What Alleged Wagyu Swap Records Reveal About Monero Privacy

Alleged Wagyu Swap records highlight a privacy risk for Monero users: a service can retain details that the blockchain conceals. On October 28, Hudson Rock published an analysis of records attributed to Wagyu.xyz. Its report describes links between public-chain deposits, Monero receiving addresses and network connections. The analysis leaves the files' authenticity unverified and shows no failure of Monero's cryptography. Read Hudson Rock's original research.

What Wagyu Swap does

Wagyu's documentation describes a service for exchanging assets across blockchains, including swaps into and out of native XMR. A customer selects an asset pair, requests a quote and supplies a receiving address. The service provides deposit instructions, processes the conversion and sends the output to that destination.

That process requires information about both sides of the order. The customer has told the service where the payout should go before Monero's blockchain protections become relevant. A website can offer swaps without requiring an account while still maintaining transaction records.

Hudson Rock's reported counts

Hudson Rock reports these counts from the material it examined:

Reported count	What it measures
38,628	Cryptocurrency order records
10,139	Distinct IP addresses, not identified people
8,137	Records naming native Monero receiving addresses
4,580	Cross-chain-to-XMR orders marked completed, with a deposit transaction hash, receiving address and client IP together

The report says the records span July 18 through October 26, 2026. “Completed” describes a field in the supplied data, not independently verified settlement. Hudson Rock checked relationships within the files but did not authenticate their provenance. Those totals describe rows and network addresses. They do not count verified victims.

What remains unverified

Public tracking pages record WhiteArmor claims naming Wagyu on October 27 and October 28. A listing documents an allegation. It cannot establish that someone encrypted servers or stole the claimed data.

Later coverage makes stronger claims. The community directory xmr.club says the operator acknowledged three months of exposed records and no lost funds. Its incident citation leads to Hudson Rock's analysis rather than an original operator statement. We could not authenticate that acknowledgment directly. The linked operator profile on X returned an access error during this review.

Our review did not locate an independently verified incident-response report or customer notification in the accessible sources checked through November 5. That search cannot establish that none exists. The access method, full scope and remediation remain unresolved, so this article treats the Wagyu.xyz data exposure as alleged.

How swap metadata can connect the two chains

Wagyu's own wallet privacy policy, dated October 1, says swap requests send assets, amounts, destination addresses and a session identifier to its API. It also says the service retains order records needed to execute and support swaps. This policy concerns the wallet extension and its service interactions. The policy does not document the alleged incident.

Imagine a Bitcoin-to-Monero swap. A public Bitcoin transaction identifies the deposit. A service's order record can associate that transaction with the Monero address submitted for payment. Someone reading that record could learn the requested destination without searching Monero's ledger for it.

This is an inference about the information available to an intermediary. It does not prove that the person submitting an order controls the receiving wallet. Nor does a network address, which may belong to a shared connection or proxy, establish a customer's identity.

Monero's cryptography and service records

Monero's stealth-address documentation explains that payments use one-time on-chain addresses. The receiving address given to a sender does not become a publicly searchable account history.

The sender still knows the address a customer supplies. Cryptography cannot make a service forget that instruction or erase its database. Access to those records creates a different privacy problem from tracing later Monero transfers. An exposed receiving address also is not a spend key and does not let someone move the wallet's funds.

Practical privacy considerations

Before choosing a swap service, check what it retains, for how long and what deletion covers. Wagyu's cited policy says the service keeps order records but does not specify a retention period. An account-free interface should not substitute for reading those terms.

Tor Browser can hide your direct IP from a website. It does not conceal the destination address you enter into that website's form. Network privacy and the information you disclose need separate attention.

Compare service designs as well as prices. Our atomic swaps guide explains trading protocols that reduce reliance on a custodial intermediary, along with their recovery requirements. Custody, record retention and network privacy are separate questions to check before sending funds.