Leaked backend data from "no-KYC" swap Wagyu.xyz links 38k+ crypto orders, Monero destinations, and user IPs

TL;DR: Ransomware group WhiteArmor leaked alleged backend data from no-KYC swap service Wagyu.xyz (38,628 orders, 10,139 IPs). Monero's cryptography wasn't broken at all, but the leak shows how off-chain centralized databases create a huge privacy hole.

Key Takeaways:

Monero is fine, centralized swap retention isn't: Monero's on-chain math still holds up. However, Wagyu stored incoming deposit hashes (BTC/ETH/SOL), outgoing XMR receiving addresses, timestamps, and client IPs together in the same database rows.

• Direct correlation risk: The leak contains 4,580 completed cross-chain-to-XMR orders that map the original public deposit TX directly to the native XMR receiving address and the user's IP. It also goes the other way for XMR exits (accepting XMR and logging the transparent ETH/BTC destination and IP).
• "Deleted" orders weren't actually deleted: Over 4,000 orders have a userDeletedAt timestamp, meaning users thought they cleared their history from the UI, but the full trade metadata and IPs remained sitting in the backend.
• What it means for users: The data doesn't magically trace funds once they move inside Monero, nor does an IP alone equal a real-world identity (VPNs, Tor, NAT). But it connects public wallets to private requests, leaving users open to targeted phishing, cross-chain clustering, and extortion.

If you use "no-KYC" instant bridges, always route through Tor/VPN and assume the platform's database retains the exact link you were trying to break.