Monero’s cryptography protects what happens on-chain. It can’t protect what a service writes down off-chain. That gap is the whole story of the Wagyu leak: a dataset from swap service Wagyu.xyz that, according to Hudson Rock, ties thousands of Monero orders to the IP addresses that placed them.
Wagyu has confirmed a leak. The Monero blockchain was not breached. For users, the lesson is about the service layer — what gets logged, and what that log can reveal when it escapes.
Key facts
- Monero swap service Wagyu.xyz confirmed a data leak; Hudson Rock says it links 4,580 completed Monero orders to receiving addresses and IP addresses.
- The dataset covers swaps from July 18 to October 26, 2026 and contains 38,628 order records and 10,139 unique IP addresses.
- For each of the 4,580 completed swaps, the deposit transaction ID, Monero receiving address and IP address appear in the same row; 1,011 of them are BTC-to-XMR swaps.
- An archived RansomLook entry dated October 27 attributes the data to a group called WhiteArmor and cites a $5 million demand, per Forklog.
- On October 28, Wagyu said the leak covered the last three months, that IP addresses were logged because of JavaScript, and that no funds were lost; these claims are unverified.
- Hudson Rock found no weakness in Monero’s cryptography; the data came from the provider’s order management system.
What data leaked from Wagyu?
According to Hudson Rock’s analysis, published on Infostealers, the dataset holds 38,628 order records and 10,139 unique IP addresses from swaps between July 18 and October 26, 2026. For 4,580 completed Monero swaps, the deposit transaction ID, the Monero receiving address and the user’s IP address sit in the same row, along with timestamps, session IDs and browser details.
Hudson Rock says it has not independently verified the files’ origin. It also stresses that records don’t equal people: VPNs, Tor and shared networks mean one IP can cover many users, and one user many IPs.
Who is behind it
An archived RansomLook entry dated October 27 attributes the data to a group called WhiteArmor and cites a $5 million demand, as Forklog reports. Reports say the group published the data after the operator refused to pay. On October 28, Wagyu said via its PerpetualCow account that the leak covered three months, that IP addresses were logged due to JavaScript, that no funds were lost and that security had been tightened.
The chain kept its secrets. The order log didn’t.
Does the Wagyu leak break Monero’s privacy?
No. Monero’s ring signatures, stealth addresses and confidential amounts were not defeated. What leaked is metadata held by one service: which IP placed which order and where the XMR was sent. That can deanonymise a specific swap — and potentially link a Bitcoin deposit to a Monero address — but it says nothing about other Monero transactions.
That distinction matters for anyone thinking about privacy. A privacy coin protects the ledger. Every service you touch on the way in or out — exchange, swap service, wallet backend, RPC node — can see something about you, and anything it stores can leak. Our explainer “Is Monero anonymous?” covers exactly this boundary.
What should affected Wagyu users do?
If you swapped into Monero through Wagyu between July 18 and October 26, 2026, assume your IP may be linked to that swap’s receiving address and deposit transaction. Consider moving funds from that receiving address to a new address you control, and avoid reusing it. Be alert to targeted phishing or extortion attempts that reference your swap details.
Protocol upgrades won’t fix service logs
Monero’s next major upgrade, FCMP++, is in testing: stressnet v3.1 with Carrot was released on October 26, 2026, per the release notes. No mainnet date has been announced. Stronger on-chain privacy is welcome, but it can’t un-log an IP address on a third-party server.
What this means for SwapZilla users
Any swap service necessarily sees the addresses involved in an order; network-level metadata such as your IP is something you can and should protect yourself. If privacy matters to you, connect through Tor or a trustworthy VPN, use a fresh receiving address for every swap, and keep personal data out of the process. SwapZilla doesn’t require an account to swap, and its private route runs swaps through Monero — our explainer is explicit about what that does and doesn’t hide. Providers may still apply AML checks, and no swap service is a guarantee of anonymity.
For more on choosing a Monero wallet that supports good habits, see our best Monero wallets guide.
Final thoughts
The Wagyu leak is not a Monero failure; it’s a reminder of where Monero’s guarantees end. Privacy is a chain of links — protocol, wallet, service, network — and the weakest one sets the level for all of them.