BTC 
ETH 
BNB 
XRP 
SOL 
TRX WhiteArmor leak of Wagyu.xyz data links 38k+ swap orders to IPs and XMR addresses
A post on r/CryptoCurrency reports that ransomware group WhiteArmor leaked alleged backend data from no-KYC swap service Wagyu.xyz, covering 38,628 orders and 10,139 IPs. The post says the data ties deposit hashes, XMR receiving addresses, timestamps and client IPs together, including 4,580 completed cross-chain-to-XMR orders. It states Monero's cryptography was not broken and that the exposure stems from centralized database retention.
Why “Rumor”
- Only community or trader posts: r/CryptoCurrency
0 independent source groups across 1 post · evidence score 9/100. How labels work
Market around the story
| Asset | Price at first report | 6h before | 1h before | 1h after | 6h after | 1h move vs normal | 24h volume vs median |
|---|---|---|---|---|---|---|---|
| XMR | $602.61 | −0.58% | −0.05% | −0.44% | −0.51% | 0.6σ | 1.2× |
Returns are measured from the moment the story first appeared. “vs normal” compares the move with the asset's typical hourly move over the previous 30 days.
What the sources claim
-
A ransomware group called WhiteArmor allegedly leaked backend data from the no-KYC swap service Wagyu.xyz.
“Ransomware group WhiteArmor leaked alleged backend data from no-KYC swap service”
r/CryptoCurrency -
The leaked data reportedly covers 38,628 orders and 10,139 IPs.
“38,628 orders, 10,139 IPs”
r/CryptoCurrency -
Wagyu stored deposit hashes, XMR receiving addresses, timestamps and client IPs in the same database rows.
“Wagyu stored incoming deposit hashes (BTC/ETH/SOL), outgoing XMR receiving addresses, timestamps, and client IPs together in the same database rows”
r/CryptoCurrency -
The leak contains 4,580 completed cross-chain-to-XMR orders mapping public deposit transactions to XMR addresses and user IPs.
“4,580 completed cross-chain-to-XMR orders that map the original public deposit TX directly to the native XMR receiving address and the user's IP”
r/CryptoCurrency -
Over 4,000 orders marked as deleted by users were not actually deleted.
“Over 4,000 orders have a `userDeletedAt` timestamp, meaning users thought they cleared”
r/CryptoCurrency -
Monero's on-chain cryptography was not broken by the incident. XMR
“Monero's cryptography wasn't broken at all”
r/CryptoCurrency
Sources
More on XMR
Summary and claims extracted by AI with prompt analyze-story@5 on 2026-10-28 21:20 UTC. Labels are computed from the sources, not by the model.