Site de troca · Breach

Monero swap site confirms three-month data leak after $5M extortion

Oct 29, 2026 · 1 min read

A Monero swap site confirmed a leak of three months of data after a US$5 million extortion demand. Hudson Rock identified 4,580 orders tying public crypto deposits to Monero addresses and the originating IP, including 4,002 orders flagged as deleted by users. Anyone who used the service should treat the link between IP and transactions as exposed.

By HIFY Radar newsroom Updated 10/29/2026 12:51 AM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A Monero swap site confirmed that three months of data leaked after a US$5 million extortion demand. Hudson Rock identified 4,580 orders tying a public crypto deposit to a Monero address and the originating IP. The leak still contains 4,002 orders users had flagged as deleted.

Why it matters

The service exists to provide privacy, and the leak exposes exactly the link between a user's IP and their Monero transactions. Orders flagged as deleted remain in the data set, so deletion protected no one. Companies that used the service may have financial activity tied to their network addresses.

What to do

Check whether the company or third parties used the service during the affected period. Treat the IP-to-transaction link as exposed and review infrastructure exposure and any notification obligations.

For the technical team

Affected: Site de troca (swap) por Monero; base de pedidos com endereços de depósito em cripto, endereços Monero e IPs de origem, · Monero swap service. Order database holding public crypto deposits, Monero addresses and originating IPs, covering three months of data.
Exploitation: Leak confirmed by the site itself after a US$5 million extortion demand. Hudson Rock analyzed the leaked data and reported the orders found.
Fix: No software fix applicable. Users of the service should treat the data as exposed, including the 4,002 orders flagged as deleted.
More details: Hudson Rock found 4,580 orders tying a public crypto deposit to a Monero address and the IP behind it. Of these, 4,002 orders were flagged as deleted by users and remain in the leak. The initial compromise method is not described in the source.