Skip to content
NoKYC Score
DirectoryExchangesSwapsBuyRatesIncidentsGuides List a project Sign in

The incident registry

Held funds, hacks, shutdowns and quiet policy changes at no-KYC services. Every entry has a public source, an amount where one is known, and how it ended. Unresolved serious incidents cap a service's Safety grade until they are resolved.

43
On record
11
Unresolved or lost
$117M
Documented value
Report an incident RSS feed
All Unresolved only OutageShutdownPolicy changeFunds heldKYC addedData leakHack or exploitOtherSeizure

2026

low

Hack or exploit IVPN

Company funds taken through BTCPay Server flaw; no customer data or funds affected

IVPN reported that attackers used a BTCPay Server vulnerability disclosed on 7 August 2026 to extract its Lightning node credentials and move 0.6168 BTC of the company's operating funds. According to the company, its VPN systems were not involved, no customer data was accessed and no customer funds were lost. Lightning payments on its website were unavailable from 7 to 10 August and were then restored.

Funds lost Source: ivpn.net ↗

high

Hack or exploit BTCPay Server

Security advisory: flaw exposing LND credentials exploited before version 2.4.2

The BTCPay Server project published an advisory on 7 August 2026 urging operators to update to version 2.4.2 immediately or take servers offline. According to the advisory, the flaw could let an unauthenticated remote attacker obtain LND credential files and move funds from the connected Lightning node; on-chain wallets were not affected. Several merchants publicly confirmed losses. The project has not published a total, and said a full post-mortem would follow.

Outcome unknown Source: blog.btcpayserver.org ↗

high

Hack or exploit OpenMonero

Reported drain of 112 XMR in July 2026

The directory kycnot.me records that 112 XMR was drained from OpenMonero in July 2026, the most recent of four incidents it lists for the service. The directory keeps the listing in its unreviewed community category with two critical incidents marked as ongoing, and commenters there have called for the service to be blacklisted. Whether the users affected by the July 2026 incident were reimbursed could not be established from the material reviewed.

Unresolved Source: kycnot.me ↗

high

Hack or exploit RetoSwap

Reported second protocol-level exploit; all trading suspended

Press coverage reports that RetoSwap suspended all trading in mid-June 2026 after confirming that the underlying Haveno protocol was being actively exploited again, about a month after the first incident. The team is reported to have forced a minimum client version and blocked the attacker's address. The size of any loss in the second incident was not stated in the coverage reviewed. New client releases were published afterwards.

Outcome unknown Source: coingabbar.com ↗

critical

Hack or exploit RetoSwap

Reported exploit of the Haveno trade protocol drained about 7,000 XMR from traders

According to press reports, an attacker exploited a flaw in the Haveno trade protocol used by RetoSwap and drained roughly 7,000 XMR, about $2.7 million at the time, from trades in progress. The network operators said the flaw was in the upstream protocol rather than their own infrastructure and that fiat trades were not affected. The directory kycnot.me states that the funds were not recovered and that no reimbursement had been confirmed.

Funds lost $2.7M Source: cryptotimes.io ↗

high

Hack or exploit Bisq

Trade-protocol flaw exploited; about 11.6 BTC taken from ten users, later reimbursed

Bisq's post-mortem states that missing validation checks in the Bisq 1 trade protocol were exploited from 1 May 2026 by an attacker using a modified client, affecting altcoin trades only. Ten users lost a total of 11.59 BTC, and trading was halted through an emergency version requirement. According to a later project update, affected users were reimbursed with funds advanced by contributors, with the accounting still to be settled through the DAO.

Resolved, user paid out Source: bisq.network ↗

high

Hack or exploit Bitrefill

Disclosed cyberattack; about 18,500 purchase records accessed and hot wallets drained

Bitrefill disclosed on 17 March 2026 that an intrusion beginning on 1 March, traced to a compromised employee laptop, gave attackers access to production systems and hot wallets. According to press coverage of its report, roughly 18,500 purchase records were accessed, including email addresses, payment addresses and IP addresses, with about 1,000 containing encrypted names. The company said it would cover all losses from operating capital and suggested a state-linked group was likely responsible.

Resolved, user paid out Source: theblock.co ↗

2025

high

Hack or exploit OpenMonero

Reported loss of about 87 XMR, the first of four recorded incidents

The directory kycnot.me records that about 87 XMR was lost at OpenMonero in June 2025, the first of four security incidents it lists for the service between June 2025 and July 2026; the others involved roughly 40 and 200 XMR. According to that record, the operator attributes around 399 XMR of cumulative losses to a single long-standing bug. Claims that affected users were refunded could not be verified by the directory.

Outcome unknown Source: kycnot.me ↗

high

Hack or exploit NoOnes

Reported drain of about $8 million from platform wallets, acknowledged weeks later

An on-chain investigator reported that NoOnes hot wallets were drained of roughly $7.9 million across several networks in early January 2025 through hundreds of small outflows. According to a blockchain-analytics write-up, the platform initially described maintenance and its chief executive acknowledged a loss of about $8 million later that month, attributing it to an exploit of a bridge component, which was then disabled.

Outcome unknown $8.0M Source: merklescience.com ↗

2024

critical

Hack or exploit FixedFloat

Reported exploit of about $26.1 million in bitcoin and ether

FixedFloat was reported in February 2024 to have lost about $26.1 million in bitcoin and ether in an exploit. According to a security firm's analysis, the attacker moved the funds through other no-KYC services, and the root cause was never publicly disclosed in detail. The service resumed operation afterwards. No evidence was found in the sources reviewed that customer swaps in progress were left unpaid as a result.

Outcome unknown $26M Source: halborn.com ↗