Skip to content
NoKYC Score
DirectoryExchangesSwapsBuyRatesIncidentsGuides List a project Sign in

The incident registry

Held funds, hacks, shutdowns and quiet policy changes at no-KYC services. Every entry has a public source, an amount where one is known, and how it ended. Unresolved serious incidents cap a service's Safety grade until they are resolved.

43
On record
11
Unresolved or lost
$117M
Documented value
Report an incident RSS feed
All Unresolved only OutageShutdownPolicy changeFunds heldKYC addedData leakHack or exploitOtherSeizure

2026

medium

Policy change Hodl Hodl

Announced screening of all incoming bitcoin, described as "security scoring"

The directory kycnot.me records that on 18 September 2026 Hodl Hodl announced on X that it would check every bitcoin sent to its escrow system. According to that record the platform described the measure as security scoring and denied that it is an AML process, while some users reported being placed in what the service privately called an AML review. The platform's FAQ, read during this review, still describes trades as taking place without KYC or AML.

Unresolved Source: kycnot.me ↗

high

Funds held Lizex

Reported hold of 18,470 USDC and $30,000 USDT after AML flags

The directory kycnot.me reports that Lizex held 18,470 USDC from 17 September 2026 after an AML flag and has held $30,000 in USDT since June 2026, about $48,000 in total. According to that account, the swap service attributed the hold to its liquidity partner, which told the user that the wallet in question was not its own. The directory flagged the listing as a scam and described the cases as ongoing.

Unresolved $48K Source: kycnot.me ↗

low

Hack or exploit IVPN

Company funds taken through BTCPay Server flaw; no customer data or funds affected

IVPN reported that attackers used a BTCPay Server vulnerability disclosed on 7 August 2026 to extract its Lightning node credentials and move 0.6168 BTC of the company's operating funds. According to the company, its VPN systems were not involved, no customer data was accessed and no customer funds were lost. Lightning payments on its website were unavailable from 7 to 10 August and were then restored.

Funds lost Source: ivpn.net ↗

high

Hack or exploit OpenMonero

Reported drain of 112 XMR in July 2026

The directory kycnot.me records that 112 XMR was drained from OpenMonero in July 2026, the most recent of four incidents it lists for the service. The directory keeps the listing in its unreviewed community category with two critical incidents marked as ongoing, and commenters there have called for the service to be blacklisted. Whether the users affected by the July 2026 incident were reimbursed could not be established from the material reviewed.

Unresolved Source: kycnot.me ↗

medium

Other BasicSwap

Advisory: refund race condition in adaptor-signature swaps; 0.66 BTC reported lost

The public event log of the directory kycnot.me recorded that on 14 July 2026 the BasicSwap team published an advisory asking users to halt trading over a race condition in the automatic refund path of adaptor-signature swaps. A counterparty running a modified client could take swap funds before a refund was broadcast. The team reported a total loss of 0.66 BTC, about $42,000, and released version 0.17.2 with a fix. Ordinary completed swaps were not affected.

Funds lost $42K Source: kycnot.me ↗

high

Funds held SolvoCard

Reported unrefunded balances after a card programme ended

The public event log of the directory kycnot.me recorded that around 10 June 2026 SolvoCard's Mastercard programme was discontinued after its card issuer withdrew support, leaving customer balances stranded on cancelled cards, and described the matter as ongoing. The SolvoCard website was offering new virtual cards when checked in October 2026 and carried no notice about the earlier programme. The number of affected users and the amounts involved were not stated.

Unresolved Source: kycnot.me ↗

critical

Hack or exploit RetoSwap

Reported exploit of the Haveno trade protocol drained about 7,000 XMR from traders

According to press reports, an attacker exploited a flaw in the Haveno trade protocol used by RetoSwap and drained roughly 7,000 XMR, about $2.7 million at the time, from trades in progress. The network operators said the flaw was in the upstream protocol rather than their own infrastructure and that fiat trades were not affected. The directory kycnot.me states that the funds were not recovered and that no reimbursement had been confirmed.

Funds lost $2.7M Source: cryptotimes.io ↗

high

Funds held Swapter

Reported 391 XMR swap unpaid since April 2026

kycnot.me, which documents an earlier held swap, also reports a 391 XMR swap that it says has remained unpaid by Swapter since April 2026, and cites a 2024 forum report of 225 XMR going missing. The directory notes that small swaps continue to complete, which keeps the service's public reviews positive. The service's replies to the directory are summarised on the listing page; the dispute was described as unresolved.

Unresolved Source: kycnot.me ↗

2025

high

Funds held Swapter

Reported 700 XMR swap held since November 2025, with ID requested months later

The directory kycnot.me documents a 700 XMR swap that it says has been held by Swapter since November 2025. According to that account, the user was told for about four months that there was no identity problem and was then asked for identification in April 2026. The directory recorded the incident on 30 January 2026, contacted the service in July and September 2026, and flagged the listing as a scam on 25 September 2026.

Unresolved Source: kycnot.me ↗

critical

Funds held XeggeX

Withdrawals halted after reported compromise; closure notice followed in June 2025

According to a published review of the case, XeggeX stopped withdrawals without warning on 3 February 2025, with the operator saying a device had been compromised and a database corrupted, an account that on-chain analysts questioned. Balances were reportedly converted into non-redeemable placeholder tokens, and a closure and bankruptcy notice followed at the end of June 2025. Industry estimates put losses at up to $80 million. No audited refund process has been documented.

Funds lost $80M Source: plisio.net ↗

high

Other THORChain

THORFi savings and lending feature defaulted; debts converted to a new token

THORChain's own FAQ states that its THORFi feature was defaulted on in the first quarter of 2025, and that the TCY token was introduced as part of the resulting debt restructuring. Users owed funds by THORFi received TCY, a claim on a share of protocol revenue, in place of the assets they had deposited. Ordinary swaps were not part of the default.

Funds lost Source: thorchain.org ↗