{"meta":{"name":"TAS Check","method":"https://tradingagentstack.com/check/#method","last_checked":"2026-10-25","license":"CC BY 4.0"},"entries":[{"name":"Trojan","slug":"trojan","kind":"telegram_bot","chains_or_assets":["Solana"],"listing_name":"Trojan","official":{"domains":["trojan.com","trojanonsolana.com"],"telegram":["@solana_trojanbot","@odysseus_trojanbot","@trojantrading"],"x":["@TrojanOnSolana"],"github":[],"apps":[],"confirmed_via":["https://trojan.com (links x.com/TrojanOnSolana, docs.trojan.com, and its 'Telegram Bot' button to trojanonsolana.com)","https://docs.trojan.com/additional-info/links.md (lists trojan.com and x.com/TrojanOnSolana)","https://www.quicknode.com/builders-guide/tools/trojan-on-solana-by-trojan-team (third-party listing: trojanonsolana.com and x.com/TrojanOnSolana)","https://trojanonsolana.com/ footer and https://trojanonsolana.com/links (t.me/solana_trojanbot labelled 'Main Bot', plus backup bots; t.me/trojantrading support group)","https://docs.trojanonsolana.com/ (links t.me/odysseus_trojanbot, which also appears on trojanonsolana.com/links)"],"notes":"@solana_trojanbot is the main trading bot. trojanonsolana.com/links also lists backup bots @achilles_trojanbot, @menelaus_trojanbot, @diomedes_trojanbot, @paris_trojanbot, @helenus_trojanbot, @hector_trojanbot, @agamemnon_trojanbot and @nestor_trojanbot (vendor-listed only; not separately double-confirmed). @trojantrading is a support group, not a bot; the vendor pages also show t.me/trojan and t.me/trojan_on_solana as support links, inconsistently. The bot usernames are confirmed only from Trojan's own pages (two separate vendor pages reached from the confirmed official domain), with no independent third-party match found. trojan.com is the newer web terminal (trojan.com/terminal). Third-party directories disagree: DappRadar lists trojanbot.work and Solana Compass lists trojan.app and @TrojanTrading. No Trojan-owned page links to any of these, so do not treat them as official."},"known_fakes":[],"custody":{"who_holds_keys":null,"note":"Trojan's terms say it is 'not a custodian' and that your Trading Wallet is provided by a 'third-party wallet provider via an SDK'; the site shows Privy as a partner, but the terms don't name the provider. You can export the private key from wallet settings ('Export Private Keys') and import a wallet with a private key. How the Telegram bot itself stores the keys of the wallets it creates is not documented on any page we could access.","source":"https://trojan.com/terms-of-use ; https://docs.trojan.com/trading-on-trojan/wallet-management.md"},"can_move_funds_out":{"value":true,"note":"Withdrawals from the Wallets page: you enter any receiving address and click Withdraw.","source":"https://docs.trojan.com/faqs.md"},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[],"deadlines":[],"worst_case":"Trading runs from a hot wallet that Trojan's bot or its wallet provider can sign for. If your Telegram account, that wallet's private key, or Trojan's systems are compromised, everything in the wallet can be withdrawn to any address, and Trojan's terms say it is not liable.","safe_setup":["Open the bot only from the links on trojanonsolana.com/links or trojan.com (main bot @solana_trojanbot), never from DMs, ads or search results","Use a fresh Trojan wallet and keep in it only what you are trading; regularly withdraw profits to a wallet that never touches the bot","Never paste the exported private key anywhere else, and turn on Telegram 2-step verification to protect the account that controls the bot"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Maestro","slug":"maestro","kind":"telegram_bot","chains_or_assets":["Solana","BNB Smart Chain","Base","Ethereum","Monad","Sonic","Avalanche","Arbitrum","HyperEVM","Robinhood Chain","Tron","TON"],"listing_name":"Maestro","official":{"domains":["maestrobots.com"],"telegram":["@Maestro"],"x":["@MaestroBots"],"github":[],"apps":[],"confirmed_via":["https://www.maestrobots.com (links t.me/Maestro as 'Launch Maestro Bot', x.com/MaestroBots, docs.maestrobots.com)","https://docs.maestrobots.com/sniper/getting-started.md (links t.me/maestro as the bot)","https://decrypt.co/204444/maestro-trading-bot-refunds-610-eth-to-users-following-router-exploit (Chainwire release gives www.maestrobots.com)","https://www.theblock.co/news/ecosystems/2023-10-25-maestro-telegram-bot-suffers-a-contract-exploit-500000-of-eth-stolen-259338 (cites twitter.com/MaestroBots post)"],"notes":"@Maestro is the trading (sniper) bot; Telegram usernames are case-insensitive. The site also lists @MaestroWalletBot, @MaestroWhaleBot and @MaestroBuyBot (other vendor products, listed on the site only) and a GitHub release for a desktop Scraper app (github.com/MaestroBots/MaestroScraper; site only, not double-confirmed, so not listed)."},"known_fakes":[],"custody":{"who_holds_keys":"service","note":"The bot generates (or imports) the wallet and holds the key to sign trades; Maestro says 'All private keys are AES encrypted' on its servers. The private key and mnemonic are shown when the wallet is created, and if you lose them and delete the bot messages they can't be retrieved.","source":"https://docs.maestrobots.com/sniper/faq/security.md"},"can_move_funds_out":{"value":true,"note":"The bot can send native coins and tokens to another of your bot wallets or to any external wallet address.","source":"https://docs.maestrobots.com/sniper/wallet-setup.md"},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[{"date":"2023-10-24","title":"Maestro Router 2 contract exploit: attacker used users' token approvals to take tokens (about 280 ETH, about $485K); Maestro says user wallets were not compromised","amount":"~280 ETH (~$485K)","outcome":"refunded (610 ETH paid from Maestro revenue, announced 2023-10-25)","source":"https://cointelegraph.com/news/telegram-maestro-bot-610-ether-refund","kind":"exploit"}],"deadlines":[],"worst_case":"Maestro stores your bot wallet's private key (encrypted) on its servers and can sign with it. A server breach, a compromised Telegram account or a router bug (as in the 2023 exploit, which was refunded) could empty the wallet or any token you approved to its router.","safe_setup":["Generate a new bot wallet instead of importing your main wallet (Maestro's own advice), and fund it only with what you're actively trading","Write the private key and mnemonic down on paper as Maestro advises, and don't keep them in the clipboard or in your Telegram chat history","Start the bot only from t.me/Maestro as linked on maestrobots.com, and periodically revoke old router approvals (e.g. with revoke.cash)"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Banana Gun","slug":"banana-gun","kind":"telegram_bot","chains_or_assets":["Ethereum","Solana","BNB Chain","Base","MegaETH"],"listing_name":"Banana Gun","official":{"domains":["bananagun.io"],"telegram":["@BananaGun_bot","@BananaGunSniper_bot","@BananaGunSell_bot","@bananagunannouncements"],"x":["@BananaGun"],"github":[],"apps":[],"confirmed_via":["https://bananagun.io (links t.me/BananaGun_bot, t.me/bananagunannouncements, x.com/bananagun, pro.bananagun.io, docs.bananagun.io)","https://docs.bananagun.io/resources/official-links.md (lists bananagun.io, t.me/BananaGunSniper_bot, t.me/BananaGunSell_bot, t.me/bananagunannouncements, x.com/BananaGun)","https://www.coingecko.com/en/coins/banana-gun (third-party: bananagun.io, twitter.com/bananagun, t.me/BananaGunSniper_bot, t.me/BananaGunSell_bot)","https://programminginsider.com/banana-gun-unifies-five-chains-into-one-telegram-bot-backed-by-16b-in-execution-history/ (2026-03-05 article: t.me/BananaGun_bot as the unified bot)"],"notes":"@BananaGun_bot is the current unified multichain trading bot (since about March 2026); @BananaGunSniper_bot and @BananaGunSell_bot are the EVM sniper and sell bots listed in the docs. The web terminal is pro.bananagun.io (a subdomain of the confirmed domain). X-handle caveat: the docs' official-links pages show the text 'x.com/BananaGun', but one copy hyperlinks to x.com/BananaGunBot, and their 'SOL bot' entry wrongly points to twitter.com/BananaGunBot. The Block's 2024 coverage also cited @BananaGunBot. Only @BananaGun is confirmed as current, so check the handle before trusting DMs or links from either account."},"known_fakes":[],"custody":{"who_holds_keys":"service","note":"The bot generates the wallet and holds the key to trade. The private key is shown once at creation; Banana Gun's FAQ says it doesn't let you retrieve the key later ('You can't'), and a deleted wallet is unrecoverable if you didn't save the key.","source":"https://banana-gun.gitbook.io/banana-gun/trading/faqs.md"},"can_move_funds_out":{"value":true,"note":"You can send tokens to any outside address via 'Custom Wallet'. After the 2024 exploit the team said transfers now have a 2-hour delay and 2FA (per The Block, 2024-09-25).","source":"https://banana-gun.gitbook.io/banana-gun/trading/settings/wallet-settings.md ; https://www.theblock.co/post/318074/banana-gun-exploit-refund"},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[{"date":"2024-09-19","title":"Unauthorized transfers drained 11 users' bot wallets; Banana Gun blamed a vulnerability in the Telegram message oracle it uses and took the bots offline","amount":"~$3M (initial estimates ~$1.9M in ETH)","outcome":"full refund from the Banana Gun treasury promised 2024-09-25; we found no independent report confirming it was paid","source":"https://www.theblock.co/post/318074/banana-gun-exploit-refund","kind":"exploit"}],"deadlines":[],"worst_case":"Banana Gun holds your bot wallet's private key and you can't retrieve it after setup. A flaw in its systems (as in the 2024 Telegram message-oracle exploit that drained about $3M from 11 users) or a hijacked Telegram account can move everything in that wallet to someone else.","safe_setup":["Save the private key the moment the wallet is generated (it can't be retrieved later), and keep only trading money in it","Use only the bots listed on bananagun.io or docs.bananagun.io (e.g. @BananaGun_bot), and ignore 'support' DMs on Telegram","Turn on the bot's security PIN and transfer 2FA, plus Telegram 2-step verification, and move profits out to a wallet the bot never sees"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"BONKbot","slug":"bonkbot","kind":"telegram_bot","chains_or_assets":["Solana"],"listing_name":"BONKbot","official":{"domains":["bonkbot.io"],"telegram":["@bonkbot_bot"],"x":["@bonkbot_io"],"github":[],"apps":[],"confirmed_via":["https://bonkbot.io/blog/a-hardware-wallet-in-the-cloud-introducing-bonkbot-s-next-gen-key-management-system (links bonkbot.io, docs.bonkbot.io, x.com/bonkbot_io, t.me/bonkbot_bot)","https://docs.bonkbot.io/bonkbot/quick-setup-guide/initializing-bonkbot.md (bot link t.me/bonkbot_bot)","https://docs.bonkbot.io/bonkbot/safety-and-security/avoiding-scams.md (official bot link t.me/bonkbot_bot)","https://www.cryptopolitan.com/bonkbot-is-going-non-custodial-with-increased-security-measures/ (third-party: @bonkbot_io, bonkbot.io blog)"],"notes":"@bonkbot_bot is the main trading bot. The docs' 'Multiple Bots' page also lists alternates @monza_bonkbot, @sonic_bonkbot, @furiosa_bonkbot, @mcqueen_bonkbot and @neo_bonkbot (vendor docs only). BONKbot's docs warn that there are fake bots asking you to deposit SOL and that official admins never DM first."},"known_fakes":[],"custody":{"who_holds_keys":"service","note":"BONKbot calls itself non-custodial since its 2024 key-management system (KMS), but its own post says the Signer 'generates the user's private key and stores it encrypted' on BONKbot's backend (hardware security module (HSM)-backed), with signing authorized only through your Telegram. Private key export and SOL withdrawals can be gated behind 2FA or a passkey.","source":"https://bonkbot.io/blog/a-hardware-wallet-in-the-cloud-introducing-bonkbot-s-next-gen-key-management-system"},"can_move_funds_out":{"value":true,"note":"SOL withdrawals out of the bot are supported; with 2FA or a passkey enabled, withdrawals and private key export need the second factor.","source":"https://docs.bonkbot.io/bonkbot/features/wallet-security-2fa.md"},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[{"date":"2024-03-29","title":"Wallet-drainer wave hit 302 Solana wallets; 113 victims had used BONKbot. BONKbot denied it was the source and said all 113 had exported their keys to another app (Solareum suspected)","amount":"~2,808 SOL (~$523K) total across all victims","outcome":"BONKbot denied responsibility; no refunds reported","source":"https://decrypt.co/224127/solana-wallets-drained-523k-bonkbot-denies-link","kind":"user_reports"}],"deadlines":[],"worst_case":"BONKbot's backend generates and stores your trading wallet's key and signs when your Telegram tells it to. A hijacked Telegram account without 2FA, a leaked exported key, or a failure of BONKbot's key system could let someone drain the wallet.","safe_setup":["Turn on BONKbot's 2FA or passkey so that withdrawals and private-key export need a second factor even if your Telegram is hijacked","Only start @bonkbot_bot (or the alternates listed in docs.bonkbot.io); fake bots ask you to 'deposit SOL', and real admins never DM first","Don't paste your exported BONKbot key into other bots or apps (the 2024 drain victims had done exactly that), and keep only trading funds in the bot"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Bloom","slug":"bloom","kind":"telegram_bot","chains_or_assets":["Solana","Ethereum","BSC","Base","Robinhood Chain","Arc","HyperEVM","Ink"],"listing_name":null,"official":{"domains":["bloombot.app"],"telegram":["@BloomSolana_bot","@BloomEVMbot","@bloomportal"],"x":["@BloomTrading"],"github":[],"apps":[],"confirmed_via":["https://bloombot.app (links t.me/BloomSolana_bot, t.me/BloomEVMbot, t.me/bloomportal, x.com/bloomtrading, docs.bloombot.app, manager.bloombot.app)","https://docs.bloombot.app/solana/getting-started/useful-links.md (same bots, Lounge t.me/bloomportal, x.com/BloomTrading, www.bloombot.app)","https://www.alchemy.com/dapps/bloombot (third-party: www.bloombot.app)"],"notes":"@BloomSolana_bot is the Solana trading bot and @BloomEVMbot the EVM bot; @bloomportal is the community lounge. The docs also list @BloomSolanaUS1_bot as a Solana (US1) bot (docs only). The web app is manager.bloombot.app, and the site links a Chrome extension (vendor site only, not listed). X caveat: Alchemy's directory and one testimonial link point to @BloomTradingBot, while Bloom's own site and docs use @BloomTrading. Only @BloomTrading is confirmed."},"known_fakes":[],"custody":{"who_holds_keys":"service","note":"The bot creates the wallet and gives you its private key to save ('Make sure to copy and save the private key!'), and it keeps the key so it can trade for you. The docs don't describe how Bloom stores keys.","source":"https://docs.bloombot.app/solana/solana-bot/wallets.md"},"can_move_funds_out":{"value":true,"note":"Withdrawals go to an address you set. You can lock that address; unlocking starts a 24-hour cooldown before it can be changed.","source":"https://docs.bloombot.app/solana/solana-bot/withdraw.md"},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[],"deadlines":[],"worst_case":"Bloom holds the private keys of the wallets it creates. If Bloom, your Telegram account, the Chrome extension or a saved copy of the key is compromised, the wallet can be emptied. A locked withdraw address only helps if you set and locked it beforehand.","safe_setup":["Set a withdraw address to a wallet you control and lock it right away, so changing it needs the 24-hour cooldown","Get the bots only from bloombot.app or docs.bloombot.app (@BloomSolana_bot, @BloomEVMbot), and install the extension only from the link on bloombot.app","Keep only active trading funds in Bloom wallets, and store the private key offline, never in Telegram chats"],"last_checked":"2026-10-24","links_status":"verified","status":"Under review (Oct 26, 2026): wallets used with Bloom were drained (about 9,400 SOL, signed with the owners' own keys). Bloom says 49 wallets belonging to 9 users were affected and it will fully reimburse them; it is still investigating the cause, including a possible third-party compromise. If you imported a key into Bloom, move funds to a fresh wallet with a new seed."},{"name":"Sigma","slug":"sigma","kind":"telegram_bot","chains_or_assets":["Ethereum","Solana","BNB Smart Chain","Base","Avalanche","Unichain"],"listing_name":null,"official":{"domains":["sigma.win"],"telegram":["@SigmaBotPortal"],"x":["@SigmaTrading"],"github":[],"apps":[],"confirmed_via":["https://sigma.win (links x.com/SigmaTrading, t.me/SigmaBotPortal, app.sigma.win, docs.sigma.win)","https://www.alchemy.com/dapps/sigma-trading-bot (third-party: sigma.win, x.com/SigmaTrading)","https://dappradar.com/dapp/sigma-trading-bot (third-party: sigma.win, t.me/SigmaBotPortal)"],"notes":"@SigmaBotPortal is the support/community channel, not the trading bot. NOT double-confirmed: sigma.win links the trading bot as t.me/Sigma_buyBot, but we found no second independent source, and our fetch of docs.sigma.win was blocked. Open the bot only from the link on sigma.win. DappRadar lists twitter.com/SigmaTradingBot, which conflicts with @SigmaTrading on sigma.win and Alchemy. Quicknode's listing also names Arbitrum, Blast and TON as supported chains (not on sigma.win)."},"known_fakes":[],"custody":{"who_holds_keys":"service","note":"Wallets are generated or imported inside the bot, which holds the keys to sign trades. Sigma's own docs couldn't be checked (fetch blocked), so the storage and export details are unconfirmed.","source":"https://www.cryptopolitan.com/crypto-trader-loses-200k-telegram-bot/"},"can_move_funds_out":{"value":null,"note":"Not confirmed from vendor documentation (docs.sigma.win could not be fetched).","source":null},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[{"date":"2026-05-11","title":"Trader 'Unihax0r' reported two wallets generated or imported through Sigma drained across Ethereum, Base and BSC; on-chain analysts said it looked like a private key compromise, but the cause (bot leak versus phishing or malware on the user's device) was not confirmed","amount":">$200K","outcome":"no vendor response or refund reported","source":"https://www.cryptotimes.io/2026/05/11/crypto-trader-drained-of-200k-in-telegram-bot-linked-crypto-hack/","kind":"user_reports"}],"deadlines":[],"worst_case":"Sigma holds the keys of the wallets it generates or that you import. If those keys leak, whether from the bot, your device or a phishing bot, everything in them can be drained, as a trader reported losing over $200K in May 2026 with no refund.","safe_setup":["Never import your main wallet; create a separate bot wallet and fund it only with what you're actively trading","Reach the bot only through the link on sigma.win and support only via t.me/SigmaBotPortal, and ignore 'verification' or CAPTCHA bots that DM you","Turn on Telegram 2-step verification and keep the device you use for Telegram free of unknown extensions and cracked software"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"GMGN","slug":"gmgn","kind":"web_trading_terminal","chains_or_assets":["Solana","BNB Chain","Ethereum","Base","Tron","Monad"],"listing_name":null,"official":{"domains":["gmgn.ai"],"telegram":[],"x":["@gmgnai"],"github":[],"apps":[],"confirmed_via":["https://www.quicknode.com/builders-guide/tools/gmgn-ai-by-gmgn-ai-team (third-party: gmgn.ai, x.com/gmgnai)","https://solanacompass.com/projects/GMGN (third-party: gmgn.ai, twitter.com/gmgnai)","x.com/gmgnai bio links gmgn.ai (checked 2026-10-24)"],"notes":"Both confirmations are third-party directories; gmgn.ai and docs.gmgn.ai could not be fetched (blocked), so nothing here comes from the vendor directly. GMGN also runs per-chain Telegram bots (login via Telegram), but we couldn't confirm their usernames from two independent sources, so none are listed. Co-founder Haze posts as x.com/haze0x (per blockchain.news, not double-confirmed). Datawallet also lists MegaETH, X Layer, Arbitrum, HyperEVM and Robinhood Chain as supported chains."},"known_fakes":[],"custody":{"who_holds_keys":"service","note":"Logging in with Telegram generates Solana, EVM and Tron addresses that GMGN controls. Per GMGN's docs as summarized by Datawallet, the private keys of these generated wallets can't be exported on any chain. To hold your own keys, connect an external wallet such as Phantom instead.","source":"https://www.datawallet.com/crypto/gmgn-explained"},"can_move_funds_out":{"value":true,"note":"Withdrawals only via the website, and they need Google Authenticator plus a whitelisted address. Changing the whitelist triggers a 3-hour withdrawal lock.","source":"https://www.datawallet.com/crypto/gmgn-explained"},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[{"date":"2026-10-25","title":"Reported by a user (unconfirmed): a trader said a 'fellow trader' he met online got him on a Discord call while he shared his screen and had him open a link for 'alpha on a new coin'; his Gmail was then taken over and his GMGN holdings were sold and sent out. How the attacker got in was not established, and GMGN's own systems were not implicated","amount":"~$15K (his figure)","outcome":"No vendor response or refund reported","source":"https://x.com/Bizonaci/status/2114220222794420556","kind":"user_reports"},{"date":"2025-10-27","title":"Phishing: fake third-party token sites tricked about 107 GMGN users into signing unauthorized transactions; GMGN said its own systems were not breached","amount":">$700K (GoPlus tally, per Datawallet)","outcome":"GMGN said it would cover 100% of losses, credited to users' GMGN accounts","source":"https://blockchain.news/flashnews/gmgn-confirms-external-phishing-attack","kind":"hack"},{"date":"2025-10-27","title":"Reported date: co-founder Haze said an MEV attack about 48 hours earlier had affected 729 GMGN user transactions","amount":null,"outcome":"co-founder Haze said compensation had been sent to affected wallets","source":"https://www.mexc.com/news/143296","kind":"exploit"}],"deadlines":[],"worst_case":"GMGN's generated wallets are controlled by GMGN and their keys can't be exported, so your funds depend on GMGN's systems and your login. A stolen session, a phishing signature, or a GMGN failure or lock could cost you the whole balance.","safe_setup":["Type gmgn.ai yourself or use a bookmark; never follow 'GMGN' links from token sites, ads or DMs","Turn on Google Authenticator and whitelist a withdrawal address you control before you deposit","Keep only trading funds in GMGN-generated wallets, since their keys can't be exported; for larger amounts connect your own wallet"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Photon","slug":"photon","kind":"web_trading_terminal","chains_or_assets":["Solana"],"listing_name":null,"official":{"domains":["photon-sol.tinyastro.io"],"telegram":["@photonlounge"],"x":["@tradewithPhoton"],"github":[],"apps":[],"confirmed_via":["https://www.bittime.com/en/blog/photon-crypto-trading-platform (third-party: official site photon-sol.tinyastro.io, developed by TinyAstro)","https://www.pcrisk.com/removal-guides/34489-fake-photon-website-scam (security vendor: legitimate site on tinyastro.io, given as photon.tinyastro.io)","https://www.bitrue.com/blog/what-is-photon-sol-a-trading-platform-on-the-solana-network (third-party: developed by TinyAstro)","photon-sol.tinyastro.io links twitter.com/tradewithPhoton and t.me/photonlounge; x.com/tradewithPhoton bio links photon-sol.tinyastro.io (checked 2026-10-24)","see above"],"notes":"Only the registered domain tinyastro.io is double-confirmed. The Solana app is commonly reached at photon-sol.tinyastro.io (Bittime), but PCrisk gives photon.tinyastro.io, so the exact subdomain is NOT double-confirmed. The vendor site couldn't be fetched (blocked). X @tradewithPhoton and website photoncrypto.io appear only in Quicknode's listing and are NOT confirmed. Quicknode's listing also mentions a GitHub 'photonle' entry that looks unrelated, so it's not listed. Photon has no Telegram trading bot. Quicknode also lists Ethereum, Base and BNB Chain as supported, but we found no vendor confirmation."},"known_fakes":[{"value":"speedtrade.icu","kind":"domain","source":"https://www.pcrisk.com/removal-guides/34489-fake-photon-website-scam","date":"2025-12-15"}],"custody":{"who_holds_keys":"service","note":"You connect a wallet such as Phantom, then Photon generates a separate trading wallet that it uses to sign your trades. The private key is shown only once at creation. Sources are third-party (Bittime, Quicknode), because Photon's own site couldn't be fetched.","source":"https://www.bittime.com/en/blog/photon-crypto-trading-platform"},"can_move_funds_out":{"value":null,"note":"Withdrawal behaviour not confirmed from a vendor or reliable source.","source":null},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[],"deadlines":[],"worst_case":"Photon's generated trading wallet is signed for by Photon's systems, and the key is shown only once. A Photon compromise, a hijacked login, or a lookalike site (several are documented) could take the whole wallet balance, and the connected Phantom wallet too if you sign a fake site's request.","safe_setup":["Bookmark photon-sol.tinyastro.io and use only that; lookalike Photon sites such as speedtrade.icu have been flagged as phishing","Save the trading wallet's private key offline when it's shown (it's displayed once), and keep only trading funds in it","Connect a burner Phantom wallet rather than your main wallet, and reject any signature request that isn't a login or a trade you started"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"BullX Neo","slug":"bullx-neo","kind":"web_trading_terminal","chains_or_assets":["Solana","Tron"],"listing_name":null,"official":{"domains":["bullx.io"],"telegram":[],"x":[],"github":[],"apps":[],"confirmed_via":["https://www.solanatracker.io/blog/bullx-shutdown (third-party: points users to bullx.io)","https://coincodecap.com/bullx-bot-telegram-trading-bot-and-web-app (third-party: web terminal at neo.bullx.io)"],"notes":"The web terminal is neo.bullx.io (a subdomain of bullx.io). Its site couldn't be fetched (blocked), so nothing here comes from the vendor directly. Telegram bot @BullxNeoBot appears only in CoinCodeCap's affiliate review and is NOT confirmed. We found no confirmed X handle. BullX Turbo (EVM: Ethereum, BNB Chain, Base, Arbitrum, Blast) is a separate product. Trading has been suspended since 2026-06-01; per Phemex, wallet functions and withdrawals were said to remain available, but Solana Tracker couldn't re-verify the notice."},"known_fakes":[],"custody":{"who_holds_keys":null,"note":"Not confirmed from vendor documentation. CoinCodeCap (affiliate review) describes BullX as non-custodial, with keys to be backed up within 24 hours of account creation.","source":"https://coincodecap.com/bullx-bot-telegram-trading-bot-and-web-app"},"can_move_funds_out":{"value":true,"note":"Per the June 2026 announcement as reported by Phemex, withdrawals and wallet management stay operational while trading is suspended.","source":"https://phemex.com/news/article/bullx-suspends-trading-functionality-to-focus-on-future-development-87410"},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[{"date":"2026-06-01","title":"BullX suspended trading in the current app to focus on a successor product; wallet and withdrawal functions were said to stay up","amount":null,"outcome":"trading paused, no relaunch date; withdrawals reported available","source":"https://phemex.com/news/article/bullx-suspends-trading-functionality-to-focus-on-future-development-87410","kind":"outage"}],"deadlines":[],"worst_case":"BullX has stopped trading and its custody model isn't documented in sources we could verify. Funds left in a BullX wallet depend on the withdrawal function staying up, and fake 'BullX' sites (e.g. neo-bulix.org) are targeting users looking for it.","safe_setup":["Don't deposit new funds: trading has been suspended since June 2026","If you still have funds there, withdraw them through the real neo.bullx.io (typed or bookmarked) to a wallet you control","Ignore 'migration', 'airdrop' or 'BullX relaunch' links from DMs, ads or search results; lookalike domains have been flagged as phishing"],"last_checked":"2026-10-24","links_status":"third_party","status":"Trading reported suspended since 2026-06-01; check the vendor before using it"},{"name":"Axiom","slug":"axiom","kind":"web_trading_terminal","chains_or_assets":["Solana","Hyperliquid (perps)"],"listing_name":null,"official":{"domains":["axiom.trade"],"telegram":[],"x":["@AxiomExchange"],"github":[],"apps":[],"confirmed_via":["https://turnkey.com/customers/axiom-global-defi-trading-platform (Turnkey case study links axiom.trade)","https://www.coingecko.com/learn/what-is-axiom-exchange (gives axiom.trade as the legitimate platform)","https://theblock.co/post/355676/axiom-exchange-hits-100-million-in-revenue-just-four-months-after-launch (cites docs.axiom.trade)","axiom.trade links x.com/axiomexchange; both link discord.gg/axiomtrade (checked 2026-10-24)"],"notes":"X handle NOT double-confirmed: Decrypt (2026-02-26) cites @AxiomExchange, but no second independent source was found and docs.axiom.trade couldn't be fetched (blocked). No official mobile app was confirmed, and a counterfeit 'Axiom' mobile app has been reported (see incidents). CoinCodeCap says Base support is in beta."},"known_fakes":[],"custody":{"who_holds_keys":null,"note":"Axiom wallets run on Turnkey's third-party key infrastructure, and Axiom presents itself as non-custodial. Ryder (a hardware-wallet seller) says the recovery phrase is exportable from settings. We couldn't confirm the exact custody split from Axiom's own docs.","source":"https://turnkey.com/customers/axiom-global-defi-trading-platform ; https://ryder.id/blogs/post/is-axiom-trade-safe-what-the-wallet-holds-and-what-the-platform-knows"},"can_move_funds_out":{"value":null,"note":"Not confirmed from vendor documentation (docs.axiom.trade could not be fetched).","source":null},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[{"date":"2026-05-30","title":"Counterfeit 'Axiom' mobile app reportedly drained more than 207 Solana traders over five months (impersonation, not a breach of Axiom)","amount":">$147K","outcome":"not refunded (scam app)","source":"https://coinmarketcap.com/community/articles/6a1b373ce5b1b711030c8a9c","kind":"user_reports"},{"date":"2026-02-26","title":"ZachXBT investigation alleged an Axiom employee abused internal support tools to look up users' private wallet activity and identities (since early 2025) for insider trading; Axiom said it removed tool access and is investigating","amount":null,"outcome":"no user fund loss from Axiom's systems reported; Axiom removed employee access","source":"https://decrypt.co/359223/y-combinator-backed-axiom-employees-accused-insider-trading-zachxbt","kind":"third_party"}],"deadlines":[],"worst_case":"Your Axiom wallet is tied to Turnkey-hosted keys and your Axiom login. A phished login, a fake Axiom app or site, or a malicious 'verification' page can drain it. Axiom staff have also been accused of looking up which wallets belong to whom.","safe_setup":["Type axiom.trade yourself or use a bookmark; don't install 'Axiom' mobile apps or follow DM or ad links (a fake Axiom app reportedly drained 200+ users)","Export and store the wallet's recovery phrase offline, and keep only trading funds in the Axiom wallet","Never run commands or paste scripts from 'Cloudflare check' or verification pages, and assume Axiom can link your wallets to your account"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Padre","slug":"padre","kind":"web_trading_terminal","chains_or_assets":["Solana","Ethereum","BNB Chain","Base"],"listing_name":null,"official":{"domains":["padre.gg"],"telegram":[],"x":["@TradingTerminal"],"github":[],"apps":[],"confirmed_via":["https://coinmarketcap.com/currencies/padre/ (third-party: padre.gg, docs.padre.gg)","https://www.publish0x.com/solana-trading-bots/is-padre-gg-legit-what-traders-should-know-before-using-it-xwrwxlw (third-party: trade.padre.gg)","padre.gg links twitter.com/TradingTerminal; that profile links discord.gg/padreapp, which padre.gg also links (checked 2026-10-24)"],"notes":"The trading app is trade.padre.gg (a subdomain of padre.gg). X @PadreApp appears only on CoinMarketCap and is NOT double-confirmed. Pump.fun acquired Padre on 2025-10-24 (Cointelegraph), and PADRE token holders could claim PUMP until 2025-12-30 (CoinMarketCap; now past). The vendor site couldn't be fetched directly."},"known_fakes":[],"custody":{"who_holds_keys":null,"note":"Not confirmed from vendor docs. A promotional Publish0x post summarizing Padre's documentation says the wallets are non-custodial on Turnkey infrastructure, with keys encrypted locally under a user-set password and no admin access.","source":"https://www.publish0x.com/solana-trading-bots/is-padre-gg-legit-what-traders-should-know-before-using-it-xwrwxlw"},"can_move_funds_out":{"value":null,"note":"Not confirmed from vendor documentation.","source":null},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[],"deadlines":[],"worst_case":"Padre's trading wallets are hot wallets controlled through your Padre login and password. A stolen login or password, a lookalike site, or a failure at Padre or its key provider could empty the trading wallet.","safe_setup":["Use trade.padre.gg from a bookmark, never from DMs, ads or search results","Set a strong unique wallet password, back up the key offline, and keep only trading funds in Padre wallets","Since Pump.fun now owns Padre, check announcements before acting on any 'migration' or 'token claim' request; the PADRE-to-PUMP claim closed 2025-12-30"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Unibot","slug":"unibot","kind":"telegram_bot","chains_or_assets":["Ethereum","Solana","Arbitrum","Base"],"listing_name":null,"official":{"domains":["unibot.app"],"telegram":["@unibotsniper_bot","@unibotportal"],"x":["@TeamUnibot"],"github":[],"apps":[],"confirmed_via":["https://www.coingecko.com/en/coins/unibot (third-party: unibot.app, twitter.com/TeamUnibot, t.me/unibotportal)","https://www.quicknode.com/builders-guide/tools/unibot-by-unibot-team (third-party: unibot.app, x.com/TeamUnibot)","https://www.theblock.co/news/regulation/2023-10-31-unibot-confirms-exploit-and-promises-compensation-as-token-price-plunges-260133 (cites @TeamUnibot posts)","unibot.app links t.me/unibotsniper_bot, t.me/unibotportal and twitter.com/TeamUnibot (checked 2026-10-24)"],"notes":"The trading bot @unibotsniper_bot appears only on CoinGecko and is NOT double-confirmed; unibot.app couldn't be fetched (blocked). In March 2024 the Ethereum team (@TeamUnibot) split from the 'Unibot on Solana' group led by @Reethmos (DL News, 2024-03-11), so Solana-side Unibot branding may not belong to @TeamUnibot. We couldn't verify whether Unibot is still actively maintained in 2026."},"known_fakes":[],"custody":{"who_holds_keys":"service","note":"The bot generates the wallet and holds the key. Since 'Unibot Cloud' (Aug 2023) keys are kept off Telegram and delivered to you as a self-destructing message; where and how they're stored isn't disclosed.","source":"https://www.dlnews.com/articles/defi/unibot-telegram-bot-unveils-cloud-service-for-private-keys/"},"can_move_funds_out":{"value":null,"note":"Not confirmed from vendor documentation.","source":null},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[{"date":"2023-10-31","title":"New Unibot router passed on arbitrary calls, letting an attacker take tokens from wallets that had approved it","amount":">$640K (PeckShield's first alert: ~$580K)","outcome":"refunded from Unibot funds (mostly token buybacks); Unibot also revoked risky approvals for users (total cost ~$1.78M per Revoke.cash). Old approvals to that router remain risky","source":"https://revoke.cash/exploits/unibot","kind":"exploit"}],"deadlines":[],"worst_case":"Unibot holds your bot wallet's key, and its old router remains exploitable for any token approvals still active. A compromise of Unibot, your Telegram account or a lingering approval can drain the wallet.","safe_setup":["Check revoke.cash for approvals to Unibot's exploited 2023 router and revoke them","Confirm the bot link against @TeamUnibot's own posts before starting it, since the project split into Ethereum and Solana teams in 2024","Use a fresh bot wallet with only trading funds, and move profits to a wallet the bot never touches"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Binance","slug":"binance","kind":"exchange","chains_or_assets":["Multi-asset centralized exchange (spot, futures, margin)"],"listing_name":"Binance","official":{"domains":["binance.com"],"telegram":[],"x":["@binance"],"github":[],"apps":[],"confirmed_via":["https://www.coingecko.com/en/exchanges/binance (website binance.com, twitter.com/binance)","https://www.binance.com/en/support/faq/how-to-create-api-keys-on-binance-360002502072 (site footer links twitter.com/binance)"],"notes":"Binance lists Telegram communities only via binance.com/en/community, not a single handle, so none listed here. App downloads: use binance.com/en/download (store listing IDs not independently confirmed)."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Custodial exchange: deposits sit in Binance-controlled wallets; you hold an account balance, not keys.","source":"https://www.binance.com/en/terms"},"can_move_funds_out":{"value":true,"note":"Crypto withdrawals to external addresses are available, subject to Binance's account and compliance controls.","source":"https://www.binance.com/en/terms"},"freeze_policy":null,"api_keys":{"note":"System-generated (HMAC) keys with unrestricted IP access can only have 'Enable Reading' (since 2023-01-30). Adding an IPv4 access restriction is mandatory to enable withdrawal permission. Binance strongly recommends against enabling non-read permissions without IP restriction; self-generated Ed25519/RSA keys are offered as an alternative. Expiry rules are not stated on this FAQ page.","source":"https://www.binance.com/en/support/faq/how-to-create-api-keys-on-binance-360002502072"},"privacy_coins":{"xmr":"delisted from spot 2024-02-20 (no XMR deposits/withdrawals); XMR perpetual futures still offered as of Oct 2026 per third-party survey (https://en.coin-turk.com/where-to-buy-monero-2026-exchanges-that-still-list-xmr/)","zec":"trade+deposit+withdraw (spot listed); Binance removed ZEC's 'monitoring tag' on 2025-07-09 (https://u.today/binance-u-turn-popular-crypto-asset-saved-from-delisting-risk; Binance notice https://www.binance.com/en/support/announcement/detail/c2536e8b6ed44c7ba4f62c249dbde9bb)","shielded_zec_withdrawals":null,"regions":null,"source":"https://www.theblock.co/post/276176/binance-delisting-monero"},"incidents":[{"date":"2025-10-10","title":"USDe, BNSOL and wBETH briefly depegged on Binance during the 10 Oct market crash, triggering liquidations of users using them as collateral","amount":"~$283M reimbursed","outcome":"refunded (Binance compensated affected Margin/Futures/Loan users within ~24h)","source":"https://decrypt.co/344026/binance-reimburses-283m-after-market-crash-and-asset-depegging-issues","kind":"outage"},{"date":"2024-02-20","title":"Monero (XMR) delisted from Binance spot after a 'monitoring tag' review","amount":null,"outcome":"XMR spot trading and deposits ended; users had to withdraw","source":"https://www.theblock.co/post/276176/binance-delisting-monero","kind":"delisting"}],"deadlines":[{"date":"2027-07-10","what":"EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use an EU/EEA-licensed entity of this service.","source":"https://didit.me/blog/privacy-coins-no-kyc-swaps-rules-2026/"}],"worst_case":"Binance holds your coins: it can freeze or close your account under its own compliance rules, and a leaked API key that has withdrawals enabled can drain the account from any IP you whitelisted.","safe_setup":["Give bots read-only or trade-only API keys; never tick 'Enable Withdrawals' on a key you paste into a third-party tool","If a key must trade, restrict it to your server's static IPv4 address so it is useless if leaked","Enable an address whitelist and 2FA on the account, and keep long-term holdings in your own wallet"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Bybit","slug":"bybit","kind":"exchange","chains_or_assets":["Multi-asset centralized exchange (derivatives, spot)"],"listing_name":"Bybit","official":{"domains":["bybit.com"],"telegram":[],"x":[],"github":[],"apps":[],"confirmed_via":["https://www.coingecko.com/en/exchanges/bybit_spot (About text: Bybit.com)","https://en.wikipedia.org/wiki/Bybit (infobox website bybit.com)"],"notes":"X handle @Bybit_Official is listed by CoinGecko but was not confirmed from a second independent source here, so it is left out. EU users are served by a MiCA-authorised entity (Austria FMA, May 2025, per Wikipedia). Official API docs are at bybit-exchange.github.io (single source here)."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Custodial exchange; customer assets are held in Bybit-controlled wallets (the 2025 hack drained a Bybit cold wallet).","source":"https://en.wikipedia.org/wiki/Bybit"},"can_move_funds_out":{"value":true,"note":"Withdrawals to external addresses; API withdrawals only by the master account's key and only to addresses already in the address book.","source":"https://bybit-exchange.github.io/docs/v5/asset/withdraw"},"freeze_policy":{"note":"News reports (Sep 2026) say Bybit published a 'Restricted Counterparty List' of 50+ platforms/entities (e.g. Garantex, Grinex, mixers, darknet markets, Lazarus Group); direct or indirect exposure can lead Bybit to freeze or terminate accounts, restrict balances and liquidate positions. Bybit's own Terms page could not be retrieved for this check.","source":"https://cryptoticker.io/en/bybit-counterparty-list-account-freeze/"},"api_keys":{"note":"Bybit's API docs state API keys with no IP bound become invalid after 90 days, and keys without IP binding become invalid 7 days after the account password is changed. Withdrawal via API requires the master UID's key and the destination must already be in the address book ('whitelisted'). Whether new keys default to read-only, and whether withdrawal permission requires an IP binding, was not confirmed.","source":"https://bybit-exchange.github.io/docs/v5/user/create-subuid-apikey"},"privacy_coins":{"xmr":"no spot market; XMR perpetual futures only (per third-party survey checked 2026-10-20)","zec":null,"shielded_zec_withdrawals":null,"regions":null,"source":"https://en.coin-turk.com/where-to-buy-monero-2026-exchanges-that-still-list-xmr/"},"incidents":[{"date":"2025-02-21","title":"Bybit hacked: ~400,000 ETH stolen from a multisig cold wallet via compromised Safe{Wallet} infrastructure; FBI attributed it to North Korea (TraderTraitor/Lazarus)","amount":"~$1.4-1.5B","outcome":"Bybit replenished reserves within ~72h via emergency funding; customers were not asked to absorb the loss","source":"https://en.wikipedia.org/wiki/Bybit","kind":"hack"}],"deadlines":[{"date":"2027-07-10","what":"EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use an EU/EEA-licensed entity of this service.","source":"https://didit.me/blog/privacy-coins-no-kyc-swaps-rules-2026/"}],"worst_case":"Bybit holds your coins: it can freeze your account if your funds are linked (even indirectly) to a listed counterparty, and an exchange-wide hack like Feb 2025 depends on Bybit's own reserves to make users whole.","safe_setup":["Bind every API key to your bot's static IP (unbound keys expire after 90 days anyway) and leave withdrawal permission off","Keep the withdrawal address book limited to your own wallets, since API withdrawals can only go to saved addresses","Avoid depositing coins that recently passed through sanctioned exchanges or mixers, as Bybit says such exposure can trigger a freeze"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"OKX","slug":"okx","kind":"exchange","chains_or_assets":["Multi-asset centralized exchange (spot, derivatives)"],"listing_name":"OKX","official":{"domains":["okx.com"],"telegram":[],"x":["@okx"],"github":[],"apps":[],"confirmed_via":["https://www.coingecko.com/en/exchanges/okex (website okx.com, twitter.com/OKX)","https://www.okx.com/help/how-to-query-unique-accounts (okx.com page metadata names @okx; OKX offers an official channel-verification tool at okx.com/en-us/support-center/channel-verification)"],"notes":"OKX recommends checking any handle, group, website or phone number with its channel-verification tool before trusting it."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Custodial exchange account (the OKX Wallet is a separate self-custody product).","source":"https://www.okx.com/help/terms-of-service"},"can_move_funds_out":{"value":true,"note":"Withdrawals available; OKX may suspend withdrawals to resolve platform incidents (ToS §4.1).","source":"https://www.okx.com/help/terms-of-service"},"freeze_policy":{"note":"OKX ToS: may 'freeze/lock any Assets in your Account' on suspected violations, unauthorized access or unreconciled balances (§7.6); may 'block transactions or freeze your funds immediately without notice' for suspected prohibited activity (§3.2); may suspend, freeze or seize accounts under investigation, subpoena or levy (§7.7); may restrict services and later suspend/terminate if requested information isn't provided in a timely manner (§4.16); may freeze/transfer assets under authority orders (§8.2(e)); may terminate 'at any time and for any reason' (§7.8). After termination you get 30 days to supply a withdrawal address before assets may be liquidated (§7.9). No fixed review duration is stated.","source":"https://www.okx.com/help/terms-of-service"},"api_keys":{"note":"Permissions are Read, Trade and Withdraw. Keys not bound to an IP that have trade or withdrawal permission are automatically deleted after 14 days of inactivity; up to 20 IPs per key. API withdrawals only go to addresses added on the withdrawal page. Default permissions for new keys are not stated.","source":"https://www.okx.com/help/api-faq"},"privacy_coins":{"xmr":"delisted (spot pairs removed 2024-01-05; no XMR-USDT spot or XMR-USDT-SWAP instrument in OKX's public API on 2026-10-24)","zec":"delisted 2024-01-05, relisted for spot (ZEC/USDT) on 2025-11-24; ZEC-USDT state 'live' in OKX public API on 2026-10-24 (https://www.okx.com/api/v5/public/instruments?instType=SPOT&instId=ZEC-USDT)","shielded_zec_withdrawals":null,"regions":"Availability on OKX's EEA entity not checked","source":"https://crypto.news/zcash-price-resistance-zone-okx-relisting-2025/"},"incidents":[{"date":"2025-03-17","title":"OKX suspended its Web3 DEX aggregator after misuse by Lazarus Group to launder Bybit-hack proceeds","amount":null,"outcome":"Service paused; not a loss of OKX customer balances","source":"https://www.theblock.co/post/346538/okx-suspends-dex-aggregator-following-lazarus-misuse-and-heightened-eu-scrutiny","kind":"outage"},{"date":"2024-01-05","title":"OKX delisted XMR, ZEC and DASH spot pairs (announced 2023-12-29); withdrawals for these tokens suspended from 2024-03-05","amount":null,"outcome":"Users had to withdraw before the suspension; ZEC later relisted 2025-11-24","source":"https://www.theblock.co/amp/post/269613/okx-privacy-coins-delisting","kind":"delisting"}],"deadlines":[{"date":"2027-07-10","what":"EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use an EU/EEA-licensed entity of this service.","source":"https://didit.me/blog/privacy-coins-no-kyc-swaps-rules-2026/"}],"worst_case":"OKX holds your coins and its terms let it freeze, block or seize them without notice during a review or legal order; a leaked trade/withdraw key not bound to an IP stays usable until 14 days of inactivity.","safe_setup":["Create bot keys with Read+Trade only and bind them to your server IP; never grant Withdraw to third-party tools","Keep the withdrawal allowlist to your own addresses, since API withdrawals can only go to saved addresses","Verify any OKX 'support' account or site with OKX's channel-verification tool before sharing anything"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Kraken","slug":"kraken","kind":"exchange","chains_or_assets":["Multi-asset centralized exchange (spot, margin, futures)"],"listing_name":"Kraken","official":{"domains":["kraken.com"],"telegram":[],"x":["@krakenfx","@krakensupport"],"github":[],"apps":[],"confirmed_via":["https://support.kraken.com/articles/201351886-how-to-follow-kraken-on-social-media (lists @krakenfx and support handle @krakensupport)","https://www.coingecko.com/en/exchanges/kraken (twitter.com/krakenfx)","https://docs.kraken.com/exchange/guides/rest/api-keys (official docs on kraken.com)"],"notes":"Kraken's social page also lists Telegram support @krakensupport and channel @kraken_announcements; not independently confirmed elsewhere, so not listed in the telegram field. Support never needs your password, 2FA or API secret."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Custodial exchange account.","source":"https://support.kraken.com/articles/360000380966-why-is-my-deposit-or-withdrawal-on-hold-"},"can_move_funds_out":{"value":true,"note":"Withdrawals available; some are held temporarily (see the hold rules below).","source":"https://support.kraken.com/articles/360000380966-why-is-my-deposit-or-withdrawal-on-hold-"},"freeze_policy":{"note":"Kraken's help center lists hold reasons: a 72-hour withdrawal hold after ACH/PayPal/card/digital-wallet purchases, up to 7 days for ACH (Plaid) deposits, up to 24 hours on withdrawals to new addresses after a password change, holds requested by your bank for 'irregular activities', name mismatches, and over-limit deposits. Some holds release automatically, others need manual review by support. Kraken's full Terms could not be retrieved for this check.","source":"https://support.kraken.com/articles/360000380966-why-is-my-deposit-or-withdrawal-on-hold-"},"api_keys":{"note":"Each permission is chosen per key, including 'Withdraw Funds' and a separate 'Add Withdrawal Addresses' permission. Kraken says a third-party trading key would almost never need Withdraw Funds, and warns a key with both permissions could add an attacker's address and withdraw with no further verification. Optional IP whitelisting and Key Expiration (e.g. a key valid for one week) are available; neither is described as mandatory.","source":"https://support.kraken.com/articles/withdrawal-addresses-api-permission"},"privacy_coins":{"xmr":"trade+deposit+withdraw where available (XMR/USD pair status 'online' in Kraken public API on 2026-10-24); delisted for EEA clients (trading/deposits halted 2024-10-31, balances left after 2024-12-31 converted to BTC) and Canada (trading disabled 2025-09-02); not offered to UK clients since 2021 (third-party: https://en.coin-turk.com/where-to-buy-monero-2026-exchanges-that-still-list-xmr/)","zec":"trade+deposit+withdraw (ZEC/USD pair status 'online' in Kraken public API on 2026-10-24)","shielded_zec_withdrawals":null,"regions":"XMR not available to EEA, Canadian or UK clients","source":"https://support.kraken.com/articles/support-for-monero-xmr-in-europe"},"incidents":[{"date":"2025-09-02","title":"XMR trading disabled for Canadian clients; accounts moved to withdraw-only for XMR","amount":null,"outcome":"clients told to withdraw or convert","source":"https://support.kraken.com/articles/notice-of-delisting-xmr-canada","kind":"delisting"},{"date":"2025-08-17","title":"Kraken paused XMR deposits after Qubic mining pool claimed >50% of Monero hashrate (withdrawals and trading stayed open); date is Cointelegraph's report date","amount":null,"outcome":"temporary deposit pause 'until safe'","source":"https://cointelegraph.com/news/kraken-pause-monero-deposits-after-51-attack","kind":"outage"},{"date":"2024-10-31","title":"XMR delisted for EEA clients; XMR still held after 2024-12-31 was force-converted to BTC (distributed by 2025-01-06)","amount":null,"outcome":"forced conversion to BTC at market rate","source":"https://support.kraken.com/articles/support-for-monero-xmr-in-europe","kind":"delisting"},{"date":"2024-06-19","title":"Researchers (CertiK) exploited a Kraken balance bug to withdraw nearly $3M","amount":"~$3M","outcome":"funds returned to Kraken; Kraken said client assets were not at risk","source":"https://www.theblock.co/post/300888/kraken-discloses-bug-exploited-for-nearly-3-million","kind":"exploit"}],"deadlines":[{"date":"2027-07-10","what":"EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use an EU/EEA-licensed entity of this service.","source":"https://didit.me/blog/privacy-coins-no-kyc-swaps-rules-2026/"}],"worst_case":"Kraken holds your coins; regional rules have already forced it to delist XMR and auto-convert leftover balances to BTC, and a leaked key with both Withdraw and Add-Address permissions can send funds to an attacker.","safe_setup":["Give bots keys with only query and order permissions; never combine 'Withdraw Funds' with 'Add Withdrawal Addresses'","Set IP whitelisting and a key expiration date on every API key","If you hold XMR on Kraken, check your region's availability notice and withdraw well before any deadline to avoid forced conversion"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Coinbase Advanced","slug":"coinbase-advanced","kind":"exchange","chains_or_assets":["Multi-asset centralized exchange (Coinbase's advanced trading interface)"],"listing_name":"Coinbase Advanced","official":{"domains":["coinbase.com"],"telegram":[],"x":[],"github":[],"apps":[],"confirmed_via":["https://www.coinbase.com/legal/user_agreement/united_states (Coinbase User Agreement)","https://docs.cdp.coinbase.com/coinbase-app/advanced-trade-apis/rest-scopes.md (official API docs; keys created at portal.cdp.coinbase.com)","https://www.sec.gov/Archives/edgar/data/1679788/000167978825000094/coin-20250514.htm (Coinbase Global 8-K)"],"notes":"API keys are created in the Coinbase Developer Platform (portal.cdp.coinbase.com). No X handle confirmed from two sources here (CoinGecko lists the legacy @CoinbasePro). Search results show many look-alike 'Coinbase Pro Login' pages hosted on sites.google.com; only sign in via coinbase.com."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Custodial; Coinbase says it will not use customer funds for operating expenses (User Agreement §2.8).","source":"https://www.coinbase.com/legal/user_agreement/united_states"},"can_move_funds_out":{"value":true,"note":"Sends/withdrawals available; Coinbase may suspend sending of digital assets (§1.2) and may impose waiting periods after transactions (§4.4).","source":"https://www.coinbase.com/legal/user_agreement/united_states"},"freeze_policy":{"note":"US User Agreement: Coinbase may 'suspend, restrict, or terminate your access' with immediate effect 'for any reason at its sole discretion' and need not explain (§6.10); may cancel or reverse transactions if it suspects financial crime (§3.8); may require additional information and Enhanced Due Diligence (§1.3, Appendix 1); may require you to wait after a transaction (§4.4). After deactivation you have 90 days to transfer funds unless legally prohibited (§6.10). No fixed review duration is stated.","source":"https://www.coinbase.com/legal/user_agreement/united_states"},"api_keys":{"note":"CDP API keys carry view, trade and/or transfer permissions. Coinbase warns that if a key can transfer, whoever holds it 'will be able to send all the digital currency out of your account'. IP allowlist is 'recommended but not required'. ECDSA signature algorithm is required for Coinbase App/Advanced APIs. Key expiry is not stated.","source":"https://docs.cdp.coinbase.com/coinbase-app/authentication-authorization/api-key-authentication"},"privacy_coins":{"xmr":"not listed","zec":"trade+deposit+withdraw (ZEC-USD online; ZEC on Zcash and Base networks per Coinbase Exchange API on 2026-10-24)","shielded_zec_withdrawals":null,"regions":null,"source":"https://api.exchange.coinbase.com/currencies/ZEC"},"incidents":[{"date":"2025-05-11","title":"Customer data breach: bribed overseas support staff leaked names, addresses, ID images, masked SSNs and balances; attacker demanded ransom; data used for impersonation scams","amount":"$180M-$400M estimated remediation and reimbursement cost","outcome":"Coinbase said no passwords or private keys were compromised and it would reimburse eligible retail customers tricked into sending funds","source":"https://www.sec.gov/Archives/edgar/data/1679788/000167978825000094/coin-20250514.htm","kind":"hack"}],"deadlines":[{"date":"2027-07-10","what":"EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use an EU/EEA-licensed entity of this service.","source":"https://didit.me/blog/privacy-coins-no-kyc-swaps-rules-2026/"}],"worst_case":"Coinbase holds your coins and can restrict your account at its sole discretion; an API key with 'transfer' permission that leaks lets the holder send everything out, and leaked customer data fuels fake-support scams.","safe_setup":["Create CDP keys with view (and trade if needed) only; never give 'transfer' to a bot","Add your server's IP to the key's allowlist, even though Coinbase doesn't require it","Treat any call or message from 'Coinbase support' as a scam; Coinbase staff never ask you to move funds"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Hyperliquid","slug":"hyperliquid","kind":"exchange","chains_or_assets":["Hyperliquid L1 (HyperCore/HyperEVM)","USDC via Arbitrum bridge"],"listing_name":"Hyperliquid","official":{"domains":["hyperliquid.xyz"],"telegram":[],"x":["@HyperliquidX"],"github":[],"apps":[],"confirmed_via":["https://www.coingecko.com/en/exchanges/hyperliquid (website app.hyperliquid.xyz, twitter.com/HyperliquidX)","https://onekey.so/blog/ecosystem/fake-hyperliquid-site-detection/ (official app URL app.hyperliquid.xyz, updated 2026-05-12)","https://cryptobriefing.com/hyperliquidx-open-interest-surpasses-13b-for-first-time-since-october-10/ (news referring to the HyperliquidX account)"],"notes":"Docs live at hyperliquid.gitbook.io. Look-alike domains are common; bookmark app.hyperliquid.xyz."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"You sign with your own wallet; deposited USDC sits in the Hyperliquid bridge contract, which permissioned validators control (2/3 of a 4-validator hot set signs withdrawals).","source":"https://www.l2beat.com/bridges/projects/hyperliquid"},"can_move_funds_out":{"value":true,"note":"Withdrawals go through the bridge after a ~200s challenge period; validators/lockers can pause it (it was paused about an hour in Nov 2025).","source":"https://www.l2beat.com/bridges/projects/hyperliquid"},"freeze_policy":{"note":"No KYC account freezes as on a CEX, but L2BEAT notes funds can be frozen if the validator set stops processing withdrawals or if permissioned 'lockers' (threshold 2) pause the bridge, and funds could be stolen if a majority of the hot validators signed an invalid withdrawal. Validators have also delisted a market and force-settled positions (JELLYJELLY, Mar 2025).","source":"https://www.l2beat.com/bridges/projects/hyperliquid"},"api_keys":{"note":"No exchange-style API keys: you approve an 'API wallet' (agent wallet) with approveAgent. An account can have 1 unnamed and up to 3 named API wallets (plus 2 named per subaccount); an expiry can be set with valid_until, at most 180 days ahead. API wallets only sign trading (L1) actions, not transfers or withdrawals, which need the main wallet's signature (per Chainstack's integration guide). Hyperliquid warns not to reuse an agent address after it is deregistered, because pruned nonces can let old signed actions be replayed.","source":"https://hyperliquid.gitbook.io/hyperliquid-docs/for-developers/api/exchange-endpoint"},"privacy_coins":{"xmr":null,"zec":"perpetual futures only (USDC-margined synthetic exposure; ZEC is one of the most actively traded perps); native ZEC deposit/withdraw not documented","shielded_zec_withdrawals":null,"regions":null,"source":"https://docs.bitquery.io/docs/perpetuals/hyperliquid/track-zec-on-hyperliquid/"},"incidents":[{"date":"2026-04-09","title":"FARTCOIN pump and self-liquidation dumped a losing position onto HLP","amount":"~$1.5M (HLP)","outcome":"Loss borne by HLP depositors","source":"https://forklog.com/en/unknown-attackers-exploit-hyperliquid-storage-via-fartcoin-pump/amp","kind":"exploit"},{"date":"2025-11-13","title":"POPCAT price manipulation left ~$4.9M bad debt in the HLP vault; bridge withdrawals paused via 'vote emergency lock'","amount":"~$4.9M (HLP)","outcome":"Withdrawals resumed after about an hour; loss borne by HLP","source":"https://cointelegraph.com/news/hyperliquid-hlp-popcat-attack-3m-wipeout","kind":"exploit"},{"date":"2025-10-10","title":"First-ever cross-margin auto-deleveraging (ADL) during the 10 Oct crash: profitable positions were force-closed at mark price","amount":null,"outcome":"Affected traders' positions closed early; no compensation reported","source":"https://wublock.substack.com/p/hyperliquid-activates-cross-margin","kind":"outage"},{"date":"2025-03-26","title":"JELLYJELLY short-squeeze manipulation threatened the HLP vault; validators delisted the market and settled positions","amount":"~$10M HLP loss reportedly avoided","outcome":"Hyperliquid said it would compensate affected JELLYJELLY traders","source":"https://thedefiant.io/news/defi/hyperliquid-to-compensate-jellyjelly-traders-and-strengthen-risk-protocols","kind":"exploit"}],"deadlines":[],"worst_case":"You keep your keys, but your deposit sits in a validator-controlled bridge that can be paused, profitable positions can be force-closed by auto-deleveraging, and HLP vault deposits absorb manipulation losses; a leaked main-wallet key (not an API wallet) can withdraw everything.","safe_setup":["Give bots a dedicated API (agent) wallet with a valid_until expiry, never your main wallet's private key","Generate a fresh agent wallet instead of re-approving an old address after deregistering it","Only use the app at app.hyperliquid.xyz and keep only trading margin on Hyperliquid, not long-term savings"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Bitget","slug":"bitget","kind":"exchange","chains_or_assets":["Multi-asset centralized exchange (derivatives, spot)"],"listing_name":"Bitget","official":{"domains":["bitget.com"],"telegram":[],"x":[],"github":[],"apps":[],"confirmed_via":["https://www.coingecko.com/en/exchanges/bitget (exchange listing, partner link to bitget.com)","https://www.bitget.com/docs/uta/rest-api (official API docs on bitget.com)"],"notes":"X handle @bitget is listed by CoinGecko but was not confirmed from a second independent source here. Bitget Wallet (web3.bitget.com) is a separate self-custody product."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Custodial; the Sept 2026 hack drained Bitget hot/warm wallets holding customer deposits.","source":"https://dailycoin.com/bitget-351m-loss-2026-exchange-hack/"},"can_move_funds_out":{"value":true,"note":"Withdrawals available; they were fully suspended 2026-09-24 and restored in phases 2026-09-28 to 2026-10-02 after the hack.","source":"https://www.outlookmoney.com/invest/bitget-to-resume-withdrawals-in-phases-after-3875-million-security-incident"},"freeze_policy":null,"api_keys":{"note":"Each UID can create 10 API keys, each read-only or read/write, with Read-only, Trade, Transfer and Withdraw permissions. 'You can only withdraw coins through a whitelisted IP address'; binding an IP is 'strongly recommended' for all keys. Key expiry is not stated.","source":"https://www.bitget.com/docs/uta/rest-api"},"privacy_coins":{"xmr":"no spot market; XMR USDT-margined perpetual futures (status 'normal' in Bitget public API on 2026-10-24)","zec":"trade+deposit+withdraw (spot listed 2025-12-03; ZECUSDT spot 'online' in Bitget public API on 2026-10-24)","shielded_zec_withdrawals":null,"regions":null,"source":"https://www.crypto-reporter.com/newsfeed/bitget-lists-zcash-zec-for-spot-trading-118558/"},"incidents":[{"date":"2026-09-24","title":"Bitget hot/warm wallets drained after attackers used a third-party security product vulnerability to get internal credentials and send fraudulent withdrawal commands (ETH, XRP, BNB, AVAX, USDT, USDC, ZEC, TRX networks)","amount":"~$387.5M (initially $351.6M)","outcome":"All withdrawals suspended, then restored in phases 2026-09-28 to 2026-10-02; Bitget said its Protection Fund covers the loss and user balances were unaffected","source":"https://forklog.com/en/bitget-reveals-hack-cause-and-resumes-bitcoin-withdrawals/","kind":"hack"}],"deadlines":[{"date":"2027-07-10","what":"EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use an EU/EEA-licensed entity of this service.","source":"https://didit.me/blog/privacy-coins-no-kyc-swaps-rules-2026/"}],"worst_case":"Bitget holds your coins: in Sept 2026 a hack froze all withdrawals for 4-8 days, and recovery depended on Bitget's own protection fund; a leaked withdraw-enabled key works from any whitelisted IP.","safe_setup":["Create bot keys with Trade (or Read-only) only and bind them to your server IP","Never enable Withdraw on a key you hand to a third-party bot or copy-trading tool","Keep only active trading balance on Bitget and withdraw the rest to your own wallet"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Gemini","slug":"gemini","kind":"exchange","chains_or_assets":["Multi-asset centralized exchange (US-regulated trust company)"],"listing_name":"Gemini","official":{"domains":["gemini.com"],"telegram":[],"x":["@Gemini","@GeminiSupport"],"github":[],"apps":[],"confirmed_via":["https://support.gemini.com/hc/en-gb/articles/360004563531-Is-Gemini-available-on-social-media (lists @Gemini, @GeminiSupport)","https://www.coingecko.com/en/exchanges/gemini (website exchange.gemini.com, twitter.com/gemini)"],"notes":"Gemini's official social list also includes @GeminiTrustCo and the founders' accounts. CoinGecko links the trading site exchange.gemini.com."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Custodial exchange account.","source":"https://www.gemini.com/legal/gemini-trust-user-agreement"},"can_move_funds_out":{"value":true,"note":"Crypto withdrawals available; may be delayed for regulatory or administrative reasons. UK/EU/EEA customers cannot start outbound crypto transfers via API.","source":"https://www.gemini.com/legal/gemini-trust-user-agreement"},"freeze_policy":{"note":"Gemini Trust User Agreement: Gemini may immediately suspend accounts and 'freeze or lock' funds 'until a determination has been made' on suspected violations of the agreement, law, its BSA/AML Program or conduct rules, court/regulator orders, unusual activity, etc.; may require additional information or a background check at any time; for source-of-funds issues it may dispose of funds it decides you don't own (e.g. return to origin). Conduct-rule notices give 7 calendar days to respond; on termination you may be asked for a wallet address within 7 calendar days or assets may be sold. ACH deposits can block withdrawals ~4-5 business days.","source":"https://www.gemini.com/legal/gemini-trust-user-agreement"},"api_keys":{"note":"Roles: Auditor (read-only), Trading (orders, no withdrawals) and Fund management (withdrawals to approved addresses). Keys can be set to 'Trusted IPs only' (recommended). Keys unused for 180 days expire. UK/EU/EEA customers cannot initiate outbound crypto transfers via API.","source":"https://support.gemini.com/hc/en-us/articles/360031080191-How-do-I-create-an-API-key"},"privacy_coins":{"xmr":"not listed (no XMR symbol in Gemini public API on 2026-10-24)","zec":"trade+deposit+withdraw (zecusd 'open' in Gemini public API on 2026-10-24); deposits go to a transparent address","shielded_zec_withdrawals":true,"regions":null,"source":"https://www.gemini.com/blog/privacy-made-simple-gemini-adds-zcash-unified-addresses"},"incidents":[{"date":"2024-02-28","title":"NYDFS settlement over Gemini Earn (frozen since the 2022 Genesis collapse): Gemini to return >$1.1B to Earn users and pay a $37M fine","amount":">$1.1B returned","outcome":"refunded (Earn users repaid via the Genesis bankruptcy settlement)","source":"https://www.theblock.co/amp/post/279704/gemini-to-pay-37-million-fine-return-over-1-billion-to-earn-customers-in-settlement-with-ny-regulator","kind":"freeze"}],"deadlines":[{"date":"2027-07-10","what":"EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use an EU/EEA-licensed entity of this service.","source":"https://didit.me/blog/privacy-coins-no-kyc-swaps-rules-2026/"}],"worst_case":"Gemini holds your coins and can freeze them pending an AML or source-of-funds determination with no fixed end date; a leaked Fund-management key can withdraw to your approved addresses only, but a leaked Trading key can still place bad trades.","safe_setup":["Give bots Trading or Auditor keys only; never a Fund-management key","Set every key to 'Trusted IPs only' with your server's address","For ZEC, withdraw to a unified (shielded) address in your own wallet rather than holding it on the exchange"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"ChangeNOW","slug":"changenow","kind":"swap_service","chains_or_assets":["Instant cross-chain swaps (hundreds of assets incl. XMR, ZEC)"],"listing_name":null,"official":{"domains":["changenow.io"],"telegram":[],"x":[],"github":[],"apps":["https://apps.apple.com/app/id1518003605"],"confirmed_via":["https://apps.apple.com//app/id1518003605 (App Store 'ChangeNOW: Crypto Exchange', seller CHN Group Limited, developer site changenow.io)","https://changenow.io (site links its app via changenow.app.link)","https://fxstreet.com/company/changenow (website changenow.io)"],"notes":"changenow.io links X at x.com/ChangeNOW while FXStreet lists twitter.com/ChangeNOW_io, so no X handle is listed until confirmed. changenow.io also links Telegram t.me/ChangeNOW_officialbot (bot) and t.me/changeNOW_chat; not independently confirmed. Related ChangeNOW products: NOW Wallet, nowpayments.io, nownodes.io."},"known_fakes":[],"custody":{"who_holds_keys":"service","note":"You send coins to a ChangeNOW deposit address; during the swap ChangeNOW controls them and can place the transaction on hold for review.","source":"https://changenow.io/terms-of-use/aml-kyc"},"can_move_funds_out":{"value":null,"note":"Not applicable (no stored balance); the swap output is sent to your address unless the transaction is held.","source":"https://changenow.io/terms-of-use/aml-kyc"},"freeze_policy":{"note":"ChangeNOW AML/KYC policy: automated tools screen transactions and flagged ones 'may be placed on hold' for individual review (Sec. 4); it may request a government ID, proof of funds and other documents via Sumsub (Sec. 3); the verification link stays active for 3 days, after which the case is reviewed individually; refusing checks or giving false information can restrict access (Sec. 3, 7); some jurisdictions must complete KYC before using the service (Sec. 2). No maximum hold duration or refund rule is stated on this page. In Trustpilot replies ChangeNOW cites its terms: 'we reserve the right to freeze your exchange transaction for any period of time necessary'.","source":"https://changenow.io/terms-of-use/aml-kyc"},"api_keys":null,"privacy_coins":{"xmr":"swap supported (to and from XMR)","zec":"swap supported (changenow.io/currencies/zcash)","shielded_zec_withdrawals":null,"regions":null,"source":"https://changenow.io/currencies/zcash"},"incidents":[{"date":"2026-07-29","title":"Reported by users (unverified): Trustpilot reviews describe swaps frozen under AML review with KYC/source-of-funds requests, holds lasting weeks to 10+ months, and stalled refunds for users who declined KYC (19 such reviews on the AML-filtered page, Feb 2021 to Jul 2026)","amount":null,"outcome":"Mixed; ChangeNOW replies cite AML procedures and give no timelines","source":"https://www.trustpilot.com/review/changenow.io?search=AML","kind":"user_reports"}],"deadlines":[],"worst_case":"While your coins sit at ChangeNOW mid-swap, an automated AML flag can hold them indefinitely until you complete ID and source-of-funds checks, and users report refunds stalling if they decline.","safe_setup":["Always enter a refund address you control when creating the swap","Test with a small amount first and only swap funds whose origin you can document","Use changenow.io or the App Store app from seller CHN Group Limited, and save your exchange ID for support"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"SideShift.ai","slug":"sideshift-ai","kind":"swap_service","chains_or_assets":["Instant cross-chain swaps (200+ assets)"],"listing_name":null,"official":{"domains":["sideshift.ai"],"telegram":[],"x":[],"github":[],"apps":[],"confirmed_via":["https://coinmarketcap.com/currencies/sideshift-token/ (website sideshift.ai, X twitter.com/sideshiftai, Telegram t.me/sideshift)","https://docs.sideshift.ai/faq (official API docs; website sideshift.ai, GitHub github.com/sideshift)"],"notes":"X @sideshiftai and Telegram t.me/sideshift (CoinMarketCap) and GitHub github.com/sideshift (docs) each have only one source here, so they are not listed. sideshift.app is a different business ('SideShift Corporation', creator platform), not the swap service."},"known_fakes":[],"custody":{"who_holds_keys":"service","note":"You send coins to a SideShift deposit address; SideShift settles to your address or refunds to the refund address.","source":"https://docs.sideshift.ai/api-intro/refunds"},"can_move_funds_out":{"value":null,"note":"Not applicable (no stored balance); refunds are automatic only if a refund address is set.","source":"https://docs.sideshift.ai/api-intro/refunds"},"freeze_policy":{"note":"Docs: refunds are automatic when a refund address is set (wrong amount, expired shift, out-of-range deposits); without one, the shift stays in 'refund' until you add an address. Out-of-range or post-expiry deposits may be processed or refunded after human review; wrong-network deposits are recovered if accessible, usually within 3 days. User eligibility is checked via a permissions endpoint. SideShift's terms (on sideshift.ai) could not be retrieved, so its AML hold policy is not confirmed here.","source":"https://docs.sideshift.ai/faq"},"api_keys":null,"privacy_coins":null,"incidents":[{"date":"2025-04-16","title":"Reported by users (unverified): Trustpilot reviews describe a shift held for 4 days and (Mar 2025) a swap stalled after SideShift said it 'needed some kind of check'","amount":null,"outcome":"Not stated; SideShift replied with boilerplate","source":"https://ca.trustpilot.com/review/sideshift.ai?page=5","kind":"user_reports"}],"deadlines":[],"worst_case":"Your coins sit at SideShift during the swap; if a shift is flagged or goes out of range it can wait on human review, and without a refund address it can't be refunded automatically.","safe_setup":["Always set a refund address you control before sending","Send the exact amount before the shift expires and test with a small amount first","Bookmark sideshift.ai (not look-alikes such as sideshift.app) and keep your shift ID for support"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"FixedFloat","slug":"fixedfloat","kind":"swap_service","chains_or_assets":["Instant cross-chain swaps (100+ assets incl. BTC Lightning, XMR, ZEC)"],"listing_name":null,"official":{"domains":["ff.io"],"telegram":[],"x":["@FixedFloat"],"github":[],"apps":[],"confirmed_via":["https://solanacompass.com/projects/fixedfloat (primary domain moved from fixedfloat.com to ff.io; x.com/fixedfloat)","https://www.analyticsinsight.net/amp/story/cryptocurrency-analytics-insight/fixedfloat-launches-fixedfloatbot-on-telegram-to-simplify-crypto-trading (Dec 2024 release: ff.io, @FixedFloat, bot @FixedFloatBot)","https://decrypt.co/218077/fixedfloat-hack-26-million-bitcoin-ethereum (X @FixedFloat; older domain fixedfloat.com)"],"notes":"Telegram trading bot @FixedFloatBot appears only in a sponsored press release, so it is not listed. Older domain fixedfloat.com was used in 2024 news coverage."},"known_fakes":[],"custody":{"who_holds_keys":"service","note":"FixedFloat says it 'does not store user funds' (no account balances), but coins you send sit in FixedFloat-controlled wallets until the swap is paid out; its hot wallets were drained twice in 2024.","source":"https://decrypt.co/218077/fixedfloat-hack-26-million-bitcoin-ethereum"},"can_move_funds_out":{"value":null,"note":"Not applicable (no stored balance).","source":"https://decrypt.co/218077/fixedfloat-hack-26-million-bitcoin-ethereum"},"freeze_policy":null,"api_keys":null,"privacy_coins":{"xmr":"swap supported","zec":"swap supported","shielded_zec_withdrawals":null,"regions":null,"source":"https://solanacompass.com/projects/fixedfloat"},"incidents":[{"date":"2024-04-01","title":"Second hack: Ethereum hot wallet drained via a third-party provider vulnerability; site in maintenance mode","amount":"~$2.8M","outcome":"FixedFloat said user funds were not affected","source":"https://forklog.com/en/fixedfloat-suffers-2-8-million-loss-in-second-hack-of-the-year/","kind":"hack"},{"date":"2024-02-16","title":"FixedFloat hot wallets hacked (~409 BTC and ~1,728 ETH); site put in maintenance mode","amount":"~$26M","outcome":"FixedFloat said user funds were not affected (company losses)","source":"https://decrypt.co/218077/fixedfloat-hack-26-million-bitcoin-ethereum","kind":"hack"}],"deadlines":[],"worst_case":"Coins in flight sit in FixedFloat's hot wallets, which were hacked twice in 2024 and taken offline into maintenance mode; FixedFloat's AML/refund terms could not be verified for this check.","safe_setup":["Swap small amounts and send only when you're ready to complete the order immediately","Always provide a refund/emergency address you control and save your order ID","Type ff.io yourself instead of following ads or DMs, and verify any Telegram bot against FixedFloat's own site"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"NEAR Intents","slug":"near-intents","kind":"swap_service","chains_or_assets":["Cross-chain intents/1Click swaps (35+ chains incl. Zcash shielded via Zodl)"],"listing_name":null,"official":{"domains":["near.com","docs.near-intents.org"],"telegram":[],"x":[],"github":[],"apps":[],"confirmed_via":["https://support.zodl.com/article/26-swapping-into-zec (Zodl: swaps subject to NEAR's Terms at near.com/terms)","https://tostracker.app/document/near (near.com terms by Intents Technology Ltd cover NEAR Intents and 1ClickSwap; updated 2026-10-07)","https://www.letsdatascience.com/news/near-launches-multichain-super-app-nearcom-for-onchain-finan-5ace494b (near.com launched 2026-02-23, powered by NEAR Intents)","https://docs.near.org/chain-abstraction/intents/overview (links docs.near-intents.org and near-intents.org)","https://github.com/defuse-protocol/one-click-sdk-typescript (links docs.near-intents.org; 1Click API base 1click.chaindefuser.com)"],"notes":"Operator per terms: Intents Technology Ltd. near-intents.org (linked from docs.near.org as the demo site), 1Click API host 1click.chaindefuser.com and GitHub org defuse-protocol each have one source here. Dev-support Telegram t.me/near_intents is linked from docs.near.org only. No official X handle confirmed. Wallets such as Zodl route swaps through NEAR Intents and say they cannot release held funds themselves."},"known_fakes":[],"custody":{"who_holds_keys":"service","note":"Your wallet stays yours, but when swapping via 1Click (e.g. from Zodl) you send funds to a NEAR Intents deposit address and they sit in the intents system until a market maker fills or a refund is sent; the terms say platform 'Balances' are 'not client money'.","source":"https://tostracker.app/document/near"},"can_move_funds_out":{"value":null,"note":"Not applicable (swap flow); refunds go to the refund address you set, subject to compliance review.","source":"https://tostracker.app/document/near"},"freeze_policy":{"note":"near.com Terms (Intents Technology Ltd, updated 2026-10-07): transactions are subject to screening, sanctions and other compliance controls by the company, its providers or underlying bridges; a transaction may be 'delayed, blocked, or rejected' and assets 'restricted or unavailable for a period or indefinitely', for 'as long as those grounds remain'; no duty to notify or give reasons; refunds can be subject to 'compliance review and/or blocking or restriction'; no guarantee a refund will be available or timely. Recovery help for user errors isn't considered under USD 300 and 'generally aims' to finish within 14 days after approval. Screening reportedly uses third-party providers (Binance AML, TRM Labs, AMLBot, PureFi) per Crypto Economy.","source":"https://tostracker.app/document/near"},"api_keys":null,"privacy_coins":{"xmr":null,"zec":"swap supported, including into/out of Zodl's shielded pool (Zodl deposits ZEC to a fresh shielded address)","shielded_zec_withdrawals":true,"regions":"Not offered to sanctioned persons/jurisdictions; company may restrict any jurisdiction","source":"https://support.zodl.com/article/26-swapping-into-zec"},"incidents":[{"date":"2026-10-01","title":"NEAR Intents exploited via a bug in how its Omni deposit/withdrawal layer interacts with the main contract holding user funds; services halted","amount":"~$3.8M","outcome":"Company said losses 'will be compensated in full'; core services resumed after ~1h, 11 networks' deposits/withdrawals down ~12h more","source":"https://decrypt.co/379822/near-intents-hacked-days-after-denying-bitget-hacker?amp=1","kind":"exploit"},{"date":"2026-09-29","title":"NEAR Intents said its screening blocked most of >$50M in Bitget-hack laundering attempts and froze $503,000 pending legal recovery (~$166,000 passed through)","amount":"$503,000 frozen","outcome":"Frozen pending legal recovery","source":"https://thedefiant.io/news/hacks/near-intents-says-it-froze-503-000-in-bitget-hack-funds","kind":"freeze"},{"date":"2026-07-20","title":"Reported by user (Zcash forum 'timtech'; unverified): ~1,120 shielded ZEC swapped via Zodl to USDT held by NEAR Intents under compliance review; cleared in writing 2026-07-23, then re-opened as 'pending review' 2026-08-27 with no deadline","amount":"~589,000 USDT","outcome":"Unresolved as of the thread's last update 2026-09-12; Zodl says it does not control the funds.","source":"https://forum.zcashcommunity.com/t/my-experience-exiting-shielded-zec-from-zodl-to-near-intents-589k-usdt-still-held-50-days-despite-a-written-compliance-clearance/57497","kind":"user_reports"}],"deadlines":[],"worst_case":"Once you send funds into a NEAR Intents swap (directly or through a wallet like Zodl), a compliance flag can hold them indefinitely with no stated deadline, as a user reported for ~589k USDT, and the wallet app cannot release them.","safe_setup":["Set a refund address you control and split large swaps into smaller test-sized amounts","Keep records of where your funds came from in case a compliance review asks","Use near.com or a wallet's built-in integration rather than links from DMs, and read near.com/terms before large swaps"],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Zodl (formerly Zashi)","slug":"zodl","kind":"privacy_wallet","chains_or_assets":["Zcash"],"listing_name":null,"official":{"domains":["zodl.com"],"telegram":[],"x":[],"github":["github.com/zodl-inc","github.com/zodl-inc/zodl-android","github.com/zodl-inc/zodl-ios"],"apps":["https://apps.apple.com/us/app/zodl-zcash-wallet/id1672392439","https://play.google.com/store/apps/details?id=co.electriccoin.zcash"],"confirmed_via":["https://z.cash/ecosystem/zodl-wallet/ (Zcash ecosystem listing links zodl.com)","https://github.com/zodl-inc (org 'Zcash Open Development Lab (ZODL), creators of Zcash and Zodl (ex-Zashi)', website zodl.com)","https://zodl.com (download popup lists App Store id1672392439, Google Play co.electriccoin.zcash, F-Droid, GitHub releases; links github.com/zodl-inc)","https://github.com/zodl-inc/zodl-android README (Google Play co.electriccoin.zcash, F-Droid repo foss.zodl.com, APK at github.com/zodl-inc/zodl-android/releases/latest)","https://github.com/zodl-inc/zodl-ios README (App Store id1672392439)","https://apps.apple.com/us/app/zodl-zcash-wallet/id1672392439 (developer website zodl.com)"],"notes":"Zashi was renamed Zodl in 2026 after the original ECC wallet team left Electric Coin Company and formed ZODL (announced 2026-02-16; https://forklog.com/en/news/zcash-developers-establish-new-entity-and-rebrand-wallet). The Android package is still co.electriccoin.zcash and the App Store seller is still 'The Zerocoin Electric Coin Company LLC', so the old company name on the listing is expected. zodl.com and zodl.com/about link the X handle @zodl_app, but we found no second independent confirmation, so it is not listed above. F-Droid: zodl.com links the main F-Droid listing (co.electriccoin.zcash.foss); the GitHub README gives Zodl's own F-Droid repo foss.zodl.com with fingerprint 7e751ab710159dff44f55631f910ba4033f0ebd2f867691af633cece4ddb62e4. Zodl is an app only: none of these official sources offers a web wallet. Support site: support.zodl.com."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"Self-custody mobile wallet. zodl.com: 'Only you can see, access, and manage your wallet' and 'Your keys, your crypto'. Your seed phrase is the backup. Optional Keystone hardware signing.","source":"https://zodl.com"},"can_move_funds_out":{"value":true,"note":"You sign sends yourself, to any Zcash address.","source":"https://zodl.com"},"freeze_policy":{"note":"In-app Swaps and CrossPay are powered by NEAR Intents, a third party. You send funds to a swap deposit address, and the swap is subject to NEAR's Terms of Service. Refunds are 'most of the time' automatic to the refund address you gave. Manual refunds go through NEAR support (near.com/support) and 'may take up to a couple of days'. A swap quote is valid for 24 hours. Sending to a Binance tex1 address takes two hops through a temporary transparent address in your wallet. If the second hop fails, the funds stay there until you recover them with the Discover Funds tool.","source":"https://support.zodl.com/article/10-refunding-a-swap"},"api_keys":null,"privacy_coins":{"xmr":"not supported (Zcash-only wallet)","zec":"send/receive, shielded (Ironwood migration support since Zodl 3.9.0)","shielded_zec_withdrawals":true,"regions":null,"source":"https://zodl.com/blog/"},"incidents":[{"date":"2026-06-02","title":"Zcash-wide emergency: a flaw in the Orchard proof circuit (found 2026-05-29) led to Orchard transactions being suspended, then re-enabled by an emergency upgrade (NU6.2). Affects every Zcash wallet, not just Zodl.","amount":null,"outcome":"Zcash Foundation: no evidence of exploitation; user funds and total supply not affected","source":"https://cointelegraph.com/news/zcash-orchard-vulnerability-emergency-upgrade","kind":"outage"},{"date":null,"title":"Zodl 3.14.0 fixed 'a range of Slipstream sync issues, including lag and freezes while syncing, transfers stuck on Sending…' (vendor release notes; release date not shown)","amount":null,"outcome":"fixed in 3.14.0","source":"https://apps.apple.com/us/app/zodl-zcash-wallet/id1672392439","kind":"outage"},{"date":null,"title":"Known issue: a failed send to a Binance tex1 address leaves funds stuck at a temporary (ephemeral) transparent address in your wallet until recovered (vendor help article, last updated 2026-09-14)","amount":null,"outcome":"recoverable with the Discover Funds tool","source":"https://support.zodl.com/article/29-recovering-funds-from-an-ephemeral-address","kind":"outage"}],"deadlines":[{"date":"2026-11-05","what":"Zcash NU7 activates at mainnet block 3,543,405 (2026-11-05 is an estimate; activation is by block height). Version 4 transactions become invalid and any ZEC left in the old Sprout pool becomes unspendable (not burned, but may never be re-enabled). Per ZIP 2003, zcashd was the only maintained software with Sprout wallet functionality, so Zodl can't rescue Sprout funds. Update the app before activation.","source":"https://zips.z.cash/zip-0259"}],"worst_case":"Zodl is self-custody, so anyone who gets your seed phrase, or tricks you into installing a fake 'Zodl' app or site, can take all your ZEC. Swaps hand your funds to NEAR Intents, and a failed swap waits on NEAR's refund process.","safe_setup":["Install only from the App Store listing id1672392439, Google Play co.electriccoin.zcash, or the zodl-inc GitHub/F-Droid links shown on zodl.com. Ignore any 'Zodl' web wallet.","Write the seed phrase on paper offline and never type it into a website, chat or 'support' form. Zodl support is at support.zodl.com.","Update to the latest version before NU7 (block 3,543,405, around 2026-11-05). Try a small swap first and keep the swap's deposit address and refund details until it completes."],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Ywallet","slug":"ywallet","kind":"privacy_wallet","chains_or_assets":["Zcash","Ycash"],"listing_name":null,"official":{"domains":["ywallet.app"],"telegram":[],"x":[],"github":["github.com/hhanh00/zwallet"],"apps":["https://apps.apple.com/us/app/ywallet/id1583859229"],"confirmed_via":["https://ywallet.app/installation (links github.com/hhanh00/zwallet releases, App Store id1583859229, Google Play me.hanh.ywallet, Flathub app.ywallet.Ywallet)","https://github.com/hhanh00/zwallet README (website ywallet.app)","https://apps.apple.com/us/app/ywallet/id1583859229 (developer Ycash Foundation; privacy policy and changelog on ywallet.app)"],"notes":"ywallet.app also links Google Play (me.hanh.ywallet) and Flathub (app.ywallet.Ywallet), but neither was confirmed a second time. The Microsoft Store version is discontinued (ywallet.app/installation). The GitHub README says 'YWallet is not going to receive further updates' apart from security fixes and protocol updates, and recommends the author's Zcash-only successor Zkool (github.com/hhanh00/zkool2). Zkool is not verified as part of this entry. z.cash only has a menu link for Ywallet, with no directory entry."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"Light wallet. Accounts are created or restored on your device from a seed phrase (ZIP 32) or keys, with watch-only and cold-signing options. No account on a server.","source":"https://github.com/hhanh00/zwallet"},"can_move_funds_out":{"value":true,"note":"You sign sends yourself. Sending after network upgrades depends on the app supporting them (see deadlines).","source":"https://github.com/hhanh00/zwallet"},"freeze_policy":{"note":"Built-in swaps and voting were removed in v1.14.1 (2025-11-27), so the app no longer sends funds through a swap provider.","source":"https://github.com/hhanh00/zwallet/releases"},"api_keys":null,"privacy_coins":{"xmr":"not supported","zec":"send/receive, transparent and shielded; release notes list no Ironwood (NU6.3) or NU7 support","shielded_zec_withdrawals":null,"regions":null,"source":"https://github.com/hhanh00/zwallet/releases"},"incidents":[{"date":"2026-06-02","title":"Zcash-wide emergency: a flaw in the Orchard proof circuit led to Orchard transactions being suspended, then re-enabled by NU6.2. Ywallet v1.15.3 (2026-06-04) then fixed its 'NU6.2 circuit version detection'.","amount":null,"outcome":"Zcash Foundation: no evidence of exploitation; patched in v1.15.3","source":"https://github.com/hhanh00/zwallet/releases","kind":"outage"},{"date":"2026-05-24","title":"Wallet deprecated: v1.14.3 added an in-app deprecation notice. The README says no further updates except security fixes and protocol updates, and points users to Zkool.","amount":null,"outcome":"still works per author ('your coins are safe'); feature development ended","source":"https://github.com/hhanh00/zwallet","kind":"outage"}],"deadlines":[{"date":"2026-11-05","what":"Zcash NU7 activates at mainnet block 3,543,405 (2026-11-05 is an estimate; activation is by block height). Version 4 transactions become invalid, transactions must commit to the new consensus branch, and ZEC left in the Sprout pool becomes unspendable. Ywallet's latest release (v1.15.3, 2026-06-04) mentions neither NU6.3 Ironwood (live since 2026-07-28) nor NU7. Per ZIP 2003, zcashd was the only maintained software with Sprout wallet functionality.","source":"https://zips.z.cash/zip-0259"}],"worst_case":"Ywallet is deprecated: its last release (2026-06-04) lists no Ironwood or NU7 support, so after these upgrades it may be unable to send your ZEC until you restore your seed in a maintained wallet. Anyone who gets your seed can take your funds.","safe_setup":["Don't start using Ywallet for new funds. If you already use it, back up the seed phrase offline now and plan to restore it in a maintained Zcash wallet (the author points to Zkool).","If you install or update it, use only the links on ywallet.app/installation or the github.com/hhanh00/zwallet releases page. Never enter your seed on a website.","Before NU7 (block 3,543,405, around 2026-11-05), test a small send. If it fails, restore the seed in a maintained wallet rather than trying third-party 'recovery' tools."],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Unstoppable Wallet","slug":"unstoppable-wallet","kind":"privacy_wallet","chains_or_assets":["Zcash","Monero","Bitcoin","Ethereum","Zano","THORChain","MayaChain","many others"],"listing_name":null,"official":{"domains":["unstoppable.money"],"telegram":[],"x":["@unstoppablebyhs"],"github":["github.com/horizontalsystems/unstoppable-wallet-android","github.com/horizontalsystems/unstoppable-wallet-ios"],"apps":["https://apps.apple.com/us/app/unstoppable-bitcoin-wallet/id1447619907","https://play.google.com/store/apps/details?id=io.horizontalsystems.bankwallet"],"confirmed_via":["https://z.cash/ecosystem/unstoppable/ (links unstoppable.money)","https://beta.getmonero.org/downloads/community/ (Monero wallet list links unstoppable.money)","https://unstoppable.money (links x.com/unstoppablebyhs, github.com/horizontalsystems, F-Droid io.horizontalsystems.bankwallet, GitHub release pages)","https://github.com/horizontalsystems (org links X @unstoppablebyhs; verified domain horizontalsystems.io)","https://github.com/horizontalsystems/unstoppable-wallet-android README (Google Play io.horizontalsystems.bankwallet, website unstoppable.money)","https://github.com/horizontalsystems/unstoppable-wallet-ios README (App Store id1447619907)","https://apps.apple.com/us/app/unstoppable-bitcoin-wallet/id1447619907 (developer Horizontal Systems, website unstoppable.money)"],"notes":"F-Droid listing io.horizontalsystems.bankwallet is linked from both unstoppable.money and the Android README. unstoppable.money also links Telegram t.me/unstoppable_announcements, but we did not confirm it a second time. The FAQ warns about fake Telegram and Twitter groups impersonating the team, and about modified copies of the open-source code. Web swap: swap.unstoppable.money (linked from the site)."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"Non-custodial. Keys are generated on the device and kept in iOS/Android secure storage. Backup is a 12- or 24-word phrase, which you must back up before receiving. The team cannot recover lost keys.","source":"https://unstoppable.money/faq"},"can_move_funds_out":{"value":true,"note":"Self-custody sends to any address.","source":"https://unstoppable.money/faq"},"freeze_policy":{"note":"Swaps route through many third-party providers, not only DEXes. Release 0.49.0 added Zcash shielded swaps via Exolix (an instant exchange that takes your deposit, per Cake Wallet's provider list) plus Barter, CCE.Cash, Pegasus Swap and Circle Swap. Release 0.50.0 added LI.FI, Jupiter, Stellar providers, Bitania and Lizex. When a provider takes custody of your deposit, it holds the funds until it pays out, under its own rules. The FAQ still says swaps are DEX-only and non-custodial, which is out of date.","source":"https://github.com/horizontalsystems/unstoppable-wallet-android/releases"},"api_keys":null,"privacy_coins":{"xmr":"send/receive (Monero accounts, coin control, node autoselect, 25-word legacy seed import since 0.50.0)","zec":"send/receive incl. shielded; Ironwood support since 0.49.4 (Android)","shielded_zec_withdrawals":true,"regions":null,"source":"https://github.com/horizontalsystems/unstoppable-wallet-android/releases"},"incidents":[{"date":"2026-06-02","title":"Zcash-wide emergency: a flaw in the Orchard proof circuit led to Orchard transactions being suspended, then re-enabled by NU6.2. Affects every Zcash wallet.","amount":null,"outcome":"Zcash Foundation: no evidence of exploitation; user funds not affected","source":"https://cointelegraph.com/news/zcash-orchard-vulnerability-emergency-upgrade","kind":"outage"}],"deadlines":[{"date":"2026-11-05","what":"Zcash NU7 activates at mainnet block 3,543,405 (2026-11-05 is an estimate). Version 4 transactions become invalid and ZEC left in the Sprout pool becomes unspendable. Per ZIP 2003, zcashd was the only maintained software with Sprout wallet functionality, so this wallet can't rescue Sprout funds. Update the app before activation.","source":"https://zips.z.cash/zip-0259"}],"worst_case":"Your keys live only on your phone, so a stolen seed phrase or a fake build means everything in the wallet can be taken. A swap through a centralized provider leaves your coins with that provider until it pays out or refunds.","safe_setup":["Install from the App Store (id1447619907), Google Play or F-Droid (io.horizontalsystems.bankwallet), or the horizontalsystems GitHub releases. Ignore Telegram and X accounts other than @unstoppablebyhs.","Back up the 12/24-word phrase on paper offline. Never screenshot it, which the FAQ itself warns against.","Before swapping ZEC or XMR, check which provider the quote uses. Prefer on-chain/DEX routes, and test a small amount first with any provider that takes custody of your deposit."],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Cake Wallet","slug":"cake-wallet","kind":"privacy_wallet","chains_or_assets":["Monero","Zcash","Bitcoin","Litecoin","Ethereum","Solana","Tron","others"],"listing_name":null,"official":{"domains":["cakewallet.com","docs.cakewallet.com","monero.com"],"telegram":["@cakewallet_bot"],"x":["@cakewallet"],"github":["github.com/cake-tech/cake_wallet"],"apps":["https://apps.apple.com/us/app/cake-wallet/id1334702542","https://play.google.com/store/apps/details?id=com.cakewallet.cake_wallet"],"confirmed_via":["https://beta.getmonero.org/downloads/community/ (links cakewallet.com and Monero.com by Cake Labs at monero.com)","https://cakewallet.com (links App Store id1334702542, Google Play com.cakewallet.cake_wallet, github.com/cake-tech/cake_wallet, x.com/cakewallet, t.me/cakewallet_bot)","https://github.com/cake-tech (org links cakewallet.com, docs.cakewallet.com and X @cakewallet)","https://raw.githubusercontent.com/cake-tech/cake_wallet/dev/README.md (App Store id1334702542, Google Play com.cakewallet.cake_wallet, fdroid.cakelabs.com, monero.com)","https://docs.cakewallet.com/support/support.md (Telegram support bot t.me/cakewallet_bot, support@cakewallet.com)","https://docs.cakewallet.com/tutorials/what-to-do-if-scammed.md (official channels: cakewallet.com, monero.com, support@cakewallet.com, Telegram @cakewallet community, @cakewallet_bot support)"],"notes":"@cakewallet_bot is the support bot, not a trading bot. monero.com is Cake's separate Monero-only app (App Store id1601990386, Google Play com.monero.app per the README). The Android APK signing certificate SHA-256 is C5:40:53:AB:0F:10:D9:54:17:62:A3:DA:76:65:AE:3D:BA:5E:7C:74:3A:B4:F1:08:A5:34:9D:62:AC:10:6E:F5 (README). The GitHub, Accrescent and F-Droid builds share this key. Linux builds publish SHA-256 hashes in the GitHub release notes, with no signature files. Windows builds are paused per the docs. cakewallet.com also links the Telegram announcements channel t.me/cakewalletannouncements, while the docs name @cakewallet as the community channel. Neither was second-confirmed."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"Non-custodial: 'Open source & non-custodial means you have complete control over your private keys'. Zcash wallets use a 12-word BIP39 seed by default (24 words and a passphrase optional). Cake 'never holds the funds' during swaps.","source":"https://docs.cakewallet.com/faq/swaps-and-exchanges.md"},"can_move_funds_out":{"value":true,"note":"Self-custody sends to any address.","source":"https://cakewallet.com"},"freeze_policy":{"note":"Every swap runs through a third-party provider. Centralized providers receive your deposit and send the swapped coin: ChangeNOW, Exolix, Trocador (aggregator), SwapTrade, LetsExchange (aggregator), XOSwap, Swaps.xyz. Decentralized routes: Chainflip, NEAR Intents, Jupiter. Refunds come from the provider that received the deposit. Cake can't reverse a completed swap, but its support escalates with the provider using your Trade ID.","source":"https://docs.cakewallet.com/support/swap.md"},"api_keys":null,"privacy_coins":{"xmr":"send/receive/swap","zec":"send/receive/swap; shielded (Ironwood) by default with autoshielding of transparent funds; Ironwood support since 6.4.0","shielded_zec_withdrawals":true,"regions":null,"source":"https://docs.cakewallet.com/cryptos/zcash.md"},"incidents":[{"date":"2026-10-24","title":"Alleged Bitcoin RBF (replace-by-fee) issue in Cake Wallet, reported on X. Not confirmed: we could not read the post or find corroboration. Cake's 6.5.0 notes (Oct 2026) include 'Fixed a send you had backed out of being able to replace a newer one on the confirmation screen', but nothing links that fix to this report.","amount":null,"outcome":"unconfirmed","source":"https://x.com/1440000bytes/status/2113930464344129724","kind":"user_reports"},{"date":"2026-09-24","title":"Reported on X: a Cake Wallet staff Telegram account was hacked and used to push malware. Not confirmed in Cake's docs or other sources we could read. Treat any download link sent in Telegram DMs or groups as hostile.","amount":null,"outcome":"unconfirmed","source":"https://x.com/OrangeFren/status/2103112296063176923","kind":"user_reports"},{"date":"2026-06-02","title":"Zcash-wide emergency: a flaw in the Orchard proof circuit led to Orchard transactions being suspended, then re-enabled by NU6.2. Affects every Zcash wallet.","amount":null,"outcome":"Zcash Foundation: no evidence of exploitation; user funds not affected","source":"https://cointelegraph.com/news/zcash-orchard-vulnerability-emergency-upgrade","kind":"outage"},{"date":"2025-06-26","title":"Bitcoin Silent Payments scanning broke after Cake Wallet 5.0.1, so most users of the feature could not see incoming Silent Payments","amount":null,"outcome":"Cake said funds were not at risk; fix promised in 5.1 or a point release","source":"https://www.criptonoticias.com/tecnologia/silent-payments-se-quiebran-cake-wallet/","kind":"outage"},{"date":null,"title":"Dropping Zano: since 6.5.0 (Oct 2026) new Zano wallets can't be created or restored, and Zano 'will be removed from Cake Wallet in a future release' (no date). Wownero support was already removed (date not given).","amount":null,"outcome":"existing Zano wallets still work for now; back up the seed","source":"https://docs.cakewallet.com/cryptos/zano.md","kind":"outage"}],"deadlines":[{"date":"2026-11-05","what":"Zcash NU7 activates at mainnet block 3,543,405 (2026-11-05 is an estimate). Version 4 transactions become invalid and ZEC left in the Sprout pool becomes unspendable. Per ZIP 2003, zcashd was the only maintained software with Sprout wallet functionality, so Cake can't rescue Sprout funds. Update the app before activation.","source":"https://zips.z.cash/zip-0259"},{"date":null,"what":"Zano support will be removed in a future Cake Wallet release (no date announced). Back up your Zano seed and be ready to restore it in another Zano wallet.","source":"https://docs.cakewallet.com/cryptos/zano.md"}],"worst_case":"Cake is self-custody, so a leaked seed or a malicious 'Cake' build (for example a file pushed through a hacked Telegram account) can empty every coin in the app. Coins swapped through a centralized provider such as ChangeNOW or Trocador sit with that provider until it pays out or refunds.","safe_setup":["Install only from App Store id1334702542, Google Play com.cakewallet.cake_wallet, Accrescent, fdroid.cakelabs.com or github.com/cake-tech/cake_wallet/releases. Verify Android APKs against the published signing-certificate hash (C5:40:53:AB:…:6E:F5) with apksigner or AppVerifier.","Never install a file or 'update' sent over Telegram, even from a known staff name. Get support only through the in-app Support option, support@cakewallet.com or @cakewallet_bot.","Write the seed on paper offline, and test a small swap first. Note the Trade ID and provider so support can chase a stuck or refunded swap."],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Feather Wallet","slug":"feather-wallet","kind":"privacy_wallet","chains_or_assets":["Monero"],"listing_name":null,"official":{"domains":["featherwallet.org","docs.featherwallet.org"],"telegram":[],"x":[],"github":["github.com/feather-wallet/feather"],"apps":[],"confirmed_via":["https://beta.getmonero.org/downloads/community/ (Monero wallet list links featherwallet.org)","https://featherwallet.org/ (links github.com/feather-wallet/feather and docs.featherwallet.org)","https://github.com/feather-wallet/feather README (website featherwallet.org, docs.featherwallet.org)","https://signpath.org/projects/feather-wallet (repository github.com/feather-wallet/feather, homepage featherwallet.org)"],"notes":"Desktop only (Linux, Tails, macOS, Windows); no mobile app store listings. The release signing key fingerprint in the GitHub README is 8185 E158 A333 30C7 FD61 BC0D 1F76 E155 CEFB A71C. Each download has a .asc signature, and there is a GPG-signed hash list (e.g. featherwallet.org/files/releases/hashes-2.8.1.txt). Reproducible Guix builds, and Windows builds code-signed via SignPath. Onion mirror: featherdvtpi7ckdbkb2yxjfwx3oyvr3xjz3oo4rszylfzjdg6pbm3id.onion. Support is via Matrix #feather:monero.social, IRC #feather on OFTC and dev@featherwallet.org. The X handle @FeatherWallet appears only in site metadata, so it is not listed. Latest release is 2.8.1 (2025-04-14); there have been no releases since."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"Desktop self-custody wallet. New wallets use a 16-word Polyseed with the restore date built in. Legacy 14- and 25-word Monero seeds can be restored.","source":"https://docs.featherwallet.org/guides/seed-scheme"},"can_move_funds_out":{"value":true,"note":"Self-custody sends to any Monero address.","source":"https://docs.featherwallet.org/guides/seed-scheme"},"freeze_policy":{"note":"featherwallet.org lists no built-in exchange or swap, so funds don't pass through a third party inside the app.","source":"https://featherwallet.org/"},"api_keys":null,"privacy_coins":{"xmr":"send/receive","zec":"not supported","shielded_zec_withdrawals":null,"regions":null,"source":"https://featherwallet.org/"},"incidents":[{"date":"2024-10-08","title":"2.7.0 fixed a display bug: payments made with a payment ID could show the base address instead of the integrated address, which 'could lead to a potential loss of funds' if that address was copied and reused","amount":null,"outcome":"fixed in 2.7.0","source":"https://featherwallet.org/changelog/","kind":"outage"},{"date":"2024-04-28","title":"Sending broke: versions 2.6.5 and below failed to build transactions ('Unrealistic number of outputs in output distribution') once Monero passed 100 million RingCT outputs; emergency release 2.6.6","amount":null,"outcome":"fixed in 2.6.6 (follow-up 2.6.7 for Linux startup)","source":"https://featherwallet.org/changelog/","kind":"outage"}],"deadlines":[],"worst_case":"Feather keeps your keys on your computer, so malware on that machine, a fake installer, or a leaked Polyseed can empty the wallet. The last release was 2025-04-14, so a future Monero upgrade may need a new version before you can send.","safe_setup":["Download only from featherwallet.org (or its onion mirror) or github.com/feather-wallet/feather releases, never from search ads or links in chat.","Verify the download: check its .asc signature or the signed hashes file against the release key fingerprint 8185 E158 A333 30C7 FD61 BC0D 1F76 E155 CEFB A71C.","Write the 16-word Polyseed on paper offline, and run Feather on a clean, up-to-date machine (Tails is supported) with a strong wallet password."],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Monero GUI / CLI (official)","slug":"monero-gui-cli","kind":"privacy_wallet","chains_or_assets":["Monero"],"listing_name":null,"official":{"domains":["getmonero.org","downloads.getmonero.org"],"telegram":[],"x":[],"github":["github.com/monero-project/monero","github.com/monero-project/monero-gui"],"apps":[],"confirmed_via":["https://www.getmonero.org/2026/10/16/monero-GUI-0.18.5.4-released.html (downloads at downloads.getmonero.org, source at github.com/monero-project/monero-gui, hashes at getmonero.org/downloads/hashes.txt)","https://en.wikipedia.org/wiki/Monero (official website getmonero.org, repository github.com/monero-project)","https://beta.getmonero.org/resources/press-kit/ (links github.com/monero-project)"],"notes":"Latest is 0.18.5.4, released 2026-10-16. The 0.18.5.3 releases (2026-10-06) were marked 'highly recommended', with wallet hardening against malicious remote nodes. The GPG-signed getmonero.org/downloads/hashes.txt 'should be treated as canonical'. Verify it against the GPG keys in the source tree (utils/gpg_keys) using the guides at getmonero.org/resources/user-guides/verification-windows-beginner.html and verification-allos-advanced.html. beta.getmonero.org is the site redesign beta announced 2026-09-08. History: in Nov 2019 the official site briefly served malware-infected CLI binaries (https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/official-monero-website-compromised-delivers-coin-stealer-malware), which is why hash checks matter. The X handle @monero appears only in getmonero.org site metadata, so it is not listed. The getmonero.org/downloads page could not be fetched directly in this check."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"The wallet file is stored on your computer. The 25-word mnemonic seed 'contains all the information needed to view and spend funds', and only the seed can recover the wallet if you lose the password.","source":"https://github.com/monero-ecosystem/monero-GUI-guide/blob/master/monero-GUI-guide.md"},"can_move_funds_out":{"value":true,"note":"Self-custody sends to any Monero address.","source":"https://github.com/monero-ecosystem/monero-GUI-guide/blob/master/monero-GUI-guide.md"},"freeze_policy":null,"api_keys":null,"privacy_coins":{"xmr":"send/receive (full node or remote node)","zec":"not supported","shielded_zec_withdrawals":null,"regions":null,"source":"https://www.getmonero.org/2026/10/16/monero-GUI-0.18.5.4-released.html"},"incidents":[],"deadlines":[],"worst_case":"The keys sit in a wallet file on your computer, so a fake or trojaned download, malware on the PC, or a leaked 25-word seed can empty the wallet. The official site itself served infected binaries for a short time in 2019.","safe_setup":["Download only from getmonero.org or downloads.getmonero.org (or build from github.com/monero-project), never from ads, forks or links in chat.","Check the file's SHA256 against the GPG-signed getmonero.org/downloads/hashes.txt, and verify that signature with the official guides before running anything.","Write the 25-word seed on paper offline, run your own node or a node you trust, and stay on the latest release (0.18.5.4 as of 2026-10-16)."],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Stack Wallet","slug":"stack-wallet","kind":"privacy_wallet","chains_or_assets":["Monero","Bitcoin","Litecoin","Bitcoin Cash","Firo","Wownero","Epic Cash","Dogecoin","others"],"listing_name":null,"official":{"domains":["stackwallet.com"],"telegram":[],"x":[],"github":["github.com/cypherstack/stack_wallet"],"apps":["https://apps.apple.com/us/app/stack-wallet-by-cypher-stack/id1634811534","https://play.google.com/store/apps/details?id=com.cypherstack.stackwallet"],"confirmed_via":["https://beta.getmonero.org/downloads/community/ (Monero wallet list links stackwallet.com)","https://stackwallet.com/ (links App Store id1634811534, Google Play com.cypherstack.stackwallet, github.com/cypherstack/stack_wallet, fdroid.stackwallet.com)","https://github.com/cypherstack/stack_wallet README (website stackwallet.com, Google Play com.cypherstack.stackwallet)","https://apps.apple.com/us/app/id1634811534 (developer Cypher Stack LLC, website stackwallet.com)"],"notes":"Desktop builds (Windows, macOS, Linux) and the Android APK come from github.com/cypherstack/stack_wallet/releases/latest. stackwallet.com also links F-Droid repo fdroid.stackwallet.com, X @stack_wallet and Telegram @stackwallet, none of which we confirmed a second time. Zcash is not in the supported-coin list on stackwallet.com or the README."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"Non-custodial: 'Stack Wallet keeps all private keys in your hands.' Backup is a recovery phrase that the site tells you to write down.","source":"https://stackwallet.com/"},"can_move_funds_out":{"value":true,"note":"Self-custody sends to any address.","source":"https://stackwallet.com/"},"freeze_policy":{"note":"The built-in exchange uses third-party exchange providers; Stack itself does not perform exchanges. Release notes added Wizardswap (v2.4.3) and Exolix (v2.6.0) and removed MajesticBank (v2.3.1). The provider that receives your deposit holds it until it pays out or refunds.","source":"https://github.com/cypherstack/stack_wallet/releases"},"api_keys":null,"privacy_coins":{"xmr":"send/receive/exchange","zec":"not supported","shielded_zec_withdrawals":null,"regions":null,"source":"https://stackwallet.com/"},"incidents":[],"deadlines":[],"worst_case":"Stack is self-custody, so a leaked recovery phrase or a fake build can empty every coin in it. Coins sent to an exchange partner through the built-in exchange depend on that partner to deliver or refund.","safe_setup":["Install only from the App Store (id1634811534), Google Play (com.cypherstack.stackwallet) or github.com/cypherstack/stack_wallet releases, as linked from stackwallet.com.","Write the recovery phrase on paper offline and never paste it into a website or support chat.","Test the built-in exchange with a small amount first, and keep the trade details in case the partner holds or refunds the swap."],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Edge Wallet","slug":"edge-wallet","kind":"privacy_wallet","chains_or_assets":["Monero","Zcash","Bitcoin","Ethereum","Solana","others"],"listing_name":null,"official":{"domains":["edge.app"],"telegram":[],"x":["@EdgeWallet"],"github":["github.com/EdgeApp","github.com/EdgeApp/edge-react-gui"],"apps":["https://apps.apple.com/us/app/edge-bitcoin-crypto-wallet/id1344400091"],"confirmed_via":["https://z.cash/ecosystem/edge-wallet/ (links edge.app)","https://beta.getmonero.org/downloads/community/ (links edge.app/monero-wallet/)","https://apps.apple.com/us/app/edge-bitcoin-crypto-wallet/id1344400091 (developer Airbitz Inc, website edge.app)","https://github.com/EdgeApp (org: 'Edge Mobile App & Security platform', formerly Airbitz; website edge.app; X @edgewallet)","https://brandfetch.com/edge.app.md (profile of edge.app lists X @EdgeWallet and github.com/EdgeApp)","https://fca.org.uk/news/warnings/edge-crypto-bitcoin-wallet (UK FCA names website edge.app and its App Store/Google Play listings)"],"notes":"The Google Play listing (package co.edgesecure.app per app mirrors) was not confirmed twice, so it is not listed. The UK FCA warning list names 'Edge - Crypto & Bitcoin Wallet' (edge.app) as an unauthorised firm that may be targeting UK users (no date shown). That entry is about UK authorisation, not a scam finding. Older history: a 2023 logging bug exposed about 600 private keys, and Edge advised affected users to move funds to new wallets (https://cryptoslate.com/crypto-wallets/edge-wallet-review/)."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"Self-custody with a username/password login. 'Edge never has access to your private keys, funds, or sending and receiving transaction data.' The account is encrypted on the device before backup to Edge's servers, and recovery needs your password, an approved device, a 2FA backup code or pre-set recovery questions. You can also view the seed phrase.","source":"https://apps.apple.com/app/id1344400091"},"can_move_funds_out":{"value":true,"note":"Self-custody sends to any address.","source":"https://apps.apple.com/app/id1344400091"},"freeze_policy":{"note":"Swaps and 'Stealth' sends go through third-party providers that compete on quotes. Release notes name HoudiniSwap and MoonPay Trade (added in 4.52.0), Changelly, Rango, THORChain/Maya and others, and LetsExchange was removed. CryptoSlate notes ChangeNOW 'may require identity checks'. When a swap goes through a centralized provider, that provider holds your coins until it pays out or refunds. Buy/sell runs through Paybis, MoonPay and Banxa.","source":"https://apps.apple.com/app/id1344400091"},"api_keys":null,"privacy_coins":{"xmr":"send/receive/swap; uses a Light Wallet Server by default (since 4.49.1 you can pick LWS or your own monerod node). getmonero.org warns that LWS wallets 'may introduce privacy risks' unless you can set your own server.","zec":"send/receive/swap; Orchard to Ironwood (NU6.3) migration card since 4.50.2. Per 4.52.0 notes, sending to Zcash pays out to a transparent address, with a warning.","shielded_zec_withdrawals":null,"regions":"UK FCA lists Edge as unauthorised for UK financial promotions","source":"https://apps.apple.com/us/app/edge-bitcoin-crypto-wallet/id1344400091"},"incidents":[{"date":"2026-06-02","title":"Zcash-wide emergency: a flaw in the Orchard proof circuit led to Orchard transactions being suspended, then re-enabled by NU6.2 (Edge shipped NU6.2 support in 4.49.0). Affects every Zcash wallet.","amount":null,"outcome":"Zcash Foundation: no evidence of exploitation; user funds not affected","source":"https://cointelegraph.com/news/zcash-orchard-vulnerability-emergency-upgrade","kind":"outage"}],"deadlines":[{"date":"2026-11-05","what":"Zcash NU7 activates at mainnet block 3,543,405 (2026-11-05 is an estimate). Version 4 transactions become invalid and ZEC left in the Sprout pool becomes unspendable. Per ZIP 2003, zcashd was the only maintained software with Sprout wallet functionality, so Edge can't rescue Sprout funds. Update the app before activation.","source":"https://zips.z.cash/zip-0259"}],"worst_case":"Edge accounts are restored with a username and password (the encrypted backup is kept on Edge's servers), so anyone who gets your login details or seed phrase can send everything. Swaps through centralized partners leave coins with that partner until it pays out.","safe_setup":["Install only from the App Store listing id1344400091 (developer Airbitz Inc) or links on edge.app. Check the developer name before installing on Android.","Use a long, unique password and turn on Edge 2FA. Write down the seed phrase and recovery details offline.","For Monero privacy, point Edge at your own node instead of the default Light Wallet Server. Test a small swap first, since partners such as ChangeNOW may ask for identity checks."],"last_checked":"2026-10-24","links_status":"verified"},{"name":"Fomo","slug":"fomo","kind":"web_trading_terminal","chains_or_assets":["Solana","Base","BNB Chain","Monad","Hyperliquid perps (via third-party protocols)"],"listing_name":null,"official":{"domains":["fomo.family"],"telegram":[],"x":["@fomo"],"github":[],"apps":["https://apps.apple.com/us/app/fomo-never-miss-out/id6741115427"],"confirmed_via":["https://fomo.family (footer links x.com/fomo, the App Store listing id6741115427, discord.gg/fomofamily, /terms)","https://defillama.com/protocol/fomo-wallet (third-party: website fomo.family, X @fomo)","https://privy.io/blog/turning-trading-into-a-social-experience-with-fomo (wallet provider's case study: fomo.family, App Store id6741115427, Android package family.fomo.app)"],"notes":"Fomo is mainly a mobile app with a web version at fomo.family. It has no official Telegram trading bot. The Android listing (package family.fomo.app) is named only in Privy's case study; fomo.family links to Google Play, but we did not read the package ID from that link, so it is not double-confirmed. FomoPeek, an unrelated iOS app that SlowMist found stealing seed phrases in September 2026, is not Fomo; Protos corrected an article that had confused the two."},"known_fakes":[{"value":"fomoo.family","kind":"domain","source":"https://www.pcrisk.com/removal-guides/35598-fake-fomo-trading-platform-scam","date":"2026-07-16"},{"value":"fomoo.family","kind":"domain","source":"https://malwaretips.com/blogs/fake-fomo-trading-platform-scam-how-fomoo-family-drains-connected-crypto-wallets/","date":"2026-08-04"}],"custody":{"who_holds_keys":"user","note":"Fomo's terms say your wallet is 'generated and managed by Privy', a third-party wallet provider, and is non-custodial. You can view and export its private keys. Access is tied to the email, Apple ID or Google login you sign up with, and the terms make you solely responsible for securing those accounts.","source":"https://fomo.family/terms"},"can_move_funds_out":{"value":true,"note":"You can export the wallet's private keys (terms). Fomo also supports bank withdrawals through the app, which it says arrive within 3 business days.","source":"https://fomo.family/terms ; https://fomo.family/answers/how-long-to-withdraw-from-fomo"},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[{"date":"2026-08-23","title":"An X user claimed a Fomo iOS update caused about $6M in user losses (example: a 662 SOL transfer). Fomo's co-founder denied it, saying no transaction was signed by Fomo's fee payer. No victim list or evidence was published, and ZachXBT linked the accuser to a ZKasino co-founder","amount":"~$6M claimed (unverified)","outcome":"Denied by Fomo; unresolved, no verified losses","source":"https://crypto-economy.com/crypto-trading-app-fomo-denies-ios-hack-after-trader-claims-6m-loss/","kind":"third_party"}],"deadlines":[],"worst_case":"Your Fomo wallet is controlled through your email, Apple ID or Google login via Privy. If someone takes over that login, or you connect a wallet on a fake site such as fomoo.family, they can drain the wallet, and Fomo's terms say it is not responsible.","safe_setup":["Install Fomo only from the App Store link on fomo.family or by typing fomo.family yourself; the real site asks you to download the app, while the fomoo.family clone asks you to 'Connect wallet'","Lock down the email, Apple ID or Google account you sign in with (strong password plus 2FA), because Fomo's terms make you responsible for those credentials","Keep only trading money in the Fomo wallet and move profits to a separate wallet; if you export the private key, don't paste it into any other app or site"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"BasedBot","slug":"basedbot","kind":"telegram_bot","chains_or_assets":["Ethereum","Base","BNB Chain","Solana","Arbitrum","Avalanche","HyperEVM","Monad","and 8 other networks (16 total)"],"listing_name":null,"official":{"domains":["basedbot.app"],"telegram":["@based_eth_bot","@BasedBotVerify"],"x":["@BasedBot"],"github":[],"apps":[],"confirmed_via":["https://basedbot.app (web terminal; footer links x.com/BasedBot, telegram.me/BasedBotVerify, discord.gg/basedbot, and docs.basedbot.app)","https://x.com/BasedBot (verified profile 'Based', bio links basedbot.app and t.me/based_eth_bot)","https://docs.basedbot.app/quick-setup-guide/based-bot-set-up.md (bot link t.me/based_eth_bot)","https://docs.basedbot.app/technical-support-and-community.md (support group t.me/BasedBotVerify)"],"notes":"@based_eth_bot is the trading bot, despite the 'eth' in its name; it is multi-chain. @BasedBotVerify is the support group. The docs also link @based_vip_bot (rewards) and @based_rescue_bot, which are vendor-docs only. Do not confuse BasedBot (basedbot.app) with Based (based.one), a separate Hyperliquid app whose Telegram bot is also called 'Based Bot'. Solana Compass lists @BasedTradingBot as BasedBot's X handle, but that account does not exist, so ignore it."},"known_fakes":[],"custody":{"who_holds_keys":null,"note":"The bot can create a wallet for you or import one from a private key. Its docs say only you can see the key, that it is linked to your Telegram account and not stored in the clear, and that the database holds a 'Hashed Private Key'. The bot still signs trades and automations for you, and the docs don't explain how it does that.","source":"https://docs.basedbot.app/welcome/safety-and-security.md ; https://docs.basedbot.app/quick-setup-guide/based-bot-set-up/managing-wallets.md"},"can_move_funds_out":{"value":true,"note":"Withdraw button: pick a network, then enter any address and an amount.","source":"https://docs.basedbot.app/quick-setup-guide/based-bot-set-up/managing-wallets.md"},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[],"deadlines":[],"worst_case":"BasedBot trades from hot wallets it can sign for, and you control them through Telegram. If your Telegram account or the wallet's private key is compromised, or BasedBot's systems are breached, everything in those wallets can be withdrawn to any address.","safe_setup":["Start the bot only from the links on basedbot.app or docs.basedbot.app (trading bot @based_eth_bot); the team says it never DMs first and never asks for your private key","Create a fresh wallet in the bot rather than importing your main wallet's private key, and keep only trading funds in it","Turn on Telegram 2-step verification and withdraw profits regularly to a wallet that never touches the bot"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Genius Terminal","slug":"genius-terminal","kind":"web_trading_terminal","chains_or_assets":["Solana","Ethereum","BNB Chain","Base","Arbitrum","Avalanche","Optimism","Sonic","HyperEVM","Hyperliquid perps"],"listing_name":null,"official":{"domains":["tradegenius.com"],"telegram":["@geniusverification"],"x":["@GeniusTerminal"],"github":[],"apps":[],"confirmed_via":["https://tradegenius.com (links x.com/GeniusTerminal, t.me/geniusverification, docs.tradegenius.com)","https://x.com/GeniusTerminal (verified profile, website field tradegenius.com, 'Backed by @YziLabs')","https://docs.tradegenius.com/contact-us/community.md (lists x.com/GeniusTerminal and t.me/geniusverification)","https://decrypt.co/354643/czs-yzi-backs-genius-in-multi-8-figure-deal-to-win-the-terminal-wars (third-party: tradegenius.com)"],"notes":"There is no Telegram trading bot. @geniusverification is the community/verification group, and its double confirmation comes from two vendor pages. GENIUS is the project's token (Genius Foundation, @GeniusFDN). An automated scanner (urlert.com) flags tradegenius.exchange as suspected fraud; it is not a Genius domain, though no reputable source has said it impersonates Genius."},"known_fakes":[],"custody":{"who_holds_keys":"shared/MPC","note":"Sign-in (Google, Apple or email) is 'validated and secured by Turnkey.com and Lit Protocol'. Decrypt describes the wallet as a custom MPC-based, self-custodial wallet, and YZi Labs calls Genius non-custodial. You get separate Solana and EVM addresses and can view or download the private keys after a confirmation step.","source":"https://docs.tradegenius.com/account-set-up/account-creation.md ; https://docs.tradegenius.com/account-set-up/wallets-and-keys.md ; https://decrypt.co/354643/czs-yzi-backs-genius-in-multi-8-figure-deal-to-win-the-terminal-wars"},"can_move_funds_out":{"value":true,"note":"Private keys for both wallets can be exported. The docs we read cover deposits but have no separate withdrawal page.","source":"https://docs.tradegenius.com/account-set-up/wallets-and-keys.md"},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[],"deadlines":[],"worst_case":"Your Genius wallets are unlocked by your Google, Apple or email login. If that login and its 2FA are compromised, or an exported key leaks, someone can trade or move everything in the Solana and EVM wallets and your Hyperliquid perps balance.","safe_setup":["Go only to tradegenius.com (linked from x.com/GeniusTerminal); treat look-alike domains such as tradegenius.exchange as unrelated","Turn on Genius's 2FA (email, SMS or WhatsApp code) and a short session length, and secure the Google, Apple or email account you log in with","Fund the terminal with only what you are actively trading, and don't export the private key unless you need to; if you do, store it offline"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Based","slug":"based-one","kind":"web_trading_terminal","chains_or_assets":["Hyperliquid (perps and spot)","HIP-3 stock perps","Polymarket (predictions)"],"listing_name":null,"official":{"domains":["based.one"],"telegram":["@BasedOneVerification"],"x":["@BasedOneX"],"github":[],"apps":["https://apps.apple.com/app/basedapp-crypto-wallet/id6747331142"],"confirmed_via":["https://based.one (links x.com/BasedOneX, t.me/BasedOneVerification, app.based.one, the App Store listing id6747331142, Google Play com.basedapp.basedsuperapp, docs at basedapp.gitbook.io/docs)","https://x.com/BasedOneX (website field based.one; bio names the foundation account @BasedFnd)","https://basedapp.gitbook.io/docs/others/official-links.md (official site based.one, web terminal app.based.one, X @BasedOneX, English Telegram t.me/BasedOneVerification)","https://basedapp.gitbook.io/docs/based/mobile-app.md (App Store id6747331142)","https://defillama.com/protocol/based (third-party: app.based.one, x.com/BasedOneX)"],"notes":"app.based.one is the web terminal. The docs list the Hyperliquid Telegram bot 'Based Bot' at t.me/based_one_bot; we found it on one docs page only, so it is not double-confirmed. The Android app (com.basedapp.basedsuperapp) and app.basedapp.io are linked from based.one only. Regional Telegram groups (@basedkr, @basedchinese, @based_LATAM) are vendor-docs only. Based is not BasedBot (basedbot.app), a different multi-chain Telegram bot."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"Based's docs say it 'never takes custody of your funds. We don't store your keys.' You either create a self-custodial wallet with email or Google, or connect an existing wallet. The docs don't say who provides the email/Google wallet.","source":"https://basedapp.gitbook.io/docs/based/mobile-app.md"},"can_move_funds_out":{"value":true,"note":"Deposits and withdrawals are managed in the terminal, and you can set withdrawal addresses.","source":"https://basedapp.gitbook.io/docs/based/web-terminal.md"},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[],"deadlines":[],"worst_case":"Your trading account lives on Hyperliquid and is controlled by the wallet or login you connect. If that wallet or login is compromised, or you sign in on a fake Based site, your perps and spot balances can be traded away or withdrawn, and leveraged positions can also be liquidated.","safe_setup":["Reach Based only via based.one or app.based.one (both listed on its docs' Official Links page), and get the mobile app from the App Store link on based.one","Use a dedicated wallet or login for Based with only the margin you intend to trade, and set your withdrawal address in advance","Leverage can wipe out a position on its own, so set stop-losses (the terminal supports TP/SL and trailing stops) and size positions you can afford to lose"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"HyperDash","slug":"hyperdash","kind":"web_trading_terminal","chains_or_assets":["Hyperliquid (perps and spot)"],"listing_name":null,"official":{"domains":["hyperdash.com"],"telegram":[],"x":["@hypurrdash"],"github":[],"apps":[],"confirmed_via":["https://x.com/hypurrdash (profile 'Hyperdash', website field hyperdash.com)","https://defillama.com/protocol/hyperdash (third-party: website hyperdash.com, X @hypurrdash)","https://hyperdash.com/terms (Terms of Use page on the domain)"],"notes":"The X handle is @hypurrdash, not 'hyperdash'. We found no official Telegram bot or group. hyperdash.com did not show social links in our read-only check."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"HyperDash's terms say it uses 'Turnkey non-custodial embedded wallets, for which Users will maintain their own keys and must approve each transaction'. The terms also disclaim any warranty for 'any private key storage service' offered.","source":"https://hyperdash.com/terms"},"can_move_funds_out":{"value":true,"note":"The terms cover transfers and withdrawals of assets from the platform. They warn that funds sent to an exchange deposit address, or to an address that does not support Hyperliquid, may be lost, and that this is your responsibility.","source":"https://hyperdash.com/terms"},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[],"deadlines":[],"worst_case":"Your Hyperliquid funds sit in an embedded wallet you unlock through HyperDash. If your login is compromised, or you withdraw to a wrong or unsupported address, the funds can be lost for good, and HyperDash's terms put that risk on you.","safe_setup":["Type hyperdash.com yourself (the X account is @hypurrdash) instead of following ads or DMs","Before withdrawing, check that the receiving address supports Hyperliquid; the terms warn that funds sent to an exchange deposit address may be lost","Keep only active margin on HyperDash, and use stop-losses on leveraged and copy-trading positions"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Insilico Terminal","slug":"insilico-terminal","kind":"web_trading_terminal","chains_or_assets":["Hyperliquid","Lighter","Bybit (via API key)","Binance (via API key)"],"listing_name":null,"official":{"domains":["insilicoterminal.com"],"telegram":[],"x":["@InsilicoTrading"],"github":[],"apps":[],"confirmed_via":["https://insilicoterminal.com (links x.com/InsilicoTrading, docs.insilicoterminal.com, discord.gg/uARfuV4zrV, contact@insilicoterminal.com)","https://defillama.com/protocol/insilico-terminal (third-party: website insilicoterminal.com, X @InsilicoTrading)","https://www.quicknode.com/builders-guide/best/top-10-trading-terminals-on-hyperliquid-2026 (third-party: lists 'Insilico Terminal' by Insilico Trading)"],"notes":"Insilico is an execution terminal; it does not issue wallets. It connects to exchange accounts through API keys and to Hyperliquid through your browser wallet (a builder-fee signature is required). We found no official Telegram."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"Funds stay on your exchange or Hyperliquid/Lighter account. The API keys you add are stored in your browser's local storage, unless you turn on the optional 'Synchronize API Keys Across Devices', which stores them on Insilico's servers.","source":"https://docs.insilicoterminal.com/documentation/welcome/security.md"},"can_move_funds_out":{"value":null,"note":"Insilico never holds your funds. Withdrawals happen on the exchange or Hyperliquid account itself, and Insilico tells you never to enable withdrawals on the API keys you give it.","source":"https://docs.insilicoterminal.com/documentation/welcome/security.md"},"freeze_policy":null,"api_keys":{"note":"Insilico's docs say 'do not ever enable withdrawals' on keys you give it. Bybit keys created through its flow are locked to Insilico's server IP range. For Binance you whitelist Insilico's server IPs. It recommends one API key per application. Keys stay in local browser storage unless you opt in to server-side sync.","source":"https://docs.insilicoterminal.com/documentation/welcome/security.md"},"privacy_coins":null,"incidents":[],"deadlines":[],"worst_case":"Insilico can place trades with the API keys or Hyperliquid connection you give it, so a leaked key or a compromised device or session can open bad or leveraged trades. If you had enabled withdrawals on a key, the exchange balance could be drained.","safe_setup":["Create trade-only API keys with withdrawals disabled, IP-restricted to Insilico's servers as its docs describe, and used for Insilico only","Leave API-key sync off unless you need it, so keys stay in your browser's local storage instead of on Insilico's servers","Keep only trading margin on the connected exchange or Hyperliquid account, and revoke the key or agent approval when you stop using the terminal"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"SolTradingBot","slug":"soltradingbot","kind":"telegram_bot","chains_or_assets":["Solana"],"listing_name":null,"official":{"domains":["soltradingbot.com"],"telegram":["@SolTradingBot","@SolanaTradingBot"],"x":["@SolTradingBot"],"github":[],"apps":[],"confirmed_via":["https://soltradingbot.com (links t.me/SolTradingBot 'Start your journey!', x.com/SolTradingBot, soltradingbot.gitbook.io/docs, t.me/SolTradingBot_Channel, t.me/SolTradingBot_Portal)","https://x.com/SolTradingBot (website field soltradingbot.com)","https://soltradingbot.gitbook.io/docs/social-media/bot-system.md (Main Bot t.me/SolTradingBot, Backup Bot t.me/SolanaTradingBot, plus Europe, Asia and Americas bots)","https://coin360.com/review/sol-trading-bot (third-party: @SolTradingBot and @SolanaTradingBot)"],"notes":"@SolTradingBot is the main bot and @SolanaTradingBot the backup. Regional bots @SolTradingBot_Europe_Bot, @SolTradingBot_Asia_Bot and @SolTradingBot_Americas_Bot are vendor-docs only. @SolTradingBot_Channel and @SolTradingBot_Portal are the announcement channel and group. The docs say not to search Telegram for the bot username and to use the official links only. The site also offers a Chrome extension (soltradingbot.com/extension)."},"known_fakes":[],"custody":{"who_holds_keys":"service","note":"The bot generates wallets and sends you their private keys in the chat, or you connect an existing wallet by pasting its private key to the bot. Its docs say the keys are stored encrypted on its side. Its terms still call it 'a non-custodial tool' that holds no assets for you, but the bot must keep your keys to trade for you.","source":"https://soltradingbot.gitbook.io/docs/feature-and-instruction/wallet-and-multi-wallet/connect-wallet.md ; https://soltradingbot.gitbook.io/docs/ecosystem/security-measures.md ; https://soltradingbot.gitbook.io/docs/notice/terms-of-use.md"},"can_move_funds_out":{"value":true,"note":"The bot shows each generated wallet's private key, so you can import it into another wallet and move the funds.","source":"https://soltradingbot.gitbook.io/docs/feature-and-instruction/wallet-and-multi-wallet/multi-wallet-creation.md"},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[],"deadlines":[],"worst_case":"SolTradingBot holds the private keys of the wallets it trades from, and those keys also sit in your Telegram chat history. If your Telegram account or the bot's backend is compromised, or you paste a key into a fake bot, everything in those wallets can be taken.","safe_setup":["Open the bot only via the button on soltradingbot.com or the docs (main @SolTradingBot, backup @SolanaTradingBot); its docs say not to search Telegram for it","Never paste your main wallet's private key to 'Connect Wallet'; generate a new bot wallet and fund it only with what you are trading","Save the generated private key offline, then delete it from the Telegram chat, and turn on Telegram 2-step verification"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Moonshot","slug":"moonshot","kind":"web_trading_terminal","chains_or_assets":["Solana","tokenized equities"],"listing_name":null,"official":{"domains":["moonshot.com"],"telegram":[],"x":["@moonshot"],"github":[],"apps":[],"confirmed_via":["https://x.com/moonshot (website field moonshot.com; bio links support.moonshot.com)","https://support.moonshot.com (help center links x.com/moonshot, moonshot.com/terms, moonshot.com/privacy, t.me/MoonshotVerified)","https://defillama.com/protocol/moonshot.money (third-party: X @moonshot; website moonshot.money)"],"notes":"Moonshot is primarily a mobile app (iOS and Android) launched by the DEX Screener team; we did not read its app store IDs from an official page, so none are listed. DefiLlama lists moonshot.money as its website, while the X profile and help center use moonshot.com; both domains returned a Cloudflare block page during our check. t.me/MoonshotVerified is linked from the help center only. Fake 'Moonshot voting/listing' sites are in circulation (e.g. moonshotvotes.live, named by PCrisk in May 2026), but the report doesn't say they impersonate this Moonshot, so they are not listed as fakes here."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"Moonshot's FAQ calls it 'a self-custodial wallet app built on top of the Solana blockchain'. You can export the secret phrase (Settings > Export Keys > Export Secret Phrase) and import it into another wallet such as Phantom.","source":"https://support.moonshot.com/faqs ; https://support.moonshot.com/get-started/account-settings"},"can_move_funds_out":{"value":true,"note":"You can withdraw by direct transfer over Solana (USDC or SOL), or cash out through off-ramp providers (MoonPay, Coinbase, Robinhood), depending on your region.","source":"https://support.moonshot.com/get-started/withdraw"},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[],"deadlines":[],"worst_case":"Your Moonshot wallet's secret phrase can be exported, and anyone who gets it, or gets into your Moonshot account, can drain the wallet. Card cash-outs also depend on third-party off-ramp providers that may require ID checks.","safe_setup":["Install Moonshot only from the official app stores via links from moonshot.com or support.moonshot.com, and ignore 'Moonshot voting' or 'listing' sites that ask you to connect a wallet","Export the secret phrase only to back it up offline, and never type it into any site, bot or 'support' chat","Keep memecoin money in Moonshot separate from savings, and withdraw profits to a wallet you control"],"last_checked":"2026-10-25","links_status":"partial"},{"name":"MevX","slug":"mevx","kind":"telegram_bot","chains_or_assets":["Solana","BNB Chain","Ethereum","Base","Tron","Hyperliquid","HyperEVM","Sui","Avalanche","Robinhood Chain"],"listing_name":null,"official":{"domains":["mevx.io"],"telegram":["@MevxTradingBot","@MevX_TG"],"x":["@MEVX_Official"],"github":[],"apps":[],"confirmed_via":["https://mevx.io (links x.com/MEVX_Official, telegram.me/MEVX_TG, discord.com/invite/mevx)","https://x.com/MevX_Official (bio 'advanced trading terminal with #1 sniper on Solana, Robinhood and BNB Chain'; website field linktr.ee/MevX_Official)","https://linktr.ee/MevX_Official (linked from the X bio: docs.mevx.io, alpha.mevx.io, t.me/MevX_TG 'MevX Announcement', Chrome Web Store extension)","https://defillama.com/protocol/mevx (third-party: website mevx.io, X @MevX_Official)","https://docs.mevx.io/docs/mevx-telegram-bot.md (bot link t.me/MevxTradingBot)"],"notes":"@MevxTradingBot is the trading bot, but we confirmed it only from two MevX docs pages (mevx-telegram-bot and preview-chart) and found no independent third-party match. @MevX_TG is the announcement channel. The docs also link @MevxTrackerBot (wallet tracker) and @mevxsignalssbot (signals), vendor-docs only. MevX says its team completed KYC with Assure DeFi."},"known_fakes":[],"custody":{"who_holds_keys":"service","note":"When you log in, MevX automatically generates a trading wallet ('a secure sub-wallet ... used for trading operations') and shows its private key once. The platform signs trades from that wallet for you.","source":"https://docs.mevx.io/docs/mevx-login.md"},"can_move_funds_out":{"value":true,"note":"MevX shows the trading wallet's private key once at login, so you can import it into another wallet and move funds. We found no separate withdrawal page in the docs.","source":"https://docs.mevx.io/docs/mevx-login.md"},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[],"deadlines":[],"worst_case":"MevX generates and signs for your trading wallet, and its key is shown only once. If your Telegram or Google login, the saved key, or MevX's systems are compromised, the wallet can be emptied; if you lose the key, you depend on MevX for access.","safe_setup":["Start the bot only from docs.mevx.io (trading bot @MevxTradingBot) or the links on mevx.io, never from DMs or search results","Save the private key MevX shows once at login offline, and never paste it into another bot or site","Keep only active trading funds in the MevX wallet and sweep profits to a wallet that never touches the bot"],"last_checked":"2026-10-25","links_status":"partial"},{"name":"Ave.ai","slug":"ave-ai","kind":"web_trading_terminal","chains_or_assets":["BNB Chain","Solana","Ethereum","Base","Hyperliquid"],"listing_name":null,"official":{"domains":["ave.ai"],"telegram":["@AveSniperBot","@aveai_english"],"x":["@AveaiGlobal"],"github":[],"apps":[],"confirmed_via":["https://ave.ai (footer links x.com/AveaiGlobal and t.me/aveai_english)","https://x.com/AveaiGlobal (bio links ave.ai and t.me/aveai_english; website field linktr.ee/ave_ai)","https://linktr.ee/ave_ai (linked from the X bio: ave.ai, doc.ave.ai, t.me/AveSniperBot 'Telegram bot', x.com/aveai_info Chinese X, t.me/aveai_english)","https://doc.ave.ai/tutorial/tg-bot-tutorial/create-bot-wallet.md (bot link t.me/AveSniperBot)","https://defillama.com/protocol/ave.ai (third-party: website ave.ai, X @AveaiGlobal)"],"notes":"@AveSniperBot is Ave.ai's Telegram trading bot, and @aveai_english is the English community group. @aveai_info is the Chinese-language X account (Linktree only). Older docs pages link x.com/aveaiofficial, which we did not confirm as current. ave.ai offers the Android app as a direct APK download from download.ave-android.com rather than only through Google Play."},"known_fakes":[],"custody":{"who_holds_keys":"service","note":"This covers the Telegram bot. When you create a bot wallet, it is 'managed by the bot'; the mnemonic is shown once and 'cannot be exported' afterwards, and you can also import an existing wallet's 12-word mnemonic. The Ave.ai mobile app wallet is a password-protected wallet whose recovery phrase you back up yourself.","source":"https://doc.ave.ai/tutorial/tg-bot-tutorial/create-bot-wallet.md ; https://doc.ave.ai/tutorial/app-use-tutorial/beginners-guide-create-your-ave.ai-wallet.md"},"can_move_funds_out":{"value":true,"note":"The bot wallet's mnemonic is shown once at creation, so a saved copy lets you restore the wallet elsewhere and move funds. We found no withdrawal page in the docs.","source":"https://doc.ave.ai/tutorial/tg-bot-tutorial/create-bot-wallet.md"},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[],"deadlines":[],"worst_case":"AveSniperBot manages the wallets it creates and shows the mnemonic only once. If your Telegram account or Ave's systems are compromised, or you lose that one-time mnemonic, you can lose access to or control of the funds. A sideloaded APK from the wrong source could be malware.","safe_setup":["Open the bot only via linktr.ee/ave_ai or doc.ave.ai (trading bot @AveSniperBot), and get the app only from the download link on ave.ai","Write the bot wallet's mnemonic down offline when it is shown (it appears once and can't be exported later), and never import your main wallet's mnemonic into the bot","Keep only trading funds in bot wallets and turn on Telegram 2-step verification"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"KuCoin","slug":"kucoin","kind":"exchange","chains_or_assets":["Multi-asset centralized exchange (spot, futures, margin)"],"listing_name":null,"official":{"domains":["kucoin.com"],"telegram":["@Kucoin_Exchange"],"x":["@kucoincom"],"github":[],"apps":[],"confirmed_via":["https://www.kucoin.com/ (homepage Community section links x.com/KuCoinCom and t.me/Kucoin_Exchange)","https://www.coingecko.com/en/exchanges/kucoin (website kucoin.com, twitter.com/kucoincom, t.me/Kucoin_Exchange)","https://x.com/KuCoinCom (verified profile, checked 2026-10-25)"],"notes":"@Kucoin_Exchange is a community channel, not a trading bot. The X bio names regional/support accounts (@KuCoinUpdates support, @KuCoin_UK, @kucoinaustralia) that were not independently confirmed. EEA users are served by KuCoin EU Exchange GmbH (Vienna) on kucoin.com/en-eu paths. App downloads: use kucoin.com/download (store listing IDs not independently confirmed)."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Custodial exchange. KuCoin EU's custody agreement says only KuCoin EU holds the means of access to your crypto (you do not have self-custody) and that client assets sit in segregated on-chain wallets.","source":"https://www.kucoin.com/en-eu/support/47185419968075"},"can_move_funds_out":{"value":true,"note":"Crypto withdrawals are available, subject to KYC level and compliance controls; KuCoin's own XMR guide says Level 2 KYC is required for privacy-coin withdrawals.","source":"https://www.kucoin.com/blog/id-2026-monero-trading-guide-why-kucoin-remains-the-top-choice-for-buying-xmr"},"freeze_policy":{"note":"KuCoin EU General Terms (last updated 2026-01-28): KuCoin EU may apply temporary measures including account suspension, transaction freezing or service restrictions, e.g. during ongoing AML/CFT investigations including EU Travel Rule checks (s.14.3.1); a freeze disables all deposits, withdrawals and transfers of crypto (s.14.3.3(B)); you must promptly provide any information or documents requested (s.9.1.3); KuCoin EU can end an account with two months' notice (s.14.1.2) and after termination you have one month to move assets out, after which a 0.1%/month custody fee may apply (s.15.2, 15.5). No maximum duration for a freeze is stated. Terms for the global (non-EU) entity could not be retrieved.","source":"https://www.kucoin.com/en-eu/support/47185419968075"},"api_keys":{"note":"Permissions are chosen per key: General (read-only), Spot/Margin/Futures trading, Earn, Withdrawal, FlexTransfers and others. The Withdrawal permission can only be used with IP Restriction enabled, and FlexTransfers also requires an IP filter; KuCoin warns these permissions move money without email or Google 2FA verification. Since 2018 new keys default to read-only. Key expiry rules are not stated in the docs page.","source":"https://www.kucoin.com/docs-new"},"privacy_coins":{"xmr":"trade+deposit+withdraw: XMR spot pairs (USDT, BTC, ETH, USDC) and XMR perpetuals; KuCoin public API showed XMR deposits and withdrawals enabled on 2026-10-25 (https://api.kucoin.com/api/v3/currencies/XMR). Third-party: XMR deposits/withdrawals were paused from 2026-09-24 and re-enabled by 2026-10-20 (https://en.coin-turk.com/?p=254402)","zec":"trade+deposit+withdraw: KuCoin public API showed ZEC (native ZEC chain) deposits and withdrawals enabled on 2026-10-25 (https://api.kucoin.com/api/v3/currencies/ZEC)","shielded_zec_withdrawals":null,"regions":"Not stated for XMR by KuCoin. KuCoin says Level 2 KYC is required for privacy-coin withdrawals. Whether KuCoin EU offers XMR/ZEC was not confirmed.","source":"https://www.kucoin.com/blog/id-2026-monero-trading-guide-why-kucoin-remains-the-top-choice-for-buying-xmr"},"incidents":[{"date":"2026-09-24","title":"XMR deposits and withdrawals paused on KuCoin; shown as enabled again by 2026-10-20 (third-party report)","amount":null,"outcome":"resumed","source":"https://en.coin-turk.com/?p=254402","kind":"outage"},{"date":"2026-03-30","title":"US court approved CFTC consent order: KuCoin operator Peken Global permanently barred from serving US users unless registered as a foreign board of trade; $500,000 penalty","amount":"$500,000","outcome":"US users cannot use KuCoin","source":"https://cointelegraph.com/news/kucoin-fined-500k-as-cftc-cases-ends","kind":"freeze"},{"date":"2026-03-05","title":"Dubai's crypto regulator (VARA) issued a cease-and-desist against KuCoin entities, including KuCoin Exchange EU GmbH, for serving Dubai residents without approval","amount":null,"outcome":"regulatory warning; no reported effect on balances","source":"https://finance.yahoo.com/markets/crypto/articles/u-bans-crypto-operator-dubai-225301785.html","kind":"freeze"},{"date":"2026-02-19","title":"Austria's FMA banned KuCoin EU from new business (no new customers or new contracts) over AML/CTF and sanctions-compliance staffing gaps, about three months after granting its MiCA licence; date approximate (decision reported 2026-02-23 as made 'Thursday')","amount":null,"outcome":"onboarding halted; effect on existing balances not reported","source":"https://cointelegraph.com/news/austria-regulator-slaps-new-business-ban-kucoin-eu","kind":"freeze"},{"date":"2025-01-27","title":"KuCoin (Peken Global) pleaded guilty in the US to operating an unlicensed money transmitting business, agreed to pay ~$297M and to exit the US market for at least two years; date approximate (January 2025)","amount":"~$297M","outcome":"US exit","source":"https://finance.yahoo.com/markets/crypto/articles/u-bans-crypto-operator-dubai-225301785.html","kind":"freeze"}],"deadlines":[{"date":"2027-07-10","what":"EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use this service through its EU-licensed entity (KuCoin EU Exchange GmbH, Austria; MiCA licence reported 2025-11-28: https://cointelegraph.com/news/kucoin-mica-license-austria-malta-left-out).","source":"https://didit.me/blog/privacy-coins-no-kyc-swaps-rules-2026/"}],"worst_case":"KuCoin holds your coins and can freeze all deposits, withdrawals and transfers during AML or Travel Rule reviews with no stated time limit, and regulators have already shut it out of the US and restricted its EU arm.","safe_setup":["Give bots General plus the one trading permission they need; never enable Withdrawal or FlexTransfers on a key you paste into a third-party tool","If a key must have Withdrawal, KuCoin forces an IP restriction: bind it to your own server's static IP only","Check that your country is allowed (KuCoin is barred for US users) and keep long-term holdings in your own wallet"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"MEXC","slug":"mexc","kind":"exchange","chains_or_assets":["Multi-asset centralized exchange (spot, futures, margin)"],"listing_name":null,"official":{"domains":["mexc.com"],"telegram":[],"x":["@MEXC"],"github":[],"apps":[],"confirmed_via":["https://www.mexc.com/ (meta twitter:site 'MEXC', checked 2026-10-25)","https://coinmarketcap.com/exchanges/mexc/ (website mexc.com, twitter.com/MEXC)","https://x.com/MEXC (verified profile, links mexc.com, checked 2026-10-25)","https://www.coingecko.com/en/exchanges/mexc (mexc.com)"],"notes":"Warning: CoinGecko and the mexc.com 'twitter:creator' tag still name @MEXC_Official, but x.com/MEXC_Official showed 'This account doesn't exist' on 2026-10-25, so that handle could be re-registered by anyone. MEXC's X bio names @MEXC_CST as support (not independently confirmed). Telegram t.me/MEXCEnglish is listed by CoinGecko and CoinMarketCap but was not found on mexc.com, so not listed. MEXC runs an official 'MEXC Verify' tool (mexc.com/official-verify) for checking whether a Telegram/X account or contact is genuine. Some regional mexc.com paths redirected to mexc.co during this check; mexc.co was not independently confirmed."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Custodial exchange account.","source":"https://www.mexc.com/support/articles/17827791523856"},"can_move_funds_out":{"value":true,"note":"Withdrawals are available but can be blocked while an account is under risk review; withdrawals may require KYC facial verification.","source":"https://www.mexc.com/support/articles/17827791523856"},"freeze_policy":{"note":"MEXC's Account Risk Review Guide (dated 2026-09-21): its risk-control system may restrict features or make services 'temporarily unavailable' until verification is complete; restrictions cannot be lifted manually or early. It may request source-of-funds records (wallet ownership, tx hashes, exchange records), income/employment proof (e.g. three months of bank statements) and proof of address. Document review typically takes ~3 business days; a further risk-control analysis has an estimated duration shown in-app that is 'for reference only'. In 2025 MEXC told Cointelegraph that a 12-month review period applies to accounts it classes as coordinated violations, high-risk or compliance-risk. On 2025-11-01 MEXC said some earlier rules had been 'overly rigid' and set up an expedited unfreeze-review team.","source":"https://www.mexc.com/support/articles/17827791523856"},"api_keys":{"note":"Binding IP addresses to a key is optional but strongly encouraged; keys not bound to an IP are valid for 90 days and can be renewed for 90 days within 5 days of expiry. Trading keys can be restricted to specific pairs. Futures order permission requires KYC. Whether a Withdraw permission exists and its default was not confirmed in MEXC's docs.","source":"https://www.mexc.com/api-docs/futures/integration-guide"},"privacy_coins":{"xmr":"XMR/USDT spot market listed on mexc.com (https://www.mexc.com/price/XMR, checked 2026-10-25); third-party survey also lists XMR/USDC (https://en.coin-turk.com/?p=254402). Deposit/withdrawal status not confirmed","zec":"ZEC/USDT and ZEC/USDC spot markets listed (third-party: https://coinranking.com/coin/aRGRWLf2RYNq4+zcash-zec/markets); MEXC also announced ZEC on BNB Smart Chain (https://www.mexc.com/lv-LV/announcements/article/mexc-to-support-zec-on-bsc-network-17827791531632)","shielded_zec_withdrawals":null,"regions":null,"source":"https://www.mexc.com/price/XMR"},"incidents":[{"date":"2025-07-01","title":"MEXC froze ~$3M of a trader ('White Whale') under a 12-month risk review; after a public campaign MEXC's CSO apologised and released the funds on 2025-10-31 (freeze date approximate: 'July')","amount":"~$3M","outcome":"released after ~4 months","source":"https://decrypt.co/347043/mexc-exec-promises-changes-after-blowup-frozen-crypto-millions","kind":"freeze"},{"date":"2024-03-15","title":"Hong Kong SFC warned that MEXC operates in Hong Kong without a licence (article date; warning issued on or shortly before)","amount":null,"outcome":"regulatory warning","source":"https://www.cryptometer.io/news/hong-kong-regulator-flags-mexc-for-operating-without-a-license/","kind":"freeze"}],"deadlines":[],"worst_case":"MEXC holds your coins and its risk-control system can lock withdrawals pending document checks with no fixed end date (it has described 12-month reviews), and a leaked API key without IP binding works from anywhere until it expires.","safe_setup":["Bind every API key to your server's IP and, if you must share a key with a tool, restrict it to the trading pairs it needs","Before contacting 'MEXC support' or following an MEXC X/Telegram account, check it in MEXC Verify on mexc.com; @MEXC_Official no longer exists on X","Complete KYC before depositing large sums and keep records showing where your deposits came from, since MEXC asks for these during reviews"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Gate","slug":"gate","kind":"exchange","chains_or_assets":["Multi-asset centralized exchange (spot, futures, margin)"],"listing_name":null,"official":{"domains":["gate.com"],"telegram":["@GateCom_EN"],"x":["@Gate"],"github":[],"apps":[],"confirmed_via":["https://www.gate.com/help/guide/faq/44564 (Gate help center footer links x.com/Gate and t.me/GateCom_EN)","https://www.coingecko.com/en/exchanges/gate (gate.com, twitter.com/Gate, t.me/GateCom_EN)","https://coinmarketcap.com/exchanges/gate/ (gate.com, @Gate, t.me/GateCom_EN)","https://x.com/Gate (verified; bio names Gate.com and t.me/GateCom_EN, checked 2026-10-25)"],"notes":"Gate moved from gate.io to gate.com on 2025-05-19; Gate says gate.io now permanently redirects to gate.com and warns the change creates phishing opportunities, so type gate.com directly (https://www.gate.com/blog/gate.io-vs-gate.com-official-domain-migration-explained). Telegram @GateCom_EN is a community channel. CoinGecko lists github.com/gate, not independently confirmed. EU users are served by Gate Technology Ltd ('Gate Europe', Malta)."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Custodial exchange account.","source":"https://www.gate.com/help/guide/faq/44564"},"can_move_funds_out":{"value":true,"note":"Withdrawals available; a risk-control freeze can block deposits, withdrawals and orders.","source":"https://www.gate.com/help/guide/faq/44564"},"freeze_policy":{"note":"Gate's help center (2025-04-22) says accounts can be frozen by risk control for login anomalies (frequent logins from different countries, sudden IP changes) or rule violations such as suspected money laundering or high-frequency bot trading; signs include being unable to deposit, withdraw or place orders. Gate explains next steps by email or in-site message. No document list or review duration is stated.","source":"https://www.gate.com/help/guide/faq/44564"},"api_keys":{"note":"Keys are 'Read and Write' or 'Read Only'; Gate's guide says API keys have permissions to withdraw and deposit. IP binding is optional; a key without IP binding accepts requests from any address and is valid for 90 days. API withdrawals require at least 24 hours since the last manual withdrawal. Default for the withdrawal permission is not stated.","source":"https://www.gate.com/es/help/guide/faq/17521"},"privacy_coins":{"xmr":"XMR perpetual futures (USDT-M) listed 2025-11-08 (official notice https://www.gate.com/announcements/article/48074); XMR spot availability not confirmed","zec":"ZEC/USDT spot market listed (third-party: https://coinranking.com/coin/aRGRWLf2RYNq4+zcash-zec/markets and https://cryptorank.io/es/price/zcash/exchanges)","shielded_zec_withdrawals":null,"regions":null,"source":"https://www.gate.com/announcements/article/48074"},"incidents":[{"date":"2025-04-23","title":"Futures and copy trading suspended during an emergency capacity upgrade after heavy traffic; Gate pledged '100% compensation' for losses during the upgrade (excluding market factors)","amount":null,"outcome":"service restored same day; compensation method not reported","source":"https://www.theblock.co/post/351654/gate-io-emergency-upgrade-compensation","kind":"outage"}],"deadlines":[{"date":"2027-07-10","what":"EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use this service through its EU-licensed entity (Gate Technology Ltd, Malta; MiCA licence announced 2025-10-01: https://www.theblock.co/post/373025/gate-group-announces-gate-technology-ltd-received-the-mica-license-from-malta-financial-services-authority-mfsa-extends-its-compliance-footprint-in-europe).","source":"https://didit.me/blog/privacy-coins-no-kyc-swaps-rules-2026/"}],"worst_case":"Gate holds your coins and can freeze deposits, withdrawals and trading on risk-control grounds with no stated timeline, and its API keys can carry withdrawal rights that work from any IP unless you bind one.","safe_setup":["Create bot keys as Read Only where possible; if a key needs Read and Write, bind it to your server's IP","Type gate.com directly: gate.io now redirects and lookalike domains of the old name are a phishing risk","Expect a risk-control freeze if you log in from many countries or IPs in a short time; keep long-term holdings in your own wallet"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"HTX","slug":"htx","kind":"exchange","chains_or_assets":["Multi-asset centralized exchange (spot, futures, margin)"],"listing_name":null,"official":{"domains":["htx.com"],"telegram":[],"x":["@HTX_Global"],"github":[],"apps":[],"confirmed_via":["https://decrypt.co/345607/htx-releases-2025-q3-report-trading-volume-surges-25-htx-burn-hits-record-high (HTX press release 'About HTX': htx.com, x.com/HTX_Global)","https://coinmarketcap.com/exchanges/htx/ (htx.com/en-us, twitter.com/HTX_Global)","https://x.com/HTX_Global (verified profile linking htx.com, checked 2026-10-25)"],"notes":"Formerly Huobi Global; CoinGecko still lists the old @HuobiGlobal handle and huobi.com. HTX press releases list Telegram t.me/htxglobalofficial while the X bio shows t.me/htxglobalofficial3, so no Telegram handle is listed. Operator named in sanctions actions: Huobi Global S.A. (Panama)."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Custodial exchange account. HTX says Huobi Global S.A. is distinct from the online exchange and that user funds are safe.","source":"https://decrypt.co/374245/eu-names-justin-suns-htx-in-russia-sanctions-two-months-after-uk"},"can_move_funds_out":{"value":true,"note":"Withdrawals from HTX itself operate, but since 2026-08-23 Binance stopped processing transfers involving HTX and other platforms and stablecoin issuers have frozen HTX-linked tokens, so where you can send funds is limited.","source":"https://cryptobriefing.com/htx-liquidity-binance-blocks-transfers/"},"freeze_policy":null,"api_keys":{"note":"Third-party integration guides: keys have Read-Only, Trade and Withdraw permissions chosen at creation (Bitsgap recommends Withdraw disabled), IP binding is optional, and HaasOnline states HTX API keys expire every 90 days. Not confirmed from HTX's own docs.","source":"https://bitsgap.com/helpdesk/article/9917844045212-How-to-Create-and-Set-Up-HTX-API-key"},"privacy_coins":{"xmr":"XMR/USDT spot listed (third-party: https://en.coin-turk.com/?p=254402 and https://coinranking.com/coin/3mVx2FX_iJFp5+monero-xmr/markets); deposit/withdrawal status not confirmed","zec":"ZEC/USDT spot listed (third-party: https://coinranking.com/coin/aRGRWLf2RYNq4+zcash-zec/markets)","shielded_zec_withdrawals":null,"regions":"Since 2026-08-23 people in the EU are barred from transacting with the exchange under the EU's Russia sanctions listing of Huobi Global S.A.; UK-nexus dealings prohibited since 2026-05-26","source":"https://en.coin-turk.com/?p=254402"},"incidents":[{"date":"2026-08-23","title":"Binance stopped processing deposits and withdrawals involving HTX (and other listed platforms) for sanctions compliance; transfers traced to listed entities may be held for review","amount":null,"outcome":"ongoing","source":"https://cryptobriefing.com/htx-liquidity-binance-blocks-transfers/","kind":"freeze"},{"date":"2026-08-18","title":"Users reported unsolicited small USDT transfers labelled as HTX-linked ('dusting'), followed by reviews or freezes of their accounts on other exchanges; HTX denied sending them (user reports)","amount":"up to ~12 USDT per transfer","outcome":"some accounts restored after escalation; cause disputed","source":"https://coin360.com/news/htx-dusting-transfers-binance-restrictions","kind":"user_reports"},{"date":"2026-07-23","title":"EU listed Huobi Global S.A. (HTX) in its 21st Russia sanctions package; transactions with the exchange barred for people in the EU from 2026-08-23 (no asset freeze)","amount":null,"outcome":"EU users cut off","source":"https://decrypt.co/374245/eu-names-justin-suns-htx-in-russia-sanctions-two-months-after-uk","kind":"freeze"},{"date":"2026-06-05","title":"World Liberty Financial froze WLFI tokens held in HTX-linked addresses citing a UK sanctions review; HTX suspended WLFI/USD1 pairs, converted user USD1 to USDT 1:1 and delisted USD1 on 2026-06-07","amount":null,"outcome":"WLFI withdrawals halted until freeze lifted","source":"https://coinpaprika.com/news/wlfi-freezes-htx-user-assets-delists-usd1/","kind":"freeze"},{"date":"2026-05-26","title":"UK sanctioned Huobi Global S.A. (HTX) for alleged support of Russia-linked financial networks: asset freeze and ban on UK persons dealing with it; HTX denies the allegations","amount":null,"outcome":"UK-nexus transactions prohibited","source":"https://www.trmlabs.com/resources/blog/uk-designates-huobi-exmo-bitpapa-and-11-other-entities-for-russian-crypto-sanctions-evasion","kind":"freeze"}],"deadlines":[],"worst_case":"HTX's operator is under UK and EU sanctions: coins held on HTX, or sent from it, can be frozen by token issuers or held by other exchanges' compliance checks, and people in the UK and EU are barred from dealing with it.","safe_setup":["If you are in the UK or EU, do not open or fund an HTX account: dealing with it is prohibited under UK sanctions and, since 2026-08-23, under EU measures","Expect that coins withdrawn from HTX may be held or rejected by other exchanges and by stablecoin or token issuers' sanctions screening","Give any bot key only Read and Trade permissions with Withdraw off, and bind it to your server's IP"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Crypto.com Exchange","slug":"crypto-com-exchange","kind":"exchange","chains_or_assets":["Multi-asset centralized exchange (spot, futures, margin)"],"listing_name":null,"official":{"domains":["crypto.com"],"telegram":[],"x":["@cryptocom"],"github":[],"apps":["https://apps.apple.com/app/crypto-com-exchange/id1569309855"],"confirmed_via":["https://crypto.com/de/company-news/mica-change-in-license (site footer links x.com/cryptocom)","https://www.coingecko.com/en/exchanges/crypto_com (crypto.com/exchange, twitter.com/cryptocom)","https://coinmarketcap.com/exchanges/crypto-com-exchange/ (crypto.com/exchange, @cryptocom)","https://crypto.com/exchange (links App Store id1569309855); https://apps.apple.com/app/crypto-com-exchange/id1569309855 (seller Foris DAX Limited, developer site crypto.com/exchange)","https://x.com/cryptocom (verified, links crypto.com, checked 2026-10-25)"],"notes":"The Exchange lives at crypto.com/exchange and is a separate product from the Crypto.com App. crypto.com/exchange also links Google Play id com.crypto.exchange (only one confirmation, so not listed). Telegram t.me/CryptoComOfficial is listed by CoinGecko/CoinMarketCap but was not found on crypto.com, so not listed. EEA services run through Foris DAX MT Limited (Malta)."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Custodial; the EU entity Foris DAX MT is authorised for custody under MiCA.","source":"https://crypto.com/de/company-news/mica-change-in-license"},"can_move_funds_out":{"value":true,"note":"Withdrawals available, but terms allow freezing assets and refusing transactions.","source":"https://financialarbiter.org.mt/sites/default/files/oafs/decisions/2550/ASF%20021-2025%20-%20TO%20vs%20Foris%20DAX%20MT%20Limited_0.pdf"},"freeze_policy":{"note":"As quoted in a Malta Financial Arbiter decision (2025-06-20): Crypto.com (Foris DAX MT) Terms of Use clause 2.3 reserve the right to suspend, restrict or terminate access to any or all services, including on suspicion of money laundering, fraud or other financial crime or pending investigation; clause 15.1 allows freezing digital assets, refusing or reversing transactions 'for any reason'. In that case a user's account had been restricted since 2024-06-17 and Crypto.com said regulatory reasons prevented releasing funds or more information; the Arbiter declined to order release. In 2026 Crypto.com told BeInCrypto it 'may place restrictions on accounts while such reviews are ongoing'. No maximum duration is stated.","source":"https://financialarbiter.org.mt/sites/default/files/oafs/decisions/2550/ASF%20021-2025%20-%20TO%20vs%20Foris%20DAX%20MT%20Limited_0.pdf"},"api_keys":{"note":"Third-party integration guides only: keys have per-key restrictions ('Can Read' on by default, 'Enable Trading' optional) and an IP access restriction setting ('Restricted to certain IPs'). How withdrawal permission and expiry work was not confirmed from Crypto.com's own docs.","source":"https://bitsgap.com/helpdesk/article/10087762559260-How-to-Create-and-Set-Up-Crypto-com-API-Key"},"privacy_coins":{"xmr":"not listed (third-party survey: no XMR market on Crypto.com Exchange, https://en.coin-turk.com/?p=254402)","zec":null,"shielded_zec_withdrawals":null,"regions":null,"source":"https://en.coin-turk.com/?p=254402"},"incidents":[{"date":"2026-08-13","title":"Reported by a user (BeInCrypto staff member): Exchange account suddenly inaccessible ('401 Unauthorized'), support first called it 'rejected' then said no account existed; funds still not returned after ~8 days","amount":null,"outcome":"unresolved at publication (2026-08-21); Crypto.com asked for a withdrawal address","source":"https://beincrypto.com/crypto-com-locked-user-account-with-funds/","kind":"user_reports"},{"date":"2025-09-19","title":"Bloomberg reported a previously undisclosed pre-2023 breach by a Scattered Spider member via a phished employee account; Crypto.com said a 'very small number' of people's personal data was affected and no funds were accessed","amount":null,"outcome":"no customer funds lost (per Crypto.com)","source":"https://www.theblock.co/post/371531/previously-unreported-attack-on-crypto-com-leaked-users-personal-data-bloomberg","kind":"hack"},{"date":"2025-06-20","title":"Malta Financial Arbiter rejected a user's request to order release of an account blocked since 2024-06-17, finding Crypto.com acted within its terms","amount":null,"outcome":"funds not released by order","source":"https://financialarbiter.org.mt/sites/default/files/oafs/decisions/2550/ASF%20021-2025%20-%20TO%20vs%20Foris%20DAX%20MT%20Limited_0.pdf","kind":"freeze"},{"date":"2025-01-28","title":"Crypto.com told EU users it would delist USDT and nine other non-MiCA-compliant tokens (purchases suspended 2025-01-31, full delisting 2025-03-31); unconverted holdings auto-swapped","amount":null,"outcome":"forced conversion for EU holders","source":"https://www.itiger.com/news/2507647256","kind":"delisting"}],"deadlines":[{"date":"2027-07-10","what":"EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use this service through its EU-licensed entity (Foris DAX MT Limited, Malta; MiCA authorisation 2025-01-27: https://crypto.com/de/company-news/mica-change-in-license).","source":"https://didit.me/blog/privacy-coins-no-kyc-swaps-rules-2026/"}],"worst_case":"Crypto.com holds your coins and its terms let it freeze assets or cut access 'for any reason' during reviews; a Malta arbiter upheld a freeze that had lasted about a year without an explanation to the user.","safe_setup":["Restrict every API key to your server's IP and give bots only read and trading rights","Use crypto.com/exchange (not the App) only if you need it, and verify app listings are published by Foris DAX","Keep only active trading balances on the Exchange and withdraw the rest to your own wallet"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"BingX","slug":"bingx","kind":"exchange","chains_or_assets":["Multi-asset centralized exchange (spot, perpetual futures incl. stock/forex/commodity perps, copy trading)"],"listing_name":null,"official":{"domains":["bingx.com"],"telegram":["@BingXOfficial"],"x":["@BingXOfficial"],"github":[],"apps":[],"confirmed_via":["https://bingx.com/en (footer links x.com/BingXOfficial and t.me/BingXOfficial; meta twitter:site @BingxOfficial)","https://www.coingecko.com/en/exchanges/bingx (bingx.com, twitter.com/BingXOfficial, t.me/BingXOfficial)","https://x.com/BingXOfficial (verified, checked 2026-10-25)"],"notes":"@BingXOfficial on Telegram is a community channel. The X bio links bingxofficial.com/m/social, a second domain not independently confirmed. App downloads: use bingx.com/en/download (store IDs not confirmed)."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Custodial; in the 2024 hack BingX said most assets were in cold wallets and only part of a hot wallet was affected.","source":"https://www.theblock.co/post/317448/crypto-exchange-bingx-faces-an-estimated-43-million-security-exploit-peckshield"},"can_move_funds_out":{"value":true,"note":"Withdrawals available; unverified accounts have limited features and accounts under security review are restricted until identity verification.","source":"https://bingx.com/en/support/articles/16392168865679"},"freeze_policy":{"note":"BingX's Account Compliance Guide (2026-06-07): actions range from account restrictions and asset freezes to permanent bans for multiple accounts, wash trading/manipulation, false ID documents, using VPNs/proxies from restricted regions, account sharing, involvement with illegal funds and community violations. A login from a new location can trigger a security review during which account functions are restricted until identity verification is complete. KYC needs a government ID and a selfie with it. Appeals via bingx.com/security/limithelper. No review durations are stated.","source":"https://bingx.com/en/support/articles/16392168865679"},"api_keys":{"note":"Third-party (Hummingbot docs): permissions are chosen when creating the key, and enabling the withdrawal permission requires linking IP addresses. Expiry rules not found; not confirmed from BingX's own docs.","source":"https://hummingbot.org/exchanges/bing_x/"},"privacy_coins":{"xmr":null,"zec":"ZEC/USDT spot listed 2026-08-28; deposits/withdrawals supported on the BEP20 (BNB Smart Chain) network per the listing notice","shielded_zec_withdrawals":null,"regions":null,"source":"https://bingx.com/en-us/support/articles/17398637905167"},"incidents":[{"date":"2024-09-20","title":"Hot-wallet hack, estimated ~$43M by PeckShield; withdrawals paused and restored in stages from 2024-09-21; BingX promised a compensation plan","amount":"~$43M (PeckShield estimate)","outcome":"BingX said it would compensate; full payout details not reported","source":"https://www.theblock.co/post/317448/crypto-exchange-bingx-faces-an-estimated-43-million-security-exploit-peckshield","kind":"hack"}],"deadlines":[],"worst_case":"BingX holds your coins: a hot-wallet hack in 2024 paused withdrawals for days, and its rules allow asset freezes or bans with no stated review time.","safe_setup":["Leave withdrawal permission off on bot keys; if you ever enable it, BingX requires linking your server's IP","Complete KYC before depositing and avoid logging in through VPNs or proxies, which BingX lists as a restriction trigger","Withdraw profits to your own wallet regularly instead of storing them on the exchange"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Bitfinex","slug":"bitfinex","kind":"exchange","chains_or_assets":["Multi-asset centralized exchange (spot, margin, derivatives, lending)"],"listing_name":null,"official":{"domains":["bitfinex.com"],"telegram":[],"x":["@bitfinex"],"github":[],"apps":["https://apps.apple.com/us/app/bitfinex-trade-digital-assets/id1436383182"],"confirmed_via":["https://www.bitfinex.com/ (footer links x.com/bitfinex, App Store id1436383182, Google Play com.bitfinex.mobileapp)","https://www.coingecko.com/en/exchanges/bitfinex (bitfinex.com, twitter.com/bitfinex)","https://apps.apple.com/us/app/bitfinex-trade-digital-assets/id1436383182 (developer Bitfinex, seller iFinex Inc., site bitfinex.com)","https://x.com/bitfinex (verified, links bitfinex.com, checked 2026-10-25)"],"notes":"Bitfinex's homepage and support pages link Telegram t.me/bitfinex, but no independent second source was found, so it is not listed. Google Play com.bitfinex.mobileapp and an APK at github.com/bitfinexcom are linked from bitfinex.com only (one confirmation)."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Custodial exchange account (operated by iFinex Inc.).","source":"https://apps.apple.com/us/app/bitfinex-trade-digital-assets/id1436383182"},"can_move_funds_out":{"value":true,"note":"Withdrawals available from the account and, if enabled, via API.","source":"https://support.bitfinex.com/hc/en-us/articles/115003363429-How-to-create-and-revoke-a-Bitfinex-API-Key"},"freeze_policy":null,"api_keys":{"note":"Permissions are set per key by category (Account Info, Orders, Wallets, Withdrawals, etc.); the Withdrawals permission 'enables withdrawals through the API'. Keys can be limited to up to 20 whitelisted IP addresses. Creating a key needs 2FA plus an email confirmation; editing permissions needs 2FA. Default for Withdrawals and any expiry are not stated.","source":"https://support.bitfinex.com/hc/en-us/articles/115003363429-How-to-create-and-revoke-a-Bitfinex-API-Key"},"privacy_coins":{"xmr":"XMR spot listed against USD, BTC and USDT (third-party: https://en.coin-turk.com/?p=254402 and https://coinranking.com/coin/3mVx2FX_iJFp5+monero-xmr/markets); deposit/withdrawal status not confirmed","zec":"ZEC/USD listed (third-party: https://coinranking.com/coin/aRGRWLf2RYNq4+zcash-zec/markets)","shielded_zec_withdrawals":null,"regions":null,"source":"https://en.coin-turk.com/?p=254402"},"incidents":[],"deadlines":[],"worst_case":"Bitfinex holds your coins, and an API key with the Withdrawals permission and no IP whitelist can move funds out from anywhere if it leaks.","safe_setup":["Never tick the Withdrawals permission on a key used by a bot or third-party tool","Whitelist your server's IP (up to 20) on every key","Keep long-term holdings in your own wallet; no full Terms of Service could be checked for freeze rules"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Bitvavo","slug":"bitvavo","kind":"exchange","chains_or_assets":["Centralized EUR spot exchange"],"listing_name":null,"official":{"domains":["bitvavo.com"],"telegram":[],"x":["@bitvavocom"],"github":[],"apps":[],"confirmed_via":["https://support.bitvavo.com/hc/en-us (Bitvavo help center links x.com/bitvavocom)","https://bitvavo.com/de/blog/bitvavo-obtains-mica-licence (Bitvavo site links x.com/bitvavocom)","https://coinmarketcap.com/exchanges/bitvavo/ (bitvavo.com, twitter.com/bitvavocom)","https://x.com/bitvavocom (verified, links bitvavo.com, checked 2026-10-25)"],"notes":"API docs at docs.bitvavo.com (linked from CoinGecko; Bitvavo's own SDK at github.com/bitvavo not independently confirmed). Bitvavo's site advertises an iOS app id1483903423 (one confirmation only)."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Custodial exchange run by Bitvavo B.V. (Amsterdam), MiCA-licensed by the Dutch AFM.","source":"https://bitvavo.com/de/blog/bitvavo-obtains-mica-licence"},"can_move_funds_out":{"value":true,"note":"Crypto can be withdrawn to external wallets, but Bitvavo has 'trade-only' assets that cannot be sent to an external wallet and can only be sold for euros.","source":"https://support.bitvavo.com/hc/en-us/articles/42230921168145-Why-are-Bitvavo-services-being-suspended-for-Hungarian-residents"},"freeze_policy":{"note":"Bitvavo blocks crypto withdrawals for 24 hours after an email, password, 2FA or phone-number change; this cannot be lifted manually. Other withdrawal restrictions for 'security reasons' require a support review with no stated duration. Accounts are blocked for e.g. duplicate accounts, under-18 users, PayPal deposits without a verified IBAN, or an expired residence permit used for ID; extra verification 'may take a few business days'. Funds in a blocked account can be withdrawn to your verified bank account.","source":"https://support.bitvavo.com/hc/en-us/articles/4405243608337-Why-are-my-crypto-withdrawals-temporarily-blocked"},"api_keys":{"note":"Permissions per key: View, Trade and Withdraw. Withdrawals made with the API do not require 2FA or e-mail confirmation. IP whitelisting is optional but 'highly recommended': without it anyone holding the keys can act on the account. Expiry is not mentioned.","source":"https://docs.bitvavo.com/docs/get-started/"},"privacy_coins":null,"incidents":[{"date":"2025-12-26","title":"Bitvavo suspended buying, selling and deposits for Hungarian residents over new Hungarian validation rules; account became withdraw-only and trade-only assets not sold by the deadline may not be convertible","amount":null,"outcome":"withdraw-only for Hungarian residents (status as of article update 2026-08-06)","source":"https://support.bitvavo.com/hc/en-us/articles/42230921168145-Why-are-Bitvavo-services-being-suspended-for-Hungarian-residents","kind":"freeze"}],"deadlines":[{"date":"2027-07-10","what":"EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use this service through its EU-licensed entity (Bitvavo B.V., Netherlands; MiCA licence announced 2025-06-27: https://bitvavo.com/de/blog/bitvavo-obtains-mica-licence).","source":"https://didit.me/blog/privacy-coins-no-kyc-swaps-rules-2026/"}],"worst_case":"Bitvavo holds your coins, some assets are trade-only and can never be withdrawn on-chain, and a leaked API key with Withdraw permission can send funds out with no 2FA or email check.","safe_setup":["Give bot keys View and Trade only; Bitvavo API withdrawals skip 2FA and email confirmation","Set an IP whitelist on every API key","Check whether an asset is 'trade-only' before buying it if you plan to move it to your own wallet"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Bitstamp","slug":"bitstamp","kind":"exchange","chains_or_assets":["Centralized spot exchange (Bitstamp by Robinhood)"],"listing_name":null,"official":{"domains":["bitstamp.net"],"telegram":[],"x":[],"github":[],"apps":[],"confirmed_via":["https://coinmarketcap.com/exchanges/bitstamp/ (website bitstamp.net)","https://www.coingecko.com/en/exchanges/bitstamp (website via links.bitstamp.net)","https://robinhood.com/us/en/support/articles/transfer-your-assets-from-bitstamp/ (Robinhood support page on 'Bitstamp by Robinhood')"],"notes":"Warning: CoinGecko and CoinMarketCap still list X handle @Bitstamp, but x.com/Bitstamp showed 'This account doesn't exist' on 2026-10-25, so that handle could be re-registered by anyone. The bitstamp.net homepage now links Robinhood's X account (@RobinhoodCrypto) instead; not listed here because it is Robinhood's account. Robinhood completed the Bitstamp acquisition on 2025-06-02. EU services run through Bitstamp Europe S.A. (Luxembourg, MiCA)."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Custodial exchange account, now part of Robinhood.","source":"https://robinhood.com/us/en/newsroom/robinhood-completes-acquisition-of-bitstamp/"},"can_move_funds_out":{"value":true,"note":"Withdrawals available; US accounts can still withdraw after they move to close-only on 2027-02-01.","source":"https://robinhood.com/us/en/support/articles/transfer-your-assets-from-bitstamp/"},"freeze_policy":null,"api_keys":{"note":"Third-party sources: permissions are selected per key and include crypto withdrawals (Fireblocks guide lists 'Create crypto withdrawals' as a choice); an 'IP Address Filter' whitelist is opt-in; new keys must be activated from an email link. Expiry not mentioned. Not confirmed from Bitstamp's own docs (its API pages did not load for this check).","source":"https://quotaguard.com/blog/bitstamp-api-static-ip-whitelist"},"privacy_coins":{"xmr":"not listed (third-party survey: https://en.coin-turk.com/?p=254402)","zec":"ZEC/USD listed (third-party: https://coinranking.com/coin/aRGRWLf2RYNq4+zcash-zec/markets)","shielded_zec_withdrawals":null,"regions":null,"source":"https://en.coin-turk.com/?p=254402"},"incidents":[{"date":"2026-08-18","title":"Per customer-posted notices (not authenticated by Bitstamp), Bitstamp began rejecting crypto deposits over EUR 1,000 from self-hosted wallets owned by someone other than the account holder under the EU Transfer of Funds Regulation; rejected deposits are not returned automatically and need a support request","amount":null,"outcome":"deposits rejected, refunds via support","source":"https://cryptoslate.com/?p=555461","kind":"user_reports"}],"deadlines":[{"date":"2027-02-01","what":"US Bitstamp by Robinhood accounts move to close-only: no new positions; you can still sell and withdraw. Robinhood offers a one-time, all-or-nothing transfer to Robinhood before then; users in locations Robinhood doesn't support must withdraw instead.","source":"https://robinhood.com/us/en/support/articles/transfer-your-assets-from-bitstamp/"},{"date":"2027-07-10","what":"EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use this service through its EU-licensed entity (Bitstamp Europe S.A., Luxembourg; MiCA CASP licence May 2025: https://www.crowdfundinsider.com/2025/05/239791-bitstamp-approved-for-crypto-asset-service-provider-casp-license-under-mica/).","source":"https://didit.me/blog/privacy-coins-no-kyc-swaps-rules-2026/"}],"worst_case":"Bitstamp holds your coins; US accounts lose trading on 2027-02-01, and EU deposits from third-party self-hosted wallets over EUR 1,000 are reportedly rejected and sit until support returns them.","safe_setup":["Do not trust any 'Bitstamp' X account: @Bitstamp no longer exists, so use bitstamp.net and in-app support only","Give bot keys only balance and trading permissions, set the IP Address Filter, and never enable crypto withdrawals on a shared key","US users: transfer to Robinhood or withdraw before 2027-02-01; EU users: deposit only from your own verified wallet or another exchange"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"WhiteBIT","slug":"whitebit","kind":"exchange","chains_or_assets":["Multi-asset centralized exchange (spot, futures, margin)"],"listing_name":null,"official":{"domains":["whitebit.com"],"telegram":[],"x":["@WhiteBit"],"github":[],"apps":["https://apps.apple.com/ua/app/whitebit/id1463405025"],"confirmed_via":["https://whitebit.com/ (footer links x.com/WhiteBit and App Store id1463405025)","https://www.coingecko.com/en/exchanges/whitebit (whitebit.com, twitter.com/WhiteBit)","https://apps.apple.com/ua/app/whitebit/id1463405025 (seller UAB Clear White Technologies; privacy policy at whitebit.com)","https://x.com/WhiteBit (verified, checked 2026-10-25)"],"notes":"CoinGecko lists Telegram t.me/White_Bit while whitebit.com links a private invite link, so no Telegram handle is listed. Google Play com.whitebit.android and an APK on cdn.whitebit.com are linked only from whitebit.com (one confirmation). WhiteBIT EU (WB-Shield Innovations GmbH, Austria) said in June 2026 it was preparing to launch whitebit.eu for EEA users; not yet independently confirmed as live."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Custodial exchange account; WhiteBIT says 96% of assets are in cold storage (site meta description).","source":"https://whitebit.com/"},"can_move_funds_out":{"value":true,"note":"Withdrawals available; API-issued keys are revoked if the account is blocked or frozen.","source":"https://docs.whitebit.com/guides/app-builders-faq"},"freeze_policy":null,"api_keys":{"note":"Withdrawal rights come only with the full 'Info + Trading + Deposit + Withdraw' set. Each key supports up to 50 whitelisted IPs and WhiteBIT says to always enable IP whitelisting for production keys. Keys unused for 14 consecutive days are deactivated automatically (an IP whitelist does not exempt them). Default permissions are not stated.","source":"https://docs.whitebit.com/best-practices/security"},"privacy_coins":{"xmr":"XMR/USDT and XMR/USDC spot listed (third-party: https://coinranking.com/coin/3mVx2FX_iJFp5+monero-xmr/markets); deposit/withdrawal status not confirmed","zec":"ZEC/USDT, ZEC/USDC and ZEC/BTC listed (third-party: https://coinranking.com/coin/aRGRWLf2RYNq4+zcash-zec/markets)","shielded_zec_withdrawals":null,"regions":"Whether WhiteBIT EU (whitebit.eu) will offer XMR/ZEC was not confirmed","source":"https://coinranking.com/coin/3mVx2FX_iJFp5+monero-xmr/markets"},"incidents":[{"date":"2026-01-23","title":"Russia declared WhiteBIT and parent W Group 'undesirable', banned it and barred Russian banks and payment providers from processing WhiteBIT transactions; continued use by Russian residents carries criminal penalties","amount":null,"outcome":"Russian users cut off","source":"https://finance.yahoo.com/news/russia-bans-ukrainian-crypto-exchange-121046608.html","kind":"freeze"}],"deadlines":[{"date":"2027-07-10","what":"EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use this service through its EU-licensed entity (WB-Shield Innovations GmbH 'WhiteBIT EU', Austria; MiCA licence announced 2026-06-19 for whitebit.eu: https://www.theblock.co/post/405421/whitebit-eu-secures-mica-license-in-austria-expanding-regulated-crypto-services-across-europe).","source":"https://didit.me/blog/privacy-coins-no-kyc-swaps-rules-2026/"}],"worst_case":"WhiteBIT holds your coins, and a leaked key carrying the full Withdraw permission without an IP whitelist can empty the account; idle bot keys also stop working after 14 days.","safe_setup":["Create bot keys without the Withdraw permission and add your server's IPs to the whitelist","Plan for the 14-day inactivity rule: a standby key that makes no requests is deactivated","EEA users: check whether your account is moving to WhiteBIT EU (whitebit.eu) and what that entity supports before relying on it"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Trocador","slug":"trocador","kind":"swap_service","chains_or_assets":["Swap aggregator that routes each swap to a third-party instant exchange (Monero-focused; also prepaid and gift cards)"],"listing_name":null,"official":{"domains":["trocador.app"],"telegram":[],"x":["@TrocadorApp"],"github":[],"apps":[],"confirmed_via":["https://trocador.app/en/ (footer links x.com/trocadorapp)","https://x.com/TrocadorApp (verified profile, joined Sep 2022, website trocador.app)","https://exolix.com (partner list links trocador.app)"],"notes":"Operator per terms: Reta Development Assets LLC. trocador.app also links the support bot t.me/TrocadorSupportBot and Matrix room #Trocador.app:matrix.org, but only from its own pages, so no Telegram handle is listed. Contact emails: support@, commercial@, compliance@trocador.app. The site runs an automatic 'checking your browser' page before loading."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Trocador says it never takes custody 'even for a second'. You send coins to a deposit address of the partner exchange you picked, and that exchange holds them until it completes or refunds the swap.","source":"https://trocador.app/en/termsofuse/"},"can_move_funds_out":{"value":null,"note":"Not applicable (no stored balance); the partner exchange sends the output or a refund.","source":"https://trocador.app/en/termsofuse/"},"freeze_policy":{"note":"Trocador Terms: partner exchanges 'always check incoming transactions' under their AML policies and 'may sometimes require users to perform a KYC check'; some partners require KYC and some don't, and Trocador shows a privacy rating per exchange. OFAC-sanctioned addresses are refused automatically; the service is not for US or EEA residents or sanctioned jurisdictions. Trocador Guarantee: if the partner neither completes nor refunds the swap and can't show high AML risk or a liquidity-provider AML block, Trocador reimburses up to the protected amount shown at creation. Claims must be filed by email or Telegram within 10 days of the Trocador transaction ID. The guarantee excludes D-rated exchanges, swaps halted by police or legal order, and (per the FAQ) mixer-origin funds, and covers only one swap at a time. No hold durations are stated.","source":"https://trocador.app/en/termsofuse/"},"api_keys":null,"privacy_coins":{"xmr":"swap supported via partner exchanges (Monero is the default coin in the swap form)","zec":null,"shielded_zec_withdrawals":null,"regions":"Terms exclude US and EEA residents and UN/OFAC-sanctioned jurisdictions","source":"https://trocador.app/en/"},"incidents":[],"deadlines":[],"worst_case":"Trocador never holds your coins, but the partner exchange you choose does during the swap: if that exchange's AML check flags them it can hold them pending KYC, and Trocador's guarantee excludes AML-flagged and legal-order cases.","safe_setup":["Before confirming, check each partner's KYC rating and protected amount, and read that partner's terms","Test with a small amount first and only swap funds whose origin you can document","Save the Trocador transaction ID and the partner's order ID; Trocador Guarantee claims must be filed within 10 days"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Exolix","slug":"exolix","kind":"swap_service","chains_or_assets":["Instant swap aggregator using third-party providers (hundreds of assets incl. XMR)"],"listing_name":null,"official":{"domains":["exolix.com"],"telegram":["@exolixcom"],"x":["@exolix_com"],"github":[],"apps":["https://play.google.com/store/apps/details?id=com.exolix.app"],"confirmed_via":["https://exolix.com (footer links twitter.com/exolix_com, t.me/exolixcom, t.me/exolix_chat, Google Play com.exolix.app)","https://x.com/exolix_com (verified profile, joined Jun 2019, bio support@exolix.com, links linktr.ee/exolix)","https://linktr.ee/exolix (links exolix.com, twitter.com/exolix_com, t.me/exolixcom)","https://play.google.com/store/apps/details?id=com.exolix.app (Exolix Exchange, developer site exolix.com, support@exolix.com)","https://trocador.app/en/ (partner list links exolix.com)"],"notes":"t.me/exolixcom is linked from both exolix.com and the Linktree in Exolix's X bio; whether it is a channel or a chat was not checked. t.me/exolix_chat (site only) and t.me/exolix (Linktree only) are unconfirmed. The Android app was last updated 2023-08-21 (5K+ downloads); no iOS app found."},"known_fakes":[],"custody":{"who_holds_keys":"service","note":"You send coins to a deposit address for the swap; Exolix routes it to independent third-party providers and can suspend, delay, reject or cancel the transaction until a compliance review is done.","source":"https://exolix.com/aml-kyc"},"can_move_funds_out":{"value":null,"note":"Not applicable (no stored balance for swaps); output goes to your address unless the swap is held.","source":"https://exolix.com/aml-kyc"},"freeze_policy":{"note":"Exolix AML/KYC policy (updated 2026-07-06): reviews can be triggered by amount, frequency, blockchain analysis, source-of-funds indications, sanctions screening, geography, wallet risk, law-enforcement requests or third-party exchange requirements, and Exolix 'reserves the right to suspend, delay, reject or cancel transactions until compliance review procedure is completed'. It may request ID, selfie/liveness, proof of address, source-of-funds and source-of-wealth documents and proof of wallet ownership; failure to provide them leads to delays, cancellation or exclusion. It is 'not obliged to notify the user' about reviews or reports. Terms (2026-07-06): no KYC for ordinary transaction errors, but for deposits flagged as suspicious, if you refuse to verify the source of funds Exolix is 'not responsible for ensuring the refund or completion'. No maximum hold time is stated.","source":"https://exolix.com/aml-kyc"},"api_keys":null,"privacy_coins":{"xmr":"swap supported (XMR listed in Exolix's currency API)","zec":"not listed (currency search for ZEC/Zcash returned nothing on 2026-10-25)","shielded_zec_withdrawals":null,"regions":null,"source":"https://exolix.com/api/v2/currencies?search=XMR"},"incidents":[{"date":"2025-12-28","title":"Reported by users (unverified): Trustpilot reviews mentioning KYC (Oct 2024 to Dec 2025) describe swaps held for KYC/source-of-funds checks for weeks to over a month; one user reports 1.056 BTC held after submitting passport, selfie and bank statements","amount":"1.056 BTC (one report)","outcome":"Exolix replied 2025-12-30 that the review was still pending because not all requested compliance information had been provided","source":"https://www.trustpilot.com/review/exolix.com?search=KYC","kind":"user_reports"}],"deadlines":[],"worst_case":"If Exolix's screening flags your deposit, the swap can be suspended until you pass ID, source-of-funds and source-of-wealth checks, with no stated time limit, and its terms say it is not responsible for a refund if you refuse.","safe_setup":["Test with a small amount first and only swap funds whose origin you can document","Include any required memo/destination tag and pick the right network; Exolix says it won't refund those mistakes","Send the deposit within the 60-minute fixed-rate window and keep the exchange ID for support"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"StealthEX","slug":"stealthex","kind":"swap_service","chains_or_assets":["Instant cross-chain swaps (2000+ assets incl. XMR, ZEC)"],"listing_name":null,"official":{"domains":["stealthex.io"],"telegram":["@StealthEX_io"],"x":["@StealthEX_io"],"github":[],"apps":["https://play.google.com/store/apps/details?id=com.stealthex"],"confirmed_via":["https://stealthex.io (footer links x.com/StealthEX_io, t.me/StealthEX_io, t.me/StealthEX, Google Play com.stealthex)","https://x.com/StealthEX_io (verified profile, joined Oct 2018, website stealthex.io, bio 'Chat: t.me/StealthEX_io')","https://play.google.com/store/apps/details?id=com.stealthex (developer Stealthex LLC, site stealthex.io, support@stealthex.io)","https://trocador.app/en/ (partner list links stealthex.io)"],"notes":"t.me/StealthEX_io is the community chat (per X bio). t.me/StealthEX and the APK at github.com/StealthEX-io/mobile-app are linked only from stealthex.io. The AML policy names StealthEx Ltd under UK regulations; the Play listing gives Stealthex LLC, Kingstown, St. Vincent & the Grenadines. Help center: intercom.help/stealthex."},"known_fakes":[],"custody":{"who_holds_keys":"service","note":"StealthEX calls itself non-custodial, but you send coins to an address it generates, and during a compliance review they 'will not be exchanged or released' until the review ends.","source":"https://stealthex.io/terms/"},"can_move_funds_out":{"value":null,"note":"Not applicable (no stored balance); failed swaps are refunded to the address you gave, minus fees.","source":"https://stealthex.io/terms/"},"freeze_policy":{"note":"StealthEX Terms (updated July 2026): it may require KYC or source-of-funds information 'at any time, including before, during, or after execution of a transaction' (2.2). A flagged transaction can be placed under compliance review, during which assets are not exchanged or released until the review is completed (4.4). It lists a 'Compliance Hold Risk': transactions may be 'delayed, withheld, refunded, or (where legally required) transferred to a competent authority'. It may cancel or withhold transactions deemed abnormal or suspicious (14.8). Failed swaps are refunded to the address you provided minus service, network and third-party fees (6.4). PEPs may not use the service. The AML policy (March 2024) lists red flags such as over USD 32,000 in related transactions, unknown origin and mixer use. No review duration is stated.","source":"https://stealthex.io/terms/"},"api_keys":null,"privacy_coins":{"xmr":"swap listed (stealthex.io/coin/monero/)","zec":"swap listed (stealthex.io/coin/zcash/)","shielded_zec_withdrawals":null,"regions":null,"source":"https://stealthex.io/coin/zcash/"},"incidents":[{"date":"2026-10-01","title":"Reported by users (unverified): Trustpilot reviews mentioning KYC describe swaps frozen under compliance review for months even after completing KYC, incl. 30 BNB held over 3 months (Aug 2026, where the user says StealthEX cited instructions from 'competent authorities') and a user who says it took almost a year (review updated Oct 2026)","amount":"30 BNB (one report)","outcome":"Mixed; StealthEX replies refer users to support","source":"https://www.trustpilot.com/review/stealthex.io?search=KYC","kind":"user_reports"}],"deadlines":[],"worst_case":"If StealthEX flags your deposit, the coins sit at its address under a compliance review with no stated end; its terms allow them to be withheld or handed to authorities, and users report waits of months.","safe_setup":["Test with a small amount first and only swap funds whose origin you can document","Use stealthex.io or the Google Play app from developer StealthEX (site stealthex.io), and save the exchange ID","Double-check the destination address and network; failed swaps are refunded to your address minus fees"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"LetsExchange","slug":"letsexchange","kind":"swap_service","chains_or_assets":["Instant swap service, closed 2026-10-01 (support until 2026-11-30)"],"listing_name":null,"official":{"domains":["letsexchange.io"],"telegram":[],"x":["@letsexchange_io"],"github":[],"apps":[],"confirmed_via":["https://letsexchange.io (closure notice, links the CPO's announcement thread and support@letsexchange.io)","https://x.com/letsexchange_io (verified profile, joined Jan 2021, website LetsExchange.io, bio 'ceased operations on October 1, 2026')","https://firo.org/2023/12/15/letsexchange-firo-ama.html (links Let'sExchange's X @letsexchange_io and LetsExchange.io)","https://blog.amlbot.com/amlbot-ensures-the-legitimacy-of-funds-transacted-on-letsexchange/ (links letsexchange.io; names CPO Alex J.)"],"notes":"Closed. Operator per archived terms: CryptoLightHouse Ltd (Seychelles). The closure thread by CPO Alex J. (x.com/3jalex) says LetsExchange.io will be renewed for 10 years and 'will remain the only official LetsExchange domain', and that any site, account or service claiming to process exchanges for LetsExchange after 2026-10-01 should be treated as fraudulent. No Telegram confirmed."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Before closing, the terms said LetsExchange held no wallets or funds and swaps were run by third-party providers, which received your deposit. No new swaps are accepted.","source":"https://web.archive.org/web/20260926073027/https://letsexchange.io/terms-of-use"},"can_move_funds_out":{"value":null,"note":"Service closed; account access has been closed and final payouts were under way (per @letsexchange_io).","source":"https://x.com/letsexchange_io"},"freeze_policy":{"note":"Archived terms (updated 2026-05-15): LetsExchange could refuse, block or cancel any transaction and suspend access with immediate effect to protect its reputation, when required by law or authorities, or on suspected breach. Swaps were run by third-party providers whose own terms and AML checks applied. Shielded or other untraceable sends of dual-nature coins (ZEC, Dash, FIRO etc.) were unsupported and treated as 'irretrievably lost'. Closure: swaps started before 2026-10-01 07:00 UTC were still processed; unresolved cases, incl. incomplete swaps, go to support@letsexchange.io and are reviewed individually until 2026-11-30.","source":"https://web.archive.org/web/20260926073027/https://letsexchange.io/terms-of-use"},"api_keys":null,"privacy_coins":{"xmr":"was accepted subject to provider policy; service closed","zec":"transparent addresses only before closure; service closed","shielded_zec_withdrawals":false,"regions":null,"source":"https://web.archive.org/web/20260926073027/https://letsexchange.io/terms-of-use"},"incidents":[{"date":"2026-10-01","title":"LetsExchange ceased exchange operations at 07:00 UTC, citing increasingly complex global regulation; swaps already started were still processed","amount":null,"outcome":"Closed; company says it will fulfil remaining obligations, support until 2026-11-30, fully discontinued from 2026-12-01","source":"https://x.com/3jalex/status/2105554228257149207","kind":"shutdown"}],"deadlines":[{"date":"2026-11-30","what":"Last day LetsExchange support (support@letsexchange.io) handles unresolved issues such as incomplete swaps; the service is fully discontinued from 2026-12-01","source":"https://x.com/3jalex/status/2105554228257149207"}],"worst_case":"LetsExchange no longer runs swaps, so coins sent to an old deposit address or to a site claiming to be LetsExchange can be lost, and unresolved swaps must be raised by 2026-11-30.","safe_setup":["Don't start swaps on any site, bot or account claiming to be LetsExchange; the company says such services are fraudulent","If you have an incomplete swap, email support@letsexchange.io with the exchange ID and transaction hashes before 2026-11-30","Remove saved LetsExchange deposit addresses and links from your wallets and bookmarks"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Houdini Swap","slug":"houdini-swap","kind":"swap_service","chains_or_assets":["Private and cross-chain swaps across 120+ chains via partner CEXs and DEXs (incl. XMR)"],"listing_name":null,"official":{"domains":["houdiniswap.com"],"telegram":[],"x":["@HoudiniSwap"],"github":[],"apps":[],"confirmed_via":["https://houdiniswap.com (footer links x.com/houdiniswap)","https://x.com/HoudiniSwap (verified profile, joined May 2022, links linktr.ee/houdini_swap)","https://cointelegraph.com/news/houdini-pay-private-crypto-payment-links-privacy (links HoudiniSwap on X and docs.houdiniswap.com)","https://solstrategies.io/houdini (parent company SOL Strategies links houdiniswap.com)"],"notes":"Owned by SOL Strategies Inc. (CSE: HODL / NASDAQ: STKE) since 2026-06-02. houdiniswap.com says t.me/HoudiniSwaps_bot is the only real swap bot and lists @HoudiniSwapSupport_bot for support; neither is confirmed by a second source, so no Telegram is listed. Web app: app.houdiniswap.com; docs: docs.houdiniswap.com. A browser extension is advertised on houdiniswap.com/product/extension but not verified."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Houdini says it never takes custody. For a private swap you send coins to a one-time deposit address at a partner centralised exchange, which converts them into a random intermediary coin and passes them to a second, unrelated exchange that pays you out. The partner exchanges hold your coins in transit.","source":"https://houdiniswap.com/product/private-swap"},"can_move_funds_out":{"value":null,"note":"Not applicable (no balance); the bot and site are interfaces, not wallets.","source":"https://houdiniswap.com/product/houdini-telegram-bot"},"freeze_policy":{"note":"houdiniswap.com: no account or KYC for standard swaps, and the platform runs 'AML/ATF controls, OFAC sanctions screening, real-time transaction monitoring, and geo-blocking'. SOL Strategies says all execution partners 'run AML screening on every transaction' (solstrategies.io/houdini). Cointelegraph (2025-11-27) reports that Houdini and its partners keep transaction metadata incl. wallets, amounts and IP addresses, and that if a transaction is flagged the exchange may request more information under its AML policy. No hold duration or refund rule was found; the full Terms of Service (PDF on houdiniswap.com) were not reviewed.","source":"https://houdiniswap.com"},"api_keys":null,"privacy_coins":{"xmr":"swap supported (houdiniswap.com/swap/xmr)","zec":null,"shielded_zec_withdrawals":null,"regions":"Geo-blocking applies (countries not listed on the site)","source":"https://houdiniswap.com/swap/xmr"},"incidents":[],"deadlines":[],"worst_case":"Mid-swap your coins sit at a partner exchange, not with Houdini, so if that exchange's AML screening flags them it can ask for more information and hold them, with no published time limit.","safe_setup":["Only use the Telegram bot linked on houdiniswap.com; Houdini says it never DMs first or asks for a seed phrase","Test with a small amount first and only swap funds whose origin you can document","Save the order ID and your deposit transaction hash, and check the destination address before sending"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"THORChain","slug":"thorchain","kind":"swap_service","chains_or_assets":["Native cross-chain swaps: BTC, ETH, SOL, LTC, BCH, DOGE, XRP, TRON, BSC, AVAX, Base, Cosmos and more; ZEC and XMR rolling out"],"listing_name":null,"official":{"domains":["thorchain.org","swap.thorchain.org"],"telegram":[],"x":["@THORChain"],"github":[],"apps":[],"confirmed_via":["https://thorchain.org (links x.com/thorchain and swap.thorchain.org)","https://x.com/THORChain (verified profile, joined Jun 2018, websites swap.thorchain.org and thorchain.org)","https://blog.thorchain.org/thorchain-exploit-report-1 (links x.com/thorchain, docs.thorchain.org)"],"notes":"Chosen over Chainflip: DefiLlama shows THORChain DEX volume of $2.52B (30d) and $335M (7d) vs Chainflip's $679M (30d) and $176M (7d) on 2026-10-25, and thorchain.org lists integrations in retail wallets (Trust Wallet, Bitget Wallet, SafePal, Ledger and others). THORChain's 30d figure is inflated by ~$1.38B of Bitget-hack swaps (Sept 25-29), but its 7d volume still leads. Telegram t.me/thorchain_org (community), t.me/thorchain_alert and t.me/thorchain_dev, plus code at gitlab.com/thorchain, are linked only from thorchain.org and its blog. Docs: docs.thorchain.org, dev.thorchain.org. Many third-party front-ends (THORSwap, Asgardex, wallets) route to THORChain."},"known_fakes":[],"custody":{"who_holds_keys":"shared/MPC","note":"You send coins to an inbound vault address controlled jointly by THORChain node operators through threshold signatures (TSS). The May 2026 exploit came from a flaw in that TSS implementation.","source":"https://blog.thorchain.org/thorchain-exploit-report-1"},"can_move_funds_out":{"value":null,"note":"Not applicable for swaps; the output or refund is sent by the network when it isn't halted.","source":"https://dev.thorchain.org/concepts/memos.html"},"freeze_policy":{"note":"No KYC or account. Refunds are automatic, minus the outbound fee, for an invalid memo, wrong asset or pool, wrong transaction type, or when the result would fall below your price limit. They go to the refund address in the memo or else to the sender (dev docs). THORChain says it can halt the network in an emergency, but a halt 'is not a selective freeze of specific funds or an individual swap', and it declined to blacklist attacker addresses (Cryptopolitan, 2026-09-28). A halt pauses everyone's swaps: after the May 2026 exploit, trading and signing were halted, and TokenPost dates the restart to 2026-06-22. The THORFi lending/savers pause (Jan 2025) held withdrawals for about $200M in liabilities.","source":"https://dev.thorchain.org/concepts/memos.html"},"api_keys":null,"privacy_coins":{"xmr":"not live as of 2026-10-22: v3.21 (2026-10-21) moves the Monero integration closer, activation awaits v3.21.1 and a limited-liquidity soft launch","zec":"ZEC pool launched 2026-10-02 with trading 'the next step' (crypto.news); current trading status not verified","shielded_zec_withdrawals":null,"regions":null,"source":"https://www.ad-hoc-news.de/boerse/news/marktberichte/thorchain-v3-21-advances-xmr-integration-what-it-means-for-monero-price/70395138"},"incidents":[{"date":"2026-09-25","title":"Funds stolen in the Bitget hack were swapped through THORChain (~$1.38B of volume over Sept 25-29); THORChain declined Bitget's request to block the attacker's addresses","amount":"~$1.38B volume","outcome":"Not blocked; THORChain says halts are not selective freezes","source":"https://www.tokenpost.com/news/technology/39436","kind":"hack"},{"date":"2026-05-15","title":"Exploit drained ~$10.7M from one of THORChain's five vaults via a flaw in its GG20 threshold-signature code, by a node operator that joined two days earlier; trading and signing halted","amount":"~$10.7M","outcome":"Loss coverage (bond slashing, protocol-owned liquidity or other options) left to governance in the report; network restarted 2026-06-22 per TokenPost","source":"https://blog.thorchain.org/thorchain-exploit-report-1","kind":"exploit"},{"date":"2025-02-21","title":"Lazarus Group laundered ETH stolen in the Bybit hack through THORChain into Bitcoin","amount":"~$1.4B ETH (per The Defiant)","outcome":"Not blocked","source":"https://thedefiant.io/news/hacks/bybit-hack-lazarus-group-launders-1-4b-eth-via-thorchain-converts-to-bitcoin-94fa64e5","kind":"hack"},{"date":"2025-01-24","title":"THORChain halted withdrawals from its THORFi Lending and Savers products, which held about $200M of BTC and ETH liabilities it couldn't pay out (swaps unaffected)","amount":"~$200M","outcome":"Debt later handled via TCY token claims","source":"https://blockworks.com/news/thorchain-halts-withdrawals-insolvency","kind":"freeze"}],"deadlines":[],"worst_case":"There are no KYC freezes, but your coins sit in node-operator-controlled vaults while a swap processes: an exploit or network-wide halt (May 2026: $10.7M taken) can delay or endanger them, and a mistake outside the automatic refund rules can't be reversed.","safe_setup":["Swap through swap.thorchain.org or a reputable wallet's built-in THORChain swap rather than hand-writing memos","Set a price limit and a refund address you control; failed swaps refund minus the outbound fee","Test with a small amount first and check that the network isn't halted before sending"],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Phantom","slug":"phantom","kind":"wallet","chains_or_assets":["Solana","Ethereum","others"],"listing_name":null,"official":{"domains":["phantom.com","phantom.app"],"telegram":[],"x":["@phantom"],"github":["github.com/phantom"],"apps":["https://chromewebstore.google.com/detail/phantom/bfnaelmomeimhlpmgjnjophhpkkoljpa","https://apps.apple.com/us/app/phantom-trading-wallet/id1598432977","https://play.google.com/store/apps/details?id=app.phantom"],"confirmed_via":["https://phantom.com/download (links Chrome Web Store extension bfnaelmomeimhlpmgjnjophhpkkoljpa for Chrome/Brave/Edge and x.com/phantom; page source carries App Store id1598432977 and Google Play app.phantom)","https://chromewebstore.google.com/detail/phantom/bfnaelmomeimhlpmgjnjophhpkkoljpa (developer website phantom.com, email support@phantom.app, 'Created by the owner of the listed website', 5,000,000 users, v26.34.0 updated 2026-10-19)","https://apps.apple.com/us/app/phantom-trading-wallet/id1598432977 (seller Phantom Technologies Incorporated, developer website phantom.com, privacy policy phantom.app/privacy)","https://play.google.com/store/apps/details?id=app.phantom (developer Phantom Technologies, Inc., website phantom.com, 10M+ downloads)","https://github.com/phantom (GitHub-verified domain phantom.app; org links X @phantom)"],"notes":"Phantom has no Firefox add-on on its download page: any 'Phantom' Firefox add-on is suspect. Brave and Edge users install the same Chrome Web Store item. Support only starts from the in-app chat: 'Phantom Support will never contact you first' and never DMs on social media, and there is no support phone number or public email (https://help.phantom.com/articles/contact-phantom-support-6953810233619). Phantom's code is closed source; github.com/phantom holds SDKs, docs and its blocklist, not wallet builds to install. Search results for 'Phantom extension' were full of non-Phantom pages (Notion, uKit, Teachable, Google Sites) when we checked on 2026-10-25."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"'Phantom is a self-custodial wallet: you control your private keys.' Some extras run through third parties: Phantom Cash's card and virtual accounts need KYC done by Stripe, with the card issued by Lead Bank and run by Bridge (https://phantom.com/learn/blog/introducing-phantom-cash). Kalshi prediction markets (US) need identity verification.","source":"https://help.phantom.com/articles/i-was-scammed-or-my-wallet-was-drained-what-can-i-do-5487893286291"},"can_move_funds_out":{"value":true,"note":"You sign every send yourself, to any address. Phantom 'cannot reverse transactions, freeze assets, or recover stolen funds.'","source":"https://help.phantom.com/articles/i-was-scammed-or-my-wallet-was-drained-what-can-i-do-5487893286291"},"freeze_policy":{"note":"In-app swaps are routed by third-party providers, including bridge providers for cross-chain swaps, and you can choose the provider for each swap. The confirmation screen shows a Phantom fee plus the network fee. Phantom can't reverse a swap or a send. Disconnecting a dapp does NOT revoke spending permissions: revoke them with Revoke.cash (EVM) or Famous Fox's Revoker (Solana).","source":"https://help.phantom.com/articles/adjust-swap-settings-in-phantom-27085326202515"},"api_keys":null,"privacy_coins":null,"incidents":[{"date":"2026-04-06","title":"Service outage: token prices and balances shown wrongly in the app. Phantom said 'Your funds are safe' and reported it resolved the same night. Users on X reported they couldn't sell (user reports, not verified).","amount":null,"outcome":"resolved same day; Phantom said funds not affected","source":"https://www.theblock.co/post/396479/phantom-reports-service-outage","kind":"outage"},{"date":"2026-02-10","title":"Address poisoning linked to Phantom's built-in chat (Phantom Chat, launched 2025-12-23): one user sent 3.5 WBTC (~$264,000) to a look-alike address. ZachXBT said the chat did not filter spam transactions (Cointelegraph, third-party report).","amount":"3.5 WBTC (~$264,000)","outcome":"not recovered (no Phantom comment in the report)","source":"https://cointelegraph.com/news/phantom-chat-address-poisoning-bitcoin-phishing","kind":"third_party"},{"date":"2025-07-03","title":"Koi Security found 40+ fake wallet add-ons on the Firefox store impersonating Phantom, MetaMask, Coinbase, Trust Wallet, Exodus, OKX and others to steal seed phrases (third-party report; extension IDs not given in the coverage).","amount":null,"outcome":"reported to Mozilla","source":"https://thehackernews.com/2025/07/over-40-malicious-firefox-extensions.html","kind":"third_party"},{"date":"2024-10-28","title":"Outage during the GRASS airdrop: wrong balances shown for about 3.5 hours. Phantom told users 'Your funds are safe.'","amount":null,"outcome":"resolved same day","source":"https://www.theblock.co/amp/post/323291/solanas-phantom-wallet-faces-downtime-causing-inaccurate-account-balances-for-users-during-anticipated-grass-airdrop","kind":"outage"}],"deadlines":[],"worst_case":"Phantom is self-custody: anyone who gets your recovery phrase (for example through a fake Phantom extension or a 'support' DM), or who gets you to sign a malicious approval, can empty the wallet, and Phantom can't reverse or freeze anything.","safe_setup":["Install only from phantom.com/download: Chrome Web Store ID bfnaelmomeimhlpmgjnjophhpkkoljpa, App Store id1598432977, Google Play app.phantom. Phantom has no Firefox add-on.","Phantom Support never messages you first. Only use the in-app chat, and never type your recovery phrase anywhere. After using a new dapp, revoke its spending permissions (Revoke.cash for EVM, Famous Fox's Revoker for Solana), because disconnecting doesn't revoke them.","Give bots and new dapps a separate Phantom account holding only what you can lose. Copy addresses from your own address book, not from transaction history or chat, to avoid address poisoning."],"last_checked":"2026-10-25","links_status":"verified"},{"name":"MetaMask","slug":"metamask","kind":"wallet","chains_or_assets":["Ethereum","EVM networks","others"],"listing_name":null,"official":{"domains":["metamask.io","support.metamask.io"],"telegram":[],"x":["@MetaMask"],"github":["github.com/MetaMask","github.com/MetaMask/metamask-extension"],"apps":["https://chromewebstore.google.com/detail/metamask/nkbihfbeogaeaoehlefnkodbefgpgknn","https://addons.mozilla.org/en-US/firefox/addon/ether-metamask/","https://apps.apple.com/us/app/metamask-blockchain-wallet/id1438144202","https://play.google.com/store/apps/details?id=io.metamask"],"confirmed_via":["https://metamask.io/download (links Chrome Web Store nkbihfbeogaeaoehlefnkodbefgpgknn, Firefox add-on ether-metamask, App Store id1438144202, Google Play io.metamask, x.com/MetaMask, github.com/MetaMask)","https://chromewebstore.google.com/detail/metamask/nkbihfbeogaeaoehlefnkodbefgpgknn (publisher Consensys Software Inc., website metamask.io, email security@metamask.io, 12,000,000 users, v13.53.0 updated 2026-10-19)","https://addons.mozilla.org/en-US/firefox/addon/ether-metamask/ (by MetaMask, support site metamask.io, ~322,716 users, updated 2026-10-19)","https://apps.apple.com/us/app/metamask-trade-crypto/id1438144202 (seller ConsenSys AG, developer website metamask.io, v8.16.0)","https://play.google.com/store/apps/details?id=io.metamask (developer Consensys Software Inc., website support.metamask.io, 10M+ downloads)","https://github.com/MetaMask (GitHub-verified domain metamask.io; links x.com/metamask)","https://support.metamask.io/configure/wallet/how-to-install-metamask-manually/ (official manual builds only at github.com/MetaMask/metamask-extension/releases)"],"notes":"MetaMask's own guide warns that fake MetaMask apps are listed in the app stores: the real Android app has 10M+ downloads. Manual installs are only for special cases, and MetaMask says anyone telling you to install it manually is 'probably a scammer' (https://support.metamask.io/configure/wallet/how-to-install-metamask-manually/). The help page still names the Firefox publisher as 'danfinlay', while the listing itself now shows 'MetaMask'. metamask.io/download also links github.com/MetaMask/metamask-mobile/releases, and the developer X account @metamaskdev, but neither was second-confirmed. Search results for MetaMask support were full of non-MetaMask Teachable pages when we checked on 2026-10-25."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"Self-custody with a Secret Recovery Phrase (SRP). Optional social login (Google, Apple or Telegram) stores your SRP online encrypted. The key to decrypt it comes from your password plus shares held by server nodes: 'No single party (not MetaMask, not the data store, not Google, Apple, or Telegram)' other than you can rebuild the SRP. That password must be guarded like the SRP itself.","source":"https://support.metamask.io/configure/wallet/social-login/"},"can_move_funds_out":{"value":true,"note":"You sign every send yourself, to any address.","source":"https://metamask.io/download"},"freeze_policy":{"note":"MetaMask Swaps only aggregates quotes. 'MetaMask does not provide the liquidity, execute the trade' itself: DEXs and other swap protocols do. The MetaMask fee is 0.875% on top of the quote and network fee. Bridging is sourced through the Li.fi and Socket aggregators, with bridge providers such as Hop, Celer cBridge and Stargate.","source":"https://support.metamask.io/trade/swap/user-guide-swaps/"},"api_keys":null,"privacy_coins":null,"incidents":[{"date":"2026-01-05","title":"Phishing emails posing as MetaMask told users to 'enable 2FA', sometimes with a countdown timer, then led to look-alike sites that asked for the recovery phrase. Flagged by SlowMist (third-party report; no domains named in the coverage).","amount":null,"outcome":"MetaMask doesn't send such emails","source":"https://www.moroccoworldnews.com/2026/01/273959/fake-2fa-emails-target-metamask-users-wallet-recovery-phrases/","kind":"third_party"},{"date":"2025-08-08","title":"'GreedyBear' campaign: 150+ malicious Firefox add-ons impersonating MetaMask, TronLink, Exodus and Rabby, plus fake sites, stole more than $1M (Koi Security, via The Hacker News).","amount":"more than $1M","outcome":"not refunded","source":"https://thehackernews.com/2025/08/greedybear-steals-1m-in-crypto-using.html","kind":"third_party"},{"date":"2025-07-21","title":"Extension bug: on Chromium browsers, MetaMask kept writing to disk in the background (one user reported ~500 GB/day), wearing out SSDs. Consensys acknowledged 'unusually high disk activity' and rolled out a partial fix.","amount":null,"outcome":"partly fixed; funds not affected","source":"https://regional-front.cointelegraph.com/news/metamask-bug-wearing-out-solid-state-drives","kind":"outage"},{"date":"2025-07-03","title":"Koi Security found 40+ fake wallet add-ons on the Firefox store impersonating MetaMask, Phantom, Coinbase, Trust Wallet, Exodus and others (third-party report).","amount":null,"outcome":"reported to Mozilla","source":"https://thehackernews.com/2025/07/over-40-malicious-firefox-extensions.html","kind":"third_party"}],"deadlines":[],"worst_case":"MetaMask is self-custody: a leaked recovery phrase (or social-login password), or one signed malicious token approval, can let an attacker drain the tokens in that account, and nobody can reverse it.","safe_setup":["Install only from metamask.io/download: Chrome Web Store ID nkbihfbeogaeaoehlefnkodbefgpgknn, Firefox 'ether-metamask', App Store id1438144202, Google Play io.metamask (10M+ downloads). Never install a 'manual' build someone sends you.","Ignore any email or DM about '2FA', 'verification' or 'migration'. MetaMask doesn't send them. Never enter your recovery phrase on a website.","Use a separate MetaMask account with a small balance for bots and new dapps, and regularly revoke old token approvals at Revoke.cash."],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Rabby Wallet","slug":"rabby","kind":"wallet","chains_or_assets":["Ethereum","EVM networks"],"listing_name":null,"official":{"domains":["rabby.io"],"telegram":[],"x":["@Rabby_io"],"github":["github.com/RabbyHub","github.com/RabbyHub/Rabby"],"apps":["https://chromewebstore.google.com/detail/rabby/acmacodkjbdgmoleebolmdjonilkdbch","https://apps.apple.com/us/app/rabby-wallet-crypto-evm/id6474381673","https://play.google.com/store/apps/details?id=com.debank.rabbymobile"],"confirmed_via":["https://rabby.io (links Chrome Web Store acmacodkjbdgmoleebolmdjonilkdbch, App Store id6474381673, Google Play com.debank.rabbymobile, x.com/Rabby_io, github.com/RabbyHub and github.com/RabbyHub/Rabby, discord.gg/seFBCWmUre)","https://chromewebstore.google.com/detail/rabby/acmacodkjbdgmoleebolmdjonilkdbch (website rabby.io, email hi@rabby.io, 'Created by the owner of the listed website', 900,000 users, v0.94.13 updated 2026-10-23)","https://play.google.com/store/apps/details?id=com.debank.rabbymobile (developer OPCODE LABS PTE. LTD., website rabby.io, 500K+ downloads)","https://apps.apple.com/us/app/rabby-wallet-crypto-evm/id6474381673 (seller OPCODE LABS PTE. LTD., privacy policy rabby.io/docs/privacy/)","https://github.com/RabbyHub (org 'Rabby', website rabby.io, X @Rabby_io)","https://ethereum.org/wallets/find-wallet/rabby-wallet/ (lists rabby.io, x.com/Rabby_io, github.com/RabbyHub/Rabby)"],"notes":"Rabby is built by the DeBank team: the Play listing's email is hi@debank.com and the terms page is titled 'Debank & Rabby'. The terms say Rabby won't offer support by SMS, WhatsApp, Telegram or WeChat, and will never ask for your recovery phrase or a payment (https://rabby.io/docs/terms-of-use/). rabby.io links 2025 audit reports by SlowMist and Least Authority, which are in the GitHub repo. GitHub releases offer a build to load manually: use the store listings unless you know why you need it. Discord: discord.gg/seFBCWmUre (rabby.io; ethereum.org shows the same invite). We found no Firefox add-on from Rabby, so treat any 'Rabby' Firefox add-on as fake (see incidents)."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"Self-custody: keys and assets are stored 'locally on their own devices'. Rabby will 'never ask you for your private key or secret recovery phrase'.","source":"https://rabby.io/docs/terms-of-use/"},"can_move_funds_out":{"value":true,"note":"You sign every send yourself, to any address.","source":"https://rabby.io/docs/terms-of-use/"},"freeze_policy":{"note":"Rabby's terms say that swaps and bridging use 'products, or services of one or more third parties'. ethereum.org lists a 0.25% Rabby swap fee (https://ethereum.org/wallets/find-wallet/rabby-wallet/).","source":"https://rabby.io/docs/terms-of-use/"},"api_keys":null,"privacy_coins":null,"incidents":[{"date":"2026-08-20","title":"'Offside Wallet Theft Factory' (Socket Threat Research): 13 Firefox add-ons ran modified Rabby builds that sent keyring data to attackers before it was encrypted. Others captured seed phrases. Names included 'RABB-Wallet Web3 & EVM', 'Rabb-Wallet CryptoPortfolio' and 'Rabbit For Desktop'. Mozilla signing records show activity from March to August 2026 (third-party report; no extension IDs published in the coverage).","amount":null,"outcome":"losses not reported","source":"https://www.technadu.com/77-firefox-extensions-one-wallet-draining-operation-abusing/633563/","kind":"third_party"},{"date":"2025-08-08","title":"'GreedyBear' campaign: 150+ malicious Firefox add-ons impersonating Rabby, MetaMask, TronLink and Exodus stole more than $1M (Koi Security, via The Hacker News).","amount":"more than $1M","outcome":"not refunded","source":"https://thehackernews.com/2025/08/greedybear-steals-1m-in-crypto-using.html","kind":"third_party"}],"deadlines":[],"worst_case":"Rabby is self-custody: a fake 'Rabby' add-on or a leaked seed gives an attacker the whole wallet, and a signed malicious approval lets them pull the approved tokens. Nobody can reverse either.","safe_setup":["Install only from rabby.io: Chrome Web Store ID acmacodkjbdgmoleebolmdjonilkdbch, App Store id6474381673, Google Play com.debank.rabbymobile. Rabby has no Firefox add-on, so any 'Rabby' or 'Rabb-Wallet' on Firefox is fake.","Read Rabby's pre-sign simulation and risk warnings before every signature, and revoke stale approvals (Rabby has an approvals view, or use Revoke.cash). Rabby never offers support on Telegram, WhatsApp, SMS or WeChat.","Use a separate Rabby address with only bot/trading money, and keep long-term holdings on a hardware wallet connected to Rabby."],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Trust Wallet","slug":"trust-wallet","kind":"wallet","chains_or_assets":["Bitcoin","Ethereum","BNB Chain","Solana","Tron","100+ chains"],"listing_name":null,"official":{"domains":["trustwallet.com","support.trustwallet.com"],"telegram":["@trust_announcements","@trustwallet"],"x":["@TrustWallet"],"github":["github.com/trustwallet"],"apps":["https://chromewebstore.google.com/detail/trust-wallet/egjidjbpglichdcondbcbdnbeeppgdph","https://apps.apple.com/app/apple-store/id1288339409","https://play.google.com/store/apps/details?id=com.wallet.crypto.trustapp"],"confirmed_via":["https://trustwallet.com/download (links Chrome Web Store egjidjbpglichdcondbcbdnbeeppgdph, App Store id1288339409, Google Play com.wallet.crypto.trustapp, x.com/TrustWallet, github.com/trustwallet, t.me/trust_announcements, t.me/trustwallet)","https://trustwallet.com/blog/announcements/trust-wallet-official-social-media-channels (updated 2026-08-17: @TrustWallet, t.me/trust_announcements, t.me/trustwallet, App Store id1288339409, Google Play com.wallet.crypto.trustapp)","https://chromewebstore.google.com/detail/trust-wallet/egjidjbpglichdcondbcbdnbeeppgdph (publisher DApps Platform Software Services Ltd., website trustwallet.com, support site support.trustwallet.com, 1,000,000 users, v26.42.4 updated 2026-10-21)","https://apps.apple.com/us/app/trust-crypto-bitcoin-wallet/id1288339409 (seller DApps Platform Software Services Ltd., developer website trustwallet.com, v26.43.14)","https://play.google.com/store/apps/details?id=com.wallet.crypto.trustapp (developer DApps Platform, Inc., 50M+ downloads)","https://github.com/trustwallet (GitHub-verified domain trustwallet.com; links @TrustWallet)"],"notes":"@trust_announcements is the global announcements channel and @trustwallet the global community group. Neither is a trading bot. The official channels post lists many regional X and Telegram accounts and says 'We'll never DM you first'. Support runs through the ticket system at support.trustwallet.com, and Trust Wallet doesn't contact users by email about account issues (https://support.trustwallet.com/support/solutions/articles/67000734572-how-to-spot-and-handle-phishing-emails). The browser extension page is trustwallet.com/browser-extension. Trust Wallet is owned by Binance (acquired 2018, per The Block)."},"known_fakes":[{"value":"metrics-trustwallet.com","kind":"domain","source":"https://trustwallet.com/blog/announcements/trust-wallet-browser-extension-v268-incident-community-update","date":"2025-12-24"},{"value":"api.metrics-trustwallet.com","kind":"domain","source":"https://trustwallet.com/blog/announcements/trust-wallet-browser-extension-v268-incident-community-update","date":"2025-12-24"}],"custody":{"who_holds_keys":"user","note":"Self-custody: 'You control your private keys, stored safely on your device and encrypted using AES.' The app also offers staking, stablecoin 'daily rewards' and prediction markets, which run through outside protocols and partners.","source":"https://play.google.com/store/apps/details?id=com.wallet.crypto.trustapp"},"can_move_funds_out":{"value":true,"note":"You sign every send yourself, to any address.","source":"https://play.google.com/store/apps/details?id=com.wallet.crypto.trustapp"},"freeze_policy":{"note":"Swaps run through third parties: THORChain for native cross-chain swaps and 1inch. 'Trust Wallet charges no service fees for executing these swaps'. Provider and network fees still apply.","source":"https://support.trustwallet.com/en/support/solutions/articles/67000734962-in-app-cross-chain-swaps-now-on-trust-wallet"},"api_keys":null,"privacy_coins":null,"incidents":[{"date":"2025-12-26","title":"Fake compensation forms and impersonators targeted v2.68 victims. Trust Wallet told users to claim only through its official support portal (be-support.trustwallet.com per its incident post).","amount":null,"outcome":"warning issued","source":"https://www.theblock.co/post/383801/trust-wallet-launches-compensation-process-for-7-million-browser-extension-hack-victims","kind":"user_reports"},{"date":"2025-12-24","title":"Browser extension v2.68 compromised: an attacker used a Chrome Web Store API key exposed in the Nov 2025 Sha1-Hulud supply-chain attack to publish a malicious build. It drained wallets that logged in between 2025-12-24 and 2025-12-26 11:00 UTC. About $8.5M was tied to 17 attacker addresses, and 2,520 wallet addresses were drained. Malicious code was served from metrics-trustwallet.com.","amount":"~$8.5M (2,520 addresses; earlier reports said $7M)","outcome":"Trust Wallet pledged voluntary reimbursement after case-by-case verification. Coincu (via MEXC) reported a first payout round in Jan 2026; we found no total paid. Fixed by rolling back to clean v2.67, released as v2.69.","source":"https://trustwallet.com/blog/announcements/trust-wallet-browser-extension-v268-incident-community-update","kind":"hack"},{"date":"2025-07-03","title":"Koi Security found 40+ fake wallet add-ons on the Firefox store impersonating Trust Wallet, MetaMask, Phantom, Coinbase, Exodus and others (third-party report).","amount":null,"outcome":"reported to Mozilla","source":"https://thehackernews.com/2025/07/over-40-malicious-firefox-extensions.html","kind":"third_party"}],"deadlines":[],"worst_case":"Trust Wallet is self-custody, so a leaked recovery phrase or a malicious extension build (as happened with v2.68 in Dec 2025) can empty every wallet on that device. A reimbursement like Trust Wallet's was voluntary and not guaranteed.","safe_setup":["Install only from trustwallet.com/download: Chrome Web Store ID egjidjbpglichdcondbcbdnbeeppgdph, App Store id1288339409, Google Play com.wallet.crypto.trustapp. Keep the extension updated, and don't keep large balances in any browser extension.","Trust Wallet never DMs first and never asks for your phrase. Ignore 'compensation' or 'support' links on social media, and use only support.trustwallet.com.","Use a separate wallet with a small balance for bots and dapps, keep savings on a phone app or hardware wallet, and revoke old approvals with Revoke.cash."],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Exodus","slug":"exodus","kind":"wallet","chains_or_assets":["Bitcoin","Ethereum","Solana","others"],"listing_name":null,"official":{"domains":["exodus.com"],"telegram":[],"x":["@exodus"],"github":["github.com/ExodusMovement"],"apps":["https://apps.apple.com/app/apple-store/id1414384820","https://play.google.com/store/apps/details?id=exodusmovement.exodus","https://www.exodus.com/download/"],"confirmed_via":["https://www.exodus.com/download/ (App Store id1414384820, Google Play exodusmovement.exodus, desktop builds from downloads.exodus.com with a hashes file, github.com/ExodusMovement, twitter.com/exodus)","https://www.exodus.com/support/en/articles/8598640-how-do-i-install-exodus (updated 2026-09-22: App Store id1414384820, Google Play exodusmovement.exodus, desktop from exodus.com/download)","https://www.exodus.com/support/en/articles/8598740-which-domains-does-exodus-use (updated 2026-09-22: exodus.com/download is 'the only official source' for Exodus; footer links github.com/ExodusMovement and twitter.com/exodus)","https://apps.apple.com/us/app/exodus-crypto-payments/id1414384820 (seller Exodus Movement Inc, developer website exodus.com/mobile, v26.10.23)","https://play.google.com/store/apps/details?id=exodusmovement.exodus (developer Exodus Movement, Inc., website exodus.com/mobile, 5M+ downloads)","https://github.com/ExodusMovement (GitHub-verified domains exodus.com and www.exodus.com; links @exodus)"],"notes":"Desktop (Windows, macOS, Linux) installers come only from exodus.com/download. Each release publishes a hashes file (e.g. downloads.exodus.com/releases/hashes-exodus-26.10.21.txt), with a help article on verifying it (https://www.exodus.com/support/en/articles/8598686-how-can-i-verify-that-my-exodus-download-is-authentic). For Linux, Exodus says never to use third-party sites, distribution platforms or package managers. Browser extension: exodus.com/download and the install article list no extension, and exodus.com/web3-wallet now redirects to the download page. We couldn't confirm the status of the older 'Exodus Web3 Wallet' Chrome listing, so treat any Exodus extension link as unconfirmed. Search results for 'Exodus Web3 Wallet' were dominated by sites.google.com pages not run by Exodus when we checked on 2026-10-25. Exodus wallet servers use *.exodus.io, emails come from @exodus.com or @exodus.io (both can be spoofed), and support is support@exodus.com."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"Self-custody: your coins sit in 'your self-custody Exodus wallet', and 'Exodus users are responsible for storing their own recovery phrase' (a 12-word secret key). Exodus calls itself 'a software platform ONLY' and 'will never ask any of our customers to provide their passwords, private keys, or 12-word secret key' (https://www.exodus.com/support/en/articles/8836608-i-received-an-email-from-exodus-asking-me-to-provide-my-12-word-secret-key-password). Exodus Markets and Exodus Predictions are newer in-app trading features.","source":"https://www.exodus.com/support/en/articles/8598630-how-do-i-swap-crypto-in-exodus-swap"},"can_move_funds_out":{"value":true,"note":"Self-custody wallet: you sign sends yourself, to any address.","source":"https://www.exodus.com/support/en/articles/8598630-how-do-i-swap-crypto-in-exodus-swap"},"freeze_policy":{"note":"'Swap services are available through third-party API providers': your coins leave your self-custody wallet for the provider, and the swapped coin is sent back. Providers aren't named in the article. Minimum and maximum amounts vary by liquidity, and Exodus support handles swap issues (https://www.exodus.com/support/en/articles/8598692-how-do-i-contact-exodus-support-about-a-swap).","source":"https://www.exodus.com/support/en/articles/8598630-how-do-i-swap-crypto-in-exodus-swap"},"api_keys":null,"privacy_coins":null,"incidents":[{"date":"2025-08-08","title":"'GreedyBear' campaign: 150+ malicious Firefox add-ons impersonating Exodus, MetaMask, Rabby and TronLink stole more than $1M (Koi Security, via The Hacker News).","amount":"more than $1M","outcome":"not refunded","source":"https://thehackernews.com/2025/08/greedybear-steals-1m-in-crypto-using.html","kind":"third_party"},{"date":"2025-07-03","title":"Koi Security found 40+ fake wallet add-ons on the Firefox store impersonating Exodus, MetaMask, Phantom, Trust Wallet, Coinbase and others (third-party report).","amount":null,"outcome":"reported to Mozilla","source":"https://thehackernews.com/2025/07/over-40-malicious-firefox-extensions.html","kind":"third_party"},{"date":null,"title":"(2024-02) Fake 'Exodus' app in the Ubuntu Snap Store (publisher 'Movement Exod'): a user who restored his wallet in it lost ~9 BTC (~$490,000), reported on the Snapcraft forum.","amount":"~9 BTC (~$490,000)","outcome":"not recovered","source":"https://www.linuxpromagazine.com/index.php/layout/set/print/Issues/2026/307/SnapScope","kind":"user_reports"}],"deadlines":[],"worst_case":"Exodus is self-custody: typing your 12-word secret key into a fake Exodus app, extension or 'support' form hands over every coin in the wallet. Coins in a swap sit with the third-party provider until it delivers.","safe_setup":["Download only from exodus.com/download (App Store id1414384820, Google Play exodusmovement.exodus, desktop installers) and check the published hash. Never use a Snap or other package-store build, or any 'Exodus' browser extension.","Exodus never asks for your 12-word secret key or password, by email or otherwise. Treat any such email as phishing, even from an @exodus.com address.","Keep bot or trading money in a separate wallet, and do a small test swap first to see how long the third-party provider takes."],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Backpack","slug":"backpack","kind":"wallet","chains_or_assets":["Solana","Ethereum","Base","Arbitrum","Optimism","Polygon","Monad","others"],"listing_name":null,"official":{"domains":["backpack.app","backpack.exchange"],"telegram":[],"x":["@Backpack"],"github":["github.com/coral-xyz/backpack"],"apps":["https://chromewebstore.google.com/detail/backpack/aflkmfhebedbjioipglgcbcmnbpgliof","https://apps.apple.com/us/app/backpack-buy-sol-btc-crypto/id6445964121","https://play.google.com/store/apps/details?id=app.backpack.mobile"],"confirmed_via":["https://backpack.app (links Chrome Web Store aflkmfhebedbjioipglgcbcmnbpgliof, App Store id6445964121, Google Play app.backpack.mobile, twitter.com/Backpack, github.com/coral-xyz/backpack, support.backpack.exchange)","https://support.backpack.exchange/start-here/downloads (App Store id6445964121, Chrome Web Store aflkmfhebedbjioipglgcbcmnbpgliof for Chrome and Brave, Android APK via backpack.app)","https://support.backpack.exchange/ (links x.com/Backpack)","https://chromewebstore.google.com/detail/backpack/aflkmfhebedbjioipglgcbcmnbpgliof (website backpack.app, 'Created by the owner of the listed website', 300,000 users, v0.10.218 updated 2026-10-09)","https://play.google.com/store/apps/details?id=app.backpack.mobile (developer Backpack Technologies Ltd., website backpack.app, 100K+ downloads)","https://apps.apple.com/us/app/backpack-trade-invest-earn/id6445964121 (seller Backpack Technologies Ltd., developer website backpack.exchange, privacy policy backpack.app/privacy.pdf, v2.89.2)","https://github.com/coral-xyz/backpack (About links backpack.app)"],"notes":"The Backpack mobile app holds two different things: Backpack Exchange accounts (custodial, region-restricted) and Backpack Wallet (self-custody). Check which one your funds are in. The Chrome listing's developer email is admin@200ms.io, a different domain from the website. The coral-xyz/backpack GitHub repo offers developer builds to load manually: ordinary users should use the store listings. Support's Android APK link (backpack.app/api/apk-download-link) and the Telegram channel t.me/BackpackOfficialTG appear only on Backpack's own pages, so they weren't second-confirmed. Support emails are listed at support.backpack.exchange (e.g. support@backpack.exchange)."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"Backpack Wallet is 'a security conscious self-custodial crypto wallet' with Ledger, Trezor and Keystone support and multisig. Backpack Exchange balances in the same app are held by the exchange, not by you (Play listing describes both products).","source":"https://support.backpack.exchange/wallet/what-is-backpack-wallet"},"can_move_funds_out":{"value":true,"note":"Wallet: you sign every send yourself. Exchange balances follow the exchange's withdrawal rules (not covered here).","source":"https://support.backpack.exchange/wallet/what-is-backpack-wallet"},"freeze_policy":{"note":"The wallet's Swap and Bridge features are signed in-wallet ('Select Approve to confirm'). Backpack's docs don't name the swap or bridge provider or a fee. Buying and selling with cards goes through MoonPay.","source":"https://support.backpack.exchange/wallet/actions/bridge-assets-across-networks"},"api_keys":null,"privacy_coins":null,"incidents":[],"deadlines":[],"worst_case":"In the self-custody wallet, a leaked recovery phrase or a signed malicious transaction can drain it irreversibly. Anything you keep in the Backpack Exchange side of the same app is held by the exchange instead.","safe_setup":["Install only from backpack.app: Chrome Web Store ID aflkmfhebedbjioipglgcbcmnbpgliof, App Store id6445964121, Google Play app.backpack.mobile. Don't use GitHub builds unless you're a developer.","Know which side your money is on: Wallet (your keys) or Exchange (Backpack's custody). Never enter your recovery phrase into anything except the Backpack app itself.","Use a separate Backpack wallet account with a small balance for bots and new dapps, and consider Backpack's NFT lock and a hardware wallet for long-term holdings."],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Solflare","slug":"solflare","kind":"wallet","chains_or_assets":["Solana"],"listing_name":null,"official":{"domains":["solflare.com"],"telegram":[],"x":["@solflare"],"github":[],"apps":["https://chromewebstore.google.com/detail/solflare-wallet/bhhhlbepdkbapadjdnnojkbgioiodbic","https://addons.mozilla.org/en-US/firefox/addon/solflare-wallet/","https://apps.apple.com/us/app/solflare-solana-wallet/id1580902717","https://play.google.com/store/apps/details?id=com.solflare.mobile"],"confirmed_via":["https://www.solflare.com/download/ (links Chrome Web Store bhhhlbepdkbapadjdnnojkbgioiodbic for Chrome/Brave/Edge/Opera/Arc, Firefox add-on solflare-wallet, x.com/solflare)","https://www.solflare.com/ (page source: App Store id1580902717, Google Play com.solflare.mobile; the download page's 'Get mobile app' link app.solflare.com/WVZY resolves here)","https://chromewebstore.google.com/detail/solflare-wallet/bhhhlbepdkbapadjdnnojkbgioiodbic (website solflare.com, email extension@solflare.com, 'Created by the owner of the listed website', 700,000 users, v2.41.0 updated 2026-10-23)","https://addons.mozilla.org/en-US/firefox/addon/solflare-wallet/ (by Solflare, homepage solflare.com, ~11,958 users, v2.28.1 updated 2026-06-08)","https://apps.apple.com/us/app/solflare-solana-crypto-wallet/id1580902717 (seller SOLRISE RESEARCH LTD, developer website solflare.com)","https://play.google.com/store/apps/details?id=com.solflare.mobile (developer Solrise Research Ltd, website solflare.com)","https://help.solflare.com/en/articles/13522176-what-should-i-do-if-my-solflare-wallet-is-compromised-or-funds-are-stolen (footer links twitter.com/solflare)"],"notes":"Operator: Solrise Research Ltd. The Firefox add-on (v2.28.1, Jun 2026) lags the Chrome one (v2.41.0, Oct 2026). github.com/solflare-wallet has a GitHub-verified solflare.com domain, but solflare.com didn't link it in our check, so it isn't listed above. It holds SDKs and the MetaMask Snap, not wallet installers. Discord discord.com/invite/solflare is linked from solflare.com only."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"'Solflare is a self-custodial wallet, meaning you control your private keys.'","source":"https://help.solflare.com/en/articles/13522176-what-should-i-do-if-my-solflare-wallet-is-compromised-or-funds-are-stolen"},"can_move_funds_out":{"value":true,"note":"You sign every send yourself. Solflare 'does not have the ability to retrieve stolen funds, reverse transactions, or monitor blockchain accounts.'","source":"https://help.solflare.com/en/articles/13522176-what-should-i-do-if-my-solflare-wallet-is-compromised-or-funds-are-stolen"},"freeze_policy":{"note":"In-wallet swaps use the Jupiter Aggregator, a third party, for routing. The article names no Solflare swap fee and says to keep at least 0.05 SOL for transaction costs.","source":"https://help.solflare.com/en/articles/5758552-how-to-swap-tokens-using-solflare-mobile"},"api_keys":null,"privacy_coins":null,"incidents":[],"deadlines":[],"worst_case":"Solflare is self-custody: a leaked recovery phrase or a signed malicious approval can drain the wallet, and Solflare can't reverse or recover anything.","safe_setup":["Install only from solflare.com/download: Chrome Web Store ID bhhhlbepdkbapadjdnnojkbgioiodbic, Firefox 'solflare-wallet', App Store id1580902717, Google Play com.solflare.mobile.","Review and revoke dapp permissions under Settings → Security and Privacy → Spending Approvals, and never type your recovery phrase into a site or 'support' chat.","Use a separate Solflare wallet with a small balance for bots and memecoin trading, and keep savings on a Ledger connected to Solflare."],"last_checked":"2026-10-25","links_status":"verified"},{"name":"Coinbase Wallet","slug":"coinbase-wallet","kind":"wallet","chains_or_assets":["Base","Ethereum","Bitcoin","Solana","BNB Chain","Optimism","Arbitrum","Polygon","Avalanche","Monad","Robinhood Chain"],"listing_name":null,"official":{"domains":["wallet.coinbase.com"],"telegram":[],"x":[],"github":[],"apps":["https://chromewebstore.google.com/detail/coinbase-wallet-extension/hnfanknocfeofbddgcijnmhnfnkdnaad","https://apps.apple.com/us/app/coinbase-wallet-trade-to-win/id1278383455","https://play.google.com/store/apps/details?id=org.toshi"],"confirmed_via":["https://help.coinbase.com/en/wallet/browser-extension/coinbase-wallet-extension (links Chrome Web Store hnfanknocfeofbddgcijnmhnfnkdnaad and wallet.coinbase.com)","https://chromewebstore.google.com/detail/coinbase-wallet-extension/hnfanknocfeofbddgcijnmhnfnkdnaad (publisher Toshi Holdings Pte. Ltd, website wallet.coinbase.com, 'Created by the owner of the listed website', 1,000,000 users, v3.150.0 updated 2026-10-19)","https://wallet.coinbase.com/ (coinbase.com/wallet redirects here; apple-itunes-app meta app-id=1278383455)","https://apps.apple.com/us/app/coinbase-wallet-trade-to-win/id1278383455 (seller Coinbase Wallet, developer website wallet.coinbase.com, v30.17)","https://www.coinbase.com/wallet/downloads (Android 'Download Now' via go.cb-w.com/wallet-mobile-download redirects to Google Play org.toshi)","https://play.google.com/store/apps/details?id=org.toshi (title 'Coinbase Wallet: Trade to Win', developer Coinbase Wallet, website wallet.coinbase.com, updated 2026-10-16)"],"notes":"Name: Coinbase renamed the self-custody app 'Base App' in July 2025, then back to 'Coinbase Wallet' on 2026-09-10 (https://theblock.co/news/defi/2026-09-10-coinbase-rebrands-base-app-back-to-coinbase-wallet-after-just-over-a-year-as-social-experiment-falls-short-414115). Some Coinbase pages still say 'Base' (the downloads page and the help article on the 'Base browser extension'), so both names are real. This is not the Coinbase exchange app, and you don't need a Coinbase account. The coinbase.com/wallet/downloads page metadata carries other app IDs (886427730, com.coinbase.android), but its download buttons lead to org.toshi: don't use the metadata IDs for the wallet. Web sign-in for smart-wallet 'Base accounts' is at keys.coinbase.com (help center; single source). wallet.coinbase.com links X @coinbasewallet, but we found no second confirmation. Search results for 'Coinbase Wallet extension' were dominated by fake Teachable, Daftpage and Google Sites pages when we checked on 2026-10-25."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"'A Coinbase wallet is a self-custody wallet': private keys are 'stored directly on your mobile device and not with a centralized exchange like Coinbase'. Newer smart-wallet 'Base accounts' can sign in with an email one-time code, a passkey or a recovery phrase (https://help.coinbase.com/en/wallet/getting-started/smart-wallet-passkeys). The help page doesn't say where key material for email sign-in is held.","source":"https://help.coinbase.com/en/wallet/getting-started/what-is-coinbase-wallet"},"can_move_funds_out":{"value":true,"note":"You sign sends yourself. Some features are geo-restricted (The Block, 2026-09-10).","source":"https://help.coinbase.com/en/wallet/getting-started/what-is-coinbase-wallet"},"freeze_policy":{"note":"In-app swaps go through third-party DEX aggregators, which 'may charge a fee', plus a fee of 'up to 1% on swaps'. Perpetual futures in the app are routed through Hyperliquid (The Block, 2026-09-10).","source":"https://help.coinbase.com/en-au/wallet/getting-started/dex-swap"},"api_keys":null,"privacy_coins":null,"incidents":[{"date":"2025-07-03","title":"Koi Security found 40+ fake wallet add-ons on the Firefox store impersonating Coinbase, MetaMask, Phantom, Trust Wallet, Exodus and others. Coinbase Wallet has no official Firefox add-on (third-party report).","amount":null,"outcome":"reported to Mozilla","source":"https://thehackernews.com/2025/07/over-40-malicious-firefox-extensions.html","kind":"third_party"},{"date":"2025-03-18","title":"'Migrate to Coinbase wallet' phishing emails gave each recipient a pre-generated 'recovery phrase' and told them to import it into the real Coinbase Wallet app. The scammers already knew the phrase and drained whatever was moved in (Bitdefender, third-party report).","amount":null,"outcome":"warning","source":"https://www.bitdefender.com/en-us/blog/hotforsecurity/mandatory-coinbase-wallet-migration-its-a-phishing-scam","kind":"third_party"}],"deadlines":[{"date":"2026-08-15","what":"PASSED: Dogecoin, Litecoin, zkSync Era and other networks are no longer supported in Coinbase Wallet. Those assets are still on-chain: import your recovery phrase into another wallet to reach them.","source":"https://help.coinbase.com/en/wallet/getting-started/get-started"}],"worst_case":"Coinbase Wallet is self-custody, so if you import a recovery phrase someone gave you (a known Coinbase-impersonation trick), leak your own phrase, or sign a malicious approval, the funds can be taken. Coinbase the exchange can't reverse it.","safe_setup":["Install only via wallet.coinbase.com or help.coinbase.com: Chrome Web Store ID hnfanknocfeofbddgcijnmhnfnkdnaad, App Store id1278383455, Google Play org.toshi. There's no Firefox add-on.","Never import a recovery phrase you didn't create yourself. Coinbase never sends you one, and any 'migration' email or call from 'Coinbase support' asking you to move funds is a scam.","Keep bot and dapp funds in a separate wallet with a small balance, and revoke stale approvals at Revoke.cash."],"last_checked":"2026-10-25","links_status":"verified","aliases":["Base app","Base wallet"]},{"name":"Electrum","slug":"electrum","kind":"wallet","chains_or_assets":["Bitcoin"],"listing_name":null,"official":{"domains":["electrum.org"],"telegram":[],"x":[],"github":["github.com/spesmilo/electrum"],"apps":["https://play.google.com/store/apps/details?id=org.electrum.electrum"],"confirmed_via":["https://electrum.org/ (project homepage, latest release 4.8.3; links github.com/spesmilo/electrum, the Google Play listing org.electrum.electrum, and download.electrum.org; says 'Do not download Electrum from a source other than electrum.org')","https://play.google.com/store/apps/details?id=org.electrum.electrum (developer Electrum Technologies GmbH, developer website https://electrum.org, 1M+ downloads, 'What's new' links 4.8.3 release notes)","https://en.wikipedia.org/wiki/Electrum_(software) (infobox: website electrum.org, repository github.com/spesmilo/electrum, developer Electrum Technologies GmbH)"],"notes":"Desktop and Android binaries are served from download.electrum.org, a subdomain linked from electrum.org; it is covered by the electrum.org confirmation and is not listed separately. X: electrum.org links x.com/ElectrumWallet as the place for official announcements (along with Nostr), but x.com could not be opened and no second source named the handle, so @ElectrumWallet is left out. F-Droid (org.electrum.electrum) is linked from electrum.org, but the F-Droid page could not be opened, so it is not listed. No official Telegram: electrum.org lists X, Nostr, r/Electrum, Bitcointalk and IRC (#electrum on Libera) and does not mention Telegram. electrum.org also says Electrum does not provide private user support, and anyone posing as 'Electrum support' in a private channel is probably an imposter. Windows binaries are often flagged by antivirus as false positives, per electrum.org. The 4.8.3 release notes (tag 4.8.3, dated October 23, 2026) mark it as a security update; the GitHub advisory GHSA-6jp4-8v48-cc5v could not be opened here."},"known_fakes":[{"value":"btc-electrum.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"btcelectrum.org","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"downloadelectrum.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"downloadelectrum.org","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"eiectrum.net","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrum.bz","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumapp.org","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumapps.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumbase.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumbase.net","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumbase.org","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumbitcoin.org","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumbtc.org","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumbuild.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumcircle.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumclient.org","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumcore.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumcore.net","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumdownload.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumdownload.org","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrume.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrume.org","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumfix.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumget.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumhub.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumnet.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumofficial.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumopen.org","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumpgrade.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumsafe.org","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumsite.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumsource.org","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumstart.org","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumtxn.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumupdate.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumupgrade.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumupgrade.org","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumware.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumware.org","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"electrumweb.net","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"getelectrum.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"getelectrum.live","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"getelectrum.org","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"goelectrum.com","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"},{"value":"myelectrum.org","kind":"domain","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","date":"2019-04"}],"custody":{"who_holds_keys":"user","note":"Self-custody. electrum.org says 'Your private keys are encrypted and never leave your computer' and 'Your funds can be recovered from a secret phrase.' Losing the seed means losing the funds; Electrum cannot recover it.","source":"https://electrum.org/"},"can_move_funds_out":{"value":true,"note":"You sign every send yourself, to any address. No one else can block or reverse it.","source":"https://electrum.org/"},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[{"date":"2026-10-23","title":"Security release 4.8.3 fixed a flaw that let a malicious Electrum server show a fake pending payment in wallet history; if the user then raised its fee (RBF), they could sign a transaction paying the attacker, whose address matched the last four characters of the real one. Electrum says users connected only to trusted servers, such as their own, were not exposed. Attack details are from press reports of Electrum's advisory; the release notes list the 4.8.3 security fixes","amount":"Not disclosed. Two incidents were reported to Electrum (2026-10-11 and 2026-10-18); crypto.news says one was a 2-of-3 multisig wallet that sent nearly all its bitcoin to a lookalike address, and another user lost funds while raising a fee. No total is given.","outcome":"Fixed in 4.8.3 (all earlier versions affected); Electrum urged all users to upgrade","source":"https://github.com/spesmilo/electrum/blob/4.8.3/RELEASE-NOTES https://crypto.news/electrum-wallet-bitcoin-theft-security-flaw-4-8-3/","kind":"exploit"},{"date":"2019-04-14","title":"Malwarebytes documents two 2018-2019 campaigns against Electrum users: malicious Electrum servers pushed fake 'update' messages through server error text (clients older than 3.3.3 displayed arbitrary rich text), and lookalike download sites served trojanised wallets. The second variant also removed RBF and confirmation prompts and redirected payments. Malwarebytes also reports a DDoS from 25,000+ IPs against Electrum servers in April 2019, and a 114.61 BTC cash-out on 2019-04-14.","amount":"Well over 771 BTC (about $4M) per Malwarebytes. Its per-variant figures (218.15 BTC and 637.73 BTC) add up to more than that total.","outcome":"Electrum added a legitimate update notice through the same mechanism and, from 2019-03-15, disrupted clients older than 3.3 to force upgrades. Malwarebytes advises updating from the official site and treating unexpected warning or update messages with suspicion.","source":"https://www.malwarebytes.com/blog/news/2019/04/electrum-bitcoin-wallets-under-siege","kind":"third_party"},{"date":"2018-12-21","title":"Phishing via malicious Electrum servers: the attacker added many servers to the network, and connected wallets showed a fake error telling the user to install an 'update' from a malicious GitHub repository. The fake app asked for the 2FA code and moved the funds. Electrum posted a warning on 2018-12-26 (per Malwarebytes).","amount":"More than $750,000 at the time of writing (SC Media, 2018-12-28)","outcome":"Electrum stopped rich-text rendering of server messages as a temporary fix; SC Media says the underlying issue needed wider changes to the server network. Users were told to download only from the official site.","source":"https://www.scworld.com/news/electrum-wallet-phishing-and-malware-attacks-net-more-than-750000-in-bitcoin","kind":"hack"}],"deadlines":[],"worst_case":"Electrum is self-custody, so a leaked seed or a fake download can empty the wallet and nobody can reverse it. Until you are on 4.8.3 or later, a malicious server could also get you to sign a fee bump that pays an attacker (an attack reported in October 2026).","safe_setup":["Download only from electrum.org (its page says not to use any other source), and check the GPG signature of every new version as Electrum's docs describe (the .asc file with gpg --verify)","Update to 4.8.3 or later (Electrum's page lists 4.8.3 as the latest release); until then, check the full address and amount before signing anything, including fee bumps","Connect only to servers you trust, ideally your own, since Electrum says trusted-server users are not exposed to the 4.8.3 attack; never install an 'update' offered in a server message or pop-up"],"last_checked":"2026-10-25","links_status":"partial"},{"name":"Keystone","slug":"keystone","kind":"wallet","chains_or_assets":["Bitcoin","Ethereum","Solana","Other chains via companion wallets (Bitcoin-only firmware also offered)"],"listing_name":null,"official":{"domains":["keyst.one"],"telegram":[],"x":["@KeystoneWallet"],"github":["github.com/KeystoneHQ"],"apps":["https://apps.apple.com/us/app/keystone-nexus/id6742313403","https://apps.apple.com/app/id1567857965"],"confirmed_via":["https://github.com/KeystoneHQ/keystone3-firmware (KeystoneHQ repo; About lists official website https://keyst.one/; FAQ points to a firmware verification guide docs/verify.md; contact eng@keyst.one)","https://apps.apple.com/us/app/keystone-nexus/id6742313403 (Keystone Nexus, 'official companion app for the Keystone 3 PRO'; seller YANSSIE HK LIMITED; developer website https://keyst.one; privacy policy on keyst.one; v1.3.5)","https://apps.apple.com/app/id1567857965 (Keystone Hardware Wallet, 'Companion for Keystone', iPhone only; same seller YANSSIE HK LIMITED; privacy policy on keyst.one; v1.4.0, 2024-07-22)","https://en.bitcoin.it/wiki/Keystone (third-party: official website keyst.one)","https://bitcoinmagazine.com/business/crypto-wallet-maker-keystone-debuts-bitcoin-only-firmware-keystone-3-pro (third-party: official website keyst.one, firmware downloads at keyst.one/firmware, firmware open source on GitHub)","https://cryptobriefing.com/keystone-data-breach-exposed-2026/ , https://news.bitcoin.com/security/keystone-wallet-data-breach-exposes-buyers-addresses-to-scammers/ and https://safeguard.sh/resources/blog/keystone-hardware-wallet-shopify-store-breach-customer-shipping-data (three outlets each cite https://x.com/KeystoneWallet/status/2114054080754770137 as Keystone's own breach statement, and advise typing keyst.one directly and using support@keyst.one)"],"notes":"keyst.one itself could not be fetched here (blocked), so nothing was read from the vendor's own site and the site's links to X, GitHub and the app stores were not checked. @KeystoneWallet is confirmed only by news outlets citing its breach statement (the statement page itself could not be opened). Bitcoin Magazine names a separate X account @KeystoneForBTC, which is in only one source and is left out. The Telegram channel t.me/keystonex ('KEYSTONE WALLET OFFICIAL', ~32K subscribers) calls itself official and posts Keystone blog links, but names no operator and never links keyst.one, so it is NOT listed. Android app and any authorised-reseller list were not found, so none are listed. Both iOS apps rest on App Store listings only. Keystone says it never asks for recovery phrases or private keys and says to type keyst.one yourself and contact support@keyst.one."},"known_fakes":[],"custody":{"who_holds_keys":"user","note":"Self-custody, air-gapped hardware wallet: the device has no WiFi, Bluetooth or NFC and signs through QR codes. Bitcoin Magazine says seeds can be generated on the device itself and that the Keystone 3 Pro erases stored keys if it detects physical tampering.","source":"https://bitcoinmagazine.com/business/crypto-wallet-maker-keystone-debuts-bitcoin-only-firmware-keystone-3-pro"},"can_move_funds_out":{"value":true,"note":"You sign every transaction on the device yourself; the companion app builds the transaction and broadcasts it once signed. Anyone who has your recovery phrase can do the same from another device.","source":"https://apps.apple.com/app/id1567857965"},"freeze_policy":null,"api_keys":null,"privacy_coins":null,"incidents":[{"date":"2026-10-24","title":"Keystone disclosed unauthorized access to its official website (detected Oct 20; it confirmed on Oct 23, after reviewing API activity with Shopify, that a third party took customer shipping information). Exposed: names, contact details, shipping addresses and order details (items and prices). Keystone says payment card or bank details, recovery phrases, private keys and wallet passwords were not exposed (not independently verified). Keystone warned scammers may pose as Keystone by phone, text, email or mail and offer refunds, replacement devices or order/address 'fixes'.","amount":null,"outcome":"Keystone says it blocked the access, patched the vulnerability, opened an investigation and is emailing affected customers; a detailed report was promised 'in the coming days' and had not appeared as of Oct 25. Number of customers, attack method and the Shopify app or credential involved were not disclosed. No loss of funds was reported.","source":"https://cryptobriefing.com/keystone-data-breach-exposed-2026/","kind":"hack"}],"deadlines":[],"worst_case":"Keystone is self-custody, so the device cannot be frozen, but anyone who gets your recovery phrase can empty every wallet it backs up. After the Oct 2026 store breach, scammers holding real names, addresses and order details can send convincing refund or 'replacement device' messages to get your phrase.","safe_setup":["Buy only through keyst.one, typed in yourself or from a bookmark, and never from links in unexpected emails, texts or letters; for anything that looks wrong, contact support@keyst.one (Keystone's post-breach guidance)","Check firmware against Keystone's verification guides in its GitHub docs before installing an update (KeystoneHQ/Keystone-developer-hub: application and secure-element update package verification)","Never enter your recovery phrase on a website, in an app or on a device you did not order, and ignore breach, refund or replacement-device messages that ask for it; Keystone says it never asks for recovery phrases or private keys"],"last_checked":"2026-10-25","links_status":"partial"},{"name":"3Commas","slug":"3commas","kind":"web_trading_terminal","chains_or_assets":["Binance","Bybit","OKX","Bitget","Gate","Kraken","KuCoin","Coinbase","Hyperliquid"],"listing_name":null,"official":{"domains":["3commas.io"],"telegram":[],"x":[],"github":[],"apps":["https://play.google.com/store/apps/details?id=io.threecommas.client.global"],"confirmed_via":["https://3commas.io (vendor homepage: footer links Google Play id io.threecommas.client.global, App Store id6446649413, x.com/3commas_io, help.3commas.io, trade.3commas.io/docs; lists exchanges Binance, Hyperliquid, Bybit, OKX, Bitget, Gate, Kraken, KuCoin, Coinbase)","https://3commas.io/security (vendor 'official channels' list: 3commas.io, app.3commas.io, help.3commas.io, feedback.3commas.io, status.3commas.io; emails support@3commas.io, security@3commas.io)","https://play.google.com/store/apps/details?id=io.threecommas.client.global (listing '3Commas: Crypto Trading Tools', developer 3C Trade Tech Ltd, email support@3commas.io, points to 3commas.io, 10K+ downloads)","https://coinbureau.com/review/3commas-review (third-party review links 3commas.io/exchanges, /pricing, /refund, /security)"],"notes":"Only 3commas.io and the Google Play app are double-confirmed (vendor site plus an independent listing or review). The vendor site and its security page also list app.3commas.io, help.3commas.io, feedback.3commas.io, status.3commas.io and trade.3commas.io (docs, terms) but we found no independent second source for each, so only the registered domain is listed. App Store id6446649413 is linked from the vendor homepage but apps.apple.com could not be fetched, so it is left out. X: the vendor footer links x.com/3commas_io, while Kraken's 3Commas partner page (kraken.com/gb/pro/3commas) links x.com/3Commas, a different handle, and x.com could not be fetched, so no X handle is listed. Telegram: the vendor footer uses bit.ly redirect links and t.me/Community_3Commas (single source), so none is listed. No GitHub found. 3Commas says it provides software only; trading is done on your exchange. Legal entities seen: 3C Trade Tech Ltd (Google Play) and 3Commas Technologies OU (named in a 2023 US class action), not reconciled here. 3Commas says its support email is support@3commas.io."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Your coins stay in your account on the exchange you connect (Binance, Kraken, Coinbase, etc.). 3Commas holds the API keys and secrets that let its bots place orders on that account, stored in its 'Sign Center', which it describes as 'a secure API key storage isolated at both infrastructure and access levels'. 3Commas says it 'provides software only' and 'has zero access to withdraw or transfer fiat or cryptocurrencies'. The Dec 2022 leak showed those stored keys are a target.","source":"https://3commas.io/security"},"can_move_funds_out":{"value":false,"note":"Only if the key is set up as 3Commas' docs say: 3Commas guides tell you to 'provide TRADING access only and DISABLE the withdrawal option', and Kraken's 3Commas page says withdrawal permission is not required. A key with withdrawal enabled could move funds if leaked. Even a trade-only key can place bad orders on your balance, which is how the 2022 thefts worked (per Bitsgap and Coin Bureau).","source":"https://help.3commas.io/en/articles/16281186-create-and-connect-api-keys"},"freeze_policy":null,"api_keys":{"note":"3Commas' key guide says to give TRADING access only and disable withdrawals. It lists per-exchange permissions: Binance (Spot & Margin Trading and Futures, restrict to trusted IPs), OKX (Trade), Bybit (Read-Write plus Unified Trading), Kraken, KuCoin (Spot Trading), Gate (Read and Write), Bitget (Read-write), Coinbase (Trade). It recommends using the whitelisted 3Commas IP addresses shown under My Exchanges > Add exchange (Gate keys without IP binding last only 90 days, and the guide tells KuCoin users to set IP restriction to 'No'). Another 3Commas help page says to use API keys only for 3Commas and not link the same exchange account to another trading service. Its security page says 'The IP whitelist can be used to restrict the API key to certain IP addresses'. Hyperliquid keys expire about six months after connecting.","source":"https://help.3commas.io/en/articles/16281186-create-and-connect-api-keys"},"privacy_coins":null,"incidents":[{"date":"2023-01-09","title":"Proposed US class action (Freeman et al. v. 3Commas Technologies OU, No. 4:23-cv-00101) alleges 3Commas did not encrypt stored API data, that the breach exposed at least 100,000 consumers and led to nearly $22 million in theft. These are allegations, not findings.","amount":"alleged nearly $22M","outcome":"No ruling or settlement reported on the source page","source":"https://www.classaction.org/news/3commas-fails-to-protect-users-crypto-accounts-from-theft-class-action-alleges","kind":"third_party"},{"date":"2022-12-28","title":"API data leak: an anonymous poster published a sample of ~100,000 API keys. After first denying a leak and pointing to phishing, 3Commas confirmed on 2022-12-28 that 'the data in the files is true' and asked Binance, KuCoin and other exchanges to revoke all keys connected to 3Commas. Binance's CEO had urged users to disable keys. The FBI was reported to be investigating. 3Commas says it found no evidence of an insider, and the attackers claimed an employee sold the data.","amount":"Traders reported ~$22M stolen (Decrypt); ZachXBT verified 44 victims / $14.8M (Decrypt); HAPI counted 86 victims / $27.3M (ForkLog)","outcome":"3Commas urged all users to reissue keys and promised no reimbursement until its investigation ended; HAPI says all exchanges have since disabled 3Commas keys. We found no source for any 3Commas compensation.","source":"https://3commas.io/blog/notice-on-api-data-disclosure-incident","kind":"hack"},{"date":"2022-10-20","title":"Phishing: lookalike sites captured users' exchange API keys, which were used to place ~20,000 unauthorized trades (DMG and other tokens) on several exchanges. 3Commas said its own systems were not breached at the time; the Dec 2022 leak later contradicted that.","amount":"~$6M claimed across exchanges; 10 confirmed 3Commas users (per 3Commas)","outcome":"FTX agreed a one-time ~$6M payout (Blockworks); 3Commas reported cloned sites for takedown","source":"https://3commas.io/blog/october-19-phishing-attack-post-mortem","kind":"third_party"}],"deadlines":[],"worst_case":"3Commas holds API keys that can trade on your exchange account. If they leak (as ~100,000 did in Dec 2022) or are phished, attackers can place orders that drain your balance even without withdrawal rights, and 3Commas' terms cap its liability at the subscription price you paid. A key with withdrawal enabled could be emptied outright.","safe_setup":["Open 3Commas only from 3commas.io (bookmark it) and turn on 2FA on both 3Commas and your exchange; never enter API keys on a site reached from ads, search results or DMs","Create the exchange API key with trading permission only and withdrawals disabled, restricted to the 3Commas IP addresses shown under My Exchanges > Add exchange (use a dedicated sub-account where your exchange supports it), and use the key only for 3Commas","Keep only the balance your bots need on that exchange account, and revoke the key at the exchange (not just in 3Commas) if you stop using it or suspect a leak"],"last_checked":"2026-10-25","links_status":"partial"},{"name":"Pionex","slug":"pionex","kind":"exchange","chains_or_assets":["Multi-asset centralized exchange with built-in trading bots (spot, perpetual futures)"],"listing_name":null,"official":{"domains":["pionex.com"],"telegram":["@pionexen"],"x":[],"github":[],"apps":[],"confirmed_via":["https://www.pionex.com/blog/ (site footer links Telegram t.me/pionexen, Twitter, Reddit, Facebook; navigation links Discord)","https://coinmarketcap.com/exchanges/pionex (listing shows website pionex.com and Telegram t.me/pionexen)","https://apps.apple.com/hn/app/pionex-crypto-trading-bots/id1485348891 (App Store listing, seller BitUniverse CO., Limited, names www.pionex.com as its support site)"],"notes":"X is left out because the sources disagree: the pionex.com footer links twitter.com/pionex_com, while CoinMarketCap lists twitter.com/pionex. We could not open either profile to check, so neither is listed. The iOS app (App Store id1485348891, seller BitUniverse CO., Limited) was not double-confirmed, because pionex.com did not link it in the pages we could fetch, so no app is listed. A GitHub org 'pionex-official' (pionex-open-api) appears in a third-party PyPI package page, but github.com could not be opened, so it is not listed. We could not open t.me/pionexen, so the group's size is unverified. Pionex.US (pionex.us, Telegram t.me/pionexus, X @PionexUS, iOS id1567213944) is a separate US-facing service with its own help center at intercom.help/pionexus; it is not covered by this entry. Pionex's own help center article 'How to Verify Official Pionex Channels & Avoid Scams' exists (listed at https://intercom.help/pionex/en/collections/19449950-getting-started), but its text could not be read here. Pionex's terms and its API-key permissions page could not be retrieved."},"known_fakes":[],"custody":{"who_holds_keys":"exchange","note":"Custodial exchange. Pionex says it keeps '100% reserve' and uses a Merkle tree plus an independent audit to show it; these are Pionex's own claims, and we did not find the audit report itself.","source":"https://intercom.help/pionex/en/articles/14607875-what-is-merkle-tree"},"can_move_funds_out":{"value":true,"note":"Pionex says 'users can withdraw their coins at any time', and its help center has withdrawal guides for web and app. Trustpilot reviewers report withdrawals blocked during Pionex 'risk-control' reviews or until KYC is completed (user claims, not verified).","source":"https://intercom.help/pionex/en/articles/14607875-what-is-merkle-tree"},"freeze_policy":{"note":"Pionex's terms of use could not be retrieved, so the exact wording is not confirmed here. In public replies on Trustpilot, Pionex cites 'risk-control measures' when users report funds being unavailable, and reviewers describe trading and withdrawal restrictions followed by requests for personal and trading records.","source":"https://www.trustpilot.com/review/Pionex.com"},"api_keys":{"note":"Pionex's API docs recommend setting up IP whitelisting along with the API key. Keys are created in the app or site under Account Settings, API Management (per CoinLedger's guide). The docs link to a separate 'API Key Permissions' page, which could not be retrieved, so whether keys have a withdrawal permission is not confirmed. Third-party guides say read-only keys are enough for tax and portfolio tools (CoinLedger, TradesViz).","source":"https://www.pionex.com/docs/api-docs"},"privacy_coins":null,"incidents":[{"date":"2025-05-28","title":"Four US state regulators (Nebraska, North Carolina, Ohio, South Dakota) issued a consent order against Pionex Inc., the US entity, over failing to collect sender and beneficiary information on transfers above $3,000, information-security and record-keeping deficiencies, and operating before licensing in North Carolina and Ohio. Pionex did not admit wrongdoing.","amount":"$20,000 penalty","outcome":"Penalty plus two years of quarterly progress reports; no cease-and-desist","source":"https://dlr.sd.gov/banking/legal/documents/pionex-consent-order.pdf","kind":"third_party"},{"date":"2022-03-06","title":"Pionex was attacked and suspended deposits and withdrawals while it repaired and upgraded its wallet functions (Wu Blockchain report, per CoinCodeCap). The article does not say how much was lost.","amount":null,"outcome":"Per the article, Pionex said it had fully compensated affected users and would reopen deposits and withdrawals after the upgrade. We did not find Pionex's own notice.","source":"https://coincodecap.com/crypto-exchange-and-trading-bot-provider-pionex-attacked","kind":"hack"},{"date":"2026-10-25","title":"Pattern of user complaints: Trustpilot shows a 2.5/5 score from 636 reviews (40% one-star). Themes include stuck withdrawals, trading and withdrawal restrictions after profitable trades or deposits, KYC-gated withdrawals, slow support and disputed compensation. Trustpilot does not verify reviews.","amount":null,"outcome":"Pionex replies to most negative reviews, often citing risk-control measures; compensation limited to verified platform issues","source":"https://www.trustpilot.com/review/Pionex.com","kind":"user_reports"}],"deadlines":[],"worst_case":"Pionex holds your coins, so an exchange hack or insolvency, or an account restriction after a 'risk-control' review, could lock your balance and your running bots for an unknown time. The '100% reserve' claim is Pionex's own, and you would depend on Pionex's compensation decisions.","safe_setup":["Type pionex.com yourself or use a bookmark; treat any Telegram or X DM, 'support' contact or giveaway as a scam, and join only the group linked from the site (t.me/pionexen)","Create API keys under Account Settings, API Management, bind each key to your bot's IP as the docs recommend, and enable only the permissions the bot needs","Keep only trading capital on Pionex and check your balance against its Merkle tree page; hold savings in your own wallet"],"last_checked":"2026-10-25","links_status":"partial"}]}