2026-07-08T12:03:39Z https://yabu.me Milan Voss https://yabu.me/npub16f7tzyma83hpu2cn96uq9kepw4fycywqhacmrlm48spknfcxupxsadj00k https://nokycswap.me/img/avatars/milan-voss.png https://nokycswap.me/img/avatars/milan-voss.png https://yabu.me/nevent1qqst0lvsv0d0636zfg42txqdjut07pyajqzlsarfl8mpmgff2zpa29czyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy648qv8c Warning: changenow.my is a full copy of the ChangeNOW site. We created an unfunded order on it: the deposit address came from the clone&#39;s own wallet, marked to be swept onward — not from ChangeNOW. ChangeNOW&#39;s only site is changenow.io. If an order page shows an ID that changenow.io cannot find, do not send.<br/><br/><a href="https://nokycswap.me/blog/changenow-my-phishing-clone/">https://nokycswap.me/blog/changenow-my-phishing-clone/</a><br/><br/>#crypto #nokyc #privacy 2026-11-09T20:10:51Z https://yabu.me/nevent1qqsdtytwj967nae9d7ugdfunuv82c82sesd495dm4tkusv9h8velm8gzyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6kc3568 Warning: changenow.my is a full copy of the ChangeNOW site.<br/><br/>We created an unfunded order on it over Tor. The order was made on the clone&#39;s own server, and the deposit address came from the clone&#39;s own wallet (address 14 of its HD wallet), marked to be swept to bc1pq7hc77cjsjzh64emnmv57s4kh049mx3x4ujc7vuafu32wsd537qqnksz5t. Nothing pointed to ChangeNOW.<br/><br/>ChangeNOW&#39;s only site is changenow.io. Before sending, paste the order ID into the tracker there; if it is not found, stop.<br/><br/>No funds had reached either address as of today. 2026-11-09T18:23:25Z https://yabu.me/nevent1qqszur38ct8flhgu9mfad02c4uxh5masd7grgdcthj2j8yw8rv4fvfczyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6jt0nae Wagyu.xyz order data leaked: about 38,600 orders and 10,100 IP addresses from 18 Jul to 26 Oct 2026, confirmed by the operator. 4,580 completed orders link the deposit transaction, the Monero receiving address and the client IP. If you used Wagyu in that window, treat that XMR address as linked to you.<br/><br/><a href="https://nokycswap.me/blog/wagyu-data-leak-2026-10-27/">https://nokycswap.me/blog/wagyu-data-leak-2026-10-27/</a><br/><br/>#crypto #nokyc #privacy 2026-11-07T20:07:10Z https://yabu.me/nevent1qqsd5ynqafsagdmtpfy3t2udgxsp2qpx2t7xppwsptuhrsyhd2yn7qszyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy66vlf2u Binance theft, week one, from our own tracking: once THORChain reopened, 28 steps we follow went straight into it (about 71 BTC on 5–6 Nov), one went through a CoinJoin, none reached Monero. And one consolidation address received steps from both our Binance and our Bitget cases.<br/><br/><a href="https://nokycswap.me/blog/binance-week-one-thorchain-bitget-link/">https://nokycswap.me/blog/binance-week-one-thorchain-bitget-link/</a><br/><br/>#crypto #nokyc #privacy 2026-11-07T14:03:50Z https://yabu.me/nevent1qqsp8rch4egl4ht2g8dmrllshpsegchn844lq3ct0jvsm46j3k9l6gqzyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy69snnee A week into the Binance theft, from our monitor&#39;s side.<br/><br/>The Bitcoin leg started moving on 1 Nov. Once THORChain reopened late on 3 Nov, 28 of the steps we follow went straight into it: about 71 BTC over 5–6 Nov. One step went through a CoinJoin (1.07 BTC). Nothing we follow has touched a Monero route so far.<br/><br/>One detail we haven&#39;t seen written up: a single consolidation address, bc1q82cksuj36wfc2khdpmhlk0szxv7u8fe894t4zw, received a step from our Binance case and a step from our Bitget case (September). Elliptic says part of the Binance money went to wallets that hold Bitget proceeds. This fits.<br/><br/>These are the steps we track, not the whole flow. 2026-11-07T12:26:00Z https://yabu.me/nevent1qqs994cm4z048na7hwwhs4l5ekn5ep0a56tw8twk8s62ar6akz053xgzyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6yflkff State of no-KYC, October 2026: Binance lost ~$6.3B, NEAR Intents ~$3.8M; nine new scam-registry entries; eleven swaps with our own money; and only one instant exchange refused a sanctioned payout address at order time.<br/><br/><a href="https://nokycswap.me/blog/state-of-no-kyc-october-2026/">https://nokycswap.me/blog/state-of-no-kyc-october-2026/</a><br/><br/>#crypto #nokyc #privacy 2026-11-01T09:22:46Z https://yabu.me/nevent1qqst4c28fyluvz0s8smcz6k78csktrc997zns2m3ac5yvvrxacq7ztszyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6tldgl5 State of no-KYC, October 2026.<br/><br/>Binance lost ~$6.3B (its own estimate); inside the niche NEAR Intents lost ~$3.8M; LetsExchange closed. Nine new scam-registry entries.<br/><br/>We ran eleven swaps with our own money. Best: a fixed quote paid to the satoshi. Worst rate: 12 % below market — while the same desk paid 9.3 % more through an aggregator.<br/><br/>Address screening: all six instant exchanges we checked accepted a sanctioned payout address at order time. Relay refused it; NEAR Intents and LI.FI screened before giving a deposit address or a route.<br/><br/><a href="https://nokycswap.me/blog/state-of-no-kyc-october-2026/">https://nokycswap.me/blog/state-of-no-kyc-october-2026/</a> 2026-11-01T08:18:46Z https://yabu.me/nevent1qqsdy9hsvy9gxsl33477ck6d6gw2zeanc0d5xs8pjdya9f4v3fh8ewgzyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6c8wj3x Binance has paused deposits and withdrawals after a ~$6.3B incident — by its own early account, one compromised DevOps laptop reached the system that submits withdrawals. On our monitor the no-KYC swaps kept working: 13 of 13 kept quoting, uptime 100% over 18 h. The lesson is custody.<br/><br/><a href="https://nokycswap.me/blog/binance-hack-6-3b-what-it-means-for-no-kyc-users/">https://nokycswap.me/blog/binance-hack-6-3b-what-it-means-for-no-kyc-users/</a><br/><br/>#crypto #nokyc #privacy 2026-10-30T08:18:09Z https://yabu.me/nevent1qqst8366ls8ff2a39yuttz25hnrkdf727mxltwldv96maawmsjjhq6gzyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6ye8rv0 Binance has paused deposits and withdrawals after the ~$6.3B incident. Its own early read: one compromised DevOps laptop reached a service container that submits withdrawals; no evidence of a key leak, ~$3B frozen, losses to be covered.<br/><br/>We checked what that did to the no-KYC swaps on our monitor. Quoting and uptime looked normal: all 13 services we quote every minute kept quoting through the night, and every service we track stayed reachable over the next 18 hours.<br/><br/>The lesson is custody, not size: a balance on any exchange is a claim, not coins.<br/><br/><a href="https://nokycswap.me/blog/binance-hack-6-3b-what-it-means-for-no-kyc-users/">https://nokycswap.me/blog/binance-hack-6-3b-what-it-means-for-no-kyc-users/</a> 2026-10-30T07:45:29Z https://yabu.me/nevent1qqsx4c2msj4kjtnrq7s8vjc7d86ksxjuspx9n6q39tz8zxepd5yp5sczyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy694rqyr In reply to <a href='/nevent1qqsv9zr3mtya7xlqhvxzcv5edkgcz4h6e8hv6nk5j5w9amafpychazcpz3mhxue69uhhyetvv9ujuerpd46hxtnfdu3ztvd7'>nevent1q…tvd7</a><br/>_________________________<br/><br/>Restore height is the step people skip and then lose a day to rescanning. One thing worth adding to the remote-node part: the node still sees your IP and which heights you ask for, so routing it over Tor matters about as much as checking the GPG signature. Worth saying out loud because plenty of services in this space quietly refuse Tor connections - we keep running into it when we test them. 2026-10-29T09:07:56Z https://yabu.me/nevent1qqsqpvayyvz0se8nt7nn0rp6wmva0wct6tkhkeax53xmq706jml59vszyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6w7s8v7 Silent Node (silentnode.host) was on our pre-launch watch list, like every service we track. Walking through it as a user, without paying: the «live» status is drawn with Math.random, the «Estonian company since 2021» has a domain from July 2026, even a pre-sales ticket needs a deposit, and top-ups get a 100% bonus into a balance with no withdrawal. The whole scheme, with sources:<br/><br/><a href="https://nokycswap.me/blog/silent-node-scam-pay-first-hosting/">https://nokycswap.me/blog/silent-node-scam-pay-first-hosting/</a><br/><br/>#crypto #nokyc #privacy 2026-10-25T22:06:59Z https://yabu.me/nevent1qqsr9a6a5d6qthhdtlagna2g9h5zykl8htd6av5sshmcd07wxyajwtszyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy635vp6v Prices, jurisdictions, server locations and limits of 15 services you can pay for without identity checks, each taken from the service&#39;s own pages on 13 October 2026, with what we could not find marked.<br/><br/><a href="https://nokycswap.me/guides/no-kyc-vpn-hosting-esim-compared/">https://nokycswap.me/guides/no-kyc-vpn-hosting-esim-compared/</a><br/><br/>#crypto #nokyc #privacy 2026-10-24T21:19:09Z https://yabu.me/nevent1qqsxm2sw9rr6rcyyxxhsejugtpd9p7kadw6jsm4eggfwnpk0zsdftuczyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy66klcjh What each exchange’s own terms say about holds and refunds, quoted with paragraph numbers, and the evidence to collect before you write to support.<br/><br/><a href="https://nokycswap.me/guides/frozen-funds/">https://nokycswap.me/guides/frozen-funds/</a><br/><br/>#crypto #nokyc #privacy 2026-10-24T15:12:50Z https://yabu.me/nevent1qqs2v92mhl9rw83p76nlm2q2nvj8gzrczqvl99lumrvwsskycxgz8gqzyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6upgff3 In reply to <a href='/nevent1qqs08d0lct5jgs202p7ht7qltppdqmk2a4g792f48qvtyu3a3rx2s0q9r9hs2'>nevent1q…9hs2</a><br/>_________________________<br/><br/>Watch the wire, not the dashboard — I&#39;m keeping that line. Timestamps were the only way to show exactly when LetsExchange stopped quoting, rather than guess. 2026-10-24T09:59:58Z https://yabu.me/nevent1qqsy5whha8d3qz3yaq6z3ku8gqklttmpnhxxmmdxy75em4evmvkdwtszyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6p79wec In reply to <a href='/nevent1qqst5gsacq5aspwrtc3u4ha0ksjgek7zx56rf75ptx36qzq7lzmkjusefwv04'>nevent1q…wv04</a><br/>_________________________<br/><br/>Right — and it usually bites after the deposit, not before. In our last count 14 of the 41 exchanges we track keep that discretionary right in their terms. We quote the clause word for word in each review, with the date we read it, so checking takes a minute. 2026-10-24T09:59:58Z https://yabu.me/nevent1qqsz0tnldmqmysj73v0agpcwyaegzd5dt52nkmk63zczmvfk0j007dczyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6va6eyk In reply to <a href='/nevent1qqst062cr0ds2ztcvqa30rf5qttst783ugujrq9f0gd7smewq8hvh9shv9asc'>nevent1q…9asc</a><br/>_________________________<br/><br/>Thanks for running it down — and fair point, I should have linked it in the first place. Your summary is the useful part: CVE-2026-115560 needs a fairly unusual session setup, and session.upload_progress.enabled=0 covers it until the fix ships. For anyone running a small swap front end on PHP, that one line is cheap to set this week. 2026-10-24T09:59:58Z https://yabu.me/nevent1qqsgc6a9y3srhy2sagl28xpyt8gqnaxgpa0ezgwvt7p24ven5vz3ehgzyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6sk5cc2 We compared quotes that no-KYC exchanges gave in the same minute for 7 days: the best offer beat the worst by 2.6–3.9%, and a fixed rate paid about 0.5% less than a floating one at the same service.<br/><br/><a href="https://nokycswap.me/guides/fixed-vs-floating-rate/">https://nokycswap.me/guides/fixed-vs-floating-rate/</a><br/><br/>#crypto #nokyc #privacy 2026-10-24T09:17:57Z https://yabu.me/nevent1qqs9ug404hxu7jq2h3apv6u628vt6fnxm254sv6fskpxqlgn2y0w8yczyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6296c9j Five checks, with what we found across the 41 exchanges we track: 14 may ask for identity at their discretion, 26 do not state who holds your coins during a swap, and 4 changed their KYC wording in the last 30 days.<br/><br/><a href="https://nokycswap.me/guides/check-a-no-kyc-exchange/">https://nokycswap.me/guides/check-a-no-kyc-exchange/</a><br/><br/>#crypto #nokyc #privacy 2026-10-24T03:23:23Z https://yabu.me/nevent1qqsxc6xrvd5cqpy8szpp3xyytjcvvzw9tkd2s8lt66783v4muz2kx6szyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6aezj0v Four laundering routes in one week, straight from our coin-flow notes. Drift&#39;s exploiter went back to Tornado Cash with ~$109M. SquidSquad ran mixer → USDT on TRON → OTC desks within minutes, before Tether could react. One institution got drained twice through EIP-7702, one leg via NEAR Intents into Zcash&#39;s shielded pool. And FreedomXMR runs a laundering desk with its own Hyperliquid ticker. Why any of this matters for your next swap:<br/><br/><a href="https://nokycswap.me/blog/where-stolen-coins-went-october-2026/">https://nokycswap.me/blog/where-stolen-coins-went-october-2026/</a><br/><br/>#crypto #nokyc #privacy 2026-10-23T21:10:09Z https://yabu.me/nevent1qqs0qpulxgv6w74zw5ksnmu8pkyfgtm4njvn4qcfenn2w0la2a7lxgczyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy64399tq In reply to <a href='/nevent1qqsdu2truw4tx4pt5ch2mc59vem3strtwlqtpl6fwhqpph6kq0yywvsppemhxue69uhkummn9ekx7mp0m8ex3n'>nevent1q…ex3n</a><br/>_________________________<br/><br/>One detail from Zach&#39;s thread keeps getting lost in the retellings: he says FreedomXMR &#34;likely uses a swap model similar to Wagyu&#39;s&#34;. That&#39;s about how it&#39;s built, not an accusation against Wagyu. He also named b1exch as another desk of the same kind on HL Core.<br/><br/>Your trail point stands — dirty money still has to enter on a transparent chain first, and that&#39;s where it gets caught. We logged it with three other laundering routes from the same week: <a href="https://nokycswap.me/blog/where-stolen-coins-went-october-2026/">https://nokycswap.me/blog/where-stolen-coins-went-october-2026/</a> 2026-10-23T17:08:59Z https://yabu.me/nevent1qqsr2p2u2ettn3muemnnjtdhgzczgs4fzapaskneeqj6c62lp6l2lhgzyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6dvs33e In reply to <a href='/nevent1qqsqx3saet80rdqxu6jgvwsusvp6uqyfmkakz4acsv4gasly69htzjqg4muna'>nevent1q…muna</a><br/>_________________________<br/><br/>Small angle from the no-KYC side: a handful of the swap and hosting services we track serve PHP session cookies on their front pages, and none of them show a version. Doesn&#39;t mean they&#39;re unpatched, only that from the outside you can&#39;t tell.<br/><br/>If you&#39;re sending coins to a small exchange this week, a test amount first isn&#39;t paranoia. And it&#39;s not over: THN reports PHP warned of another unpatched RCE two days after the emergency patches. 2026-10-23T17:08:59Z https://yabu.me/nevent1qqs24hq7fs9k6nj70wgdaw0unzrdfh6vanra0dma543tvs7a5f86j2gzyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6n9vw9u AMLBot put out its 2026 investigations report: 250+ cases, $291.6M reported lost. The line that stuck with me: 81% of cases involving exchanges and other custodial services were hacks, not exit scams. And stolen stablecoins get swapped into BTC or ETH within hours, over the same routes honest users take. That&#39;s the real reason a perfectly normal swap can get held after you send. Wrote up what it means if you swap without KYC:<br/><br/><a href="https://nokycswap.me/blog/amlbot-2026-report-no-kyc/">https://nokycswap.me/blog/amlbot-2026-report-no-kyc/</a><br/><br/>#crypto #nokyc #privacy 2026-10-23T14:57:59Z https://yabu.me/nevent1qqs2a3un3r6s0txtfvmhf9d0qhz70wtu5w94m2tkscyv7fhxwpwlw9czyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6xyd0hj One signed transaction, paid out twice. On Sept 12 someone pulled 736,442 USDT out of Chainflip&#39;s TRON vault by adding a memo to transactions that were already signed.<br/><br/>What happened, who pays, and what it means:<br/><br/><a href="https://nokycswap.me/blog/chainflip-tron-memo-exploit/">https://nokycswap.me/blog/chainflip-tron-memo-exploit/</a><br/><br/>#chainflip #tron #usdt #exploit #crypto 2026-10-08T11:23:52Z https://yabu.me/nevent1qqs9c52l60stlrenalqnccv5q97z8wycjvk4fnueus9zu38qhukm6lgzyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6atzt0a A week after NEAR Intents blocked $50M of the Bitget funds, it lost about $3.8M itself — a bug between its Omni deposit and withdrawal system and its contract.<br/><br/>What happened, and what it means if you route swaps through it:<br/><br/><a href="https://nokycswap.me/blog/near-intents-exploit-3-8m/">https://nokycswap.me/blog/near-intents-exploit-3-8m/</a><br/><br/>#near #defi #exploit #crypto #nokyc 2026-10-07T18:12:50Z https://yabu.me/nevent1qqs8m2jn4ca0f4d8ng2wujacjx2th8v8wuufe7x47xwswsp089ky4dgzyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6ra5w6p LetsExchange shut down on October 1 at 07:00 UTC. Our monitor logged their last quote at 06:59:57 — three seconds before the lights went out.<br/><br/>If you still had an order open there, here is what is known and what you can actually do:<br/><br/><a href="https://nokycswap.me/blog/letsexchange-closed/">https://nokycswap.me/blog/letsexchange-closed/</a><br/><br/>#letsexchange #crypto #nokyc #privacy 2026-10-06T15:09:05Z https://yabu.me/nevent1qqsdqcm05xrwtgk2epkn56gnvcek448t6uaua42scsr5k2j4d0yktjgzyrf8evgn057xu83tzvhtsqkmy964ynq3czlhrv0lw57qx6d8qmsy6m5rkvn $387.5M left Bitget on Sept 24. What caught my attention is the route: the money went through THORChain and NEAR Intents — the same rails people use to swap without KYC.<br/><br/>How they got in, how the funds moved, and how not to end up holding tainted coins:<br/><br/><a href="https://nokycswap.me/blog/bitget-hack-387m-cross-chain/">https://nokycswap.me/blog/bitget-hack-387m-cross-chain/</a> 2026-10-05T21:11:06Z