Threat reportData BreachTL-2026-4663
Wagyu.xyz Alleged Data Leak: 38,628 Swap Orders and 10,139 IPs Claimed by WhiteArmor, Exposing Monero Metadata Correlation Risk
Wagyu.xyz Alleged Data Leak (TL-2026-4663) is a medium-severity data breach, first published 2026-10-28. It is attributed to WhiteArmor with low confidence, affects Wagyu Wagyu.xyz no-KYC cross-chain swap service, maps to 5 MITRE ATT&CK techniques (T1213, T1566, T1589), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 1WhiteArmor
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-4663
- Threat ID
- TL-2026-4663
- Severity
- MEDIUM
- Status
- TRACKING
- Category
- DATA_BREACH
- First published
- Last reviewed
- Attribution
- WhiteArmor
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, cryptocurrency
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 11
How Wagyu.xyz Alleged Data Leak works
Hudson Rock analyzed purported transaction records from Wagyu.xyz, a no-KYC crypto swap service, allegedly containing 38,628 orders (July 18 - October 26, 2026) linking deposits, Monero destination addresses and 10,139 distinct client IPs. The WhiteArmor ransomware group listed Wagyu.xyz on 2026-10-27/28; the intrusion method and dataset authenticity are unverified. The risk is off-chain metadata correlation, not a cryptographic weakness in Monero.
On 2026-10-27/28 the WhiteArmor ransomware group posted listings naming Wagyu.xyz, a no-KYC cross-chain swap service focused on Monero (XMR), on multiple ransomware-tracking services. The actor's stated grievances were allegedly unfair coin-flip odds in the swap service and undisclosed or hidden fees. Hudson Rock (InfoStealers) examined files purportedly originating from the incident and published its analysis on 2026-10-28. Hudson Rock states the origin and authenticity of the files are not independently verified, no blockchain verification was performed, and no connection to infostealer malware was established.
The purported dataset spans July 18 to October 26, 2026 and consists of multiple CSV exports with 38,628 order records and 10,139 distinct IP addresses (not confirmed to be unique individuals). 8,137 orders carry native XMR receiving addresses; 4,580 completed cross-chain-to-XMR records link a deposit transaction, a destination address and a client IP; 1,011 completed BTC-to-XMR orders carry full linkage data; 9,187 completed records also retain outgoing transaction hashes; and 1,328 IPs appear in both XMR-output and non-XMR orders. 4,002 completed orders carry a userDeletedAt field yet remain in the export, 3,180 of them still holding deposit transaction hashes, suggesting metadata survived user-requested deletion. Assets referenced include BTC, ETH, SOL and XMR.
Hudson Rock's central finding is that Monero's cryptography (stealth addresses, ring signatures, RingCT) is not broken; the privacy gap arises at the exchange boundary, where service-side records map entry and exit points and tie them to IPs, timestamps and session identifiers. If authentic, the data enables transaction-aware phishing using real swap details, cross-chain wallet clustering, targeted extortion based on historical transaction values, and enrichment with infostealer records. WhiteArmor's leak site was first tracked on 2026-10-22 (Whirlpool) and by 2026-10-27 had listed six victims per Breachsense. No CVE, malware family or network IOC beyond the Wagyu.xyz domain and the actor leak-site onion address was identified. BeaconBeagle returned no C2 configuration match for wagyu.xyz.
MITRE ATT&CK techniques used in TL-2026-4663
Collection
T1213 Data from Information Repositories
Initial Access
Reconnaissance
T1589 Gather Victim Identity Information; T1598 Phishing for Information
Impact
Affected products and versions in Wagyu.xyz Alleged Data Leak
- Wagyu — Wagyu.xyz no-KYC cross-chain swap service
Vulnerable versions: Orders July 18 - October 26, 2026 (alleged)
Remediation for Wagyu.xyz Alleged Data Leak
Immediate actions
- Treat any Wagyu.xyz swap (July-October 2026) as linkable: deposit transaction, XMR destination address and client IP may be associated
- Distrust unsolicited refund or support messages that reference real Wagyu order details; verify through official channels only
- Do not publish swap transaction IDs alongside public profiles or identities
Workarounds
- Assume swap providers retain source and destination metadata indefinitely
- Use separate network egress for swap activity if IP linkage is a concern
Longer-term hardening
- Swap providers should minimize co-location of IPs, sessions, destination addresses and order mappings
- Separate transaction data from operational telemetry and encrypt it at rest
- Define and document what deletion means across live systems, logs, analytics and backups
- Build incident response around data-linkage patterns, not just credential exposure
Weaknesses (CWE) in Wagyu.xyz Alleged Data Leak
Timeline of Wagyu.xyz Alleged Data Leak
- Start of the date range covered by the purported Wagyu.xyz order dataset (per Hudson Rock)
- Chainwire press release: Wagyu.xyz reports $700M in Monero volume and launches a public API
- WhiteArmor's first victim (Whirlpool) is recorded on its leak site by Breachsense
- End of the date range covered by the purported Wagyu.xyz order dataset; WhiteArmor lists several other victims the same day
- WhiteArmor ransomware group posts listings naming Wagyu.xyz on multiple tracking services, alleging unfair coin-flip odds and hidden fees
- Hudson Rock publishes analysis of the purported dataset: 38,628 orders and 10,139 IPs; authenticity and intrusion method unverified
Sources cited for Wagyu.xyz Alleged Data Leak
- 38,628 Crypto Orders. 10,139 IPs. What Wagyu's Alleged Leak Means for Monero Privacy.
- WhiteArmor Ransomware Group - Breachsense
- Wagyu.xyz reaches $700M in Monero volume and launches public API (Chainwire press release)
- ZachXBT flags $20M XMR laundering ring on Hyperliquid (FreedomXMR)
- Wagyu.xyz URL scan - MalwareTips
Detection coverage for TL-2026-4663
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4663 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.