Wagyu.xyz suffered a hack exposing user swaps, IP addresses, and transaction details after refusing a $5M ransom demand.
Security & Exploits ·
Wagyu.xyz, a cross-chain swap platform enabling direct cryptocurrency-to-Monero exchanges without identity verification, suffered a security breach that exposed comprehensive user records after the operator PerpetualCow declined a $5 million extortion demand. The incident resulted in disclosure of user swap histories, IP addresses, geographic locations, transaction metadata, and wallet fingerprints. The threat actor WhiteArmor claimed possession of 38,628 orders and 10,139 distinct IPs associated with approximately $907 million in volume routed through Hyperliquid's order book.
Beyond the data leak itself, disclosed materials alleged operational irregularities in two systems. Wagyu's coinflip game reportedly advertised a 48 percent win probability with 4 percent house edge, yet server configurations targeted a measurably higher expected loss. More significantly, fee discrepancies emerged across 28,840 swap and bridge transactions totaling roughly $264.9 million: while Wagyu advertised $1.73 million in fees, actual collection reached $5.64 million, representing $3.9 million or 69.28 percent undisclosed extraction.
The breach discovery occurred October 27, 2026. WhiteArmor has posted samples on its site and provided contact information, yet confirmation of how the initial compromise occurred remains unclear, as does any response from Wagyu.xyz.