Alleged Wagyu Leak Contains 4,580 Completed Crypto Swaps Linking Monero Wallets to IP Addresses

An alleged leak from cryptocurrency swap service Wagyu.xyz contains 4,580 completed cross-chain swaps linking incoming transaction hashes, Monero receiving addresses, and client IP addresses.

The dataset reportedly includes 38,628 order records from July 18–October 26, 2026, plus an activity index covering 10,139 distinct IP addresses.

Hudson Rock has not independently authenticated the files’ alleged breach provenance, and neither orders nor IP addresses necessarily represent individual customers.

Ransomware trackers indexed WhiteArmor listings naming Wagyu on October 27–28. Associated accusations concerned allegedly unfair gambling odds and undisclosed swap fees.

Those claims do not establish intrusion, ransomware deployment or financial misconduct.

Wagyu markets cryptocurrency conversions involving Monero without mandatory identity verification. Nevertheless, processing swaps requires information that can undermine privacy when retained alongside network metadata.

For Bitcoin-to-Monero conversions, the supplied records reportedly combine deposit transactions, destination addresses, timestamps, browser information, session identifiers and IP addresses.

Hudson Rock identified 8,137 orders naming native Monero destinations; 6,692 were marked completed.

Within the completed cross-chain subset, 4,580 records retained the transaction-address-IP combination, including 1,011 Bitcoin-to-Monero orders.

The distinction is correlation. Monero’s privacy protections do not prevent an intermediary from recording the destination voluntarily supplied by a customer.

Such records can connect a transparent-chain payment to an intended Monero recipient without revealing subsequent Monero transfers.

They also do not establish a customer’s legal identity or prove that the requester controls the receiving wallet.

Hudson Rock Researchers said that, the findings expose potential off-chain privacy failures, not a demonstrated compromise of Monero’s cryptography.

Alleged Wagyu Data Breach

Exposure extends beyond purchases of Monero. Hudson Rock identified 11,317 native-Monero-input orders containing service deposit addresses and destinations for other assets. Of these, 9,187 completed records retained outgoing transaction hashes.

For Monero-to-Ethereum swaps, those records can connect an accepted deposit to an Ethereum payout address, timing information and network metadata.

Investigators could examine that payout on Ethereum, but the service’s Monero deposit address does not publicly disclose the originating wallet.

The companion IP index reportedly reconciles with the order export. Additional overlaps include 130 session identifiers appearing across multiple IPs and 261 Monero receiving addresses used from multiple IPs.

These relationships remain investigative leads. VPNs, Tor, shared networks, custodial destinations and automated integrations complicate attribution.

Several large orders carry labels including “Poloniex Hacker,” “DCENT Wallet Hacker,” “Theft” and “Tornado.Cash: 100 ETH.”

Six completed bridge withdrawals labeled “Poloniex Hacker” total approximately $1.03 million.

Poloniex suffered a publicly documented November 2023 hack involving reported outflows exceeding $100 million, but that incident does not authenticate Wagyu’s wallet attribution.

Three linked Ethereum-to-Monero orders total approximately $903,000, including two labeled “DCENT Wallet Hacker.”

DCENT disclosed unauthorized App Wallet transfers in September 2026 and cooperation with investigators; its disclosure does not establish that these swaps involved stolen funds.

Another 360 completed orders labeled “Theft” total approximately $1.72 million, with 315 clustered near $5,000. Repetition alone cannot establish deliberate evasion of financial controls.

Separately, 25 Tornado Cash-labeled orders total $3.56 million. Some overlap other case totals, and mixer associations alone do not prove criminal activity.

The central risk is therefore database exposure at cryptocurrency entry and exit points. Independent blockchain evidence, authenticated service logs and corroborating attribution remain necessary before treating these records as proof of ownership or wrongdoing.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.