Hackers Claim Wagyu Crypto Platform Breach, Exposing Monero Transaction Links
Hackers claim a breach of cryptocurrency swap platform Wagyu.xyz, with researchers uncovering a dataset potentially linking Monero transactions to public blockchain payments and IP addresses.
Hackers have claimed responsibility for a breach affecting Wagyu.xyz, a cryptocurrency swap platform. Concurrently, security researchers have identified a substantial dataset purportedly leaked from the platform, containing thousands of records that could link Monero transactions with public blockchain payments and associated IP addresses. The dataset, reportedly spanning from July 18 to October 26, 2026, includes 38,628 order records and 10,139 distinct IP addresses. The authenticity and origin of this data remain unverified by independent parties.
The implications of such a leak extend beyond typical cryptocurrency wallet compromises. Unlike breaches that directly expose private keys, this incident highlights the privacy risks associated with service-side data retention. Wagyu.xyz, as a platform facilitating swaps between different blockchains, would necessarily maintain databases connecting transactions. This could inadvertently link a user's visible Bitcoin transaction with their Monero receiving address, a timestamp, and their IP address. Researchers from Infostealers and Hudson Rock's threat-intelligence publication, who reported their findings on October 28, examined an order export and an IP-level activity summary. They identified 8,137 orders involving Monero receiving addresses, with 6,692 marked as completed. A subset of these completed cross-chain transactions, specifically 4,580 records, contained an incoming transaction hash, a Monero destination address, and a client IP address.
This connection is critical because swap providers need to know where to deliver purchased cryptocurrency. For instance, in Bitcoin-to-Monero swaps, the platform must link the incoming Bitcoin deposit to the specified Monero receiving address. The leaked data appears to contain precisely this kind of linkage, potentially exposing financial relationships that are not discernible by simply analyzing the Monero blockchain itself. The research also noted the reverse direction of transactions, with 11,317 native-XMR-input swap orders containing service deposit addresses and destinations for other assets. Among these, 9,187 completed records included outgoing transaction hashes, which could reveal the service's payouts to public chains, though not the original source of its Monero deposits.
Some of the transaction groups within the dataset carried labels such as "Poloniex Hacker," "Theft," and "Tornado.Cash: 100 ETH." Six completed withdrawals labeled "Poloniex Hacker" reportedly totaled over $1 million in recorded value. However, it is crucial to note that these labels are unverified and do not constitute confirmed criminal attributions. The recorded amounts also do not definitively establish stolen proceeds, and overlapping groups cannot be reliably aggregated to determine a total laundering amount.
The research does not indicate any cryptographic weaknesses within Monero itself. Instead, it underscores the vulnerability introduced by the storage of sensitive metadata outside of the blockchain. While an IP address alone is not a definitive identifier of a user—due to the use of VPNs, Tor, shared networks, or multiple addresses per individual—its association with transaction details can still pose a significant privacy risk. The presence of a userDeletedAt field in 4,002 completed orders, all retaining IP addresses and destinations, further complicates the situation, raising questions about data retention policies and potential breaches of user trust or legal obligations.
If the leaked data is indeed authentic, it could be exploited for various malicious purposes. This includes facilitating convincing refund scams, enabling targeted phishing attacks through fake support messages, or even extortion attempts that leverage knowledge of real trades. The findings serve as a stark reminder of the broader threat landscape, where information held by third-party services can be as valuable to attackers as the cryptocurrencies themselves. The report did not find evidence of infostealer malware being the cause of this specific incident or that identified Wagyu customers were infected.
In response to such incidents, cybersecurity best practices for platforms include minimizing data retention periods, implementing strict access controls for databases, and clearly communicating data handling and deletion policies to users. For users, vigilance is key: verifying communications through trusted channels, never sharing private keys, and being wary of unsolicited prompts or requests for sensitive information are essential protective measures. The incident also saw threat actor listings on ransomware-tracking services naming Wagyu, citing "unfairness" related to hidden swap fees and coin-flip odds, though these claims remain unverified and do not confirm data exfiltration or ransomware deployment.
Indicators of compromise (IoCs) associated with this incident include masked IP addresses such as 103.75.xxx.xxx, which were linked to redacted Bitcoin-to-Monero orders, and 146.70.xxx.xxx, shared across seven orders. Malware hashes and transaction hashes were withheld and not available for matching, according to the report.