Skip to content
NoKYC Score
DirectoryExchangesSwapsBuyRatesIncidentsGuides List a project Sign in

The incident registry

Held funds, hacks, shutdowns and quiet policy changes at no-KYC services. Every entry has a public source, an amount where one is known, and how it ended. Unresolved serious incidents cap a service's Safety grade until they are resolved.

43
On record
11
Unresolved or lost
$117M
Documented value
Report an incident RSS feed
All Unresolved only OutageShutdownPolicy changeFunds heldKYC addedData leakHack or exploitOtherSeizure

2026

low

Outage Cake Pay

Website displayed an "under maintenance" notice

When checked on 12 October 2026 the Cake Pay website displayed a notice stating that the service was under maintenance and asking visitors to check back soon, with questions directed to the Cake Wallet support address. The notice gave no start date, cause or expected end. The date recorded here is the date of observation, not necessarily the start of the maintenance. No reports of unfulfilled orders were reviewed.

Outcome unknown Source: cakepay.com ↗

high

Shutdown LetsExchange

Official notice: exchange operations ceased on 1 October 2026

The LetsExchange website displays a notice stating that the service ceased its exchange operations on 1 October 2026 and that customer support remains available until 30 November 2026. The notice read during this review did not give a reason for the closure. Users with unresolved orders therefore have until the end of November 2026 to contact support. No reports of unpaid swaps tied to the closure were reviewed.

Service closed Source: letsexchange.io ↗

medium

Policy change Hodl Hodl

Announced screening of all incoming bitcoin, described as "security scoring"

The directory kycnot.me records that on 18 September 2026 Hodl Hodl announced on X that it would check every bitcoin sent to its escrow system. According to that record the platform described the measure as security scoring and denied that it is an AML process, while some users reported being placed in what the service privately called an AML review. The platform's FAQ, read during this review, still describes trades as taking place without KYC or AML.

Unresolved Source: kycnot.me ↗

high

Funds held Lizex

Reported hold of 18,470 USDC and $30,000 USDT after AML flags

The directory kycnot.me reports that Lizex held 18,470 USDC from 17 September 2026 after an AML flag and has held $30,000 in USDT since June 2026, about $48,000 in total. According to that account, the swap service attributed the hold to its liquidity partner, which told the user that the wallet in question was not its own. The directory flagged the listing as a scam and described the cases as ongoing.

Unresolved $48K Source: kycnot.me ↗

medium

KYC added Peach Bitcoin

Interim rules restrict sell offers to verified, whitelisted or established sellers

According to press coverage of a company announcement dated 31 August 2026, Peach Bitcoin introduced interim rules from 1 September 2026 after it received a regulatory letter saying its compliance arrangement should be requalified. Sellers must be KYC-verified, whitelisted or have a sufficient trade record to post sell offers; purchases are capped at CHF 500 per transaction; and the platform's escrow co-signature is paused. The company described the measures as temporary while it appeals.

Outcome unknown Source: bitcoinnews.com ↗

medium

Funds held ChangeHero

Reported withheld funds; one $94,000 case released after identity verification

The public event log of the directory kycnot.me recorded on 1 September 2026 several reports of ChangeHero withholding funds from swaps. In one case involving about $94,000, the user reportedly had to complete identity verification before the funds were released. The official site could not be read during this review, so the clause relied on by the service was not confirmed. Other reported cases were not described in enough detail to establish their outcome.

Resolved only after ID $94K Source: kycnot.me ↗

high

Data leak Pocket Bitcoin

Support-system backup exposed, including ID copies of 291 customers

Pocket Bitcoin disclosed on 21 August 2026 that a backup of its support system had been exposed. Its update of 31 August said 291 customers had bank-compliance correspondence exposed, including names, addresses, bitcoin addresses, ID copies and source-of-funds documents in varying combinations, and 5,120 customers had bank transfer lists exposed with names, addresses, amounts and some IBANs. The operator said no funds were affected.

Resolved Source: pocketbitcoin.com ↗

critical

Shutdown NoOnes

Announced wind-down after EU sanctions listing; marketplace closed 21 August 2026

According to press coverage, NoOnes began winding down on 17 August 2026 after the EU sanctions package adopted on 23 July 2026 listed its operating entity and partners withdrew services. The peer-to-peer market closed on 21 August, and users were told to withdraw all balances by 23 August through Bitcoin or USDT on Tron. The directory kycnot.me recorded withdrawal failures during the closure. No confirmation that all balances were returned was found.

Service closed Source: beincrypto.com ↗

high

Shutdown Cypher Card

Official wind-down: cards closed 8 August 2026, platform shut down 6 September 2026

Cypher's official site states that the service is sunsetting. Card loading was disabled, cards remained usable until 8 August 2026 at 00:00 UTC, and the platform shuts down on 6 September 2026, with balances withdrawable without fees until that date. Support pages say merchant refunds arriving after card closure are credited to the balance and must be withdrawn before the shutdown date. No reason for the closure was given on the pages reviewed.

Service closed Source: cypherhq.io ↗

low

Hack or exploit IVPN

Company funds taken through BTCPay Server flaw; no customer data or funds affected

IVPN reported that attackers used a BTCPay Server vulnerability disclosed on 7 August 2026 to extract its Lightning node credentials and move 0.6168 BTC of the company's operating funds. According to the company, its VPN systems were not involved, no customer data was accessed and no customer funds were lost. Lightning payments on its website were unavailable from 7 to 10 August and were then restored.

Funds lost Source: ivpn.net ↗

high

Hack or exploit BTCPay Server

Security advisory: flaw exposing LND credentials exploited before version 2.4.2

The BTCPay Server project published an advisory on 7 August 2026 urging operators to update to version 2.4.2 immediately or take servers offline. According to the advisory, the flaw could let an unauthenticated remote attacker obtain LND credential files and move funds from the connected Lightning node; on-chain wallets were not affected. Several merchants publicly confirmed losses. The project has not published a total, and said a full post-mortem would follow.

Outcome unknown Source: blog.btcpayserver.org ↗

low

Policy change SMSPool

Reported end of direct Monero payments, citing EU rules

The public event log of the directory kycnot.me recorded on 24 July 2026 that SMSPool said it could no longer accept Monero directly, citing the EU's MiCA and incoming anti-money-laundering requirements, and that Monero remained available through its official resellers. The official site could not be read during this review because of an anti-bot challenge, so the current list of accepted payment methods was not confirmed first-hand.

Outcome unknown Source: kycnot.me ↗

high

Hack or exploit OpenMonero

Reported drain of 112 XMR in July 2026

The directory kycnot.me records that 112 XMR was drained from OpenMonero in July 2026, the most recent of four incidents it lists for the service. The directory keeps the listing in its unreviewed community category with two critical incidents marked as ongoing, and commenters there have called for the service to be blacklisted. Whether the users affected by the July 2026 incident were reimbursed could not be established from the material reviewed.

Unresolved Source: kycnot.me ↗

medium

Other BasicSwap

Advisory: refund race condition in adaptor-signature swaps; 0.66 BTC reported lost

The public event log of the directory kycnot.me recorded that on 14 July 2026 the BasicSwap team published an advisory asking users to halt trading over a race condition in the automatic refund path of adaptor-signature swaps. A counterparty running a modified client could take swap funds before a refund was broadcast. The team reported a total loss of 0.66 BTC, about $42,000, and released version 0.17.2 with a fix. Ordinary completed swaps were not affected.

Funds lost $42K Source: kycnot.me ↗

low

Policy change Swapuz

Reported undisclosed fee on transfers classed as high-risk

The public event log of the directory kycnot.me recorded on 2 July 2026 a user report that Swapuz had charged an undisclosed fee on a transfer it classed as high-risk. According to that log, the aggregator OrangeFren intervened and negotiated a refund for the user. Swapuz publishes an AML/KYC policy alongside its terms of use. The size of the fee and the criteria for the high-risk classification were not stated.

Resolved, user paid out Source: kycnot.me ↗

high

Hack or exploit RetoSwap

Reported second protocol-level exploit; all trading suspended

Press coverage reports that RetoSwap suspended all trading in mid-June 2026 after confirming that the underlying Haveno protocol was being actively exploited again, about a month after the first incident. The team is reported to have forced a minimum client version and blocked the attacker's address. The size of any loss in the second incident was not stated in the coverage reviewed. New client releases were published afterwards.

Outcome unknown Source: coingabbar.com ↗

low

Outage RoboSats

Project website reported down from 11 June to 5 July 2026

The public event log of the directory kycnot.me recorded that the RoboSats site was down between 11 June and 5 July 2026. RoboSats is operated as a federation of independent coordinators reached mainly through Tor, so an outage of the project website does not necessarily mean that trading through coordinators stopped. The cause of the outage was not stated in the material reviewed. The documentation site was reachable in October 2026.

Resolved Source: kycnot.me ↗

high

Funds held SolvoCard

Reported unrefunded balances after a card programme ended

The public event log of the directory kycnot.me recorded that around 10 June 2026 SolvoCard's Mastercard programme was discontinued after its card issuer withdrew support, leaving customer balances stranded on cancelled cards, and described the matter as ongoing. The SolvoCard website was offering new virtual cards when checked in October 2026 and carried no notice about the earlier programme. The number of affected users and the amounts involved were not stated.

Unresolved Source: kycnot.me ↗

medium

Funds held FixedFloat

Reported suspension of funds originating from one exchange pending verification

The public event log of the directory kycnot.me recorded that between 8 June and 8 August 2026 FixedFloat suspended orders funded from a specific large exchange and required verification before processing or refunding them. FixedFloat's terms allow it to suspend an order where suspicious activity is detected, carry out KYC and source-of-funds procedures and extend processing by up to two months. The number of users affected and the amounts involved were not stated.

Outcome unknown Source: kycnot.me ↗

low

Other 1984 Hosting

Reported abrupt termination of a Monero marketplace's VPS, restored within a day

The public event log of the directory kycnot.me recorded that on 6 June 2026 the Icelandic host 1984 abruptly terminated a virtual server used by the XmrBazaar marketplace and restored it about a day later. The reason for the termination was not stated in the material reviewed. The event is relevant to customers who rely on the host for projects that could attract complaints, since it shows service can be interrupted at short notice.

Resolved Source: kycnot.me ↗

medium

Data leak Exolix

Reported partner-API exposure of metadata for about 355,000 swaps

According to a third-party project profile and the kycnot.me event log, security research published in mid-2026 found that Exolix partner-API keys were unscoped and lacked rate limiting, exposing transaction metadata reportedly covering about 355,000 swaps and $39.5 million in volume between January 2025 and May 2026. No loss of user funds was reported. No public incident report from the company was found during this review.

Outcome unknown Source: solanacompass.com ↗

low

Other Mullvad VPN

Disclosed exit-IP assignment behaviour that could link sessions across servers

Mullvad disclosed that it became aware on 15 May 2026 of a fingerprinting issue: a client reconnecting through a different server was likely to receive an exit address at the same relative position in that server's range, which could let an observer infer that the same user had moved between servers. The company said this does not reveal a user's identity and that a change in behaviour was being tested for rollout in the following weeks.

Outcome unknown Source: mullvad.net ↗

critical

Hack or exploit RetoSwap

Reported exploit of the Haveno trade protocol drained about 7,000 XMR from traders

According to press reports, an attacker exploited a flaw in the Haveno trade protocol used by RetoSwap and drained roughly 7,000 XMR, about $2.7 million at the time, from trades in progress. The network operators said the flaw was in the upstream protocol rather than their own infrastructure and that fiat trades were not affected. The directory kycnot.me states that the funds were not recovered and that no reimbursement had been confirmed.

Funds lost $2.7M Source: cryptotimes.io ↗

high

Hack or exploit Bisq

Trade-protocol flaw exploited; about 11.6 BTC taken from ten users, later reimbursed

Bisq's post-mortem states that missing validation checks in the Bisq 1 trade protocol were exploited from 1 May 2026 by an attacker using a modified client, affecting altcoin trades only. Ten users lost a total of 11.59 BTC, and trading was halted through an emergency version requirement. According to a later project update, affected users were reimbursed with funds advanced by contributors, with the accounting still to be settled through the DAO.

Resolved, user paid out Source: bisq.network ↗

low

Outage Kyun

Outages in April and July 2026; the July outage attributed to a DDoS attack

The directory kycnot.me records two resolved outages at the VPS provider Kyun: a service outage from 23 to 25 April 2026, and a second from 8 to 9 July 2026 that it attributes to a distributed denial-of-service attack, after which the provider said it had added rate limiting. Whether customers were compensated was not stated. The provider's own website could not be rendered during this review.

Resolved Source: kycnot.me ↗

high

Funds held Swapter

Reported 391 XMR swap unpaid since April 2026

kycnot.me, which documents an earlier held swap, also reports a 391 XMR swap that it says has remained unpaid by Swapter since April 2026, and cites a 2024 forum report of 225 XMR going missing. The directory notes that small swaps continue to complete, which keeps the service's public reviews positive. The service's replies to the directory are summarised on the listing page; the dispute was described as unresolved.

Unresolved Source: kycnot.me ↗

high

Hack or exploit Bitrefill

Disclosed cyberattack; about 18,500 purchase records accessed and hot wallets drained

Bitrefill disclosed on 17 March 2026 that an intrusion beginning on 1 March, traced to a compromised employee laptop, gave attackers access to production systems and hot wallets. According to press coverage of its report, roughly 18,500 purchase records were accessed, including email addresses, payment addresses and IP addresses, with about 1,000 containing encrypted names. The company said it would cover all losses from operating capital and suggested a state-linked group was likely responsible.

Resolved, user paid out Source: theblock.co ↗

high

Shutdown UnCash

Cards closed after Mastercard shut down the programme

Trade-press coverage reports that Mastercard shut down cards tied to UnCash's no-KYC product in February 2026. In a statement dated 10 February 2026 the company reportedly said that about 90% of its cards ran on that network, that all cards would be closed immediately and that remaining balances would be refunded. No later confirmation that refunds were completed was found, and the official site returned a hosting error in October 2026.

Service closed Source: paymentexpert.com ↗

2025

high

Funds held Swapter

Reported 700 XMR swap held since November 2025, with ID requested months later

The directory kycnot.me documents a 700 XMR swap that it says has been held by Swapter since November 2025. According to that account, the user was told for about four months that there was no identity problem and was then asked for identification in April 2026. The directory recorded the incident on 30 January 2026, contacted the service in July and September 2026, and flagged the listing as a scam on 25 September 2026.

Unresolved Source: kycnot.me ↗

high

Shutdown Paxful

Announced closure of all operations by the start of November 2025

Press coverage reports that Paxful disclosed on 1 October 2025 that it would close all operations by the start of November 2025 and urged users to withdraw balances before the cut-off. The company is reported to have cited a historical legal case that exposed compliance weaknesses and the cost and legal risk of remediation. The platform had previously suspended operations temporarily in 2023 during a dispute among its founders.

Service closed Source: techpoint.africa ↗

critical

Seizure TradeOgre

Canadian police announced seizure of about C$56 million from the platform

In September 2025 the Royal Canadian Mounted Police announced that it had seized about C$56 million in cryptocurrency from TradeOgre, describing it as the largest crypto seizure in Canadian history. Police said the platform did not identify its users and had never registered as a money services business. No arrests were announced. The exchange had already gone offline, and no process for returning customer balances was described in the coverage reviewed.

Service closed Source: barchart.com ↗

high

Hack or exploit OpenMonero

Reported loss of about 87 XMR, the first of four recorded incidents

The directory kycnot.me records that about 87 XMR was lost at OpenMonero in June 2025, the first of four security incidents it lists for the service between June 2025 and July 2026; the others involved roughly 40 and 200 XMR. According to that record, the operator attributes around 399 XMR of cumulative losses to a single long-standing bug. Claims that affected users were refunded could not be verified by the directory.

Outcome unknown Source: kycnot.me ↗

high

Data leak cock.li

Reported theft of about one million user records through retired webmail software

Security press reported in June 2025 that an attacker exploited the Roundcube webmail platform used by cock.li and offered the resulting databases for sale. According to the service's own statement as reported, records for an estimated 1,023,800 users who had logged in to webmail since 2016 were exposed, with contact entries for a further subset; passwords, email content and IP addresses were not included. The service removed Roundcube entirely.

Outcome unknown Source: bleepingcomputer.com ↗

critical

Seizure eXch

German authorities seized servers, 8 TB of data and about EUR 34 million

After allegations that part of the proceeds of a major exchange theft in February 2025 passed through eXch, the service announced it would close on 1 May 2025. On 30 April 2025 German federal police and the Frankfurt prosecutor seized its German servers, reporting more than 8 TB of data and about EUR 34 million in crypto assets. Authorities said the operators are suspected of commercial money laundering; the operators had denied laundering allegations. No arrests were reported.

Service closed Source: elliptic.co ↗

critical

Funds held XeggeX

Withdrawals halted after reported compromise; closure notice followed in June 2025

According to a published review of the case, XeggeX stopped withdrawals without warning on 3 February 2025, with the operator saying a device had been compromised and a database corrupted, an account that on-chain analysts questioned. Balances were reportedly converted into non-redeemable placeholder tokens, and a closure and bankruptcy notice followed at the end of June 2025. Industry estimates put losses at up to $80 million. No audited refund process has been documented.

Funds lost $80M Source: plisio.net ↗

high

Other THORChain

THORFi savings and lending feature defaulted; debts converted to a new token

THORChain's own FAQ states that its THORFi feature was defaulted on in the first quarter of 2025, and that the TCY token was introduced as part of the resulting debt restructuring. Users owed funds by THORFi received TCY, a claim on a share of protocol revenue, in place of the assets they had deposited. Ordinary swaps were not part of the default.

Funds lost Source: thorchain.org ↗

high

Hack or exploit NoOnes

Reported drain of about $8 million from platform wallets, acknowledged weeks later

An on-chain investigator reported that NoOnes hot wallets were drained of roughly $7.9 million across several networks in early January 2025 through hundreds of small outflows. According to a blockchain-analytics write-up, the platform initially described maintenance and its chief executive acknowledged a loss of about $8 million later that month, attributing it to an exploit of a bridge component, which was then disabled.

Outcome unknown $8.0M Source: merklescience.com ↗

2024

high

Shutdown LocalMonero

Announced wind-down citing internal and external factors

LocalMonero announced in May 2024 that it was winding down, citing a combination of unspecified internal and external factors. New sign-ups and trade postings were disabled first, and the site was taken offline in November 2024, giving users about six months to complete trades and withdraw. The official domain now shows a closure notice. The operators did not explain the decision further; press coverage inferred regulatory pressure.

Service closed Source: decrypt.co ↗

high

Shutdown AgoraDesk

Wound down in 2024 together with its sister site

AgoraDesk, run by the same team as LocalMonero, wound down its operations in 2024 alongside its sister site. The official domain now displays a closure notice stating that the platform has been taken offline and is closed after nearly seven years of operation, with a contact address for remaining enquiries. Some older guides to no-KYC peer-to-peer trading still recommend the service, although it no longer operates.

Service closed Source: agoradesk.com ↗

critical

Seizure Samourai Wallet

US authorities arrested the developers and seized the wallet's domain and servers

On 24 April 2024 the US Department of Justice announced charges against the two developers of Samourai Wallet, alleging conspiracy to commit money laundering and to operate an unlicensed money transmitting business, together with the seizure of the project's web domain and servers. According to later press coverage, the developers pleaded guilty to the unlicensed money transmitting conspiracy and were sentenced in November 2025. Users' coins remained under their own keys.

Service closed Source: justice.gov ↗

critical

Hack or exploit FixedFloat

Reported exploit of about $26.1 million in bitcoin and ether

FixedFloat was reported in February 2024 to have lost about $26.1 million in bitcoin and ether in an exploit. According to a security firm's analysis, the attacker moved the funds through other no-KYC services, and the root cause was never publicly disclosed in detail. The service resumed operation afterwards. No evidence was found in the sources reviewed that customer swaps in progress were left unpaid as a result.

Outcome unknown $26M Source: halborn.com ↗

2023

high

Shutdown LocalBitcoins

Announced discontinuation of its bitcoin trading service

LocalBitcoins announced on 9 February 2023 that it would discontinue its peer-to-peer bitcoin trading service after about a decade, citing difficult market conditions. Trading was suspended shortly afterwards and users were given a period in which to withdraw their bitcoin. The official site still states that LocalBitcoins Oy has closed its trading service and that remaining funds can be withdrawn by logging in to an existing account.

Service closed Source: cointelegraph.com ↗