaction hashes, Monero receiving addresses and client IPs. Hudson Rock says that would indicate off-chain privacy failures, not a break of Monero cryptography, and found no evidence infostealer malware caused the incident. WhiteArmor-associated listings appeared on October 27–28, but a listing does not prove intrusion, ransomware, theft, or fee claims. Labels such as “Poloniex Hacker,” “Theft,” and Tornado Cash do not by themselves prove stolen funds or criminal activity.
- 4,580 completed cross-chain records join a deposit hash, XMR address, and IP.
- 8,137 native Monero destination orders include 6,692 marked completed.
- 11,317 Monero-input orders include 9,187 completed records with outgoing hashes.
- Six “Poloniex Hacker” withdrawals total $1,025,047; “Theft” labels about $1.72 million.
- Tornado Cash-labeled orders total $3.56 million; labels do not prove crime.
- 4,002 completed orders with userDeletedAt still retained an IP and destination.
Timeline
dated events in the reporting · oldest first- Jul 18, 2026Earliest orders in the alleged Wagyu export. · GBHackers
- Oct 26, 2026Latest orders in the alleged export. · GBHackers
- Oct 27, 2026WhiteArmor-associated listings naming Wagyu appear. · Cyber Security News
- Oct 29, 2026Hudson Rock reviews the unverified order export. · Cyber Security News
What each outlet adds
beyond the shared facts- GBHackersMonero order counts and Theft and Tornado Cash label totals.
- Cyber Security NewsExact $1,025,047 figure, deleted-user retention, and no infostealer evidence.
- Products
- Wagyu.xyz
- Threat actors
- WhiteArmor
- Organizations
- Hudson Rock
Coverage
oldest first · one row per article · UTC- · 1d ago
GBHackersFirst report
Alleged Wagyu leak links 4,580 swaps to Monero addresses and IPs
Hudson Rock has not authenticated the files, and WhiteArmor listings do not prove intrusion or ransomware.
- · 1d ago
Cyber Security News
Alleged Wagyu.xyz leak links Monero swaps to IPs
Researchers reviewed an unverified export with 38,628 orders and 10,139 IP addresses covering July 18 to October 26, 2026.