The incident registry

Held funds, hacks, shutdowns and quiet policy changes at no-KYC services. Every entry has a public source, an amount where one is known, and how it ended. Unresolved serious incidents cap a service's Safety grade until they are resolved.

43
On record: 11
Unresolved or lost: $117M
Documented value

Report an incident RSS feed

All Unresolved only Outage Shutdown Policy change Funds held KYC added Data leak Hack or exploit Other Seizure

2026

14 Jul 2026

medium

Other BasicSwap

Advisory: refund race condition in adaptor-signature swaps; 0.66 BTC reported lost

The public event log of the directory kycnot.me recorded that on 14 July 2026 the BasicSwap team published an advisory asking users to halt trading over a race condition in the automatic refund path of adaptor-signature swaps. A counterparty running a modified client could take swap funds before a refund was broadcast. The team reported a total loss of 0.66 BTC, about $42,000, and released version 0.17.2 with a fix. Ordinary completed swaps were not affected.

Funds lost $42K Source: kycnot.me ↗

6 Jun 2026

low

Other 1984 Hosting

Reported abrupt termination of a Monero marketplace's VPS, restored within a day

The public event log of the directory kycnot.me recorded that on 6 June 2026 the Icelandic host 1984 abruptly terminated a virtual server used by the XmrBazaar marketplace and restored it about a day later. The reason for the termination was not stated in the material reviewed. The event is relevant to customers who rely on the host for projects that could attract complaints, since it shows service can be interrupted at short notice.

Resolved Source: kycnot.me ↗

20 May 2026

low

Other Mullvad VPN

Disclosed exit-IP assignment behaviour that could link sessions across servers

Mullvad disclosed that it became aware on 15 May 2026 of a fingerprinting issue: a client reconnecting through a different server was likely to receive an exit address at the same relative position in that server's range, which could let an observer infer that the same user had moved between servers. The company said this does not reveal a user's identity and that a change in behaviour was being tested for rollout in the following weeks.

Outcome unknown Source: mullvad.net ↗

2025

23 Jan 2025

high

Other THORChain

THORFi savings and lending feature defaulted; debts converted to a new token

THORChain's own FAQ states that its THORFi feature was defaulted on in the first quarter of 2025, and that the TCY token was introduced as part of the resulting debt restructuring. Users owed funds by THORFi received TCY, a claim on a share of protocol revenue, in place of the assets they had deposited. Ordinary swaps were not part of the default.

Funds lost Source: thorchain.org ↗