Hackers Claim Wagyu Crypto Platform Breach as Researchers Find Thousands of Monero Transaction Records

Hackers have claimed a breach of cryptocurrency swap platform Wagyu.xyz, while researchers reviewing the purported leak found thousands of records connecting Monero transactions with public blockchain payments and IP addresses.

The dataset contains 38,628 order records and 10,139 distinct IP addresses, covering activity between July 18 and October 26, 2026. Its origin and authenticity remain independently unverified.

The findings highlight a privacy risk beyond cryptocurrency code: information held by services that move funds between blockchains. Unlike a wallet compromise, a transaction database leak can expose financial relationships without revealing private keys.

The earlier Coinbase customer data breach similarly showed how exposed account information could create social-engineering risks without directly compromising customer funds.

Researchers from Infostealers, Hudson Rock’s threat-intelligence publication, reported their findings on October 28.

They noted that infostealer malware can expose credentials, browser activity and cryptocurrency information, but found no evidence that such malware caused this alleged incident or infected identified Wagyu customers.

Hackers Claim Wagyu Crypto Platform Breach

Ransomware-tracking services indexed WhiteArmor-associated listings naming Wagyu on October 27–28, including an entry titled “wagyu.xyz unfairness.”

The accompanying claims focused on allegedly hidden swap fees and unfair coin-flip odds. However, a threat actor’s listing does not establish that ransomware was deployed, data was stolen, or financial misconduct occurred.

Hudson Rock examined an order export and a separate IP-level activity summary. Researchers identified 8,137 orders naming native Monero receiving addresses, including 6,692 marked completed.

Within the completed cross-chain subset, 4,580 records joined an incoming transaction hash, an XMR destination and a client IP address. That group included 1,011 Bitcoin-to-Monero orders.

This matters because a swap provider must know where to deliver purchased coins. Its database may therefore connect a visible Bitcoin deposit with a Monero receiving address, timestamp, browser information and session identifier.

These service-side records expose relationships that are not available through ordinary inspection of Monero’s blockchain. The wider risk involves combining separate sources of metadata.

As reporting on stolen credentials fueling breaches explains, infostealer logs can contain browser sessions and wallet information. Such material could provide additional investigative context, although Hudson Rock did not report matching Wagyu records against infected users or stolen credentials.

The records also show the reverse direction. Researchers found 11,317 native-XMR-input swap orders containing service deposit addresses and destinations for other assets.

Among them, 9,187 completed records retained outgoing transaction hashes. These links can reveal a service’s public-chain payouts, but not which private Monero wallet originally supplied its deposits.

Some transaction groups carried labels including “Poloniex Hacker,” “Theft” and “Tornado.Cash: 100 ETH.” Six completed withdrawals labeled “Poloniex Hacker” totaled $1,025,047 in recorded value.

These are unverified database labels, not confirmed criminal attributions. Recorded amounts also do not establish stolen proceeds, and overlapping groups cannot be added into a reliable laundering total.

Privacy Risks, Data Retention and User Protection

The research does not demonstrate a weakness in Monero’s cryptography. Instead, it shows how information stored outside the blockchain can connect transaction requests and network activity.

An IP address is not a verified identity: VPNs, Tor, shared networks and automated services can represent several users, while one person may use multiple addresses.

Another concern involves 4,002 completed orders containing a populated userDeletedAt field. All retained an IP address and destination, while 3,180 also retained deposit transaction hashes.

The field alone cannot establish what users deleted, whether backups were involved, or whether Wagyu breached any retention promise or legal obligation.

If authentic, the records could support convincing refund scams, fake support messages or extortion attempts referencing real trades.

Separate campaigns using fake crypto wallet screens demonstrate why users should never enter recovery phrases into unexpected prompts. Hudson Rock did not establish that anyone had exploited the alleged Wagyu leak this way.

Users should verify notices through trusted channels and reject requests for private keys. Platforms should limit retention, restrict database access and explain how deletion affects logs and backups.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Claim Wagyu Crypto Platform Breach as Researchers Find Thousands of Monero Transaction Records appeared first on Cyber Security News.