Reported partner-API exposure of metadata for about 355,000 swaps
According to a third-party project profile and the kycnot.me event log, security research published in mid-2026 found that Exolix partner-API keys were unscoped and lacked rate limiting, exposing transaction metadata reportedly covering about 355,000 swaps and $39.5 million in volume between January 2025 and May 2026. No loss of user funds was reported. No public incident report from the company was found during this review.
This entry summarises a public report and links to it. It is a record of what was reported, not a finding of wrongdoing. If you represent Exolix, you can
claim the listing and respond here. To correct an error, send a correction.
