# Wagyu.xyz Alleged Data Leak: 38,628 Swap Orders and 10,139 IPs Claimed by WhiteArmor, Exposing Monero Metadata Correlation Risk

> Hudson Rock analyzed purported transaction records from Wagyu.xyz, a no-KYC crypto swap service, allegedly containing 38,628 orders (July 18 - October 26, 2026) linking deposits, Monero destination addresses and 10,139 distinct client IPs. The WhiteArmor ransomware group listed Wagyu.xyz on 2026-10-27/28; the intrusion method and dataset authenticity are unverified. The risk is off-chain metadata correlation, not a cryptographic weakness in Monero.

- **Published:** 2026-10-28T18:04:39Z
- **Last reviewed:** 2026-10-28T18:04:39Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4663
- **ID:** TL-2026-4663
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** TRACKING
- **Actor:** WhiteArmor
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-27/28 the WhiteArmor ransomware group posted listings naming Wagyu.xyz, a no-KYC cross-chain swap service focused on Monero (XMR), on multiple ransomware-tracking services. The actor's stated grievances were allegedly unfair coin-flip odds in the swap service and undisclosed or hidden fees. Hudson Rock (InfoStealers) examined files purportedly originating from the incident and published its analysis on 2026-10-28. Hudson Rock states the origin and authenticity of the files are not independently verified, no blockchain verification was performed, and no connection to infostealer malware was established.

The purported dataset spans July 18 to October 26, 2026 and consists of multiple CSV exports with 38,628 order records and 10,139 distinct IP addresses (not confirmed to be unique individuals). 8,137 orders carry native XMR receiving addresses; 4,580 completed cross-chain-to-XMR records link a deposit transaction, a destination address and a client IP; 1,011 completed BTC-to-XMR orders carry full linkage data; 9,187 completed records also retain outgoing transaction hashes; and 1,328 IPs appear in both XMR-output and non-XMR orders. 4,002 completed orders carry a userDeletedAt field yet remain in the export, 3,180 of them still holding deposit transaction hashes, suggesting metadata survived user-requested deletion. Assets referenced include BTC, ETH, SOL and XMR.

Hudson Rock's central finding is that Monero's cryptography (stealth addresses, ring signatures, RingCT) is not broken; the privacy gap arises at the exchange boundary, where service-side records map entry and exit points and tie them to IPs, timestamps and session identifiers. If authentic, the data enables transaction-aware phishing using real swap details, cross-chain wallet clustering, targeted extortion based on historical transaction values, and enrichment with infostealer records. WhiteArmor's leak site was first tracked on 2026-10-22 (Whirlpool) and by 2026-10-27 had listed six victims per Breachsense. No CVE, malware family or network IOC beyond the Wagyu.xyz domain and the actor leak-site onion address was identified. BeaconBeagle returned no C2 configuration match for wagyu.xyz.

## MITRE ATT&CK

- T1657 Financial Theft
- T1213 Data from Information Repositories
- T1566 Phishing
- T1589 Gather Victim Identity Information
- T1598 Phishing for Information

## Sources

- [38,628 Crypto Orders. 10,139 IPs. What Wagyu's Alleged Leak Means for Monero Privacy.](https://www.infostealers.com/article/38628-crypto-orders-10139-ips-what-wagyus-alleged-leak-means-for-monero-privacy/)
- [WhiteArmor Ransomware Group - Breachsense](https://www.breachsense.com/ransomware-groups/whitearmor/)
- [Wagyu.xyz reaches $700M in Monero volume and launches public API (Chainwire press release)](https://decrypt.co/375636/wagyu-xyz-reaches-700m-in-monero-volume-and-launches-public-api-for-pre-execution-compliance-routing)
- [ZachXBT flags $20M XMR laundering ring on Hyperliquid (FreedomXMR)](https://www.bankless.com/read/news/zachxbt-flags-20m-xmr-laundering-ring-on-hyperliquid)
- [Wagyu.xyz URL scan - MalwareTips](https://tools.malwaretips.com/url-scan/wagyu.xyz)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4663