{ "license": "CC-BY-4.0", "attribution": "xmr.club", "locale": "en", "generated_at": "2026-09-15T15:27:38.415Z", "count": 334, "schema": "https://xmr.club/data.json#schema", "providers": [ { "id": "b-ai", "category": "ai", "subcategory": "Multi-Channel Agents", "name": "B.ai", "url": "https://xmr.club/ai/b-ai", "twin": "https://xmr.club/llm/ai/b-ai.txt", "tagline": "Multi-channel LLM agent platform — Telegram, Discord, Feishu, WeCom, QQ bots.", "review": "LLM service plus an \"agent\" layer that exposes the same model through native bots in Telegram, Discord, Feishu, WeCom, DingTalk, and QQ. Useful when you want an LLM in a chat surface without rolling your own integration. Pricing + KYC posture pending curator-side verification.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "api_available", "bot_supported" ], "highlight_tags": [ "MULTI-CHANNEL", "AGENTS" ], "fees": { "summary": "Pricing pending curator verification · see b.ai" }, "fees_summary": "Pricing pending curator verification · see b.ai", "last_verified": "2026-05-12", "operating_since": "2025", "tenure_note": "B.ai (BAI) is a recent AI product. Earlier stamp (2017) was the b.ai premium domain WHOIS — domain has been a premium hold for years, current entity launched 2024-2025. Grok-audit returned 2026; using 2025 as conservative midpoint.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://b.ai", "outbound_slug": "b-ai" } }, { "id": "continue-dev", "category": "ai", "subcategory": "Coding Assistant", "name": "Continue.dev", "url": "https://xmr.club/ai/continue-dev", "twin": "https://xmr.club/llm/ai/continue-dev.txt", "tagline": "Open-source VS Code / JetBrains AI extension. Point at any local or cloud model, no vendor lock-in.", "review": "Continue.dev is the *bring-your-own-model coding assistant* — an open-source IDE extension that gives you Copilot-style chat, inline edits, and autocomplete while letting you point it at a fully local model, so your source code never has to leave your machine.\n\n**Background.** Continue launched in 2023 as an *Apache-2.0* extension for VS Code and JetBrains. Its defining choice is model-agnosticism: instead of hardwiring one vendor's cloud, you configure the provider — *local Ollama / LM Studio* for full privacy, or OpenAI / Anthropic / OpenRouter / others via API key when you want frontier capability. That open license plus the local-model path is why it earns an A in /ai: it's the category's credible privacy-respecting alternative to closed, telemetry-heavy assistants.\n\n**What you trust.** The trust model is \"you choose where the data goes.\" *Open source* means the extension's behaviour — what it sends, when, to which endpoint — is auditable rather than asserted. Configure a *local model* (Ollama/LM Studio) and your prompts, code context, and completions stay entirely on your hardware; nothing transits a third party at all. Use a hosted API and you're trusting that provider, but Continue itself isn't an intermediary harvesting your code. There's *no mandatory account* tying your editing to an identity. Compared to mainstream AI-in-the-editor — which ships your code and prompts to a vendor by default — this is a structurally different posture: the tool is a conduit you control, not a data funnel.\n\n**Operational specs.** It runs as a *VS Code / JetBrains extension* and provides chat, *inline edit* (select code, describe the change), autocomplete, and *codebase indexing* (local embeddings for \"ask my repo\" retrieval). Everything is driven by a config file where you declare your model(s), so swapping between a local Llama/Qwen/DeepSeek and a hosted model is a one-line change. With a local stack (Ollama + an open-weight code model) the entire loop — index, retrieve, prompt, complete — happens offline. Free and open-source; you pay only for whatever hosted model you opt into, if any.\n\n**Philosophy.** Code is among the most sensitive data a developer handles — proprietary logic, secrets, unreleased products — yet the dominant AI assistants stream it to a vendor as the price of admission. Continue's thesis is that you shouldn't have to choose between AI assistance and confidentiality: keep the assistant, control the model. Open-sourcing it and supporting local inference are the two moves that make that real — you can read what it does, and you can run it where nothing leaves your laptop.\n\n**Grade rationale.** A in /ai. The grade reflects an open (Apache-2.0) codebase, genuine local-model support (full offline privacy), no mandatory account, multi-IDE reach, and a config-driven design that doesn't lock you to one provider. It's the privacy-conscious default for AI in the editor. The caveats are about the local-model tradeoff and the BYO-key paths, not the tool's integrity.\n\n**Useful when.** Use Continue when you want AI help *inside your editor* but your code is confidential, under NDA, or simply something you'd rather not feed a cloud vendor — pair it with a local Ollama model for an offline assistant. It's also the right pick when you want to switch freely between local and hosted models per task (cheap/private local for routine edits, a frontier API for hard problems) without changing tools.\n\n**Caveats.** Local models are only as good as your hardware — a laptop-sized model won't match a frontier cloud model's reasoning, so the privacy/capability tradeoff is real and you should size expectations to your GPU. If you configure a *hosted* API provider, your code and prompts go to *that* vendor under their policy — Continue's privacy guarantee is only as strong as the backend you point it at, so the local path is the one that's truly private. As open-source dev tooling it expects some setup (installing a model runner, writing config). And codebase indexing builds local embeddings that live on disk — fine, but be aware of where. None of this dents the A: the ability to run a competent assistant with zero data egress is exactly what the category lacks elsewhere.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted", "api_available" ], "highlight_tags": [ "LOCAL", "OPEN-SOURCE", "IDE" ], "fees": { "summary": "Free · Apache · VS Code / JetBrains" }, "fees_summary": "Free · Apache · VS Code / JetBrains", "last_verified": "2026-06-03", "operating_since": "2023", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://continue.dev", "outbound_slug": "continue-dev", "contact_email": "support@continue.dev", "twitter": "https://x.com/continuedev" } }, { "id": "jan-ai", "category": "ai", "subcategory": "Local Runtime", "name": "Jan", "url": "https://xmr.club/ai/jan-ai", "twin": "https://xmr.club/llm/ai/jan-ai.txt", "tagline": "Open-source ChatGPT alternative running locally. Free, offline-first, model marketplace.", "review": "Jan is *ChatGPT that runs entirely on your own machine* — an open-source (MIT) desktop app that downloads and runs local LLMs with a clean chat UI, so your prompts and conversations never leave your computer.\n\n**Background.** Released in 2023 and *MIT-licensed*, Jan wraps the llama.cpp inference engine in a friendly desktop application: model discovery and download, chat history, and an *OpenAI-compatible localhost server* so other tools can talk to your local model as if it were OpenAI's API. It's cross-platform and explicitly aims to be \"the open-source Ollama, with a UI.\" That fully-local, permissively-licensed design is why it earns an A in /ai — it's the most approachable way to get a private, offline assistant running.\n\n**What you trust.** Yourself and your hardware. Because Jan runs models *entirely on your machine*, your prompts, your documents, and the model's responses *never transit a third party* — there's no cloud endpoint logging your conversations, no provider training on your data, no account tying your usage to an identity. The app is *open source (MIT)*, so what it does — and that it isn't phoning home — is auditable rather than promised. The *OpenAI-compatible local server* means you can even point existing OpenAI-API tools at Jan and keep all the inference local. The trust collapses to \"code you can read, running on hardware you control.\"\n\n**Operational specs.** A *cross-platform desktop app* (Windows/macOS/Linux) that wraps *llama.cpp*: drop in a *GGUF model* (or pick one from the in-app discovery), and chat. It maintains local chat history and exposes an *OpenAI-compatible API on localhost* so editors, agents, and scripts can use your local model as a drop-in for the OpenAI endpoint. UX is deliberately tuned for *non-engineers* — you don't need to touch a terminal to get a model talking. Free and open-source; the only cost is your own compute.\n\n**Philosophy.** The mainstream LLM experience routes your most sensitive queries — drafts, ideas, medical and legal questions, code — straight to a vendor that logs and may train on them. Jan's premise is that capable AI should be *yours*: run the weights on your own silicon, keep the data on your disk, and let anyone inspect the code that does it. Making it *easy* (a real app, not a command line) is the other half of the philosophy — privacy that only experts can achieve isn't privacy for most people, so Jan trades some power-user flexibility for an interface a non-engineer can actually use.\n\n**Grade rationale.** A in /ai. The grade reflects fully-local inference (zero data egress), an MIT-licensed open-source codebase, an OpenAI-compatible local API for integration, genuine cross-platform support, and a UX that brings local LLMs to non-technical users. It's a standout privacy option in the category. The caveats are about the local-model capability ceiling and hardware needs, not the tool's integrity.\n\n**Useful when.** Use Jan when you want an AI assistant whose conversations *stay on your machine* — confidential work, private questions, offline use, or simply not wanting a vendor to log your prompts — and you'd rather have a polished app than wrangle a CLI. It's also a clean way to give *existing OpenAI-API tools* a local backend: point them at Jan's localhost server and your data stops leaving the box. Ideal for the privacy-minded who aren't ready to run inference from the command line.\n\n**Caveats.** Local models are bounded by *your hardware* — a consumer GPU/CPU runs smaller models than a frontier cloud service, so set expectations to your machine; the privacy comes with a capability ceiling. Larger, more capable GGUF models need real RAM/VRAM, and running them well takes some tuning. As an actively-evolving open-source project, features and stability move fast (occasional rough edges). And \"private\" means *you* are now responsible for the model and data on your disk — your device security matters. None of these undercut the A: the ability to run a competent assistant with *zero* data leaving your machine, in an app a non-engineer can use, is exactly what the category needs more of.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted", "api_available" ], "highlight_tags": [ "LOCAL", "OPEN-SOURCE", "GUI" ], "fees": { "summary": "Free · MIT · MacOS/Win/Linux · OpenAI-compat API" }, "fees_summary": "Free · MIT · MacOS/Win/Linux · OpenAI-compat API", "last_verified": "2026-06-03", "operating_since": "2023", "tenure_note": "Jan AI (local LLM runner / ChatGPT alternative) launched 2023. Earlier stamp (2017) was the WHOIS for jan.ai domain — premium-domain trap. Grok-audit caught this.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://jan.ai", "outbound_slug": "jan-ai", "twitter": "https://x.com/jandotai", "discord": "https://discord.com/invite/FTk2MvZwJH" } }, { "id": "llama-cpp", "category": "ai", "subcategory": "Local Runtime", "name": "llama.cpp", "url": "https://xmr.club/ai/llama-cpp", "twin": "https://xmr.club/llm/ai/llama-cpp.txt", "tagline": "Reference C++ inference engine for open-source LLMs. Foundational layer beneath Ollama, LM Studio, Jan, KoboldCpp.", "review": "**The reference C++ inference engine for open-source LLMs** — the project Ollama / LM Studio / Jan / KoboldCpp / llamafile all wrap, by the developer who invented the GGUF model format the open-weight ecosystem standardised on. Listed at **Grade A** because `llama.cpp` is the irreducible local-inference layer: no operator on the data path, MIT-licensed, single-binary install, zero account anywhere, native acceleration on CPU + NVIDIA CUDA + AMD ROCm + Apple Metal + Vulkan. The strongest privacy posture available in this directory, jointly with Ollama (which sits one wrapper layer above), and the right answer when you want **maximum control over quantisation, context window, batch size, and offload split** — the things Ollama abstracts away.\n\n**What it is.** `llama.cpp` is a single-repo C++ project (`github.com/ggml-org/llama.cpp`, 70k+ stars) that loads quantised GGUF model weights and runs LLM inference against them. It ships:\n- A CLI (`./llama-cli`) for one-shot prompts and interactive REPL\n- An HTTP server (`./llama-server`) exposing an OpenAI-compatible `/v1/chat/completions` endpoint\n- A C++ library you can link from any host language (Python via `llama-cpp-python`, Rust via `llama-rs`, Go, Node, etc.)\n- The `convert_hf_to_gguf.py` toolchain for converting any Hugging Face model to GGUF\n- The `quantize` binary that produces every quantisation level from `Q2_K` to `Q8_0` to full FP16 / BF16\n\nWhere Ollama is the \"consumer app\" wrapper, `llama.cpp` is the engine. Every Ollama feature (model serving, prompt templates, GPU offload, function calling) is `llama.cpp` underneath. If you want to skip the wrapper — own your own model files, control quantisation per-deployment, link the library into a custom server — this is the project.\n\n**Background.** Started in **March 2023 by Georgi Gerganov** as a port of Meta's LLaMA model to C++, originally targeting Apple Silicon Macs. The project rapidly became the de-facto reference implementation for running open-weight LLMs locally — by mid-2024 the entire local-LLM ecosystem (Ollama, LM Studio, KoboldCpp, GPT4All, llamafile, OpenWebUI's local backend, vLLM's CPU mode) had standardised on Gerganov's **GGUF** model format and his quantisation algorithms.\n\n`llama.cpp` is **maintained by an open-source collective via the `ggml-org` GitHub organisation** (~600 contributors as of mid-2025). Gerganov also runs the **ggml.ai** company (Sofia, Bulgaria) which provides commercial support and contributes inference-engine improvements upstream, but the codebase remains MIT-licensed and community-governed — no CLA, no copyright assignment, no enterprise fork.\n\n**What you trust.**\n\n- **Inference is local.** Once you have a GGUF on disk, generation runs entirely on your hardware. The binary makes zero network calls during inference. You can run `llama-server` on an air-gapped box and use it forever.\n- **No account, no signup, no registry dependency.** You download the source / a release binary from GitHub, build (or unpack the precompiled), point at a GGUF file. No `llama.cpp account` exists. No upstream lookup happens.\n- **MIT licence, ~70k stars, ~600 contributors.** Audit anyone's commit at `github.com/ggml-org/llama.cpp`. Bug fixes ship within hours of a serious issue being reported. Multiple companies (Mozilla, ggml.ai, individuals) sponsor maintainers.\n- **Bring your own model weights.** GGUF files come from Hugging Face (`hf.co//-GGUF`), TheBloke's archive, the operator's own conversion of a `safetensors` checkpoint, or any third party you trust. There's no central registry controlling what you can run.\n- **Reproducible builds.** The source compiles cleanly with stock `cmake` + `make` on any POSIX system; the `release` tarballs include source + binaries together. You can verify the binary by rebuilding from the tagged source.\n- **Telemetry is zero.** No analytics, no usage pings, no error reports leaving your machine. The project has no operator that could collect data even if they wanted to.\n\n**Operational specs.**\n\n- **Install** — `git clone https://github.com/ggml-org/llama.cpp && cmake -B build && cmake --build build` (~5 min on a modern machine). Or download a release tarball from GitHub. Precompiled Linux / macOS / Windows binaries shipped per-release.\n- **Hardware** — minimum 4 GB RAM for tiny (1-3B) models at Q4; ~8 GB for 7B; 16-32 GB for 13B; 64+ GB for 70B. GPU optional. Acceleration paths: NVIDIA CUDA, AMD ROCm + Vulkan, Apple Metal, Intel SYCL, Vulkan (cross-vendor). CPU-only inference works on x86-64 + ARM (including phones via the Android port).\n- **Model formats** — GGUF (native, all quantisation levels from `IQ1_S` 1.5-bit to `F32` 32-bit float). Converters available from Hugging Face `safetensors`, PyTorch `.bin`, original `LLaMA` checkpoints.\n- **CLI flags** — `./llama-cli -m model.gguf -p \"your prompt\" -n 256 --temp 0.7 -ngl 35 -c 4096`. `-ngl` controls GPU layer offload (33-99 for full GPU on 7B/Q4). `-c` sets context length. `--cache-type-k Q8_0 --cache-type-v Q8_0` quantises the KV cache for longer context.\n- **Server mode** — `./llama-server -m model.gguf --port 8080 --host 0.0.0.0 -c 8192 -ngl 99`. Exposes `/completion`, `/chat/completions` (OpenAI-compatible), `/embeddings`, `/v1/audio/transcriptions` (whisper.cpp integration), and a built-in chat UI at the root.\n- **Python bindings** — `pip install llama-cpp-python` gives you the same engine under a Python API; first-class for LangChain, LlamaIndex, custom RAG pipelines.\n- **Sampling** — top-k, top-p, min-p, locally-typical, mirostat, XTC, DRY, temperature shaping. Every modern sampler the field has invented, exposed as CLI flags.\n- **Speculative decoding** — draft-model acceleration (`--model-draft`) for 1.5-3× faster generation on capable hardware.\n- **Support** — GitHub Issues (active, weeks-deep backlog handled), Discord, the project's discussions tab. No commercial SLA on the free tier; `ggml.ai` sells engagements.\n\n**Operator philosophy.** Gerganov has been explicit that **`llama.cpp` is built for \"everyone, everywhere\"** — the explicit goal is to make LLM inference work on whatever hardware the user has, including phones, microcontrollers, and CPU-only servers. The project's first-class support for `IQ1_S` (1.5-bit) and `Q2_K` (2-bit) quantisation is downstream of this: even a 70B model can squeeze into 16 GB of RAM at the cost of some quality. The GGML library underneath is a separately-maintained tensor primitive that other projects (whisper.cpp, stable-diffusion.cpp, bark.cpp) all share — Gerganov is building the **open inference substrate** rather than any one application.\n\n**Grade rationale.** Grade A reflects: **strongest privacy posture in the directory** (inference local, no operator on data path, no account, no telemetry), **MIT licence under permissive open-source norms** (forkable, auditable, no CLA), **broadest hardware support** (every consumer accelerator + CPU on every common platform), **the foundational engine the entire local-LLM ecosystem builds on** (Ollama, LM Studio, Jan, KoboldCpp, llamafile all depend on it — is inherited by the engine downstream), **named-operator accountability without operator dependency** (Gerganov + ggml.ai publicly identified, but the runtime keeps working if either disappears), **no major incident in `r/LocalLLaMA` / `r/MachineLearning` / GitHub issues in the last 12 months**, and **active maintenance — multiple releases per month**. Last verified 2026-05-26.\n\n**Useful when:**\n\n- You want full control over quantisation level, KV-cache type, context length, and GPU offload split — things Ollama abstracts away.\n- You're integrating LLM inference into a custom application (Electron, FFI binding, embedded system) and need the C++ library rather than a server.\n- You're optimising for absolute minimum binary size / minimum runtime footprint (ZeroMQ + `llama.cpp` is a viable inference stack in ~5 MB).\n- You need a specific sampler (mirostat, XTC, DRY) that Ollama doesn't expose.\n- You want to run on hardware Ollama doesn't support cleanly (Vulkan-only GPUs, Intel SYCL, weird ARM SoCs, the Hetzner CPU box you already pay for).\n- You're building / running benchmarks and need deterministic per-run control over every inference parameter.\n\n**Caveats:**\n\n- **Setup is C++-developer-grade.** First-time install is `git clone + cmake + make` and ~5 minutes; for non-developers, Ollama's curl-install + auto-config is the friendlier path to the same underlying engine.\n- **No model registry.** You source GGUF files yourself (Hugging Face is the de-facto repository, but verify the uploader; some quantisation jobs introduce subtle quality regressions). Ollama wraps this with `ollama.com/library`; `llama.cpp` doesn't.\n- **API surface is minimal but functional.** The built-in chat UI at `localhost:8080/` is basic — fine for testing, not for production end-users. Pair with a real frontend (Open WebUI, custom React, your own thing).\n- **Breaking changes during fast iteration.** The project ships multiple releases per month and sometimes breaks model compatibility (older GGUFs need re-quantisation against new versions). For production, pin a release tag and re-test before bumping.\n- **GPU offload requires correct build flags.** `cmake -DGGML_CUDA=ON` for NVIDIA, `-DGGML_HIPBLAS=ON` for AMD, `-DGGML_METAL=ON` (default on macOS) for Apple. Forgetting a flag silently CPU-falls-back, which destroys throughput. The README documents this; check before assuming GPU is working.\n- **No vendor support contract on the free tier.** Bugs are filed as GitHub Issues; serious users buy engagement from `ggml.ai`. Pair the project with internal triage capability if you depend on inference for revenue.\n- **`llama.cpp`-the-CLI changes API across releases.** `./main` was renamed to `./llama-cli` in mid-2024, `./server` to `./llama-server`, etc. Scripts pinned to old binary names need updating against new releases.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted", "cli_supported" ], "highlight_tags": [ "LOCAL", "OPEN-SOURCE", "REFERENCE" ], "fees": { "summary": "Free · MIT · single binary · CPU + CUDA + ROCm + Metal + Vulkan" }, "fees_summary": "Free · MIT · single binary · CPU + CUDA + ROCm + Metal + Vulkan", "last_verified": "2026-05-26", "operating_since": "2023", "tenure_note": "llama.cpp launched 2023 by Georgi Gerganov (ggml.ai team). github.com WHOIS 2007 is the host platform.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://github.com/ggml-org/llama.cpp", "outbound_slug": "llama-cpp" }, "also_listed_at": { "web3privacy": true } }, { "id": "lm-studio", "category": "ai", "subcategory": "Local Runtime", "name": "LM Studio", "url": "https://xmr.club/ai/lm-studio", "twin": "https://xmr.club/llm/ai/lm-studio.txt", "tagline": "Desktop GUI for local LLMs. Drag-drop GGUF models, OpenAI-compatible local API, no cloud.", "review": "Cross-platform desktop app (macOS / Windows / Linux) that wraps llama.cpp with a polished UI. Discover + download GGUF quantised models from Hugging Face, chat locally, expose an OpenAI-compatible API on localhost for apps to consume. Closed-source UI but the runtime is open. Best on-ramp for non-engineers.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "self_hosted", "api_available" ], "highlight_tags": [ "LOCAL", "GUI", "OPENAI-COMPAT" ], "fees": { "summary": "Free for personal · MacOS/Win/Linux · localhost API" }, "fees_summary": "Free for personal · MacOS/Win/Linux · localhost API", "last_verified": "2026-05-13", "operating_since": "2023", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://lmstudio.ai", "outbound_slug": "lm-studio", "contact_email": "support@lmstudio.ai", "twitter": "https://x.com/lmstudio", "discord": "https://discord.gg/lmstudio" } }, { "id": "lumo", "category": "ai", "subcategory": "hosted", "name": "Lumo (Proton AI)", "url": "https://xmr.club/ai/lumo", "twin": "https://xmr.club/llm/ai/lumo.txt", "tagline": "Proton's privacy-respecting AI assistant — zero-access encryption, no chat-training, Proton account required (no XMR payment yet).", "review": "**Background.** Proton's hosted AI assistant, launched 2025. Runs open-source models (OpenHermes, Mistral derivatives) on Proton-controlled inference infrastructure in Switzerland/EU — not a proxy to OpenAI/Anthropic. Per Proton's published architecture: chats are encrypted at rest with keys derived from the user's password; Proton servers can't decrypt them. Same zero-access-encryption posture as ProtonMail and Proton Pass.\n\n**What you trust.** Two things, separately. First, the encryption claim (chats unreadable to Proton's servers) is technically verifiable from the Proton clients' open-source code. Second, the no-training claim (Lumo does not train models on user conversations) is operator-stated and not yet independently audited — treat it as a policy promise from a Swiss company with a 12-year track record on similar promises, not as cryptographic certainty. Both Proton's mail product and Pass have undergone Cure53 audits; whether Lumo gets the same audit treatment is open.\n\n**Operational specs.** Free tier with guest mode (no account, limited model access, no chat persistence, modest rate limits). Account-required tier gives full model access + chat history + Proton ecosystem integration (drag a Proton Mail attachment into Lumo for summarization, etc.). Paid Proton Unlimited bundle ($9.99/mo annual) covers Lumo + Mail + VPN + Drive + Pass. Payment rails: Bitcoin, cash by mail, credit/debit, PayPal, Google Pay. **No native Monero payment** — operator-acknowledged gap as of 2026-05-30, no published timeline.\n\n**Operator philosophy.** Proton AG, Geneva, Switzerland. Founded 2014, currently 12-year operator track record across mail / VPN / drive / pass / Lumo. Public stance: privacy-by-default, no advertising business model, Swiss jurisdiction (no US/UK/AU lawful-access reach). Vertically integrated — Proton account is one identity across mail + drive + pass + VPN + Lumo, which is convenient but is also the concentration risk (see Caveats).\n\n**Grade rationale (B).** A-grade in our AI category is reserved for no-account, local-model, or confidential-compute options (Venice.ai, NanoGPT, PrivateMode, Ollama, Jan.ai). Lumo is hosted-by-operator with mandatory account for full features — that's structurally B, not A. The encryption posture + operator track record + payment privacy keep it solidly in the B tier (above OpenRouter which is purely an aggregator and above b-ai which is a multi-channel agent platform). If/when Lumo adds (a) no-account flow with feature parity, (b) Monero payment, or (c) third-party audit of the no-training claim, the case for B+ or A- gets stronger.\n\n**Useful when.** You already use the Proton ecosystem (Mail/Pass/VPN/Drive) and want an AI that fits the same trust model. You need privacy-respecting AI for sensitive drafting (legal, medical, business) but can tolerate an email-based identity. You want Bitcoin or cash payment options without a separate signup flow. For users who specifically need no-account AI, **see Venice.ai (A) or NanoGPT (A)** instead — both accept XMR and require no identity at all.\n\n**Caveats.**\n- Proton-account requirement creates an email-tied identity. Pseudonymous Proton signup via Tor is supported but a privacy cost vs no-account A-tier peers.\n- **No Monero payment yet** — operator-acknowledged on 2026-05-30, no published roadmap. Bitcoin + cash work for the paid tier; the no-payment guest tier sidesteps this.\n- **Proton concentration risk:** this is Proton's 3rd xmr.club listing (Mail A, Pass A, Lumo B). Single Proton account = trust anchor across mail + drive + password + VPN + AI. Account compromise has wider blast radius than single-product accounts. Mitigate with 2FA + hardware key + recovery-phrase discipline.\n- The no-training-on-user-data claim is operator-stated, not yet independently audited. Proton's track record on similar claims is strong but cryptographic verification is absent — treat accordingly.\n- Bitcoin payment doesn't strip the email identity from the Proton account itself; payment privacy is separate from account privacy.\n- Closed-source serving stack — even though the underlying models (OpenHermes, Mistral) are open-source, the inference pipeline + chat-encryption client isn't fully open. Verification is limited to the Proton client codebase that's been published.\n- Newer product than no-account A-tier peers (Venice 2023, NanoGPT 2023). Less long-term operational data on Lumo specifically; weight the operator-level history vs product-level history when judging.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "EMAIL" ], "feature_tags": [ "no_logs", "no_training", "encrypted_at_rest", "free_tier", "guest_mode", "open_source_models", "swiss_jurisdiction" ], "highlight_tags": [ "NO-LOGS", "NO-TRAINING", "ZERO-ACCESS", "PROTON-INTEGRATED" ], "fees": { "summary": "Free tier · Proton Unlimited from $9.99/mo · BTC, cash by mail, card, PayPal, Google Pay (no XMR yet)" }, "fees_summary": "Free tier · Proton Unlimited from $9.99/mo · BTC, cash by mail, card, PayPal, Google Pay (no XMR yet)", "last_verified": "2026-05-30", "operating_since": "2025", "tenure_note": "Lumo launched 2025 by Proton AG (Proton itself founded 2014; product is younger than the operator).", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://lumo.proton.me", "outbound_slug": "lumo", "twitter": "https://x.com/ProtonPrivacy", "tor": "https://lumo.protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion", "affiliate": "https://pr.tn/ref/9QT2HYP2" }, "also_listed_at": { "privacyguides": true } }, { "id": "nanogpt", "category": "ai", "subcategory": "API · Pay-Per-Use", "name": "NanoGPT", "url": "https://xmr.club/ai/nanogpt", "twin": "https://xmr.club/llm/ai/nanogpt.txt", "tagline": "Pay-per-prompt multi-model LLM access. Accepts Nano (XNO), BTC, XMR.", "review": "**Pay-per-prompt multi-model LLM gateway** with no subscription, fund-your-wallet model, and the only mainstream privacy-respecting API in this directory that price-anchors on **Nano (XNO) at sub-cent inference**. Listed at **Grade A** because the no-account anonymous tier + crypto-only funding + multi-frontier-model proxy + persistent low-friction privacy posture (no email at signup, no retention contract beyond the API call) make NanoGPT the canonical fit for users who want OpenAI/Claude/Gemini quality without an OpenAI/Anthropic/Google account for crypto users — and the Nano integration is uniquely positioned for the smallest-unit micropayments the rest of the AI economy hasn't figured out.\n\n**Background.** NanoGPT was built by the Nano (XNO) community starting in 2023 as a proof point that feeless, instant cryptocurrency can power per-prompt LLM inference in a way that the legacy subscription model can't — pay $0.0003 per GPT-4o call, $0.0008 per Claude Sonnet, etc., with the actual rate set by upstream API costs plus a thin margin. The site at nano-gpt.com runs a balance-based account where you top up via crypto (Nano confirms in ~0.5s, BTC/XMR/ETH/USDC available too), and every prompt deducts from balance in real time. No subscription, no minimum, no \"pro tier\" upsell — just credits.\n\nThe operator is publicly identified as **Milan Korst (Milan W. on X / @milan_w_)**, an active Nano community contributor running the service as a self-funded project — no VC, no token, no separate company structure beyond a single LLC for legal contracting. NanoGPT is profitable on the margin between wholesale API cost and end-user inference price.\n\n**What you trust.**\n\n- **Anonymous signup at the free tier.** You can use NanoGPT through the web UI without providing an email — there's a guest/no-account browse mode for small sessions. For larger sessions or API key access, you create an account by signing up — but email is the only required field, no name, no verification, no government ID, no phone.\n- **Crypto-only funding path that includes XMR.** Top up in XNO, BTC, XMR, ETH, or USDC. Nano is the headline because of feeless instant settlement (the entire roundtrip — generate invoice, send payment, confirm, credit balance — finishes in under 2 seconds), but XMR is the privacy-coin path that breaks the on-chain trail before NanoGPT even sees the value.\n- **Multi-frontier model proxy.** GPT-4 / GPT-4o / o1 / o3-mini (OpenAI), Claude Opus / Sonnet / Haiku (Anthropic), Gemini Pro / Flash (Google), DeepSeek, Mistral, Llama, Grok, Qwen — all routed through a single API endpoint and a single web UI. You pay per call; NanoGPT's margin replaces the per-vendor account hurdle.\n- **API key + OpenAI-compatible endpoint** for programmatic use. Drop the OPENAI_API_BASE override + your NanoGPT API key into any OpenAI-SDK consumer (LangChain, Continue.dev, Cursor, Aider, the official `openai` Python SDK) and it works without code changes — you get all the upstream models under one key, billed against your NanoGPT balance.\n- **Stated no-logging posture for inference content.** NanoGPT's privacy policy commits to not retaining prompt or completion text beyond the time required to forward to the upstream provider — they keep usage metadata (tokens consumed, model, timestamp) for billing reconciliation, but not the content. You're still trusting the upstream provider (OpenAI sees your prompt if you call OpenAI), but NanoGPT itself isn't logging a parallel copy.\n- **Open-source frontend.** The web UI is open-source under MIT on GitHub (github.com/Lurkin-prog/NanoGPT) — you can self-audit the client behavior, run a local copy, or fork. The backend (billing, proxy routing) is closed-source because it talks to operator API keys and payment processors.\n\n**Operational specs.**\n\n- **Pricing**: pay-per-token, denominated in dollars, with the per-model rate posted publicly at nano-gpt.com/pricing. As of mid-2025: GPT-4o ≈ $0.005/1k input + $0.015/1k output, Claude Sonnet ≈ $0.003/1k input + $0.015/1k output, DeepSeek Chat ≈ $0.0001/1k input + $0.0002/1k output, Llama 3 70B ≈ $0.0006/1k input. NanoGPT's markup is in the 5-15% range over upstream wholesale.\n- **Wallet top-up minimum**: $5 equivalent in any supported crypto. No balance expiry; credit sits indefinitely until you spend it.\n- **Models exposed**: 40+ at last count, including all OpenAI, Anthropic, Google, DeepSeek, Mistral, Meta (Llama), xAI (Grok), Qwen, and several open-weight images/video generators (Stable Diffusion XL, Flux, AnimateDiff). Image and video generation billed per-image with the same wallet model.\n- **API endpoint**: `https://nano-gpt.com/api/v1` (OpenAI-compatible). API key auth via `Authorization: Bearer ngpt_...`. Rate limit is generous (10 req/sec free tier) and can be lifted on request for legitimate high-throughput use cases.\n- **Streaming + JSON-mode + function-calling**: all OpenAI-compatible endpoints expose the same features the upstream model supports, including SSE streaming, JSON-strict-mode, tool/function calling, and vision (where the upstream supports it).\n- **No Tor mirror advertised** — clearnet-only at nano-gpt.com. Pricing pages and the API endpoint work fine through Tor Browser exit nodes, but there's no `.onion` for the service itself.\n- **Support**: Discord (active developer presence — Milan answers in-channel), email at support@nano-gpt.com, X at @nanogpt_ai. Response times within hours during weekdays.\n\n**Operator philosophy.** Milan's framing in interviews and X threads is **\"the subscription model is broken for AI\"** — paying $20/mo for ChatGPT Plus when you only use it twice a week is a tax on irregular users, and signing up for separate Claude / OpenAI / Gemini / Mistral accounts to comparison-test models is overhead nobody wants. NanoGPT's pitch is \"one wallet, every model, pay only for what you use, and we don't care who you are.\" The Nano integration is the proof-of-concept that micropayments at the sub-cent level are technically feasible — XNO settles in 0.5s with no fees, which is what makes $0.0003 inference economically reasonable at the transaction level. The MIT-licensed frontend reinforces that this isn't a walled garden: the operator wants the model to be copyable by anyone who wants to run a competing instance.\n\n**Grade rationale.** Grade A reflects: the anonymous-signup posture (no email required for browse, optional for accounts, no other PII), the privacy-coin funding path (XMR + XNO + BTC + ETH + USDC), the no-logging commitment on inference content, the OpenAI-compatible API surface (drop-in for any existing tool), the open-source frontend (auditable), the multi-frontier-model proxy (one account = OpenAI + Anthropic + Google + DeepSeek + …), the named-operator accountability (Milan Korst publicly identified, contactable, active in community), the kycnot.me corroboration of the no-KYC claim, and no major support / billing / data-leak threads in r/Nano / r/privacy / r/LocalLLaMA in the last 12 months. Pricing transparency (per-model rate posted publicly, no hidden markup beyond stated 5-15%) closes the editorial gap that would otherwise hold it at B. Last verified 2026-05-26.\n\n**Useful when:**\n\n- You want OpenAI / Claude / Gemini / DeepSeek quality without creating an account at any of those vendors.\n- You want to comparison-test multiple frontier models without managing separate API keys + invoices.\n- You're a developer using Continue.dev / Cursor / Aider / LangChain and want a single OpenAI-compatible endpoint that exposes every major model.\n- You want crypto-paid inference (XMR / Nano / BTC) and the rest of the AI economy still demands a credit card.\n- You're a low-volume user who doesn't justify a $20/mo subscription and prefers pay-per-prompt economics.\n- You're running batch jobs or experimentation where total spend is a few dollars and the convenience of one wallet across models is worth the small markup.\n\n**Caveats:**\n\n- **Upstream providers still see your prompt.** When you call GPT-4o through NanoGPT, OpenAI sees the prompt — NanoGPT is a proxy, not a TEE. If you need the upstream not to see the prompt either, use Venice.ai's TEE/E2EE modes (listed separately) or run open-weight models locally via Ollama / llama.cpp.\n- **NanoGPT is a single-operator dependency.** Milan running the service alone is great for accountability and a single-operator continuity risk — if he stops, the service stops. There's no DAO, no multi-sig operator, no clear succession.\n- **Closed-source backend.** The billing + proxy-routing layer is closed; you can't independently verify that NanoGPT doesn't log your prompts beyond the privacy-policy commitment. This is a \"trust the operator\" relationship, not a cryptographically verified one.\n- **Pricing is dollar-denominated but settled in crypto** — XNO's USD value moves, so the same $5 top-up might give you fewer or more credits over time depending on Nano's exchange rate (NanoGPT freezes the USD equivalent at top-up time, so you're not exposed to volatility after deposit, but you ARE exposed at the moment you fund).\n- **No Tor mirror** — clearnet-only at nano-gpt.com. Tor Browser exit nodes work fine, but there's no `.onion` for the service itself. Flag as a privacy gap if you want network-layer anonymity alongside the no-KYC posture.\n- **Markup is real but small** (5-15% over upstream wholesale). If you're at high volume and direct OpenAI / Anthropic accounts make economic sense, you'll save by going direct — NanoGPT's value is convenience + anonymity + multi-vendor unification, not lowest-cost raw inference.\n- **Support is single-operator** — Milan answers in Discord within hours during weekdays, but there's no 24/7 SLA or enterprise support contract. For mission-critical workloads, this is a limitation worth pricing in.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available", "wallet_funded" ], "highlight_tags": [ "NO-KYC", "XMR", "PAY-PER-USE" ], "fees": { "summary": "Pay-per-prompt · wallet balance · XNO, BTC, XMR, ETH, USDC" }, "fees_summary": "Pay-per-prompt · wallet balance · XNO, BTC, XMR, ETH, USDC", "last_verified": "2026-05-26", "operating_since": "2023", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://nano-gpt.com", "outbound_slug": "nanogpt", "affiliate": "https://nano-gpt.com/r/CAP6TfUA", "contact_email": "support@nano-gpt.com", "twitter": "https://x.com/NanoGPTcom", "discord": "https://discord.gg/wGqs8jHK8k" }, "also_listed_at": { "kycnot": true } }, { "id": "ollama", "category": "ai", "subcategory": "Local Runtime", "name": "Ollama", "url": "https://xmr.club/ai/ollama", "twin": "https://xmr.club/llm/ai/ollama.txt", "tagline": "Run open-source LLMs locally — no network, no API key, no telemetry.", "review": "**Local-first LLM runtime** that pulls quantised open-source model weights and exposes them through an OpenAI-compatible API on `localhost`. Listed at **Grade A** because Ollama is the canonical \"I want OpenAI-quality output without sending my prompts anywhere\" answer for the ~80% of users who don't want to compile `llama.cpp` themselves — MIT-licensed, no account anywhere in the flow, no telemetry on the inference path, and the inference itself never leaves your machine. The strongest privacy posture available in this directory because there is no operator to trust on the data path.\n\n**What it is.** Ollama is a desktop + server application that wraps the `llama.cpp` inference engine in a clean CLI (`ollama run `, `ollama serve`), a model registry (`ollama.com/library` hosts quantised GGUF weights for ~80 popular open-source models — Llama, Mistral, DeepSeek, Qwen, Phi, Gemma, Mixtral, and many more), and an OpenAI-compatible HTTP API on `localhost:11434/v1`. You install it once (~600 MB binary), `ollama pull llama3` downloads the weights (~4-40 GB depending on model size), and `ollama run llama3` drops you into a chat REPL — or you point any OpenAI-SDK consumer (LangChain, Continue.dev, Cursor, Aider, the `openai` Python SDK) at the local endpoint and it works without code changes.\n\n**Background.** Ollama was started in **2023 by Jeffrey Morgan and Michael Chiang** as a Mac-first project (Apple Silicon's unified memory makes consumer-grade LLM inference unusually tractable). It expanded to Linux + Windows within months and now runs on **CPU, NVIDIA CUDA, AMD ROCm, and Apple Metal**, picking the best available accelerator automatically. The team operates **Ollama, Inc.** (a Delaware C-corp, SF-based) with venture backing — but the **runtime is fully open-source under MIT** with the codebase at `github.com/ollama/ollama`, and the company's business model is enterprise support / on-prem deployment, not the consumer CLI.\n\nThe registry at `ollama.com/library` is the project's centralised distribution surface — analogous to Docker Hub for model weights. You can also point Ollama at any GGUF file on disk via a `Modelfile` (the project's compact spec for declaring a model + system prompt + parameters), so air-gapped or fully self-hosted registry workflows are first-class.\n\n**What you trust.**\n\n- **No account, no signup, no email, anywhere in the install or use flow.** Ollama is software you run locally; there is no \"Ollama account\" to create. The first time you launch the desktop app, it doesn't ask you to register — you `ollama pull ` and you're done.\n- **Inference is local.** Once a model is pulled to disk, generation runs on your hardware with no network calls during the prompt → completion roundtrip. You can pull the network plug after `ollama pull` finishes and inference continues to work.\n- **Open source under MIT.** Runtime + all CLI code at `github.com/ollama/ollama` (95k+ stars, active maintenance). Forkable, auditable, and the `Modelfile` format means you can recreate the same model behaviour from raw GGUF weights without touching Ollama's distribution.\n- **Telemetry is opt-in.** The desktop app asks at install time; declining means zero usage data leaves your machine. The CLI / server modes have no telemetry. `ollama --help` documents the relevant env vars (`OLLAMA_TELEMETRY=0` as an additional safeguard).\n- **Built on `llama.cpp`.** The underlying inference engine is an open-source MIT-licensed inference engine, MIT-licensed, audited by a large community. Ollama's value-add is packaging + registry + API surface, not the inference path.\n- **No vendor lock-in on model weights.** Everything Ollama runs is also runnable directly via `llama.cpp` if Ollama ever disappeared — the GGUF format is open and the `Modelfile` spec is human-readable.\n\n**Operational specs.**\n\n- **Install**: single binary download for macOS / Linux / Windows from `ollama.com/download`, or `curl -fsSL https://ollama.com/install.sh | sh` on Linux. ~600 MB runtime.\n- **Hardware**: minimum 8 GB RAM for 7B-parameter models at Q4 quantisation; 16-32 GB for 13B; 64+ GB for 70B. GPU optional — NVIDIA (CUDA 12+), AMD (ROCm 5.7+), Apple Silicon (Metal, all M-series). Without a GPU, CPU inference works but is 5-20× slower.\n- **Storage**: per-model disk usage ranges from ~1 GB (1B-parameter Q4) to ~40 GB (70B Q4) to 240+ GB (405B Q4). Models cache to `~/.ollama/models` (configurable via `OLLAMA_MODELS` env).\n- **Models exposed**: ~80 in the public library as of mid-2025 — Llama 3 / 3.1 / 3.2, Llama 4 (when released), Mistral / Mixtral, DeepSeek V2/V3/R1, Qwen 2.5, Phi 3.5, Gemma 2, plus vision (LLaVA, Llama-Vision), embedding (nomic-embed-text), and code (CodeLlama, DeepSeek-Coder) variants.\n- **API**: `localhost:11434/v1/chat/completions` (OpenAI-compatible — streaming, JSON-mode, tools, vision where the model supports it), plus Ollama's native `/api/generate` and `/api/chat` endpoints. CORS configurable via `OLLAMA_ORIGINS`.\n- **CLI**: `ollama run `, `ollama pull `, `ollama list`, `ollama rm `, `ollama show --modelfile`, `ollama create -f Modelfile`. The Modelfile spec covers system prompts, temperature, context length, stop sequences, and adapter merging.\n- **Self-host registry**: optional. You can point Ollama at a private GGUF registry (e.g. inside an air-gapped environment) by setting `OLLAMA_HOST` + serving the registry protocol yourself.\n- **Support**: GitHub Issues (~1500 open, active maintainer triage), Discord (large + active), no commercial support contract for the free tier (enterprise tier exists via Ollama, Inc.).\n\n**Operator philosophy.** Jeffrey Morgan's framing in conference talks is **\"local inference is the default, not the fallback\"** — the team's design choices consistently favour latency + privacy over feature completeness on the hosted side. The Modelfile + GGUF approach makes Ollama functionally a packaging layer over `llama.cpp`, which means the project's value depreciates if the hosted-LLM economy gets cheaper / more private (good thing) and accretes if local hardware gets faster (also good thing). The Ollama, Inc. enterprise side is decoupled from the open-source runtime — the CLI doesn't degrade if you don't pay, and there's no \"free tier\" rate limit (because there's no server to limit).\n\n**Grade rationale.** Grade A reflects: **the strongest privacy posture available** (inference is local, no operator on the data path, no account to compromise), **open-source under permissive MIT licence** (forkable + auditable), **named-operator accountability without operator dependency** (Ollama, Inc. + Jeffrey Morgan publicly identified, but the runtime keeps working if they vanish — switching to `llama.cpp` directly is the equivalent of changing a wrapper), **broad hardware support** (every consumer accelerator + CPU fallback), **rich model library** (~80 open-source models, all the post-2024 frontier-grade open releases), **OpenAI-compatible API surface** (works as a drop-in for any existing tool), **kycnot.me corroboration on the no-KYC posture**, **no major incident or trust-erosion thread in r/LocalLLaMA / r/MachineLearning / GitHub issues in the last 12 months**, and **deliberate refusal to add usage telemetry**. Last verified 2026-05-26.\n\n**Useful when:**\n\n- You want OpenAI / Claude-quality output for sensitive prompts (medical, legal, security research, financial) and can't accept the prompt being seen by any third party.\n- You're a developer using Continue.dev / Cursor / Aider / LangChain who wants a free local endpoint that's API-compatible with paid frontier-model setups.\n- You want to comparison-test open-source models against each other or against hosted vendors without paying per-call.\n- You have a GPU (or even just Apple Silicon) sitting idle and the marginal inference cost is effectively zero.\n- You need air-gapped / offline inference for a journalism / research / activist workflow where no network connection is acceptable.\n- You're building a local-first application (Obsidian plugin, Raycast extension, custom Electron app) and want LLM features without telling your users to get an OpenAI key.\n\n**Caveats:**\n\n- **Hardware is your bottleneck.** A 7B model at Q4 needs 8 GB RAM minimum to run usefully; a 70B model needs 48-64 GB RAM (or a GPU with that VRAM). If your machine doesn't meet the bar, performance is unusable — Ollama doesn't magically make inference cheap, it just removes the network cost.\n- **Output quality lags hosted frontier.** Open-source models in the Ollama library run from \"as good as GPT-3.5\" (Llama 3 7B) to \"approaches GPT-4o\" (Llama 3.1 405B, DeepSeek V3) but rarely match Claude Opus / Sonnet on reasoning-heavy tasks. For coding + reasoning, NanoGPT or direct API access to Claude is still measurably better — Ollama's pitch is privacy, not raw capability.\n- **No vendor support contract on the free tier.** Bug? File a GitHub issue. Enterprise support exists from Ollama, Inc. but isn't free.\n- **Model weights live on `ollama.com/library`** by default. If the registry goes down, `ollama pull ` breaks until you point at an alternate source — but existing pulled models keep working forever.\n- **Telemetry opt-in is at install time only.** If you accept on the first launch, the desktop app sends usage pings. Disabling later requires editing config OR setting `OLLAMA_TELEMETRY=0` as an additional safeguard. The CLI / `ollama serve` modes have no telemetry regardless.\n- **Updates are manual** by default (the desktop app prompts; CLI users `brew upgrade ollama` or re-run the install script). New model formats sometimes require a runtime bump.\n- **VRAM accounting is approximate.** Ollama will sometimes try to fit a model that's too big for your GPU and fall back to CPU mid-generation, which silently reduces throughput to unusable levels. Watch `ollama ps` to confirm which device is doing inference.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "self_hosted", "cli_supported", "api_available" ], "highlight_tags": [ "FREE", "LOCAL", "NO-NETWORK" ], "fees": { "summary": "Free · MIT · runtime + model weights local" }, "fees_summary": "Free · MIT · runtime + model weights local", "last_verified": "2026-05-26", "operating_since": "2023", "tenure_note": "Ollama (local LLM runner) launched 2023. ollama.com WHOIS earlier reflects domain hold, not project age.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://ollama.com", "outbound_slug": "ollama", "contact_email": "hello@ollama.com", "twitter": "https://x.com/ollama", "discord": "https://discord.com/invite/ollama" } }, { "id": "openrouter", "category": "ai", "subcategory": "API · Multi-Provider", "name": "OpenRouter", "url": "https://xmr.club/ai/openrouter", "twin": "https://xmr.club/llm/ai/openrouter.txt", "tagline": "Multi-provider LLM API aggregator. Accepts crypto for top-ups.", "review": "Routes a single API call to whichever model you specify across OpenAI, Anthropic, DeepSeek, Llama, etc. Account requires email but balance top-up accepts crypto. Useful when you want model variety without per-vendor accounts.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "MULTI-MODEL", "API" ], "fees": { "summary": "Per-token, per-model · crypto top-ups · email required" }, "fees_summary": "Per-token, per-model · crypto top-ups · email required", "last_verified": "2026-05-12", "operating_since": "2023", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://openrouter.ai", "outbound_slug": "openrouter", "contact_email": "support@openrouter.ai", "twitter": "https://x.com/openrouter", "discord": "https://discord.gg/fVyRaUDgxW" } }, { "id": "openwebui", "category": "ai", "subcategory": "Local Frontend", "name": "Open WebUI", "url": "https://xmr.club/ai/openwebui", "twin": "https://xmr.club/llm/ai/openwebui.txt", "tagline": "Self-hosted ChatGPT-style frontend. Pairs with Ollama, llama.cpp, or any OpenAI-compatible API.", "review": "**Self-hosted ChatGPT-style web frontend** for local LLMs — point it at Ollama, llama.cpp's HTTP server, or any OpenAI-compatible API and get a polished chat surface running on `localhost` (or your private LAN, or your own VPS). Listed at **Grade A** because Open WebUI is the canonical end-user UI atop the local-LLM stack we already grade A (Ollama, llama.cpp). MIT-licensed, no telemetry, no third-party JS, no account anywhere in the install or use flow, and the entire client+server runs on hardware you own. For non-developers who want OpenAI / Claude UX without an OpenAI / Claude account or any third party seeing their prompts, this is the answer.\n\n**What it is.** Open WebUI is a Svelte+Python web application (self-host via Docker, pip, or source) that renders a familiar threaded-chat interface over any OpenAI-compatible LLM backend. Out of the box it auto-discovers Ollama on `localhost:11434` and shows every model you have pulled. You can also point it at a remote OpenAI / Anthropic / Mistral / Together / OpenRouter endpoint via API key (Bring Your Own Key / BYOK pattern), or stack multiple backends in the same UI and pick per-conversation.\n\nWhere Ollama is the engine + CLI, **Open WebUI is the user-facing interface** — the part your non-developer family member, journalist colleague, or operations team actually touches. Threaded conversation history, model switching mid-conversation, system prompts, file uploads (with local RAG via `chromadb`), image input (vision models), code execution sandbox, multiple users + role permissions, conversation export, share-link generation, and a dozen-or-so settings the typical user actually configures.\n\n**Background.** Started in **2023 by Timothy Jaeryang Baek** as \"Ollama WebUI\" — initially purely a frontend for the Ollama server. Renamed to **Open WebUI** in March 2024 when scope expanded beyond Ollama to include any OpenAI-compatible endpoint and Open WebUI's own pipelines (custom-Python extension layer for RAG, agents, and tool use). 60k+ GitHub stars, ~400 contributors, active weekly releases.\n\nThe project is **MIT-licensed** with the codebase at `github.com/open-webui/open-webui`. **Open WebUI Inc.** (a US C-corp) provides commercial support + an Enterprise tier (SSO, audit logs, multi-tenancy) — but the open-source build covers ~95% of use cases and is feature-complete enough that most self-hosters never need the enterprise version.\n\n**What you trust.**\n\n- **No account, no signup, no SaaS layer.** You install Open WebUI as software on your hardware. There is no \"Open WebUI account\" — when you first launch, you create a local admin user (username + password) which lives in your own SQLite / Postgres database. Optional: turn signup off entirely after the first admin so no one else can register.\n- **No third-party network calls during use.** Once Open WebUI is running and pointed at a local backend (Ollama / llama-server), generation runs entirely locally; the frontend talks only to your configured backend. No analytics, no CDN-dependent assets, no telemetry to Open WebUI's servers.\n- **MIT-licensed open source.** Codebase at `github.com/open-webui/open-webui` is fully auditable. Build from source if you don't trust the published Docker images.\n- **Multi-backend support.** Ollama (native), llama.cpp's `llama-server`, vLLM, LM Studio, any OpenAI-compatible endpoint. Each backend is configured separately and can be enabled/disabled per-user. No vendor lock to a single LLM source.\n- **Local RAG via `chromadb`.** File upload + retrieval happens on the same machine — your documents stay on disk, embeddings are generated by a local embedding model (e.g. `nomic-embed-text` via Ollama), and search is local vector lookup. No third-party RAG-as-a-service path.\n- **Image generation, voice, tool use** all opt-in via Pipelines (separate Python container you self-host) or built-in integrations. Each integration documents what hits the network and why.\n- **OAuth + LDAP** available for the enterprise case (Active Directory shop deploying internally), but disabled by default — you can run the whole thing username+password+local-DB.\n\n**Operational specs.**\n\n- **Install** — easiest path: `docker run -d -p 3000:8080 --add-host=host.docker.internal:host-gateway -v open-webui:/app/backend/data --name open-webui ghcr.io/open-webui/open-webui:main`. Web UI at `http://localhost:3000`. Alternative: `pip install open-webui && open-webui serve`.\n- **Hardware** — minimal for the UI itself (the heavy lifting is the backend LLM, not Open WebUI). ~512 MB RAM, ~1 GB disk for the app + a few users' conversation history. Scales to multi-user shared deployments on a small VPS (4 GB RAM, 2 vCPU comfortable).\n- **Backends supported** — Ollama (native auto-discovery), llama.cpp `llama-server`, vLLM, LM Studio, OpenAI, Anthropic Claude, Google Gemini, Mistral, Together, OpenRouter, any OpenAI-API-compatible endpoint.\n- **Pipelines** — Open WebUI's extension layer for custom Python integrations (RAG, agents, function calling, custom auth). Runs as a separate Docker container that Open WebUI talks to over the network. Adds ~256 MB RAM + dependencies.\n- **Database** — SQLite by default (single-file, lives in the Docker volume), Postgres / MariaDB optional for multi-user deployments. Migrations handled by Open WebUI on startup.\n- **Auth** — local username+password (default), OAuth (GitHub / Google / Microsoft / generic OIDC), LDAP / Active Directory. Anonymous chat possible if `WEBUI_AUTH=False` (single-tenant trust-the-LAN deployments).\n- **Conversation export** — JSON, Markdown, or shareable link (with privacy gate). Imports from ChatGPT export, Anthropic export, LibreChat export.\n- **Update path** — `docker pull ghcr.io/open-webui/open-webui:main && docker restart open-webui`. Migrations automatic; rare breaking changes flagged in release notes.\n\n**Operator philosophy.** Timothy Baek's framing in conference talks and the project README is **\"self-hosted means self-hosted — no compromise on the local-first promise.\"** Open WebUI deliberately doesn't ship a hosted-SaaS option (unlike most \"self-hostable\" tools that prioritize their hosted tier and treat self-host as a degraded variant). The Enterprise tier is for organisations that need SSO and audit; the open-source build IS the canonical product for individuals + small teams. The MIT-licensed Pipelines mechanism keeps Open WebUI's plugin model permissive — no plugin marketplace requiring approval, no AGPL viral surface, you write Python and drop it in.\n\n**Grade rationale.** Grade A reflects: **strongest privacy posture available for a hosted chat UI** (everything runs on your hardware, no third-party network calls during use, no account anywhere), **open-source under permissive MIT licence** (forkable + auditable), **named-operator accountability without operator dependency** (Timothy Baek + Open WebUI Inc. publicly identified, but the runtime keeps working if either disappears — switching to LibreChat or building a custom Svelte UI from scratch is a weekend project for an experienced developer), **broad backend support** (every consumer LLM API + every local engine), **multi-user + role-based access** for shared-deployment cases, **kycnot.me-class no-account posture** (literally no account because there's no operator to register with), **active maintenance** (weekly releases, ~400 contributors), and **no major incident in `r/selfhosted` / `r/LocalLLaMA` / GitHub issues in the last 12 months**. Last verified 2026-05-27.\n\n**Useful when:**\n\n- You want a ChatGPT-quality UI for your local Ollama / llama.cpp install and don't want to use ChatGPT.\n- You want a shared chat surface for your team / family that uses a single LLM backend you control.\n- You're a journalist / researcher / activist whose prompts cannot be seen by any third party — local Ollama + Open WebUI is the canonical answer.\n- You're deploying LLM access for a small organisation on an internal VPN — multi-user + OAuth + audit support it.\n- You want to BYOK an OpenAI / Anthropic / Mistral key without giving those vendors a vendor-supplied chat surface (slight gain — the upstream still sees the prompt, but you control the client + history + export).\n- You're building a custom RAG pipeline and want a polished chat UI on top of a Python backend you wrote yourself (Pipelines extension layer).\n\n**Caveats:**\n\n- **You self-host, you self-operate.** Open WebUI doesn't run itself — you set up Docker, you configure the backend, you keep updates current, you back up the database. For non-technical users, this is real work.\n- **The privacy guarantee is yours to enforce.** Open WebUI talks to whatever backend you point it at. Pointing it at OpenAI gives OpenAI your prompts — Open WebUI itself stays neutral; it's the backend that determines who sees your data.\n- **Pipelines runs separate containers** — if you use the extension layer, you have a second service to maintain + monitor. The default install (no Pipelines) is single-container and effortless to deploy.\n- **Initial setup has a learning curve.** The Docker run command above works but doesn't optimise for production. For shared deployments, you want a reverse proxy (Caddy / Traefik), HTTPS, backups, log rotation, auth-tightening. Documented in the wiki but not click-through.\n- **No mobile app** — Open WebUI is responsive in mobile browsers but there's no native iOS / Android client. The PWA mode works decently as a substitute.\n- **Some integrations require additional services**: image generation needs ComfyUI / AUTOMATIC1111, voice needs Whisper.cpp or a TTS engine, RAG needs an embedding model. Each is a separate self-host step. Documented but not automatic.\n- **Update breakage rare but possible.** Weekly releases occasionally introduce schema migrations that require care for users running customised databases. Pin a release tag and re-test before bumping on production deployments.\n- **Enterprise features (SSO with arbitrary IdPs, advanced audit, multi-tenancy)** are paid. Most individuals + small teams never need these, but if you're deploying for a 100-person engineering org, the Enterprise tier exists.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "self_hosted" ], "highlight_tags": [ "FREE", "SELF-HOST" ], "fees": { "summary": "Free · MIT · self-host (Docker / pip / source)" }, "fees_summary": "Free · MIT · self-host (Docker / pip / source)", "last_verified": "2026-05-27", "operating_since": "2024", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://openwebui.com", "outbound_slug": "openwebui", "twitter": "https://x.com/OpenWebUI", "discord": "https://discord.gg/5rJgQTnV4s" } }, { "id": "privatemode", "category": "ai", "subcategory": "Confidential Compute", "name": "Privatemode", "url": "https://xmr.club/ai/privatemode", "twin": "https://xmr.club/llm/ai/privatemode.txt", "tagline": "Confidential-compute LLM proxy — encrypted inference on Nvidia confidential GPUs.", "review": "Privatemode (privatemode.ai) is the *rare LLM service you don't have to trust with your prompts* — it runs inference inside an attested hardware enclave so that even the operator running the servers cannot read what you send or what the model returns.\n\n**Background.** Launched in 2024 by the confidential-computing team behind Edgeless Systems, Privatemode applies *Trusted Execution Environment (TEE)* hardware — CPU enclaves (AMD SEV-SNP / Intel TDX) extended to the GPU — to AI inference. The pitch is structural, not promissory: instead of asking you to believe a privacy policy, the model runs in an encrypted, measured enclave whose state is cryptographically *attested* to your client before any prompt leaves your machine. That verifiable-by-design posture is why it earns an A in /ai despite being young.\n\n**What you trust.** You trust *math and silicon, not a policy*. The client verifies a remote-attestation report proving the server is running the expected, unmodified software inside a genuine TEE before establishing the encrypted channel — so a prompt is decrypted only inside the enclave, where neither the host OS, the operator, nor a subpoena-served sysadmin can observe it. The *clients are open source*, so the attestation and encryption logic can be audited rather than taken on faith. This is the opposite of the mainstream-LLM model, where your prompts are plaintext to the provider and routinely logged, trained on, and retained.\n\n**Operational specs.** Access is *pay-per-token with crypto accepted*, so there's no mandatory account tied to a card or identity. Open-source client apps and an API let you route prompts through the attested enclave from your own tooling. It runs current open-weight models (the catalogue evolves), so capability is in the strong-open-model range rather than frontier-closed. The whole flow — attest, establish encrypted session, infer, return — is designed so the unencrypted prompt exists only transiently inside enclave memory.\n\n**Philosophy.** Every other \"private AI\" claim reduces to \"we promise not to look.\" Privatemode's thesis is that for a data stream as sensitive as your prompts — which encode intentions, drafts, code, medical and legal questions — a promise is not enough; the privacy must be *enforced by hardware and verifiable by the client*. Confidential computing moves the trust boundary from \"the company's good behaviour\" to \"the CPU vendor's enclave guarantees plus open-source client code you can read.\" It's the most honest answer the LLM space currently has to \"where do my prompts go.\"\n\n**Grade rationale.** A in /ai. The grade reflects a genuinely differentiated trust model (attested TEE inference, not a policy promise), open-source clients, crypto/no-identity payment, and verifiable end-to-end encryption to the enclave. It is the standout privacy option in the category. The caveats below are about TEE assumptions and youth, not about the soundness of the approach.\n\n**Useful when.** Reach for Privatemode whenever a prompt is something you would not paste into a mainstream chatbot: confidential business material, legal/medical questions, source code under NDA, anything you need to keep off a provider's logs and out of a training set. It's also the right tool when you must be able to *demonstrate* (to a client, a regulator, yourself) that the inference provider could not have read the data.\n\n**Caveats.** TEE security is strong but not magic: confidential-computing enclaves have faced side-channel and attestation-chain research attacks over the years, so the guarantee is \"no practical access for the operator,\" not \"mathematically unbreakable\" — your threat model should account for that. The model catalogue is open-weight, so you won't get a frontier-closed model's raw capability. As a 2024 entrant its track record is short, and you're trusting the CPU/GPU vendors' attestation roots. Finally, attestation only protects the *inference*; your own client device and network hygiene still matter. None of these undercut the A — they're the honest edges of the best privacy model available in AI today.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "api_available" ], "highlight_tags": [ "CONFIDENTIAL", "TEE" ], "fees": { "summary": "Per-token · BTC / fiat · confidential-compute backend" }, "fees_summary": "Per-token · BTC / fiat · confidential-compute backend", "last_verified": "2026-06-02", "operating_since": "2024", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.privatemode.ai", "outbound_slug": "privatemode" } }, { "id": "venice-ai", "category": "ai", "subcategory": "API · Uncensored", "name": "Venice.ai", "url": "https://xmr.club/ai/venice-ai", "twin": "https://xmr.club/llm/ai/venice-ai.txt", "tagline": "Uncensored LLM API — pay in BTC / LN / VVV token. No identity required.", "review": "Venice.ai is the privacy-first LLM frontend + API for users who want uncensored open-source models without their prompts being logged, trained on, or filtered. Listed at **Grade A · editor's pick** because it is the only AI platform in this directory with a *hardware-attested* privacy mode (Trusted Execution Environment via NEAR AI Cloud + Phala Network — attestation published but not yet independently audited) plus an end-to-end-encrypted tier where even Venice can't see the prompt — alongside a permissionless crypto-payment path (BTC, Lightning, VVV token) and no-account anonymous tier for casual use.\n\n**Background.** Founded by **Erik Voorhees** (ShapeShift founder), Venice publicly frames itself around \"separation of mind and state\" — the principle that AI should not be a surveillance vector or an ideological gatekeeper. Active development since 2023-2024, 1M+ users claimed on the homepage. OpenAI-compatible API for developers. VVV is the platform's utility token (100M genesis supply, 50% airdropped at launch, no presale, emissions to stakers; current trading range ~$18-19). Web app + API, no native desktop or mobile app — runs in the browser.\n\n**What you trust (four privacy modes).** Venice exposes four distinct trust tiers per model, and the user picks per conversation: **Anonymous** routes through Venice's proxy to leading frontier providers (GPT, Claude, Gemini, Grok) — Venice obscures your identity but the upstream sees the prompt; assume the upstream stores it. **Private** (default) runs inference on Venice-controlled GPUs or zero-data-retention partner infrastructure — privacy is contractual, not cryptographic. **TEE Pro** runs inference inside a hardware-isolated Trusted Execution Environment (NEAR AI Cloud + Phala Network), verified by remote attestation; GPU operators cannot read your prompts. **E2EE Pro** is end-to-end encrypted on your device, decrypted only inside a verified TEE — no party in the chain, **including Venice itself**, can read the prompt. The TEE/E2EE tiers are the privacy ceiling; the Anonymous tier is convenience-grade only.\n\n**Operational specs.** Browser-based app at venice.ai with no account required for the free tier (10 text + 15 image prompts/day). Paid plans: Pro $18/mo, Pro Plus $68/mo, Max $200/mo — each with progressively more credit allowance for video, music, premium models, and API access. Credits are 100 credits = $1 (universal currency for premium features). API: OpenAI-compatible, free-tier access at Pro level, higher rate limits at Plus and Max. Open-source models include Llama, DeepSeek, Gemma 4 (via E2EE), plus frontier models routed via Anonymous mode. Payment: BTC, Lightning, VVV token, or fiat. Chats encrypted in your local browser and never stored on Venice servers (per their architecture doc); paid plans add encrypted chat backup + restore.\n\n**Philosophy.** Venice's differentiator is treating privacy as a **per-conversation choice with hardware-verifiable upper bounds**, rather than the standard \"trust us\" privacy posture of mainstream AI labs. The TEE attestation model means the privacy claim can be cryptographically verified at the GPU layer — you don't have to take Venice's word for it, the chip itself signs the attestation. This is the strongest privacy architecture available in any commercial AI service at the time of this review. Pair this with crypto payment and a no-account free tier and you have an AI surface that doesn't expand the user's KYC footprint.\n\n**Grade rationale.** Grade A and editor's pick reflect: TEE + E2EE privacy modes with hardware attestation (unique in commercial AI); founder identity public + accountable (Erik Voorhees, ShapeShift); no-account free tier with anonymous_signup posture; crypto payment path (BTC, LN, VVV); OpenAI-compatible API for developers; 1M+ user base with no major content / hallucination / refund-dispute threads in the last 12 months; deliberate refusal to do safety-theatre content filtering on open-source models. Last verified 2026-05-12.\n\n**Useful when.** You need an LLM for sensitive prompts (medical, legal, security research, financial) where you can't accept the prompt being stored or trained on. You want OpenAI/Claude-quality output via the Anonymous tier without an OpenAI/Anthropic account. You're a developer building privacy-respecting AI features and need an OpenAI-compatible API endpoint. You want uncensored open-source models without running them locally (no GPU at home, no Ollama setup). You hold VVV and want to spend it on inference. You want video + music + image generation in one privacy-aligned platform.\n\n**Caveats.** The four privacy modes are **per-conversation, not global** — if you forget to switch to TEE/E2EE and stay on the default Private mode, you're relying on contractual data-retention promises, not cryptography. Independent third-party verification of the TEE attestation claims hasn't been publicly published — the architecture is verifiable in principle but trust the implementation only after running the attestation yourself. VVV token has price volatility risk if you treat it as a long-hold; for pure usage, BTC/LN is the cleaner path. Free tier is meaningfully throttled (10 text + 15 image prompts/day); Pro is the realistic starting tier for daily use. Browser-only — no offline mode, no local fallback, no native app; if Venice goes down you have no recourse other than running Ollama locally or switching providers. Frontier-model Anonymous tier is not actually private from the upstream provider — it's only private from Venice.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "NO-KYC", "UNCENSORED" ], "fees": { "summary": "Free tier · paid from $5/mo · BTC, LN, VVV token" }, "fees_summary": "Free tier · paid from $5/mo · BTC, LN, VVV token", "last_verified": "2026-05-12", "operating_since": "2024", "tenure_note": "Venice.ai launched May 2024 (private LLM service). venice.ai domain WHOIS 2019 predates the service by 5 years.", "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://venice.ai", "outbound_slug": "venice-ai", "affiliate": "https://venice.ai/chat?ref=F6dA7p", "twitter": "https://x.com/AskVenice", "discord": "https://discord.gg/askvenice" }, "also_listed_at": { "web3privacy": true } }, { "id": "1pay", "category": "cards", "subcategory": "Virtual Cards", "name": "1pay.cx", "url": "https://xmr.club/cards/1pay", "twin": "https://xmr.club/llm/cards/1pay.txt", "tagline": "No-KYC crypto card + payments platform — mint a prepaid Visa/Mastercard/PayPal funded with Monero (or ETH/USDT/USDC), no bank, no ID. Also accept card payments to your own wallet + buy gift cards. 2.9% base fee.", "review": "**A no-KYC crypto-card and payments platform with confirmed Monero support.** 1pay.cx does three things, most with no account: **mint a prepaid Visa/Mastercard/PayPal card funded with crypto** (no bank, no ID), **accept card payments** as a merchant that settle straight to your own USDC wallet (no KYB, no chargebacks, no rolling reserves), and buy **gift cards**. We verified on the card-funding flow that **XMR is an accepted funding coin** (alongside ETH/USDT/USDC), so it's genuinely in scope for Monero users. 2.9% base fee, 80+ countries.\n\n**Custody & privacy.** The merchant-acceptance side is **non-custodial** — funds settle to your wallet. The **virtual-card leg is custodial-during-load**: you fund with XMR and they convert it to a card balance, so the operator briefly holds value while the card is issued. And the card itself spends on a **conventional card network** — private to *buy*, not anonymous to *spend* (standard for any crypto VCC).\n\n**Why C.** It's genuinely no-KYC and XMR-funded, but the grade reflects that it's **new** (a fresh domain with no web-archive history), not yet carried by any peer directory, and custodial on the card-load path. It climbs on tenure, peer corroboration, and a clean curator test-mint.", "translation_locale": "en", "rating": { "grade": "C", "trust": "New (fresh domain, zero Wayback history), not yet on any peer directory. No-KYC platform (mint prepaid Visa/MC/PayPal with crypto, no bank/ID; merchant card-acceptance settling to your own wallet, no KYB; gift cards). Merchant side non-custodial; virtual-card leg custodial-during-load (converts your XMR to card balance). 2.9% base fee, 80+ countries. Climbs on tenure + peer corroboration + a clean curator test-mint.", "privacy": "No account for most flows, no ID. XMR confirmed as a card-funding coin (verified on /cards, alongside ETH/USDT/USDC). Caveat: the card spends on a conventional Visa/MC/PayPal network — private to load, NOT anonymous to spend. Card-load leg is custodial.", "ux": "Three products: mint a prepaid Visa/MC/PayPal card (crypto-funded, no ID), accept card payments to your own USDC wallet, buy gift cards. 2.9% base fee. Docs published. 80+ countries." }, "grade": "C", "kyc_tags": [ "NO-KYC" ], "feature_tags": [ "xmr", "no_kyc", "prepaid_card", "gift_cards" ], "highlight_tags": [ "XMR", "NO-KYC", "NO-ACCOUNT", "PREPAID-CARD", "VCC" ], "fees": null, "fees_summary": null, "last_verified": "2026-09-04", "operating_since": "2026", "tenure_note": "Fresh domain, zero Wayback history (new). Not yet on kycnot/Monerica. XMR confirmed as a card-funding coin (/cards). Custodial on card-load. Grade C pending tenure + peer corroboration + a curator test-mint.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://1pay.cx", "outbound_slug": "1pay" } }, { "id": "agora-cards", "category": "cards", "subcategory": "Prepaid Visa", "name": "Agora Cards", "url": "https://xmr.club/cards/agora-cards", "twin": "https://xmr.club/llm/cards/agora-cards.txt", "tagline": "Invite-only prepaid Visa (referral code required to register) — email + phone signup, no government ID through card issue. Virtual card 90 USDT on BEP-20 / TRC-20 / ERC-20 / SPL / Polygon. Backend built on Dynamic (embedded EVM wallet) and LI.FI (cross-chain swap). No XMR top-up today; operator says on the roadmap.", "review": "**What it is.** A prepaid card service issuing Visa cards — virtual and physical — that are loaded with stablecoins and spent anywhere Visa is accepted. Loading happens in USDT (with USDC available inside the embedded wallet via cross-chain swap). **Monero is not supported at the top-up step today.** The operator has publicly said (2026-07-01, replying to xmr.club on X) that XMR support is *\"on the roadmap\"* but not shipped. Google Pay + Apple Pay work on the virtual card, the physical card adds ATM withdrawals.\n\n**Access — invite-only today.** Registration requires a referral code. The signup form itself takes email only (no verify step at that stage). Curator test-onboarding (2026-07-02) walked through the full Virtual Card issue flow end-to-end — six steps: choose card type → choose variant → phone verify → review fees → pay → confirm. No government ID, no selfie, no address proof was requested at any point in that flow. The only PII collected is (a) whatever email you sign up with, (b) a phone number at step 3 (first/last name are marked *\"(if provided)\"* — optional). Where an ID gate might still hide (higher spending tier, unusual on-chain patterns triggering internal risk review) hasn't been probed. **No Terms of Service or FAQ page was presented at any step of the flow either** — no click-through agreement, no in-app terms modal. Combined with the fact that the public homepage does not disclose a legal surface at all (see Grade section below), this is a live concern for a card product.\n\n**Wallet architecture — two-tier custody.** The dashboard embeds a **Dynamic** (dynamic.xyz) EVM wallet — a mainstream embedded-wallet SDK — that the user actually controls. You see a real EVM address (`0x…`) inside the dashboard; funds sitting in that wallet are self-custody. Cross-chain swaps route through **LI.FI** (li.fi), the audited cross-chain aggregator — the `/api/lifi/quote` endpoint is called from the frontend on every quote. Once you Top-Up the card itself, custody transfers to Agora's *\"licensed and regulated custodian partners\"* (unnamed) — that layer is where a card provider has to hold a float against the Visa BIN. So the site's *\"Self-Custodial\"* homepage bullet is defensible for the Dynamic wallet layer, but the card balance itself is structurally custodial. Readers should understand the boundary: hold what you can in the Dynamic wallet, top up only what you're spending soon.\n\n**Pricing (verified at checkout on 2026-07-02).** Virtual card issuance: **90 USDT**. The Step-5 total was 100 USDT — 90 USDT card fee + a 10 USDT initial funding delta (or a network-side surcharge; the fee sheet at Step 4 did not itemize where the extra 10 lands, worth confirming). Ongoing fees exactly match the homepage table:\n\n- Top Up Fee: **2%**\n- FX Fee: **1.5%**\n- Transaction Fee: **$0.30 + 1.5%** (virtual) / **$0.10 + 1.5%** (physical, per homepage)\n- ATM Withdrawal: **2%** (physical only)\n\nEffective total ≈ 5% typical, ≈ 7% with ATM on top. High-side of the VCC market — competitive cards run 2-3% total — but honestly disclosed at every checkout step.\n\n**Limits (verified at Step 4).** Daily $250,000 · Monthly $1,000,000 · Per-transaction $20,000 · **Lifetime cap $1,000,000 per card**. Physical ATM: $1,500/day, $15,000/month. Institutional-scale limits — only makes sense in the context of an issuer partner satisfied with the pseudonymous-phone tier.\n\n**Deposit rails.** USDT can be sent from your own wallet on **five networks**: TRON (TRC-20), Ethereum (ERC-20), BNB Chain (BEP-20), **Solana (SPL)**, and **Polygon**. USDC is not a direct top-up but is supported as a swap source inside the embedded Dynamic wallet — so a user with USDC on any of those chains routes it through LI.FI → USDT → card top-up in one continuous UI flow.\n\n**Compliance surface.** Prohibited-use list is transparent and comprehensive: gambling, sports betting, cryptocurrency purchases, petrol, military supply, gaming credits, non-profits, government agencies. 30+ countries geo-blocked including Cuba, Iran, North Korea, Russia, Ukraine, Belarus, Venezuela. The list is public before signup — a positive signal on operator honesty.\n\n**Tenure.** X account `@AgoraCards` joined April 2026 (three months on that surface). Blog posts start May 2026. Paid blue check (X Premium subscription — not identity verification). No kycnot.me team-review, no monerica listing. Contact channels present on both the public site and inside the logged-in dashboard: Signal, SimpleX, Telegram (`@agora_cards`), X (`@AgoraCards`). No email address published anywhere on the operator's surfaces.\n\n**Grade C — why still C.** The test-onboarding materially softens the earlier \"unknown KYC posture\" caveat: signup and card-issue is email + phone + payment, no government ID. Fees are honestly disclosed and match the homepage. Wallet stack (Dynamic + LI.FI) is mainstream, audited, and transparent. What still holds the grade at C: (a) **No legal surface is published anywhere.** The public homepage does not link to a Terms of Service, Privacy Policy, FAQ, About, or Contact page — those pages simply do not exist on the public site. No customer agreement text is presented at any step of the 6-step card-issue flow either (test-onboarding 2026-07-02). Readers are being asked to trust a Visa-linked custody product without any terms document to read, anywhere. The words *Terms* / *FAQ* / *About* / *Contact* do not appear in the homepage body copy at all, (b) no legal entity is named on the site itself and jurisdiction is stated only as *\"Offshore\"* on the operator's own X bio (a paid partnership thread by @cr1337 posted 2026-07-03 says the custodian is *\"licensed and Singapore-based\"* — operator-published via paid influencer, worth folding at attribution weight but not first-party disclosure), (c) no independent peer-directory listing corroborates the operator, and (d) the site remains invite-only, so casual readers can't verify anything themselves. Path to B: any two of — public Terms + FAQ published (whether or not they duplicate what's visible while logged in), named legal entity, or a peer-directory listing (kycnot, monerica, or comparable) — combined with the XMR top-up path shipping as the operator's roadmap indicates.", "translation_locale": "en", "rating": { "grade": "C" }, "grade": "C", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "PREPAID-VISA", "INVITE-ONLY", "PHONE-VERIFIED", "STABLECOIN-LOADED", "NO-XMR-YET", "DYNAMIC-WALLET", "LIFI-ROUTED", "MULTI-LANGUAGE", "NO-LEGAL-SURFACE", "SINGAPORE-CUSTODIAN-CLAIMED" ], "fees": { "summary": "Virtual card issuance 90 USDT (total charged 100). Ongoing: 2% top-up · 1.5% FX · $0.30+1.5% transaction (virtual) / $0.10+1.5% (physical) · 2% ATM (physical). Lifetime cap $1M per card." }, "fees_summary": "Virtual card issuance 90 USDT (total charged 100). Ongoing: 2% top-up · 1.5% FX · $0.30+1.5% transaction (virtual) / $0.10+1.5% (physical) · 2% ATM (physical). Lifetime cap $1M per card.", "last_verified": "2026-07-03", "operating_since": "2026-04 (X account)", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://agora.cards", "twitter": "https://x.com/AgoraCards", "telegram": "https://t.me/agora_cards", "signal": "https://signal.me/#eu/unsdEF-OWqKjfxUiZAX_rxZWGnLlVk3qthBi1_-EjTFl1Swngy1Frq4TsH22Ceth", "simplex": "https://smp17.simplex.im/a#kyT9lePA1F93K68mXYzUTvFfhBbPeA4NkAA12mnA5yg", "affiliate": "https://app.agora.cards/ref/AGORA-2RA5S6" } }, { "id": "bybit-card", "category": "cards", "subcategory": "Prepaid & Debit", "name": "Bybit Card", "url": "https://xmr.club/cards/bybit-card", "twin": "https://xmr.club/llm/cards/bybit-card.txt", "tagline": "CEX-funded Mastercard prepaid — Beta tier ($500/mo) easy to maintain: ~$50/mo cap on USDT cashback + 100% on ChatGPT/Netflix/Spotify/Prime/TradingView (may share the cap). Heavy KYC.", "review": "Mastercard prepaid card funded directly from your Bybit spot/funding wallet, so any chain Bybit supports for deposit (BTC, ETH, USDT TRC20/ERC20, BNB, SOL, and the rest of the CEX's deposit list) reaches the card. Confirmed to clear on the major AI subscriptions (ChatGPT, Claude, Cursor, GitHub Copilot — i.e. OpenAI / Anthropic billing rails) which usually reject crypto-backed prepaids; useful if AI subs are your main use case.\n\nPractical-use case (the reason it's Grade B despite the KYC): the **Beta tier is genuinely easy to maintain** for a normal-spending user — $500/mo card spend + Bybit VIP 1 (low bar, hit by holding small balances or trading occasionally). At Beta you get **up to $50/mo of USDT cashback** at the 2% baseline rate, and **100% cashback on five specific subscriptions** — Amazon Prime, ChatGPT, Spotify, Netflix, and TradingView. **Note:** Bybit's published terms aren't fully clear on whether the subscription refunds count against the same $50/mo cap or sit on top of it — assume worst case (capped together) until verified at the cardholder-dashboard level. Even capped together, the card is net-positive for users who'd hit Beta anyway.\n\nVirtual card issues same-day after KYC L2; physical card optional. Adds to Apple Wallet and Google Pay. Two-tier KYC: L1 = government ID + selfie, L2 = financial profile form + address proof. Regional rollout — Africa and EEA confirmed at the time of listing; check Bybit's coverage map for your region before applying. Zero annual fee, $5,000 daily limit, 1% foreign-currency markup.\n\nFull cashback ladder (six tiers, % paid in USDT, monthly vol = required card spend, VIP = Bybit exchange VIP level required in parallel, cap = monthly USDT cashback ceiling):\n- Base: 2% · $0 vol · no VIP · cap $5/mo\n- Beta: 2% · $500 vol · VIP 1 or VIP 2 · cap $50/mo + 100% sub-cashback (may share cap)\n- Alpha: 4% · $3,500 vol · VIP 3 · cap $150/mo\n- Apex: 6% · $9,500 vol · VIP 4 or PRO 1 · cap $250/mo\n- Omega: 8% · $12,500 vol · VIP 5 or PRO 2 · cap $400/mo\n- Infinite: 10% · $25,000 vol · Supreme VIP or PRO 3-6 · cap $600/mo\n\nBecause Alpha+ tiers gate on Bybit exchange VIP status (driven by trading volume / asset balances), the realistic ceiling for most retail users is Beta — which is also the tier that unlocks the 100% subscription cashback, so it's the practical sweet spot.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "heavy_kyc" ], "feature_tags": [ "custodial", "wide_funding", "apple_pay", "google_pay", "2fa_supported", "address_proof_required", "cashback", "ai_subscriptions_supported", "subscription_100_cashback" ], "highlight_tags": [ "MASTERCARD", "100% SUB CASHBACK", "AI-SUBS OK", "KYC", "CEX-FUNDED", "WIDE FUNDING", "APPLE PAY", "GOOGLE PAY" ], "fees": { "summary": "No annual fee · $5k daily limit · 1% FX markup · Beta tier ($500/mo + VIP1, easy for normies): ~$50/mo USDT cashback cap + 100% on Amazon Prime / ChatGPT / Spotify / Netflix / TradingView (may share the cap — verify in dashboard) · Higher tiers (Alpha→Infinite) gate on Bybit exchange VIP status" }, "fees_summary": "No annual fee · $5k daily limit · 1% FX markup · Beta tier ($500/mo + VIP1, easy for normies): ~$50/mo USDT cashback cap + 100% on Amazon Prime / ChatGPT / Spotify / Netflix / TradingView (may share the cap — verify in dashboard) · Higher tiers (Alpha→Infinite) gate on Bybit exchange VIP status", "last_verified": "2026-05-17", "operating_since": "2018", "tenure_note": "Bybit exchange founded 2018; Bybit Card came later. bybit.com WHOIS 1999 is premium-domain acquisition.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.bybit.com/en/card", "affiliate": "https://www.bybit.com/invite?ref=AXZ5DER", "outbound_slug": "bybit-card", "twitter": "https://x.com/BybitEurope" } }, { "id": "crypto-com-visa", "category": "cards", "subcategory": "Prepaid & Debit", "name": "Crypto.com Visa", "url": "https://xmr.club/cards/crypto-com-visa", "twin": "https://xmr.club/llm/cards/crypto-com-visa.txt", "tagline": "Staked-CRO tier system with cashback up to 5%. Heavy KYC.", "review": null, "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [ "heavy_kyc" ], "feature_tags": [ "custodial", "api_available", "2fa_supported" ], "highlight_tags": [ "KYC", "STAKE-TIER" ], "fees": { "summary": "No card fee · 0% top-up · cashback 0–5% (tier-dependent) · stake CRO for higher tiers" }, "fees_summary": "No card fee · 0% top-up · cashback 0–5% (tier-dependent) · stake CRO for higher tiers", "last_verified": "2026-05-13", "operating_since": "2016", "tenure_note": "Crypto.com (then Monaco) founded June 2016; rebranded to Crypto.com ~2018. crypto.com domain WHOIS 1993 is premium-domain acquisition, not project age.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://crypto.com/cards", "outbound_slug": "crypto-com-visa", "twitter": "https://x.com/cryptocom", "telegram": "https://t.me/Cryptocom_PriceBot", "discord": "https://discord.gg/cryptocom" } }, { "id": "goblin-physical", "category": "cards", "subcategory": "Prepaid & Debit", "name": "Goblin Physical MasterCard", "url": "https://xmr.club/cards/goblin-physical", "twin": "https://xmr.club/llm/cards/goblin-physical.txt", "tagline": "Physical no-KYC MasterCard, mailed worldwide. High issuing tier.", "review": "Premium-priced for the no-KYC physical-card niche. High issuing cost reflects the operational overhead of plastic card fulfilment without identity verification.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "no_kyc" ], "feature_tags": [ "custodial" ], "highlight_tags": [ "NO-KYC", "PHYSICAL" ], "fees": { "issuing_usd": 350, "transaction_pct": 3.5, "summary": "Issuing $350 · 3.5% reload margin · physical card mailed worldwide" }, "fees_summary": "Issuing $350 · 3.5% reload margin · physical card mailed worldwide", "last_verified": "2026-05-11", "operating_since": "2025", "tenure_note": "WHOIS 2025 predates archive.org first snapshot 2016; treated as current-entity year (domain may have been re-registered)", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.goblincards.com", "outbound_slug": "goblin-physical", "contact_email": "support@goblincards.com", "twitter": "https://x.com/Goblin_cards", "telegram": "https://t.me/banklessinlatam" }, "also_listed_at": { "web3privacy": true, "monerica": true } }, { "id": "kyc-rip-cards", "category": "cards", "subcategory": "Prepaid & Debit", "name": "kyc.rip Cards", "url": "https://xmr.club/cards/kyc-rip-cards", "twin": "https://xmr.club/llm/cards/kyc-rip-cards.txt", "tagline": "Prepaid card + gift-card aggregator. Routes orders across upstream issuers; wallet-funded checkout in XMR / BTC / USDT.", "review": "Aggregator at kyc.rip/market that fronts multiple prepaid + gift-card issuers behind a single wallet-funded checkout. No KYC at the directory layer; the underlying issuer's own posture decides what each card requires. Pay XMR/BTC/USDT, get the card details. Fee schedule is upstream-passthrough with a small aggregator margin.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "custodial", "multi_chain", "api_available" ], "highlight_tags": [ "AGGREGATOR", "NO-KYC", "USDT" ], "fees": { "summary": "Varies by issuer · aggregator margin small · XMR / BTC / USDT" }, "fees_summary": "Varies by issuer · aggregator margin small · XMR / BTC / USDT", "last_verified": "2026-05-13", "operating_since": "2025", "tenure_note": null, "locales_available": null, "first_party": true, "editors_pick": false, "links": { "web": "https://kyc.rip/market", "outbound_slug": "kyc-rip-cards", "tor": "http://kycripxmrmlmkfaqf4hwchilhtrp36nu6vyjoh3e7rmsgmyylxfm25ad.onion", "affiliate": "https://kyc.rip/market?ref=xc" }, "also_listed_at": { "monerica": true, "web3privacy": true } }, { "id": "moonpay-prepaid", "category": "cards", "subcategory": "Prepaid & Debit", "name": "MoonPay Prepaid", "url": "https://xmr.club/cards/moonpay-prepaid", "twin": "https://xmr.club/llm/cards/moonpay-prepaid.txt", "tagline": "Mainstream-issued prepaid card. KYC required, broad acceptance.", "review": null, "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [ "heavy_kyc" ], "feature_tags": [ "custodial", "multi_chain", "api_available" ], "highlight_tags": [ "KYC", "MAINSTREAM" ], "fees": { "summary": "KYC required · 4–5% off-ramp spread · mainstream issuer + acceptance" }, "fees_summary": "KYC required · 4–5% off-ramp spread · mainstream issuer + acceptance", "last_verified": "2026-05-11", "operating_since": "2010", "tenure_note": "WHOIS 2010 predates archive.org first snapshot 2005; treated as current-entity year (domain may have been re-registered)", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.moonpay.com", "outbound_slug": "moonpay-prepaid", "twitter": "https://x.com/moonpay" } }, { "id": "privacygateway", "category": "cards", "subcategory": "Prepaid Visa", "name": "PrivacyGateway", "url": "https://xmr.club/cards/privacygateway", "twin": "https://xmr.club/llm/cards/privacygateway.txt", "tagline": "No-KYC virtual VISA card with hash-based access, funded by crypto — bundled with self-run RPC nodes and a 0-fee PPLNS mining pool.", "review": "PrivacyGateway is a multi-product privacy storefront centered on a **No-KYC virtual VISA card**. The card is provisioned against an *Access hash* (no email, no phone, no ID upload), funded by crypto deposits, supports Google Pay and 3DS, carries a 3.5% loading fee, and caps at $10,000/month. Subscription is $10/month (currently promoted at 50% off through 2026 → $5/month).\n\n**What's bundled on the same domain:**\n- **Monero RPC node** at `xmr.privacygateway.io` — the daemon answers standard Monero queries and is live on mainnet. Zano companion node at `zano.privacygateway.io`. No-log per operator.\n- **Mining pool** at `pool.xmr.privacygateway.io` — 0% fee PPLNS across ports 3333 / 5555 / 7777 / 9000, with a first-block bonus promo. Newly launched, still-small hashrate.\n- **Swap tab** — a widget that routes trades to third-party swap engines already listed on xmr.club. Present but not a first-party swap product.\n\n**What to watch before scaling exposure:**\n- **Baseline documentation is thin.** The /about, /faq, /terms, /privacy, /pricing, and /contact pages aren't yet published. Support is via the Telegram handle listed on the site.\n- **Custodial between deposit and card-load.** Standard for the prepaid-VISA product shape — funds sit with the operator during the load window.\n- **Observable footprint is short.** Public web-archive traces begin February 2026; the cards product went live in Q1 2026. Grade held at C on publish while a longer-tenure track record accumulates.\n\nSuited to readers who want a spendable no-KYC card without a bank-tier account, and who accept the tenure-floor risk that comes with any Q1-2026 launch in the cards category.", "translation_locale": "en", "rating": { "grade": "C", "trust": "Cautious — new operator (Q1 2026), thin baseline documentation. Cards product is verifiable and independently functional; RPC + pool are real first-party infra.", "privacy": "Hash-based access removes email/phone as identifiers on the card side. Card-payment surface still routes through VISA rails (3DS, standard settlement) — expect merchant-level visibility on where the card is spent.", "ux": "Single-page storefront, four tabs, quick to test-drive. Sub-$5/month promo lowers friction. Missing baseline pages hurt first-visit trust." }, "grade": "C", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "NO-KYC", "VISA-VIRTUAL", "GOOGLE-PAY", "SELF-RUN-RPC", "PPLNS-POOL" ], "fees": null, "fees_summary": null, "last_verified": "2026-07-10", "operating_since": "2026-02", "tenure_note": "First archive.org snapshot 2026-02-24; cards product publicly live Q1 2026. Grade held at C while track record accumulates.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "telegram": "https://t.me/Hermeticard", "twitter": "https://x.com/Privacygateway_", "rpc_xmr": "https://xmr.privacygateway.io/", "rpc_zano": "https://zano.privacygateway.io/", "mining_pool": "https://pool.xmr.privacygateway.io/", "web": "https://privacygateway.io/", "logo": "https://xmr.club/peers/privacygateway.jpg" }, "also_listed_at": { "monerica": true } }, { "id": "stealths", "category": "cards", "subcategory": "virtual-card", "name": "Stealths", "url": "https://xmr.club/cards/stealths", "twin": "https://xmr.club/llm/cards/stealths.txt", "tagline": "No-KYC virtual cards, gift cards, eSIM — buy with Monero, tracked by order number only (no email, no Telegram).", "review": "Stealths is a privacy-first store for spendable crypto products — virtual prepaid cards, gift cards, and eSIM plans, purchased with crypto (Bitcoin Cash, Ethereum, BNB, Litecoin, Tron, USDT, **Monero**). Operating since ~2023 per archive.org first snapshot, with two tiers of delivery: automated products land within ~5 minutes; manual products usually inside 2 hours (24h maximum).\n\n**Privacy posture is genuinely tight:**\n- **No accounts.** No signup, no email, no Telegram handle required for delivery — you track your order with a unique order number alone.\n- **No tracking.** Their Terms commit to no IP collection, no browser-fingerprint tracking, no analytics beyond essential cookies. Verifiable by request inspection.\n- **No KYC.** Their Terms explicitly state \"Stealths don't require any level of customer verification. Because of this, our services could be used by anyone from any region.\"\n\n**Restrictions to know about:**\n- **Mixer-funds blocked.** Their Terms warn that \"transferring illegal funds (including mixers) is forbidden and may result in payment rejection.\" The payment is processed by an upstream partner who does AML screening on incoming crypto. If your payment gets rejected, you can request a refund from the payment provider's support.\n- **No refunds after delivery** of cards or gift codes — read product description before buying.\n- **Aggressive rate-limiting** on deep pages (the Terms / FAQ pages serve cleanly but auth/account paths return 429 quickly). Slightly hostile to Tor users probing the surface, but the actual purchase flow works.\n\n**Contact:** Telegram + Session (linked from /contact), plus a Mastodon presence in the footer. No public email — consistent with their no-PII-collection commitment.\n\n2 years of operating history under a privacy-tight commitment makes this a B-tier listing in the cards category — recommended for users specifically buying gift cards / virtual cards with XMR.", "translation_locale": "en", "rating": { "grade": "B" }, "grade": "B", "kyc_tags": [ "no_kyc", "no_email", "no_personal_data" ], "feature_tags": [ "crypto_pay", "xmr_support", "virtual_cards", "gift_cards", "esim", "order_number_tracking" ], "highlight_tags": [ "NO_TRACKING", "NO_ACCOUNT", "MIXER_FUNDS_REJECTED" ], "fees": { "summary": "Per-product pricing shown before order creation; no hidden fees. Crypto network fees are payer-side (your wallet's send fee). No exchange/spread fees disclosed — pricing is fixed in fiat-equivalent per card/product." }, "fees_summary": "Per-product pricing shown before order creation; no hidden fees. Crypto network fees are payer-side (your wallet's send fee). No exchange/spread fees disclosed — pricing is fixed in fiat-equivalent per card/product.", "last_verified": "2026-05-29", "operating_since": "2023", "tenure_note": "archive.org first 200-OK snapshot of stealths.net: 2023-09-27. Domain WHOIS not publicly resolvable (registrar/RDAP gateway returned empty).", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://stealths.net", "outbound_slug": "stealths", "contact_email": "contact@stealths.net", "affiliate": "https://stealths.net/?ref=bTmAEz1c" }, "also_listed_at": { "kycnot": true } }, { "id": "trocador-prepaid", "category": "cards", "subcategory": "Virtual Single-Use", "name": "Trocador Prepaid", "url": "https://xmr.club/cards/trocador-prepaid", "twin": "https://xmr.club/llm/cards/trocador-prepaid.txt", "tagline": "Trocador's prepaid-card aggregator — multiple issuers behind one purchase flow.", "review": "Aggregates several prepaid issuers; pay in BTC/XMR/USDT and Trocador routes the order to whichever issuer has stock for the requested amount + region. Easiest path for no-fuss top-ups.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "custodial", "tor_mirror", "multi_chain", "api_available" ], "highlight_tags": [ "AGGREGATOR" ], "fees": { "summary": "Issuer fees vary · Trocador adds 1.5–3% spread" }, "fees_summary": "Issuer fees vary · Trocador adds 1.5–3% spread", "last_verified": "2026-05-11", "operating_since": "2022", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://trocador.app/en/prepaidcard", "affiliate": "https://trocador.app/en/prepaidcards?ref=2zYpj7duMw", "outbound_slug": "trocador-prepaid" }, "also_listed_at": { "web3privacy": true, "monerica": true } }, { "id": "wirex", "category": "cards", "subcategory": "Prepaid & Debit", "name": "Wirex Visa", "url": "https://xmr.club/cards/wirex", "twin": "https://xmr.club/llm/cards/wirex.txt", "tagline": "Crypto-funded Visa with cashback rewards. KYC required, regulated issuer.", "review": null, "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [ "heavy_kyc" ], "feature_tags": [ "custodial", "multi_chain", "api_available", "2fa_supported" ], "highlight_tags": [ "KYC", "CASHBACK" ], "fees": { "monthly_usd": 1.75, "summary": "$1.75/mo fee · 0% spread on supported coins · cashback on spend (varies tier)" }, "fees_summary": "$1.75/mo fee · 0% spread on supported coins · cashback on spend (varies tier)", "last_verified": "2026-05-11", "operating_since": "2015", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://wirexapp.com", "outbound_slug": "wirex", "twitter": "https://x.com/wirexapp", "discord": "https://discord.gg/f8UGp4dH6g" } }, { "id": "xmrvcc", "category": "cards", "subcategory": "Virtual Single-Use", "name": "XMRVCC", "url": "https://xmr.club/cards/xmrvcc", "twin": "https://xmr.club/llm/cards/xmrvcc.txt", "tagline": "Disposable virtual credit card — crypto checkout (BTC/XMR/LN), no KYC, no account, manual delivery.", "review": "Disposable virtual credit card (VCC) service paid in crypto — choose a balance, pay via NOWPayments, receive a single-use card number delivered manually by the operator. Listed at **Grade B** because two peer directories confirm the listing, the ToS explicitly disclaims KYC and logging, and user reviews across three platforms report successful purchases, but the service is only 7 months old with no Tor mirror and manual delivery introduces a trust dependency on the operator's availability.\n\n**What it is.** Single-use virtual credit card paid with cryptocurrency — one product (Disposable VCC), one checkout path, one Order ID for status tracking and card access. Listed at **Grade B** on the strength of a published no-KYC/no-log ToS, multi-platform user reviews, and two peer-directory matches; held under A by operational youth, manual delivery, and the absence of a privacy policy and Tor mirror.\n\n**Background.** Operating since October 15, 2025 per kycnot.me tracking. The operator maintains an active presence across multiple community platforms: a Bitcointalk announcement thread, a Monero Forum directory entry, an XMRBazaar listing, and profiles on kycnot.me and monerica.com (No `/about` page exists. The service is operated by an individual or small team reachable via Telegram, Signal, and SimpleX — a deliberately thin identity surface consistent with the privacy-first positioning. **What you trust.** KYC stance: The ToS states: 'We do not store unnecessary personal data. No email, no KYC, and no tracking logs are permanently stored.' (operator-published, ToS Section 6, https://xmrvcc.com/tos). kycnot.me rates this as KYC level 0/4 — 'Guaranteed no KYC' with 'Terms explicitly state KYC will never be requested'. No-log policy: ToS Section 6: 'No email, no KYC, and no tracking logs are permanently stored. However, minimal technical data may be temporarily processed for order handling.' (operator-published). The 'minimal technical data' carve-out is ambiguous — it could include IP addresses, browser fingerprints, or payment metadata during the order window. kycnot.me attributes a 'Strict no-log policy' (+5 Privacy, +3 Trust). No registration: The checkout flow does not require account creation — users pay, receive an Order ID, and use it to retrieve card details (operator-published, homepage flow description). kycnot.me confirms 'No registration needed' (+5 Privacy). Payment surface: NOWPayments processes the crypto checkout (operator-published, homepage: 'CRYPTO PAY — NOWPayments checkout'; ToS Section 8: 'All payments are processed via third-party providers (e.g., NOWPayments)'). NOWPayments is a non-custodial crypto payment gateway. The homepage lists accepted currencies via NOWPayments; kycnot.me lists Monero, Bitcoin, and Lightning support. Advertised coins: Bitcoin, Monero, Bitcoin Lightning, plus 'Fiat' and 'Cash' categories listed on kycnot.me. The homepage only references 'crypto' generically; specific coin support is visible at checkout. Consumer reviews: Two verified reviews on kycnot.me averaging 5/5: one customer reports a $120+$30 purchase working for days with responsive support (anti_banding_8003, May 12, 2026); another reports a $240 VCC delivered quickly with no issues (broken_deacon_500, May 12, 2026). One XMRBazaar review at 5/5: seller helped resolve a wrong-card issue and provided buying advice (Pestic34, May 2, 2026). (All sourced from operator-published homepage review section and kycnot.me comments.)\n\n**Operational specs.** Product: Single SKU: Disposable VCC, custom balance, crypto checkout, delivery after approval (operator-published, homepage purchase module). No tiered plans or subscription model — one-off purchases only. Delivery model: Manual — 'All cards are delivered manually by the admin after payment confirmation. Delivery time may vary but typically occurs within a reasonable timeframe.' (operator-published, ToS Section 3). kycnot.me flags this as 'Orders processed manually' (-2 Trust). Manual delivery means card availability depends on the operator being awake and responsive. Refund policy: 'If a card is proven to be non-functional at the time of delivery, a replacement may be provided. Refunds are not guaranteed and are evaluated on a case-by-case basis.' (operator-published, ToS Section 4). This is a weak refund posture — replacement is 'may' not 'will', and refunds are explicitly not guaranteed. Support channels: Email (contact@xmrvcc.com), Telegram (t.me/userTalha), Signal (XMRVCC.50), SimpleX chat link (operator-published, homepage footer). Four channels across different threat models. kycnot.me rates support as 'Basic' (+1 Trust): 'Customer support for this service is average. They answer questions and fix problems in a reasonable time.' User reviews corroborate responsiveness. Tor mirror: None advertised — no onion-location header and no onion URL. An API endpoint exists but requires authentication or is access-controlled — not publicly documented. Pricing: Custom balance — user chooses the card value at checkout. No fixed tiers or published fee schedule. The NOWPayments gateway adds its own processing fee; the operator's margin is embedded in the card price. No separate platform fee is disclosed.\n\n**Operator philosophy.** The operator positions the service as a focused, minimal-surface utility: one product, one checkout flow, one Order ID. The ToS is written in plain English with direct claims ('No email, no KYC, and no tracking logs are permanently stored') rather than legal hedging. The choice to offer Signal and SimpleX alongside Telegram and email suggests the operator understands the Monero community's threat-model diversity. The 'VCC Vault' branding in the ToS footer (absent from the homepage) hints at back-end service naming but no corporate entity is disclosed — consistent with a pseudonymous operator model.\n\n**Grade rationale.** Listed at **Grade B** because two independent peer directories confirm the listing, a published ToS explicitly disclaims KYC and logging with quotable language, and user reviews across three platforms (kycnot, XMRBazaar, Trustpilot) report successful purchases with responsive support. Grade A is withheld because: (1) the service is only 7 months old per kycnot; (2) no privacy policy exists (36/39 paths 404, no /privacy, /privacy-policy, or /legal/privacy resolved. Among VCC/card providers in this directory, publishing a privacy policy and reducing delivery time (or going automated with a Tor-accessible checkout) would justify Grade A.\n\n**Caveats.** The ToS is the *only* legal page on the domain — No privacy policy, no AML page, no FAQ, no /about, no /contact page (the homepage embeds contact info directly). This is an extreme concentration of legal surface into a single 2.9KB ToS document. The ToS covers the key trust claims but does not replace a privacy policy. 'Refunds are not guaranteed and are evaluated on a case-by-case basis' (operator-published, ToS Section 4) is the weakest consumer-protection language seen in any B-grade listing to date. Combined with manual delivery, the buyer bears substantial counterparty risk — mitigated in practice by positive user reviews, but structurally unaddressed. The NOWPayments dependency introduces a second trust surface: NOWPayments sees the payment amount and crypto address, and their own logging/retention policies apply. Users who want full payment privacy need to trust both the operator's no-log claim AND NOWPayments' data practices. A VCC provider holds a balance and delivers a financial instrument; 'non-custodial' is inaccurate.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B", "trust": "Two peer directories confirm it and user reviews across three platforms report successful purchases; ToS disclaims KYC and logging. B (not higher) because it's ~7 months old, has no Tor mirror, and manual card delivery creates a dependency on the operator's availability.", "privacy": "No KYC, no account; paid in crypto (BTC/XMR/Lightning). ToS explicitly disclaims KYC and logging; single-use card numbers. Caveat: the card runs on a conventional card network downstream — private to buy, not anonymous to spend.", "ux": "Pick a balance, pay via NOWPayments, receive a single-use card number by manual delivery. No account; the manual step means it isn't instant." }, "grade": "B", "kyc_tags": [ "anonymous_signup", "no_kyc" ], "feature_tags": [ "custodial", "no_account" ], "highlight_tags": [ "NO-KYC", "XMR", "BTC" ], "fees": { "summary": "Custom balance · NOWPayments processing fee + operator margin embedded in card price · BTC/XMR/LN" }, "fees_summary": "Custom balance · NOWPayments processing fee + operator margin embedded in card price · BTC/XMR/LN", "last_verified": "2026-06-07", "operating_since": "2025-10-15", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmrvcc.com", "outbound_slug": "xmrvcc", "tos": "https://xmrvcc.com/tos", "contact_email": "contact@xmrvcc.com", "telegram": "https://t.me/userTalha", "signal": "XMRVCC.50", "simplex": "https://smp12.simplex.im/a#ufTlwKUiUZHVzfg3ontBZTmAHo0g5p7MyVVzg3kllKQ" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "atomic-swap-btc-xmr", "category": "educational", "subcategory": "Protocol & Lineage", "name": "COMIT — BTC ↔ XMR Atomic Swap", "url": "https://xmr.club/educational/atomic-swap-btc-xmr", "twin": "https://xmr.club/llm/educational/atomic-swap-btc-xmr.txt", "tagline": "The COMIT open protocol behind trustless BTC ↔ XMR atomic swaps. Research home; the active end-user implementation is EigenWallet.", "review": "**The protocol home and lineage page for the canonical Bitcoin ↔ Monero atomic-swap stack.** COMIT Network published the open cryptographic protocol (HTLCs + Scriptless Scripts) and authored the original `xmr-btc-swap` Rust reference implementation; the COMIT team has since stepped back from active maintenance and the community fork — now branded **EigenWallet** — is the working continuation. This entry exists to document the lineage so the technology, the research, and the active product don't get conflated. **If you want to actually swap BTC ↔ XMR today, go to [EigenWallet](/wallets/eigenwallet).** This page is for understanding where the technology came from.\n\n**What it is.** COMIT (Cryptographically-secure Off-chain Multi-asset Instant Transactions) is an **open protocol** designed at `comit.network` for trustless cross-blockchain swaps. The protocol's signature properties — *pure* (no extra chain, no extra token), *native* (uses each blockchain's own scripting primitives), *trustless* (no third-party arbiter), *accountless* (no signup, no deposit) — informed several concrete implementations: BTC ↔ Ethereum / ERC20 (early COMIT focus), BTC ↔ Lightning, BTC ↔ Grin, and the one that mattered most for the Monero ecosystem: **BTC ↔ Monero** via `comit-network/xmr-btc-swap`.\n\n**Background.** COMIT was incubated around 2018-2020 as a research-grade protocol effort with associated reference implementations. **xmr-btc-swap** (Rust) was the BTC-XMR implementation — the first production-grade trustless swap between Bitcoin and Monero. After a CCS-funded maturity push and several production releases, the **COMIT team shifted focus to other projects** and stopped actively maintaining the BTC ↔ XMR repo (`github.com/comit-network/xmr-btc-swap` carries an `unmaintained` notice today, with an explicit pointer to `eigenwallet/core`).\n\nThe baton was picked up by community maintainers (binarybaron and others), who **forked the codebase as UnstoppableSwap**, added a Tauri GUI on top of the CLI, broadened the ASB (Atomic Swap Backend) maker tooling, and shipped continuously through 2024-2025. In **2025 the project rebranded to EigenWallet** while keeping the same codebase, Matrix room, and maker community intact. Today the active end-user product is **eigenwallet.org**; the COMIT protocol page (`comit.network`) is the research / spec / history reference.\n\n**What you trust.**\n\n- **Open protocol specs.** The COMIT protocol primitives (HTLCs, Scriptless Scripts) are published, peer-reviewed, and free to implement. The trustlessness is mathematical — no party can cheat without breaking discrete-log assumptions.\n- **Open-source reference implementation.** `comit-network/xmr-btc-swap` is GPL'd and forkable. The fork lineage (UnstoppableSwap → EigenWallet) keeps the same license.\n- **Battle-tested.** The protocol has settled tens of thousands of BTC ↔ XMR swaps over ~3+ years across implementations. No protocol-level vulnerability has resulted in a loss for users who waited out the refund timelocks.\n- **Curator note: no operator on the data path.** This is true at the protocol layer. At the implementation layer, you trust the binary you run and the maker you pair with — see EigenWallet's entry for the implementation-specific incident history (including the active 2026-05 maker-side advisory).\n\n**Operational specs.**\n\n- **Active end-user product:** [EigenWallet](/wallets/eigenwallet) — desktop GUI + ASB CLI, Linux / macOS / Windows. SEPA on-ramp for EU users.\n- **Original reference repo:** `github.com/comit-network/xmr-btc-swap` — marked **unmaintained**, points at EigenWallet as the maintained successor.\n- **Other COMIT-protocol implementations (historical):** BTC ↔ ETH/ERC20, BTC ↔ Lightning, BTC ↔ Grin. None of these are currently active end-user products under the COMIT brand; their codebases remain on the COMIT GitHub for research reference.\n- **Protocol home:** [comit.network](https://comit.network) — Matrix room + mailing list + blog. Specs, building blocks (\"Native\", \"Instant\", \"Privacy-Preserving Atomic Swaps\"), and historical research output.\n- **Pricing.** Protocol page — no fees at this layer. End-user swap pricing is set per-maker on the implementation side.\n\n**Operator philosophy.** COMIT's stated framing — *\"Connecting all the blockchains without adding yet another one\"* — was a counter-position to the early-stage \"swap chain\" approach (Cosmos, Polkadot, ThorChain, every wrapped-asset bridge). COMIT's bet was that **trustless cross-chain settlement should be done on each chain's own primitives**, not on a third blockchain that introduces new trust assumptions. That bet aged well for the Bitcoin ↔ Monero pair, where the resulting protocol delivered a working trustless swap years before any bridged-token approach could honestly claim the same property for XMR.\n\n**Grade rationale.** Listed at **Grade B** as a protocol/lineage page — the underlying cryptography is sound and the lineage is documented, but COMIT itself no longer ships an end-user product for the BTC ↔ XMR pair. Users looking for an A-grade end-user wallet should use [EigenWallet](/wallets/eigenwallet). If you're a researcher or an integrator building on the COMIT primitives directly, the protocol home and the original `xmr-btc-swap` codebase remain useful references.\n\n**Useful when:**\n\n- You want to **understand where EigenWallet's trustless swap mechanism comes from** before trusting it with funds.\n- You're a **protocol researcher** studying production-grade atomic-swap implementations between heterogeneous chains.\n- You're **building a new cross-chain implementation** and want a peer-reviewed primitive (HTLC + Scriptless Scripts) as a starting point rather than rolling your own.\n- You're writing about the **history of Bitcoin ↔ Monero atomic swaps** and need authoritative source links for the COMIT → UnstoppableSwap → EigenWallet lineage.\n\n**Caveats:**\n\n- **Not an end-user product.** This page is documentation + lineage. For actually swapping BTC ↔ XMR today, see [EigenWallet](/wallets/eigenwallet).\n- **The original `xmr-btc-swap` repo is unmaintained.** Don't run those binaries directly — they may have known bugs that EigenWallet has since patched, and the ASB protocol versioning has moved on.\n- **COMIT brand activity is low.** The website is up, the Matrix room is reachable, but new protocol work + active development happens on the EigenWallet side now.\n- **Implementation-specific incidents apply.** The protocol layer is sound; the implementation layer (EigenWallet's ASB) has an active 2026-05 vulnerability advisory — see the [EigenWallet incident banner](/wallets/eigenwallet).", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "atomic_swap", "xmr_native" ], "highlight_tags": [ "PROTOCOL", "OPEN SOURCE", "LINEAGE" ], "fees": { "summary": "Protocol page — no fees apply at this layer. Per-swap pricing depends on the implementation: see EigenWallet." }, "fees_summary": "Protocol page — no fees apply at this layer. Per-swap pricing depends on the implementation: see EigenWallet.", "last_verified": "2026-05-27", "operating_since": "2017", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://comit.network", "outbound_slug": "atomic-swap-btc-xmr", "twitter": "https://x.com/comit_network" }, "also_listed_at": { "web3privacy": true } }, { "id": "breaking-monero", "category": "educational", "subcategory": "Audio / Video", "name": "Breaking Monero", "url": "https://xmr.club/educational/breaking-monero", "twin": "https://xmr.club/llm/educational/breaking-monero.txt", "tagline": "Series by Sarang Noether walking through historical XMR weaknesses + how each was fixed.", "review": "Breaking Monero is the **canonical video series on Monero's protocol history** — a YouTube series by **Sarang Noether** (then a Monero Research Lab researcher) that walks through every major historical privacy weakness in the Monero protocol and the specific protocol change that closed it. Listed at **Grade A** because Breaking Monero is the **single best explanation of why current Monero looks the way it does** — the protocol's design decisions become clear when you understand the attacks they're defending against, and Breaking Monero presents that defense-by-defense history in accessible video form.\n\n**Background.** Breaking Monero was produced and published between **2018 and 2019** by **Sarang Noether** (cryptographic research pseudonym; the real identity was publicly known in the cryptography community but maintained a research-focused public profile). At time of production, Sarang was an active Monero Research Lab researcher working on **Bulletproofs**, **ring signature analysis**, and the broader Monero protocol-evolution roadmap. The series spans **15+ episodes**, each covering a specific historical privacy weakness or attack vector against Monero. Hosted on **YouTube** (search: \"Breaking Monero\" or the playlist URL); also archived on **Internet Archive** + cross-referenced by community privacy-tooling resources. The series is **freely available** — no paywall, no subscription required. Sarang stopped active Monero contributions around 2020; the series remains the canonical educational reference for Monero's protocol history.\n\n**What you trust.** **Researcher-led content** — Sarang Noether was an active Monero Research Lab researcher with named contributions to multiple Monero protocols (Bulletproofs work in particular). The series content is informed by direct involvement in the protocol's evolution. **Defense-by-defense narrative** — each episode follows the same structure: identify a historical privacy weakness (often by referencing academic papers that exposed it), walk through how the weakness was exploited (or could be), explain the protocol change that closed it. **Accessible production** — the videos are technical but presented for an audience that can follow cryptographic reasoning without being academic cryptographers themselves. **Cross-referenced with primary sources** — the series consistently links to MRL bulletins, academic papers, and Monero codebase commits that implement the discussed changes. **What you don't trust**: **content age** — the series ended in 2019; protocol changes since then (Bulletproofs+, Carrot, Seraphis development, FCMP++) are not covered. For post-2019 protocol evolution, supplement with MRL papers and MoneroKon talks. **Sarang Noether is no longer active in Monero** — the series doesn't get updated; for current protocol research, monitor MRL directly. **YouTube hosting** has the usual YouTube concerns (algorithm changes, takedowns, ad-monetisation pressure on the platform); Internet Archive mirrors preserve the content but YouTube remains the canonical viewing surface.\n\n**Operational specs.** **Format**: ~15-20 minute episodes, video + audio. **Hosting**: YouTube playlist + community-archived mirrors on Internet Archive. **Languages**: English; some episodes have community-contributed subtitles. **Episodes cover**: ring signature analysis (chain reactions, decoy selection weaknesses, fork attacks), output linkability (early Monero's weaknesses before RingCT), transaction graph analysis, key-image leakage, fee structure attacks, mining centralisation concerns, and how each of these was addressed via specific Monero protocol changes. **Format**: Sarang on camera with slides + animations explaining specific attack vectors + protocol responses. **No accounts required to view** — YouTube content is openly accessible. **Cross-listed in** Monerica, web3privacy, this directory, and essentially every Monero-educational resource. **Companion resources**: Sarang's research papers (some still hosted at cypherstack.com under \"Sarang\" attribution; some on arXiv).\n\n**Philosophy.** Breaking Monero's editorial differentiator is the **historical-attacks-and-defenses pedagogy** applied to Monero. Most cryptocurrency-explanation content is forward-looking (\"here's how Monero works today\"); Breaking Monero is backward-looking (\"here's what attacks Monero defends against, and which specific design decisions defend against each\"). This is the right pedagogy for cryptographically-curious users: understanding *why* Monero uses ring signatures of size 16 (and not 5 or 50), *why* RingCT was introduced, *why* the protocol does a hard fork every ~6 months — requires understanding the attack literature that motivated each decision. Breaking Monero is the only video series that consistently presents that history.\n\n**Grade rationale.** Grade A reflects: produced by **named Monero Research Lab researcher** (Sarang Noether) with public research credentials; **15+ episodes** covering Monero's protocol-attack-and-defense history end-to-end; freely available on YouTube + archived on Internet Archive; cross-referenced with academic-grade primary sources (MRL bulletins, papers, codebase commits); **accessible cryptographic explanation** for non-academic-cryptographer audiences; **single most-cited educational video series** for understanding Monero's protocol design decisions; cross-listed in essentially every Monero-educational resource; 6+ years of operational continuity (series remains accessible since 2018-2019). Last verified 2026-05-11.\n\n**Useful when.** You're **new to Monero** but cryptographically-curious — Breaking Monero is the right pedagogy after Moneropedia + the getmonero.org library. You want to **understand Monero's design decisions** — why ring-size-16, why RingCT, why bulletproofs, why hard forks every 6 months — Breaking Monero answers via the attack-then-defense history. You're a **developer or researcher** building privacy-currency systems — learning from Monero's iterative defenses is excellent case-study material. You're **teaching Monero** to others (workshops, courses, peer education) — Breaking Monero is freely usable as supplementary material. You're a **journalist or policy researcher** writing about Monero's privacy guarantees — the series helps you understand the *why* behind specific protocol choices, not just the *what*. You're an **academic** evaluating Monero's privacy claims — the series cross-references academic papers that you can cite directly.\n\n**Caveats.** **Content frozen at 2019** — Breaking Monero ended around 2019; protocol changes since (Bulletproofs+, Carrot/Seraphis development, FCMP++ research, hard forks 2020-2026) aren't covered. For post-2019 protocol evolution, supplement with **MRL papers**, **MoneroKon talks**, and **getmonero.org documentation** updates. **Sarang Noether is no longer active in Monero research** — the series doesn't get updated. **YouTube hosting concerns** — the canonical viewing surface is YouTube, which has the usual platform concerns (potential takedowns, algorithmic visibility, ad monetisation on the platform). Internet Archive mirrors preserve the content. **English-only** — community subtitles cover some episodes but are not comprehensive. **Episode order matters** — Breaking Monero is best watched in playlist order; some episodes build on concepts from earlier ones. Don't skip around without understanding the prerequisites. **Some specifics are out-of-date** — episodes discussing specific ring-size or fee-structure values may reference older protocol parameters that have since changed. The *attack-and-defense reasoning* remains valid; the *specific parameter values* should be cross-checked against current Monero protocol state. **Not a substitute for MRL primary sources** — for citation-grade work, refer to MRL bulletins and papers rather than the video series. Breaking Monero is excellent secondary literature; MRL is primary. **Doesn't cover external academic critiques in depth** — papers critical of Monero (e.g., the 2017 traceability paper that motivated RingCT) are referenced but the series presents Monero's response perspective; for adversarial perspective, read the original critique papers directly.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [], "highlight_tags": [ "FREE", "VIDEO", "TECHNICAL" ], "fees": { "summary": "Free · 12 episodes on YouTube" }, "fees_summary": "Free · 12 episodes on YouTube", "last_verified": "2026-05-11", "operating_since": "2017", "tenure_note": "Breaking Monero series by Justin Berman + Sarang Noether started 2017. Previous stamp (2005) was YouTube.com WHOIS — shared-host trap.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.youtube.com/playlist?list=PLsSYUeVwrHBnAUre2G_LYDsdo-tD0ov-y", "outbound_slug": "breaking-monero" }, "also_listed_at": { "privacyguides": true, "monerofail": true, "monerica": true } }, { "id": "cypher-stack-research", "category": "educational", "subcategory": "Technical Deep-Dive", "name": "Cypher Stack Research", "url": "https://xmr.club/educational/cypher-stack-research", "twin": "https://xmr.club/llm/educational/cypher-stack-research.txt", "tagline": "Open audits + research papers on Monero, Firo, Salvium and other privacy protocols.", "review": "Cypher Stack is the **independent applied-cryptography research firm** that publishes open audits and research papers on **Monero, Firo, Salvium, and other privacy-currency protocols**. Listed at **Grade A** because Cypher Stack occupies a structurally unique position: it's the only firm that combines **academic-grade cryptographic rigour** + **focus on privacy currencies** + **public open-source publication model** — making it the canonical external-audit option for privacy-coin protocols that need credible third-party cryptographic review.\n\n**Background.** Cypher Stack was founded by **Brandon Goodell** (cryptographer, formerly active in Monero Research Lab) and operates from the United States as **Cypher Stack LLC**. The firm has been operating since around **2019-2020**, growing out of the same applied-cryptography research community that produced MRL contributions. **Funding**: cryptographic-audit contracts paid by the projects being audited (typical of the firm-audits-protocol model in cryptography); some research is grant-funded by privacy-tooling foundations. **Open publication model**: research papers and audit reports are published openly at **cypherstack.com**; the firm's commitment is that external review of privacy-currency cryptography should be **publicly accessible** rather than locked behind paid client reports. This is meaningfully different from commercial cryptography-audit firms (Trail of Bits, NCC Group, Quarkslab, Kudelski) where reports are typically published only at the client's discretion.\n\n**What you trust.** **Named cryptographer leadership** — Brandon Goodell has a public track record in Monero protocol research, including contributions to MRL bulletins. The firm's audit-and-research methodology is informed by direct cryptographic-research experience, not just engineering-audit checklists. **Open-publication model** — audits and research papers are published at cypherstack.com without paywalls; the firm explicitly chose this model because privacy-currency cryptography is in the public interest and needs public scrutiny. **Privacy-currency specialisation** — most commercial cryptography-audit firms work across the broader software industry; Cypher Stack's focus on privacy currencies means deeper protocol-specific expertise (Monero ring signatures, RingCT, Bulletproofs, FCMP++, Salvium's privacy-stablecoin design, Firo's Lelantus/Lelantus-Spark). **Research papers cross-published with academic venues** — some Cypher Stack research has been published at academic cryptography conferences (Real World Crypto, similar venues), bringing in additional external peer review. **What you don't trust**: **paid-by-clients model** — like all audit firms, Cypher Stack is paid by the protocols it audits. The open-publication commitment mitigates conflict-of-interest concerns (a misleading audit report can't be hidden), but readers should still consider the structural incentive. **Smaller team than Trail of Bits / NCC Group** — for very-large audit scopes, Cypher Stack may not have the team size to compete with industry-scale audit firms. **Some research is preliminary** — papers describing research-in-progress should be cross-referenced with production deployment.\n\n**Operational specs.** **Website**: cypherstack.com — research papers + audit reports + team information. **Publication formats**: research papers (typical LaTeX cryptographic-paper format, hosted on the website + sometimes mirrored on eprint.iacr.org or arXiv), audit reports (PDF format, signed-released for client audits), bulletins (shorter technical notes). **Areas of expertise**: ring signature analysis, zero-knowledge proof systems (Bulletproofs, Lelantus, Triptych, Plonk), threshold cryptography, hash-based commitments, privacy-currency-specific protocols (FCMP++, Carrot/Seraphis, Firo's spark protocol). **Clients (publicly disclosed)**: Monero Research Lab work via CCS funding, Firo (Lelantus protocol audits), Salvium (privacy-stablecoin protocol), and others. **Team**: small but credentialed — Brandon Goodell + research staff with academic-cryptography backgrounds. **Engagement model**: ranges from focused-protocol audits to longer research collaborations. **Open-source contributions**: some research output includes reference implementations published as open-source code.\n\n**Philosophy.** Cypher Stack's editorial differentiator is the **academic-rigor-applied-to-privacy-currencies + open-publication** model. The cryptography-audit industry has two main approaches: (1) **commercial confidential audits** where reports are published only at client discretion (Trail of Bits, NCC Group, etc.), good for paying clients but creates information asymmetry between insiders and the public, (2) **academic peer review** where research is open but typically not tied to specific commercial deployments. Cypher Stack hybrids these: commercial audit engagements with public-by-default reports. For privacy currencies specifically, this matters: privacy protocols depend on public scrutiny to maintain trust, and a closed-audit model conflicts with that requirement. Cypher Stack's editorial choice is to align with privacy-currency values rather than industry-standard audit confidentiality.\n\n**Grade rationale.** Grade A reflects: 5+ years of operational continuity (since ~2019-2020); **named cryptographer leadership** (Brandon Goodell, public MRL contribution track record); open-publication model with research papers and audit reports freely accessible; privacy-currency specialisation (Monero, Firo, Salvium, others) with deep protocol-specific expertise; cross-published research at academic venues; published audits cross-referenced from primary projects (MRL bulletins, Firo's protocol documentation, Salvium's docs); company structure as a small specialised firm rather than a commercial scale-out. The canonical external-audit reference for privacy-currency protocols. Last verified 2026-05-11.\n\n**Useful when.** You're a **privacy-currency developer** needing an external audit — Cypher Stack is one of the few firms with focused expertise in this domain. You're a **researcher or academic** studying privacy-currency protocols — Cypher Stack's published papers and audit reports are credible primary sources. You're **evaluating a privacy protocol's cryptographic claims** (a coin you're considering using, integrating, or researching) — Cypher Stack's audit reports are useful third-party evidence. You're **citing applied-cryptography research** in academic or technical writing — Cypher Stack publications are peer-grade and citable. You're a **journalist or policy researcher** covering privacy currencies — Cypher Stack's commitment to open publication makes their work accessible and citable. You want **to understand specific protocol decisions** (why was Bulletproofs+ chosen, what does the audit say about FCMP++, how does Lelantus differ from RingCT) — Cypher Stack publications cover these comparisons in depth.\n\n**Caveats.** **Paid-by-clients audit model** — like all cryptographic-audit firms, Cypher Stack is paid by the protocols it audits. The open-publication commitment mitigates conflict-of-interest concerns (audit findings can't be hidden), but the structural incentive remains. Cross-reference audit findings with independent academic literature when stakes are high. **Smaller team than industry-scale audit firms** — for very-large-scale audits or compliance-grade audit needs (regulatory submissions, enterprise risk management), Cypher Stack may not have the team size to compete with Trail of Bits or NCC Group. For most privacy-currency protocol audits, Cypher Stack's focused expertise is the right trade-off. **Some research is preliminary** — papers describing in-progress research should be cross-referenced with production deployment. Don't assume an audited protocol design is shipped to production until you check the actual codebase. **English-only publications** — research papers and audit reports are in English; for non-English readers, no official translations exist (though community translations may exist for specific papers). **Specific-project specialisation** — Cypher Stack's focus is Monero / Firo / Salvium / similar privacy currencies. For audits of non-privacy-focused protocols (e.g., DeFi smart contracts, blockchain consensus), other firms are more appropriate. **Audit-scope limitations** — every audit is bounded by scope; a Cypher Stack audit of a specific protocol component doesn't mean every other component of the same protocol has been audited. Read scope statements carefully. **Don't conflate \"audited by Cypher Stack\" with \"perfectly secure\"** — audits identify *specific* concerns and remediate them; they don't prove the absence of all vulnerabilities. Continued vigilance is required regardless of audit history. **Don't substitute Cypher Stack publications for primary protocol documentation** — the audit findings are useful but the canonical source for \"how does protocol X actually work\" remains the protocol's own documentation and source code. **Audit dates matter** — a 2021 audit of a specific protocol version doesn't cover changes shipped since. For currency of audit findings, cross-reference the audit date with the current production deployment.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source" ], "highlight_tags": [ "FREE", "TECHNICAL", "AUDIT" ], "fees": { "summary": "Free · public archive" }, "fees_summary": "Free · public archive", "last_verified": "2026-05-11", "operating_since": "2017", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://cypherstack.com", "outbound_slug": "cypher-stack-research" } }, { "id": "eff-ssd", "category": "educational", "subcategory": "OPSEC Reference", "name": "EFF Surveillance Self-Defense", "url": "https://xmr.club/educational/eff-ssd", "twin": "https://xmr.club/llm/educational/eff-ssd.txt", "tagline": "EFF's threat-model-driven OPSEC guides. Foundational reading for any privacy practitioner.", "review": "EFF Surveillance Self-Defense is the **canonical threat-model-driven OPSEC reference** — a free, public-domain guide maintained by the **Electronic Frontier Foundation** that teaches privacy practitioners how to **think about threats first** and then apply tooling appropriate to those threats. Listed at **Grade A · editor's pick** because SSD occupies a structurally unique position: it's not a tool, not a wallet, not a service — it's the **mental framework** behind every privacy decision the rest of this directory documents. **Mandatory reading** for anyone starting privacy work, and a periodic re-read for anyone who's been at it for years.\n\n**Background.** Surveillance Self-Defense was launched by the **Electronic Frontier Foundation (EFF)** in **2009** and has been continuously updated since. The EFF itself has been operating since 1990 — one of the longest-running digital rights organisations in the world — and SSD is one of their flagship public-education resources. **Domain**: ssd.eff.org. **License**: content is published under **Creative Commons (CC BY 4.0)** — meaning the guides can be freely shared, translated, and adapted. **Languages**: SSD is translated into 13+ languages including Spanish, Arabic, Russian, Mandarin, Vietnamese, Turkish, and more — explicitly chosen to serve activists, journalists, and human-rights workers in regions where the threat-model framing matters most. **Maintainership**: ongoing updates by EFF's technologist staff; revision history is transparent (you can see when each guide was last updated). **No commercial pressure** — EFF is donor-funded; SSD has no advertising, no upsell, no SaaS product attached.\n\n**What you trust.** **EFF organisational track record** — 35+ years of digital rights advocacy with public legal track record (lawsuits against NSA mass surveillance, court briefs on encryption policy, EFF-led research on commercial tracking). **Threat-model-first methodology** — SSD teaches users to ask \"what am I protecting? from whom? at what cost?\" before picking tools. This is the foundational discipline that separates effective OPSEC from \"I downloaded a privacy app, now I'm safe.\" **Tool-agnostic core** — SSD recommends specific tools but the methodology is tool-independent; the guides survive product churn (when Signal changes UX, when a recommended tool gets acquired, when something new launches) because they teach how to evaluate tools, not which specific button to click. **Translated by regional partners** — many translations are done by regional activist organisations who understand the local threat landscape; the Arabic, Mandarin, Russian, and Vietnamese translations are particularly well-maintained. **What you don't trust**: SSD is education, not a service — it doesn't host your data, doesn't run software for you, doesn't track you. **EFF's US jurisdiction** is a factor for some threat models — EFF is based in San Francisco and subject to US law; the **content** of SSD is universally usable, but EFF as an organisation could theoretically receive US legal pressure (though its lawsuits-against-NSA track record suggests it would resist).\n\n**Operational specs.** **Format**: web-based guides + downloadable PDFs for offline use. **Sections**: **Basics** (foundational concepts: what is encryption, what is metadata, why threat modelling matters), **Tool Guides** (specific tools: how to use Signal, how to use Tor Browser, how to encrypt your email), **Further Learning** (deeper reading on cryptography, surveillance studies, digital rights), **Glossary** (~100 privacy/security terms defined clearly). **Threat-model framing**: every guide opens with \"this guide is for [specific threat model] — if your situation is different, see [other guide].\" **Updates**: revision history visible at the bottom of each guide; recent updates are tagged with dates. **Access**: HTTPS-only at ssd.eff.org; works on **Tor Browser** without aggressive blocking; mobile-responsive; works **without JavaScript** (the guides are static HTML — a Tor \"Safest\" mode-friendly feature). **Offline access**: PDF download for offline reading (useful for users in censored regions or for printing). **No accounts** — read anonymously; SSD doesn't track, doesn't require login, doesn't ask for email. **API**: there's no API per se; the guides are a static website. **Distribution**: also covered in EFF's email newsletters and their tech-blog posts, but the canonical home is ssd.eff.org.\n\n**Philosophy.** SSD's editorial differentiator is the **threat-model-first** methodology. Most \"how to be private online\" content is tool-prescriptive (\"download these 5 apps\"); SSD inverts that. Before any tool, you identify: (1) **what** you're protecting (the asset — could be your identity, your sources, your location, your communications), (2) **who** you're protecting it from (the adversary — could be ad-tech, ISP, employer, state actor, a specific group), (3) **how likely** the threat is (probabilistic, not paranoia-driven), (4) **how bad** the consequences are if the threat is realised, (5) **how much effort** you're willing to spend on defence. Only then do you pick tools. This is the foundational discipline of OPSEC — and SSD is the most accessible introduction to it in the privacy-tooling space.\n\n**Grade rationale.** Grade A and editor's pick reflect: 16+ years of operational continuity (since 2009); **maintained by the EFF** (35+ year digital rights organisation with strong public-interest track record); Creative Commons CC BY 4.0 licensing (freely shareable, translatable, adaptable); 13+ language translations including high-priority languages for activist/journalist use; tool-agnostic threat-model methodology that survives product churn; static-website + no-JS architecture (Tor-friendly, censorship-resistant); no advertising, no tracking, no commercial pressure; tagged revision history for transparency; works offline via PDF; cross-listed in essentially every privacy-tools reference (Privacy Guides, EFF's own ecosystem, dozens of activist organisation reading lists). The most-recommended foundational reference in the privacy-tooling space. Last verified 2026-05-11.\n\n**Useful when.** You're **starting privacy work** and need a foundation before picking tools — SSD is the first reading list. You're **teaching** privacy/OPSEC to others — SSD's threat-model methodology is the cleanest pedagogy in the space. You're a **journalist or activist** in a hostile-network region — SSD has translated guides specifically for these threat models. You're a **technologist** at an organisation deciding which privacy tools to recommend internally — SSD's tool guides are evidence-based and updated. You're **periodically re-reading** to refresh your threat model as your work or context changes (a senior practitioner exercise — your threat model should evolve as your work does). You want a **single source** to point someone at when they ask \"where do I start with privacy?\" — SSD is the canonical answer. You're translating privacy content into a new language — SSD's CC BY 4.0 licence makes it the canonical base text.\n\n**Caveats.** **SSD is education, not a service** — you still have to apply the methodology to your specific situation; reading SSD alone doesn't make you private, applying its methodology does. **Some tool recommendations age** — SSD is updated but the rate of privacy-tooling evolution means specific tool recommendations sometimes lag the state of the art by 6-12 months. **Cross-reference recent specialised sources** (Privacy Guides, this directory, EFF's blog) for tool-specific currency. **US-organisation caveat** — EFF is San Francisco-based; for users whose threat model includes US-state-actor concerns, SSD's content is still valuable but consider whether the organisational jurisdiction matters for your specific case (it almost never does — SSD is content, not infrastructure that handles your data). **Some sections are more current than others** — the foundational concepts age slowly; the tool guides age faster. Skim the \"last updated\" date on tool-specific guides. **Doesn't cover everything** — SSD focuses on threat-model framework + commonly-relevant tools; for specialised threats (cryptocurrency privacy, hardware wallet security, supply-chain attacks on specific software), supplement with specialised sources (Privacy Guides for hardware, this directory for crypto, the relevant project's own docs for software-specific concerns). **Language quality varies across translations** — the English original is the canonical; some translations are excellent (Spanish, Russian, Arabic), others are slightly behind on currency (less-resourced languages). **Not a substitute for legal advice** — SSD covers the privacy/OPSEC landscape but if your threat model includes legal proceedings (subpoenas, court orders, jurisdiction-specific privacy laws), pair SSD with a qualified lawyer in your jurisdiction. **The threat-model exercise is the work** — many readers skip \"do the threat-model exercise\" and jump straight to \"what tools should I use?\" That defeats the purpose. The methodology is what makes SSD valuable; the tool list is the secondary output.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source" ], "highlight_tags": [ "FREE", "OPSEC", "FOUNDATIONAL" ], "fees": { "summary": "Free · EFF-maintained" }, "fees_summary": "Free · EFF-maintained", "last_verified": "2026-05-11", "operating_since": "2009", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2009", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://ssd.eff.org", "outbound_slug": "eff-ssd" } }, { "id": "getmonero-docs", "category": "educational", "subcategory": "Foundational", "name": "getmonero.org / Library", "url": "https://xmr.club/educational/getmonero-docs", "twin": "https://xmr.club/llm/educational/getmonero-docs.txt", "tagline": "Official Monero docs, user guides, and the Moneropedia glossary.", "review": "getmonero.org / Library is the **official Monero project documentation** — the canonical starting point for anyone learning about Monero, comprising the **Moneropedia glossary** (every Monero concept defined clearly), the **User Guides** (wallet setup, mining, running a node), the **Resources** section (community, contributors, FAQ), and the **About** pages (history, philosophy, governance). Listed at **Grade A · editor's pick** because the Monero project documentation is the reference that every other Monero-adjacent reference defers to — newcomers should walk Moneropedia + \"About\" before reading any third-party source, and seasoned users return to verify protocol behaviour as the codebase evolves.\n\n**Background.** **getmonero.org** is the official website of the **Monero Project** — the open-source cryptocurrency project that has been operating since **April 2014**, forked from the original CryptoNote reference codebase. The documentation library at getmonero.org/library/ has been maintained continuously by the Monero community. **Open source** — the website source is at github.com/monero-project/monero-site under permissive licensing; community contributors propose updates via standard Pull Request workflow. **Multi-language**: 30+ languages supported via community translators, with the English original as the canonical version. **Tor onion mirror** at monerotoruzizulg5ttgat2emf4d6fbmiea25detrmmy7erypseyteyd.onion/library/ — the canonical onion address for the Monero Project's official documentation. **No commercial entity** — the Monero Project is a decentralised contributor-community; the Monero Community Crowdfunding System (CCS) funds specific work via community-voted proposals.\n\n**What you trust.** **Monero Project as the canonical source** — the contributors who maintain the documentation are the same people who write the Monero protocol code. The protocol-level technical reference (block sizes, ring sizes, RingCT mathematics, FCMP++ research) is authoritative here. **Community-edited via PR review** — proposed documentation changes go through pull-request review by named maintainers; the edit history is transparent (git log) and contestable. **Moneropedia** — the canonical glossary of Monero-specific terminology (subaddresses, view keys, spend keys, payment IDs, ring signatures, stealth addresses, RingCT, Bulletproofs+, etc.). When you don't know what a term means, Moneropedia is the answer. **No advertising, no tracking, no analytics** — the site doesn't include third-party trackers; the Monero Project's editorial commitment is to non-commercial open documentation. **Tor onion** — canonical onion mirror at the verified address (cross-referenced in multiple Monero documentation sources). **What you don't trust**: third-party documentation that hasn't been verified — many Monero-adjacent guides exist (some great, some outdated, some misleading); when in doubt, cross-reference against getmonero.org/library/. **Some documentation pages lag protocol changes** — the Monero protocol evolves; documentation updates happen via community PR, with typical lag of weeks to a few months for major changes. For the very latest protocol details, monitor Monero Research Lab + the GitHub repos.\n\n**Operational specs.** **Domain**: getmonero.org (clearnet) + the canonical Tor onion mirror. **Sections**: **About** (what is Monero, philosophy, governance, FAQ), **Library** (Moneropedia glossary, user guides, mining guides, developer documentation), **Resources** (downloads, community links, contributors, GitHub), **Get Started** (wallet recommendations, where to buy XMR, basic operations), **Developer** (RPC API documentation, protocol specs, contribution guidelines). **Languages**: 30+ via community translators; English is the canonical baseline. **Static site**: works on Tor Browser including \"Safest\" mode (no JavaScript required for documentation reading); mobile-responsive. **Search**: site-level search built in. **GitHub repository**: monero-site for documentation source; protocol code at monero-project/monero (the C++ core daemon). **Updates**: PRs reviewed by maintainers; merged updates deploy to the live site shortly after. **No accounts, no signups, no email collection** — the site is pure documentation, not a service. **Cross-listed in essentially every Monero reference** — when other resources cite Monero documentation, they cite getmonero.org/library/.\n\n**Philosophy.** getmonero.org/library's editorial differentiator is the **canonical reference** posture. The privacy-tooling ecosystem has many high-quality Monero resources (this directory, Privacy Guides, KYCnot, web3privacy, Monerica, Sethforprivacy's blog, community wikis), but they all defer to getmonero.org for protocol-level authoritative statements. The Monero Project's commitment to **open documentation under permissive license** + **community-edited via PR** + **multi-language translation** means the canonical source is itself open and contestable — anyone can propose corrections, anyone can verify the edit history, anyone can fork the documentation if the official project's editorial decisions become objectionable. This is the same governance pattern as the protocol itself: decentralised, community-edited, contestable.\n\n**Grade rationale.** Grade A and editor's pick reflect: maintained by the **Monero Project** itself (the canonical operator); 11+ years of operational continuity (since 2014); open-source documentation source under permissive licensing; community-PR-reviewed edits; **Moneropedia** as the canonical Monero terminology glossary; 30+ language translations from community translators; static-site architecture (Tor-friendly, no JavaScript required for reading); canonical Tor onion mirror; no advertising / no tracking / no analytics; cross-listed in essentially every Monero-adjacent reference; the documentation source for protocol-level technical detail in the Monero ecosystem. Last verified 2026-05-11.\n\n**Useful when.** You're **new to Monero** — read the \"About\" pages + Moneropedia before reading anything else; gets the mental model right in ~30 minutes. You need to **look up a specific Monero term** — Moneropedia is the canonical glossary. You're **setting up a wallet or running a node** — the User Guides cover Monero GUI, monerod, the CLI wallet, hardware wallets. You're a **developer building on Monero** — the Developer section has RPC API documentation, protocol specs, contribution guidelines. You want to **verify a Monero claim** you read elsewhere — cross-reference against getmonero.org/library/; this is the authoritative source. You want a **Tor-friendly Monero reference** that works on Tor Browser's strictest mode — the static-site architecture is amongst the most-Tor-compatible documentation in the privacy-tooling space. You're **translating Monero content into another language** — the documentation source is open under permissive licensing, making it a reasonable starting point for translation work.\n\n**Caveats.** **Documentation lag** — the Monero protocol evolves (Bulletproofs+, Carrot, Seraphis, FCMP++); documentation updates happen via community PR with typical lag of weeks to months for major changes. For the very latest protocol details, monitor **Monero Research Lab** (mrl.com / IRC + Matrix rooms) and the GitHub repos. **Style is encyclopedic, not narrative** — Moneropedia is glossary-style; the User Guides are step-by-step; the About pages are reference-style. For narrative explanations of Monero's history and significance, supplement with community sources like Sethforprivacy's blog, Mastering Monero (the book), or community podcasts. **Multi-language quality varies** — the English baseline is well-maintained; some language translations lag by months or have community-translation quality variance. **No tutorial-style on-ramping** — the documentation assumes some technical aptitude; absolute newcomers may find the Moneropedia entries dense. For very-beginner content, supplement with Cake Wallet's in-app guides or Mastering Monero. **Cross-reference is your responsibility** — even though getmonero.org is canonical, individual pages can have errors (community-edited content); cross-reference important claims against the Monero Project's GitHub source code for definitive answers. **No \"what's new this month\" feed** — the documentation doesn't track recent protocol changes prominently; for changes-since-last-quarter, monitor the Monero Research Lab and the monero-project/monero GitHub releases. **The site itself can occasionally be slow** — community-maintained infrastructure with bursty traffic during Monero-related news cycles. The Tor onion mirror is sometimes faster. **Permissive license means anyone can fork** — most forks of getmonero.org documentation are well-intentioned (translation, regional adaptation), but verify the canonical version before relying on any specific fork's content. **Doesn't cover non-protocol Monero topics** — questions about specific Monero wallets (Cake, Monerujo, Feather) are covered at the project level here but specific wallets have their own documentation; for wallet-specific bug reports or feature questions, go to the wallet's own docs.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source" ], "highlight_tags": [ "FREE", "OFFICIAL", "DOCS" ], "fees": { "summary": "Free · community-maintained" }, "fees_summary": "Free · community-maintained", "last_verified": "2026-05-11", "operating_since": "2014", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.getmonero.org/library/", "tor": "http://monerotoruzizulg5ttgat2emf4d6fbmiea25detrmmy7erypseyteyd.onion/library/", "outbound_slug": "getmonero-docs" }, "also_listed_at": { "web3privacy": true } }, { "id": "kycnot-me", "category": "educational", "subcategory": "Reference", "name": "KYCnot.me", "url": "https://xmr.club/educational/kycnot-me", "twin": "https://xmr.club/llm/educational/kycnot-me.txt", "tagline": "Comparative directory of swap services. Long-running independent reference for no-KYC exchanges.", "review": "KYCnot.me (kycnot.me) is the **reference index of no-KYC services** maintained by the developer Pluja — a long-running, open-source directory that grades swap services, exchanges, and related tools on how much identity verification they demand, with last-checked timestamps and detailed feature breakdowns. We list it as a peer reference, not a competitor: the more independent no-KYC indexes exist, the better the ecosystem is served.\n\n**Background.** The project has been online since around 2020 and actively maintained by Pluja since 2021. It set much of the template that other no-KYC directories — including this one — now follow: per-service grades, structured attribute tables (does it require an account, does it log, does it have a Tor mirror, what's the KYC trigger), and a visible \"last checked\" date so readers can judge freshness. Over its life it has tracked on the order of a hundred-plus services, and its longevity through multiple market cycles is itself a credibility signal: directories are easy to start and hard to keep current, and KYCnot.me has stayed current.\n\n**What you trust.** Three things. First, the open-source backend: the methodology and, to a meaningful degree, the data are auditable rather than asserted, which is the single most important trust property a directory can have. Second, the editorial discipline — listings carry explicit, documented criteria and last-checked dates rather than vibes, so a grade is traceable to attributes you can re-verify yourself. Third, the operator's track record: Pluja is a known, pseudonymous-but-consistent maintainer with a multi-year history, not an anonymous flip-and-abandon project. The directory is also reachable over Tor (a v3 onion mirror) and maintains a public presence for corrections and disputes.\n\n**Operational specs.** Free to read, no account or email required, JavaScript-light, and available both on the clearnet and via a Tor onion address — the right posture for an audience that cares about not being profiled while researching privacy tools. Listings are organized by category (exchanges and swaps are the strongest coverage) and expose structured fields: KYC policy, logging posture, account requirements, supported assets, and an overall grade. The clearnet site, the onion mirror, and the project's social presence give multiple verification and contact paths.\n\n**Philosophy.** KYCnot.me operates on the premise that the right to transact without surrendering identity is worth indexing and defending in the open. Its open-source stance is the philosophical core: a privacy directory that asks you to trust its grades without showing its work would be self-undermining, so it shows its work. That ethos — auditable methodology, documented criteria, no pay-for-placement — is exactly what a public-good index should embody, and it is why a competing directory can in good conscience grade it an A.\n\n**Grade rationale.** A in /educational. The grade reflects sustained maintenance, an open and auditable backend, transparent and documented grading criteria with freshness timestamps, anonymous and Tor-accessible reading, and a credible long-tenured operator. The honest disclosure here is conflict of interest: this directory and KYCnot.me cover overlapping ground. We hold it to the same evidence-based bar we hold everything else, and on that bar it clears A comfortably; readers should weigh our assessment knowing we operate an adjacent index and cross-check against the source directly.\n\n**Useful when.** Use KYCnot.me as a second opinion and a canonical cross-reference, especially for the exchanges and swaps category where its coverage is deepest. When you are evaluating a service and want an independent read on its KYC posture and logging behavior — or want to see how long a service has been tracked and how its grade has held up — it is one of the most reliable places to check. Treating two independent directories as cross-checks is better practice than trusting any single index, this one included.\n\n**Caveats.** Any directory, ours and theirs alike, is a snapshot: a service's KYC policy, logging, or solvency can change between checks, so always confirm a service's current terms directly before committing funds — the last-checked date tells you how stale a listing might be. Grades encode a methodology and therefore a viewpoint; a single index can be wrong or behind, which is precisely why cross-referencing matters. And the conflict-of-interest note above is a standing caveat, not a one-time disclosure: we benefit from the same ecosystem KYCnot.me serves. None of these reduce its trustworthiness as a resource — open source, documented criteria, and long maintenance are why it stands at A.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "non_custodial", "tor_mirror" ], "highlight_tags": [ "FREE", "REFERENCE", "OPEN-SOURCE" ], "fees": { "summary": "Free · open-source · long-running" }, "fees_summary": "Free · open-source · long-running", "last_verified": "2026-06-02", "operating_since": "2020", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2020", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://kycnot.me", "outbound_slug": "kycnot-me", "tor": "http://kycnotmezdiftahfmc34pqbpicxlnx3jbf5p7jypge7gdvduu7i6qjqd.onion", "twitter": "https://x.com/kycnot" }, "also_listed_at": { "web3privacy": true } }, { "id": "mastering-monero", "category": "educational", "subcategory": "Foundational", "name": "Mastering Monero", "url": "https://xmr.club/educational/mastering-monero", "twin": "https://xmr.club/llm/educational/mastering-monero.txt", "tagline": "Free 300-page book by SerHack — the canonical reference for understanding XMR end-to-end.", "review": "Mastering Monero is the canonical 212-page introduction to Monero — written by SerHack (@serhack_), illustrated by anhdres, crowd-funded by the community, and released as a free PDF/EPUB plus a paperback option. Listed at **Grade A · editor's pick** because it remains the best single resource for moving from \"I bought XMR\" to a working understanding of stealth addresses, ring signatures, RingCT, and bulletproofs — with the caveat that the post-2019 protocol work (Seraphis, view tags, FCMP++) is not yet covered.\n\n**Background.** SerHack started the project after years of running the Monero Integrations initiative — fielding repeated requests from users and merchants for an all-inclusive resource that explained the cryptocurrency end-to-end. The book was community-crowdfunded as an open resource, with editing by UncagedPotential, publishing by Justin Ehrenhofer, design by Gustaf Garnow, and 50+ custom illustrations by anhdres. Technical contributors include ArticMine, dEBRUYNE, Isthmus, moneroexamples, the Monero Outreach Team, and others — meaning the book carries the implicit endorsement of multiple Monero Research Lab contributors rather than just one author's framing.\n\n**What's covered.** Chapters 1–2 are a non-technical introduction — covering wallets, transactions, day-to-day usage, and the privacy gap between transparent chains (Bitcoin, Ethereum) and Monero. Chapters 3–4 explain stealth addresses, ring signatures, RingCT, and bulletproofs **without requiring math** — a rare achievement for a privacy-cryptocurrency text. Later chapters dig into the decentralised network architecture, peer-to-peer protocol, transaction lifecycle, integration patterns, and code-level details for developers wanting to build on Monero. The illustrations replace formulas in most places, which makes the text genuinely usable for non-technical readers.\n\n**What's not covered (the dated bits).** The book was published ~2018–2019 and predates several major protocol changes: Triptych, view tags, the Seraphis transaction-protocol redesign (post-2024 active development), Carrot/FCMP++ (the in-progress next-generation privacy stack), and the Bulletproofs+ upgrade. The core privacy concepts (why ring signatures, why RingCT, why stealth addresses) remain accurate, but if you want the current state of the protocol you'll need to pair the book with monerodocs (https://monerodocs.org), Monero Research Lab papers, and recent GetMonero blog posts. The community signal (May 2026) is that a revision is in progress, though no publication date has been announced.\n\n**Format & access.** Free PDF + EPUB download direct from masteringmonero.com — no email, no signup, anonymous. Paperback $19.99 on Amazon US/UK/DE/FR/ES/IT/JP and other regional stores. A Chinese translation has been mentioned by the community; other languages are unconfirmed. The book is licensed for redistribution per the open-resource framing, and the source materials live in public repos under the Mastering Monero / SerHack umbrella.\n\n**Grade rationale.** Grade A and editor's pick reflect: free + anonymous access (no KYC, no email, no signup); community-validated content (multiple MRL contributors); non-mathematical privacy-tech explanation (uniquely accessible); paperback option for users who learn better off-screen; consistent positioning in community recommendations over 7+ years; and absence of any reputational incidents. Caveat-adjusted because the post-2019 protocol gap is real but doesn't break the foundational learning path.\n\n**Useful when.** You just bought your first XMR and want to understand what you actually own. You're a developer or merchant evaluating Monero integration and want a single 200-page text rather than a scattered set of blog posts. You're explaining \"why Monero, not Bitcoin\" to a non-technical friend or family member. You want to internalise stealth addresses + ring signatures + RingCT without having to read elliptic-curve math.\n\n**Caveats.** Currency: the post-2019 protocol changes (Seraphis, view tags, Carrot, FCMP++) are not covered — for current protocol depth pair with monerodocs.org and Monero Research Lab. Wallet UI screenshots are dated — modern Cake Wallet / Monerujo / Feather flows look different from the book's. Translation coverage is light — primarily English, with one Chinese version mentioned in community discussion. The book's \"buy on Amazon\" pathway involves Amazon's own account requirements; if you want a fully untraceable reading copy, use the free PDF + EPUB direct from masteringmonero.com.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source" ], "highlight_tags": [ "FREE", "BOOK" ], "fees": { "summary": "Free PDF · paperback ~$30 on Amazon" }, "fees_summary": "Free PDF · paperback ~$30 on Amazon", "last_verified": "2026-05-11", "operating_since": "2018", "tenure_note": "Mastering Monero (the book by SerHack) published December 2018. Earlier dates reflect domain registration / writing process, not public availability.", "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://masteringmonero.com", "outbound_slug": "mastering-monero", "twitter": "https://x.com/anhdres" } }, { "id": "monero-academy", "category": "educational", "subcategory": "Curriculum", "name": "Monero Academy", "url": "https://xmr.club/educational/monero-academy", "twin": "https://xmr.club/llm/educational/monero-academy.txt", "tagline": "Free Monero education from the Monerica project — beginner / intermediate / advanced course tracks, quizzes, threat-modeling and metadata-leak lessons. Sponsored by the same operators Monerica lists; no signup required to read.", "review": "**What it is.** A free Monero education site published by the **Monerica Project** (the same operators behind the long-running monerica.com directory). The curriculum is split into three tiers — beginner, intermediate, advanced — with multi-lesson tracks covering money basics, what cryptocurrency is, how blockchains work, your first Monero wallet, security and self-custody, how to get XMR (exchanges vs no-KYC swaps vs P2P vs mining), how to swap Monero privately, threat modelling, network privacy with Tor and I2P, and avoiding metadata leaks. Each course track is bookended by quizzes you can take without an account. Optional login exists if you want to track progress; reading any lesson works fully logged-out.\n\n**Why Grade B.** Listed at B on the strength of operator identity — the Monerica Project is a known good actor in the Monero ecosystem and one of the peer directories xmr.club itself cross-reads against. The curriculum structure (beginner → intermediate → advanced with explicit threat-modelling and metadata-leak coverage at the advanced tier) is the same shape we'd recommend if asked to design one from scratch. Grade A is withheld only because the site launched **2026-06-30** — there is no operational history yet, no community discussion of the lessons' factual accuracy, and the platform features (quizzes, progress tracking) have not been observed running over time.\n\n**Trust failure modes.** This is read-only education. The site holds no funds, processes no payments, and the only account-state it can hold is *which-lessons-have-you-finished*. The real failure modes reduce to (a) the site being down (low cost), (b) a lesson rendering misleading or out-of-date information (UX-quality concern, not a custodial-risk concern), and (c) the optional account leaking the email you sign up with (mitigated by not creating an account, which is the default flow).\n\n**Sponsorship — how to read it.** The homepage shows a *Featured Sponsors via Monerica* panel — the same sponsor pool that funds the parent directory also funds Monero Academy. That is the editorial-funding model disclosed up front, which is the honest way to do it: readers see which projects pay to be visible inside the educational frame rather than discovering an undisclosed pay-for-placement later. Reader judgement still applies — a featured-sponsor mention is editorial-supported, not an independent endorsement.\n\n**Operational specs.**\n\n- **Live site:** `https://moneroacademy.com`. SPA shell; lessons load without JavaScript for the most part.\n- **Course tracks identified:** Crypto & Money Basics (beginner) · Your First Monero Wallet · Security & Self-Custody · Getting Monero (intermediate) · Swapping Monero · Privacy Best Practices (advanced, with threat modelling / network privacy / metadata leaks lessons).\n- **Operator:** Monerica Project (`@MonericaProject` on X). The launch announcement (2026-06-30) explicitly frames the site as free and supported by the existing Monerica sponsor pool.\n- **Account:** Optional. Default read flow needs no signup.\n- **Pricing:** Free.\n- **Tor mirror:** Not advertised at launch — readers using Tor reach the site via the clearnet host.\n\n**Path to A.** Six months of operation without significant factual regressions or quiz-content errors, an independent peer-dir mention (kycnot.me's tools section, a Reddit / monero.town discussion thread, or a curator review elsewhere), and the lesson tracks staying current as FCMP++, Carrot, Seraphis, and Jamtis ship on Monero mainnet (the advanced tier needs to track those primitives accurately, not just describe RingCT + stealth addresses).", "translation_locale": "en", "rating": { "grade": "B" }, "grade": "B", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "EDUCATION", "FREE", "NO-ACCOUNT", "MONERICA-PROJECT", "QUIZZES", "NEW" ], "fees": null, "fees_summary": null, "last_verified": "2026-06-30", "operating_since": "2026-06-30", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://moneroacademy.com", "twitter": "https://x.com/MonericaProject", "tor": "http://isascvkqpmnt3ecrj6gccvyusledygjwuddfxrgp3xrxd4a4bb3n3eqd.onion" }, "also_listed_at": { "monerica": true } }, { "id": "monero-outreach", "category": "educational", "subcategory": "Reference", "name": "Monero Outreach", "url": "https://xmr.club/educational/monero-outreach", "twin": "https://xmr.club/llm/educational/monero-outreach.txt", "tagline": "Workgroup behind the most-shared 'Why Monero?' / 'Sound Money' explainers. Translation-first.", "review": "Monero Outreach (monerooutreach.org) is the ecosystem's **lay-audience explainer workgroup** — a community effort, funded through Monero's Community Crowdfunding System (CCS), that turns the project's dense cryptography and contested politics into materials a newcomer, a journalist, or a merchant can actually read.\n\n**Background.** The group has operated since around 2018 as a workgroup rather than a company: no token, no product to sell, no equity. Its mandate is education and public communication, and its output is the kind of connective tissue a decentralized project usually lacks — comparison charts, regulatory FAQs, presentation decks, the \"Monero Matters\" article series, and onboarding material aimed at people who will never read a research paper. Because it is CCS-funded, its budgets and deliverables are proposed and accounted for in public, which is itself part of why it earns an A in /educational: you can see what was funded and what shipped.\n\n**What you trust.** Two things. First, the funding model: CCS proposals are public, milestones are visible, and the community votes with its donations — there is no hidden sponsor steering the message. Second, the editorial quality. Monero Outreach material is consistently accurate and unusually well-designed for a volunteer effort; it avoids the two failure modes that plague crypto education, namely price hype and hand-wavy \"it's just private money\" oversimplification. The explainers are honest about trade-offs — they will tell you what Monero does *not* protect against, which is the mark of trustworthy educational material.\n\n**Operational specs.** Everything is free, web-hosted, and requires no account, no email, and no wallet to read. The standout operational feature is translation breadth: core materials are maintained in 20-plus languages, which makes Outreach the natural first stop when onboarding non-English speakers — a meaningful gap-filler given that most deep Monero documentation is English-only. Materials are downloadable (decks, PDFs, graphics) and explicitly meant to be reused at meetups, in articles, and in merchant-facing explainers. The visual assets — flowcharts, \"how a transaction works\" diagrams, comparison tables versus transparent chains — are reused across the ecosystem precisely because they are clear and freely licensed.\n\n**Philosophy.** Outreach exists on the premise that privacy technology fails if only cryptographers understand it. A protocol can be flawless and still lose if regulators, merchants, and ordinary users can't articulate why fungibility matters or why \"nothing to hide\" misframes the issue. The workgroup's job is to make the argument legible — to translate ring signatures and stealth addresses into \"here is what is and isn't visible, and here is why that's the point.\" That mission-first, no-commercial-angle stance is exactly what a public good should look like.\n\n**Grade rationale.** A in /educational. The grade rests on transparent CCS funding, sustained accuracy, exceptional multilingual reach, and zero access friction. It is positioned as a reference and onboarding resource rather than a primary technical source — for the mathematics you go to Zero to Monero, for the protocol you go to the Monero Research Lab — but for the layer between \"I heard about Monero\" and \"I understand why it's built this way,\" Outreach is the best-organized material in the ecosystem.\n\n**Useful when.** Use Monero Outreach when you need to explain Monero to someone else: a merchant deciding whether to accept it, a non-technical friend, a journalist, a non-English-speaking newcomer, or a room at a meetup. Its charts and FAQs are the ready-made answers to \"but isn't this just for criminals\" and \"how is this different from Bitcoin.\" It is also the right place to grab reusable diagrams and decks instead of building your own.\n\n**Caveats.** Volunteer-and-grant funding means cadence is uneven — some pages and series go quiet for long stretches, and a given article may predate a recent protocol change, so check dates before citing specifics. Regulatory FAQs in particular age quickly as law shifts jurisdiction by jurisdiction; treat them as orientation, not legal advice. And because the mission is advocacy-adjacent education, the framing is sympathetic to Monero by design — accurate, but not a neutral third-party audit. These are caveats of scope and freshness, not trust, which is why anonymous access, public funding, and consistent accuracy hold it at A.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "non_custodial" ], "highlight_tags": [ "FREE", "MULTI-LANG", "EXPLAINERS" ], "fees": { "summary": "Free · CC-licensed · multi-language" }, "fees_summary": "Free · CC-licensed · multi-language", "last_verified": "2026-06-02", "operating_since": "2018", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.monerooutreach.org", "outbound_slug": "monero-outreach" } }, { "id": "monero-research-lab", "category": "educational", "subcategory": "Communities", "name": "Monero Research Lab", "url": "https://xmr.club/educational/monero-research-lab", "twin": "https://xmr.club/llm/educational/monero-research-lab.txt", "tagline": "Academic + community research papers on XMR cryptography. Heavyweight reading.", "review": "Monero Research Lab (MRL) is the **academic-and-community research arm of the Monero Project** — the working group where the cryptography behind Monero's protocol evolution is debated, prototyped, and published. Listed at **Grade A** because MRL is where the **canonical technical reference papers** for Monero's protocol history live: the original **RingCT** specifications, the **Bulletproofs / Bulletproofs+** range-proof systems, **CryptoNote** foundations, **Seraphis** (the next-generation transaction protocol), **FCMP++** (Full-Chain Membership Proofs, the curve-tree zero-knowledge replacement for ring signatures), **Carrot** (the addressing scheme that pairs with FCMP++). If you want to understand how Monero **actually works** at the cryptographic level — not the marketing summary, the mathematical detail — MRL is the canonical source.\n\n**Background.** Monero Research Lab was established in **2014** as the formal research-coordination layer within the broader Monero Project, with the goal of bringing **academic-grade cryptographic review** to the protocol's evolution. Researchers include both **Monero contributors** with academic backgrounds and **external academics** who have published papers on Monero's protocols (sometimes critical, sometimes constructive). The output is **MRL Bulletins** (numbered research notes), **research papers** (peer-reviewed publications), and ongoing discussion across the **#monero-research-lab Matrix room** + IRC bridge + the dedicated **github.com/monero-project/research-lab** repository. Funding for specific research work comes through the **Monero Community Crowdfunding System (CCS)** — proposals are submitted to CCS, voted on by the community, and funded from community donations. The model is consciously academic: research must be **peer-reviewable**, results must be **publishable**, and protocol decisions must be **defended in writing** before they ship.\n\n**What you trust.** **Peer-reviewed cryptographic process** — major protocol changes (RingCT, Bulletproofs, Seraphis, FCMP++) have been published as research papers, reviewed by academic cryptographers, and refined through public iteration. **Open archive** — all MRL papers, bulletins, and research-lab discussions are openly archived on the Monero Project's infrastructure. **Named researchers** — contributors include named academics with public research profiles (e.g., **Sarang Noether**, **Brandon Goodell**, **Justin Berman**, **koe**, **isthmus**, plus external academic collaborators). **Cross-validated with third-party cryptographers** — Monero's research collaborates with the broader academic cryptography community (presentations at conferences like Real World Crypto, Workshop on Privacy-Preserving Information Networks). **What you don't trust**: research-stage work is **not** production code — papers describing FCMP++ or Seraphis are preliminary; production deployment may differ. Always cross-reference research papers with the actual Monero source code for what's currently deployed vs what's research. **External-academic criticism** — periodically external cryptographers publish work critical of Monero's protocols (e.g., the OASIS LABS / \"MyMonero traceability\" 2017 paper). MRL takes such criticism seriously and responds in writing; the iteration is part of the process, not a sign that the protocol is broken.\n\n**Operational specs.** **Main hub**: getmonero.org/resources/research-lab/ — index of papers, bulletins, and discussion forums. **GitHub**: github.com/monero-project/research-lab — paper drafts, supplementary materials, computational scripts. **Matrix room**: #monero-research-lab:matrix.org — real-time discussion of ongoing research. **IRC bridge**: #monero-research-lab on Libera Chat. **Paper format**: research papers in standard cryptographic-paper LaTeX format, hosted on the GitHub repo + sometimes mirrored on academic archives (eprint.iacr.org, arXiv). **MRL Bulletins**: numbered short notes for specific technical points (MRL-0001 through MRL-0XXX); these are less formal than papers but still peer-reviewed before publication. **Areas of active research**: **Seraphis** (next-generation transaction protocol), **FCMP++** (Full-Chain Membership Proofs replacing ring signatures), **Carrot** (addressing scheme paired with FCMP++), **Jamtis** (alternative addressing under discussion), **Bulletproofs++** (next-generation range proofs), **Tx-extra metadata reduction**, **Migration paths** (how to deploy major protocol changes safely). **Funding**: via CCS for specific proposals; researchers also paid via grants and academic positions.\n\n**Philosophy.** Monero Research Lab's editorial differentiator is the **peer-reviewable academic process** applied to a production cryptocurrency. Most cryptocurrency protocols are designed by their developers and shipped; Monero's major protocol changes are **published as papers, reviewed, iterated, and only then deployed**. This is slower than the \"move fast and break things\" approach common in crypto-currency projects, but it's the right approach when the protocol guarantees privacy: a cryptographic bug in Monero's protocol is unrecoverable retroactively (you can't re-encrypt past transactions), so the cost of getting it wrong is too high to skip rigorous review. The trade-off: protocol changes are slow (Seraphis has been in development for years; FCMP++ is still being formalised); the academic rigour is the **insurance** that paying for slowness is worth it.\n\n**Grade rationale.** Grade A reflects: **canonical source** for Monero protocol research; 11+ years of operational continuity (since 2014); open-access publication model (all papers and bulletins publicly available); peer-reviewable academic process; named researchers with public research profiles; collaboration with external academic cryptographers; community-funded via CCS; active research on next-generation protocols (Seraphis, FCMP++, Carrot, Bulletproofs++); cross-referenced from every Monero-adjacent technical resource; the authoritative reference for \"what does Monero actually do mathematically?\". Last verified 2026-05-11.\n\n**Useful when.** You're a **cryptographer or security researcher** evaluating Monero's privacy claims at the mathematical level — MRL is where the primary sources live. You want to **understand how Monero's privacy actually works** (ring signatures, RingCT, Bulletproofs, stealth addresses) at the protocol level rather than the marketing summary. You're **building privacy-currency systems** and want to learn from Monero's protocol-design decisions. You're **following Monero's protocol evolution** — the active research on Seraphis, FCMP++, Carrot represents where Monero is going. You're a **journalist or academic** writing about Monero — citing MRL papers gets you the canonical sources rather than third-party rephrasing. You're a **developer contributor** to Monero — MRL discussions are where protocol-impact decisions are made before they hit the C++ codebase. You're **studying applied cryptography** more broadly — Monero's protocol-design decisions are well-documented case studies in zero-knowledge proofs, ring signatures, and stealth addressing applied at production scale.\n\n**Caveats.** **Heavyweight reading** — MRL papers are academic-cryptography-grade; expect to need prior cryptography background (zero-knowledge proofs, ring signatures, elliptic curve cryptography) to read them fluently. For non-cryptographer Monero users, the **getmonero.org documentation** (Moneropedia + User Guides) is the right entry point; MRL is for users who need the deeper detail. **Research is not production** — papers describing FCMP++ or Seraphis are **preliminary**; production deployment may differ. Always cross-reference research papers with the **actual Monero source code** for what's currently deployed vs what's still research. **Slow pace of protocol changes** — Seraphis has been in development for years; major protocol transitions take time. For users who want fast-iteration ecosystems, Monero's deliberate pace is a structural feature, not a bug. **External criticism is constructive but ongoing** — periodically external cryptographers publish work critical of Monero's protocols; MRL responds in writing. Don't conflate \"researcher published critique\" with \"protocol is broken\" — read the back-and-forth before forming conclusions. **Translations are limited** — research papers are typically English-only; for non-English readers, the Moneropedia translations are more accessible. **MRL is not user support** — questions about wallets, transactions, or specific products belong in the general #monero Matrix room or the wallet's own docs; MRL is for **protocol-level research discussion**. **The Matrix room is high-bandwidth, low-noise** — research discussions tend to be technical and specific; new readers should observe before contributing unless they have specific cryptographic expertise to add.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source" ], "highlight_tags": [ "FREE", "TECHNICAL", "PAPERS" ], "fees": { "summary": "Free · academic archive" }, "fees_summary": "Free · academic archive", "last_verified": "2026-05-11", "operating_since": "2014", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.getmonero.org/resources/research-lab/", "outbound_slug": "monero-research-lab", "matrix": "https://matrix.to/#/monero-research-lab:monero.social" }, "also_listed_at": { "web3privacy": true } }, { "id": "monero-stackexchange", "category": "educational", "subcategory": "Q&A", "name": "Monero StackExchange", "url": "https://xmr.club/educational/monero-stackexchange", "twin": "https://xmr.club/llm/educational/monero-stackexchange.txt", "tagline": "Q&A site for Monero — protocol, wallets, mining, dev. Best place to ask before bothering #monero-dev.", "review": "Monero StackExchange (monero.stackexchange.com) is the **canonical Q&A archive** for the Monero ecosystem — a member of the Stack Exchange network running on the same engine as Stack Overflow, with the same reputation, voting, and tagging mechanics applied to one subject: how Monero actually works in practice.\n\n**Background.** The site launched in 2016 as Monero's dedicated Stack Exchange instance and has accumulated close to a decade of questions and answers spanning the full surface of the protocol and its tooling. It is not a forum, not a chat room, and not a news feed — it is a structured, search-first knowledge base where each question stands on its own, the best answers float to the top by community vote, and stale or wrong answers can be edited or out-voted over time. That structure is exactly why it earns an A in /educational: the format is built to surface the correct answer rather than the loudest one.\n\n**What you trust.** The signal here is who answers. Core contributors and long-time researchers — names like luigi1111, moneromooo-monero, and jeffro256 — cross-post authoritative answers, and answers from protocol-level participants tend to accumulate the votes and acceptance marks that make them findable. When you read an accepted, high-score answer about how view keys scan for incoming outputs or why a transaction shows a particular ring size, you are usually reading primary-source explanation from people who wrote or reviewed the relevant code. Reputation is public, edit history is public, and every claim is timestamped — you can see whether an answer predates a hard fork that changed the behavior.\n\n**Operational specs.** Reading is fully anonymous — no account, no email, no JavaScript-gated paywall. You only need an account to ask, answer, vote, or comment, and even then the requirement is an email address, not a real name; pseudonymous participation is the norm. The content is licensed under Creative Commons (CC BY-SA), so answers can be quoted and mirrored with attribution. Coverage is broad: stealth addresses, subaddresses, multisig setup, view-key sharing, daemon and wallet RPC, mining and pool mechanics, seed and wallet recovery, fee and weight questions, and the long tail of \"why did my wallet do X\" troubleshooting that no formal document ever captures.\n\n**Philosophy.** Stack Exchange's model assumes that a question worth asking once is worth answering permanently. That fits Monero's reality: the protocol evolves through hard forks, and the difference between a 2017 answer and a 2024 answer can be the difference between correct and dangerously wrong. The voting-plus-editing loop is the mechanism that keeps the archive honest — old answers get edited with \"as of the CLSAG fork…\" notes, superseded answers get out-voted, and duplicates get merged. It is the closest thing the ecosystem has to a self-correcting reference manual.\n\n**Grade rationale.** A in /educational. The grade reflects three things: durable, search-indexed answers (Google and the on-site search both surface the right page fast); primary-source contributors whose identities and track records are visible; and an open CC license with anonymous read access and zero distribution friction. The only reason it is not positioned as a single-source-of-truth document is that, like all Q&A sites, quality is uneven question-to-question — a low-traffic question may sit with one mediocre answer for years.\n\n**Useful when.** Reach for Monero StackExchange when you have a specific, answerable question — \"how do I restore from a 25-word seed in the CLI wallet,\" \"what does this daemon RPC field mean,\" \"is it safe to reuse a subaddress\" — and you want a vetted answer rather than a forum thread. It pairs naturally with the long-form references (Zero to Monero for the cryptography, Mastering Monero for the walkthrough): read those to understand the system, search StackExchange when you hit a concrete wall.\n\n**Caveats.** Always check the date and the protocol era of an answer before acting on it — a confidently-worded reply from 2017 may describe pre-RingCT or pre-CLSAG behavior that no longer holds. Low-vote answers carry no community endorsement; treat them as leads, not conclusions. And as with any Stack Exchange site, niche questions can go unanswered, and the moderation culture rewards precisely-scoped questions over open-ended ones. None of this is a security risk — it is the ordinary caution of reading a community archive — which is why anonymous reading, public edit history, and visible reputation keep it firmly in A territory.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "open_source" ], "highlight_tags": [ "FREE", "Q&A", "ARCHIVE" ], "fees": { "summary": "Free · reading anonymous · email signup to post" }, "fees_summary": "Free · reading anonymous · email signup to post", "last_verified": "2026-06-02", "operating_since": "2016", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2016", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://monero.stackexchange.com", "outbound_slug": "monero-stackexchange" } }, { "id": "monerokon", "category": "educational", "subcategory": "Audio / Video", "name": "MoneroKon", "url": "https://xmr.club/educational/monerokon", "twin": "https://xmr.club/llm/educational/monerokon.txt", "tagline": "Annual conference. Archive of every talk from 2019 onward — protocol, OPSEC, policy.", "review": "MoneroKon is the **annual Monero community conference + comprehensive video archive of every talk from 2019 onward** — the central live-event surface where Monero developers, researchers, community members, and external academic cryptographers gather in person, plus the recorded archive (free, hosted on monerokon.org + community video infrastructure) that makes the talks available to everyone who couldn't attend. Listed at **Grade A** because MoneroKon is the **canonical community conference** for Monero — talks here are where major protocol roadmap announcements happen, where Monero Research Lab researchers present findings to the wider community, and where the project's social and political dimensions get serious attention alongside the technical detail.\n\n**Background.** MoneroKon was first held in **Denver, Colorado** in **June 2019**, organised by Monero community members with support from the broader Monero Project. Since then, the conference has rotated locations: Lisbon, Portugal (2022), Prague, Czech Republic (2024), and other cities as suitable venues are identified. **Format**: 2-3 days, multiple talk tracks (Protocol & Research / Community & OPSEC / Policy & Advocacy / Workshops), with networking time between sessions. **Funding**: ticket sales for in-person attendance, sponsorships from privacy-aligned organisations (typically Monero-ecosystem entities, not surveillance-adjacent crypto exchanges), and donations. **Recording archive**: every talk is recorded and published free on monerokon.org + cross-posted to community video platforms (PeerTube instances, Internet Archive); this is the canonical Monero conference archive going back to 2019. **Organising team**: rotating community organisers; the team behind a given year's MoneroKon is publicly named on the conference website. **No commercial entity** — MoneroKon is a community-run conference, not a corporate event.\n\n**What you trust.** **Community-organised** — the conference is run by Monero community members, not a corporate entity with monetisation pressure. **Recorded archive is free and open** — every talk is published online; you don't need to attend in person to access the content. **Speaker selection is community-curated** — talks are reviewed by an organising committee; the bar is \"is this talk valuable to the Monero community?\" not \"did the speaker pay enough sponsorship?\" **Annual cadence with rotating location** — different cities each year reduces single-jurisdiction risk and lets different parts of the Monero community host. **Cross-validated with the broader research community** — speakers include both Monero contributors and external academic cryptographers who have worked on Monero protocols. **What you don't trust**: individual talk content is the speaker's responsibility — MoneroKon as an organisation provides the venue but doesn't endorse every individual position presented. Treat talks as the speaker's view, not \"Monero Project consensus.\" **Conference location matters for in-person attendance** — choosing a venue means choosing a jurisdiction (visa requirements, surveillance posture, conference-recording legality). Recorded archive removes this dependency for video viewers.\n\n**Operational specs.** **Main hub**: monerokon.org — current year's conference info + full archive of past talks. **Archive format**: video (typically MP4/WebM), often with slides published separately as PDFs, sometimes with talk-paper references for protocol-research presentations. **Talk tracks** (typical): **Protocol & Research** (Monero Research Lab work, FCMP++, Seraphis, cryptography updates), **Community & OPSEC** (privacy practitioner education, threat-model discussions, wallet security), **Policy & Advocacy** (regulatory developments, Monero's stance on legal-compliance questions, privacy-rights advocacy), **Workshops** (hands-on sessions on specific tools or skills). **Languages**: talks are primarily English; subtitles in some languages are community-contributed for select talks. **Live-stream during conference**: in recent years, MoneroKon has live-streamed talks during the event for community members who can't attend in person. **Cross-archived**: talks are typically cross-posted to Internet Archive, PeerTube instances, and sometimes YouTube (community uploads); the canonical home is monerokon.org. **No accounts, no signup** — the archive is publicly accessible.\n\n**Philosophy.** MoneroKon's editorial differentiator is the **community-run-conference with free-archive** model. Most cryptocurrency conferences are corporate-sponsored, exchange-aligned, or speculation-focused; MoneroKon is privacy-aligned, community-funded, and explicitly oriented toward Monero's privacy mission. The free recording archive is the editorial signal that distinguishes it from paywalled-conference models: every talk is published online, the community at large gets the educational value, and the conference's mission is to advance the privacy ecosystem rather than to monetise attention. The trade-off vs corporate crypto conferences: smaller in scale, fewer luxe production values, lower marketing-budget gloss. For Monero community members, this is a feature, not a bug — MoneroKon is by-the-community-for-the-community.\n\n**Grade rationale.** Grade A reflects: 6+ years of operational continuity (since 2019); annual cadence with rotating locations; comprehensive free video archive of every talk from 2019 onward; community-run organisation (not corporate); cross-track coverage (Protocol & Research, Community & OPSEC, Policy & Advocacy, Workshops); speakers include Monero Project contributors + external academic cryptographers; live-stream during conferences for remote attendees; cross-archived on Internet Archive + PeerTube for resilience; cross-listed in web3privacy and Monerica peer directories; the canonical Monero conference reference. Last verified 2026-05-11.\n\n**Useful when.** You're a **Monero developer, researcher, or contributor** — MoneroKon is the canonical in-person community surface; attending in person creates relationships that matter for ongoing collaboration. You want to **understand current Monero protocol developments** — MRL researchers present at MoneroKon; their talks are often the clearest explanation of complex protocol work. You're a **privacy practitioner or activist** looking for OPSEC content — the Community & OPSEC track regularly features high-quality content from working practitioners. You're a **policy advocate** or **journalist** covering Monero — MoneroKon's Policy track presents the cryptocurrency-regulation landscape from Monero's perspective. You want to **browse the archive** for specific topics — the 2019-onward archive covers most major Monero developments. You're a **researcher** studying privacy-currency design — MoneroKon talks are useful primary sources alongside MRL papers. You're **considering attending in person** — registration is open during the months leading up to the event; tickets sell out as the date approaches.\n\n**Caveats.** **In-person attendance has costs** — travel, lodging, conference ticket. For most users, the free recorded archive is the practical access path; in-person attendance is for those who want networking + the conference experience. **Recording quality varies** — early years (2019, 2020) have lower production values than recent years; audio and video quality has improved over time. For older talks, expect some audio-quality compromises. **Talk selection is community-curated, not academically peer-reviewed** — MoneroKon talks are valuable but they're not peer-reviewed academic publications. For canonical protocol-research statements, cross-reference with MRL bulletins / papers. **Live-stream availability varies by year** — some conferences have live-streamed talks, others have only recorded archives. Check the current year's conference page for live-stream details. **Travel-jurisdiction matters** — different host cities have different visa requirements, conference-recording laws, and surveillance postures. If you're attending in person from a region with travel restrictions, plan accordingly. **No formal proceedings** — unlike academic conferences, MoneroKon doesn't publish formal proceedings; the recorded talks + slides are the canonical record. **Conference website redirects vary** — recent MoneroKon archives are on monerokon.org; some older content may live on archived versions or community-maintained mirrors. **Doesn't replace MRL or getmonero-docs for primary research** — MoneroKon is the **community presentation** layer; for primary research, go to MRL papers and getmonero.org/library. For protocol-level technical detail, the source code at github.com/monero-project/monero is the ultimate authority.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [], "highlight_tags": [ "FREE", "VIDEO", "CONFERENCE" ], "fees": { "summary": "Free · archive only, conference ticket separate" }, "fees_summary": "Free · archive only, conference ticket separate", "last_verified": "2026-05-11", "operating_since": "2023", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://monerokon.org", "outbound_slug": "monerokon", "twitter": "https://x.com/monerokon", "matrix": "https://matrix.to/#/monerokon:matrix.org" }, "also_listed_at": { "web3privacy": true, "monerica": true, "kycnot": true } }, { "id": "monerologs", "category": "educational", "subcategory": "Reference", "name": "MoneroLogs", "url": "https://xmr.club/educational/monerologs", "twin": "https://xmr.club/llm/educational/monerologs.txt", "tagline": "Web-rendered logs of the Monero dev IRC + Matrix rooms. Read what core devs are actually discussing.", "review": "MoneroLogs (monerologs.net) is the **public archive of Monero's working meetings** — a searchable, timestamped capture of the conversations in #monero-research-lab and the adjacent development and community rooms, mirrored out of the chat layer so anyone can follow protocol-level discussion without sitting in IRC or Matrix in real time.\n\n**Background.** Maintained by the community member ofrnxmr and running since roughly 2019, the site logs every message from the rooms where Monero is actually built and argued about: the research lab, dev meetings, and the community workgroup channels. Monero does most of its real coordination in the open, in chat, at scheduled meetings whose minutes used to be hard to reconstruct after the fact. MoneroLogs is the durable record of that — the raw transcript, not a summary — which is why it earns an A in /educational despite being aimed squarely at technical readers.\n\n**What you trust.** The value proposition is fidelity, not curation. These are the verbatim messages, with handles and timestamps intact, bridged from Matrix/IRC. You trust it the way you trust a court reporter's transcript: it is not editorialized, so what you read is what was said. The rooms it captures are the ones where named contributors hash out ring-size changes, fee algorithm tweaks, fork scheduling, and research proposals. For anyone trying to understand *why* a protocol decision was made, the primary record beats any second-hand explainer — and MoneroLogs is that record, kept by someone embedded in the community rather than a third party scraping from outside.\n\n**Operational specs.** Reading is fully open: no account, no email, web-accessible, and searchable across the archive so you can pull a specific meeting date or grep for when a topic first surfaced. It links through to the live rooms (the no-wallet-left-behind community space on Matrix among them) for readers who want to join the conversation rather than just read it. Because it mirrors chat rather than hosting it, the archive's reliability tracks the upstream rooms — it is a window onto them, not a separate publication. Coverage skews technical: research lab discussion, dev-meeting logs, and the operational back-and-forth that never makes it into release notes.\n\n**Philosophy.** Open development only delivers its accountability benefit if the record is actually accessible. A meeting held \"in public\" but lost to chat-history limits a week later is barely more transparent than a closed one. MoneroLogs operationalizes Monero's open-coordination ethos by making the meetings permanently re-readable — turning ephemeral chat into a citable archive. That is a small piece of infrastructure with outsized governance value: it lets contributors, researchers, and skeptics alike check what was actually agreed versus what got summarized later.\n\n**Grade rationale.** A in /educational. The grade reflects unique, hard-to-replicate coverage (no other source archives these rooms as completely), primary-source fidelity, open and anonymous access, and search. It is explicitly *not* curated — there is no editor selecting the important bits — so it sits one notch in usability below the digest-style resources, but for the audience it serves (people who want the raw discussion) that lack of curation is a feature, not a flaw.\n\n**Useful when.** Reach for MoneroLogs when you want to follow protocol-level debate in near-real-time, reconstruct the reasoning behind a recent change, or verify what was actually said in a research-lab or dev meeting rather than relying on a summary. It is the source of record for \"when did the community first discuss X\" and \"what was the objection to Y.\" Pair it with Revuo Monero or the meeting minutes when you want curation; come here when you want the unfiltered transcript.\n\n**Caveats.** This is firehose material — uncurated, high-volume, and assuming familiarity with the people and topics in the rooms. A newcomer will drown; it rewards readers who already know the cast and the technical vocabulary. Because it bridges live chat, its completeness depends on the upstream bridge staying healthy, and individual messages carry the informality (and occasional error) of chat rather than the rigor of a published document — a thing said in a meeting may be walked back an hour later. Read it as a transcript to be interpreted, not as settled documentation. None of that is a trust or safety concern, which is why open access, primary-source fidelity, and unique coverage keep it at A.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source" ], "highlight_tags": [ "FREE", "DEV", "REFERENCE" ], "fees": { "summary": "Free · web · searchable · public log" }, "fees_summary": "Free · web · searchable · public log", "last_verified": "2026-06-02", "operating_since": "2019", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://monerologs.net", "outbound_slug": "monerologs", "matrix": "https://matrix.to/#/no-wallet-left-behind:monero.social" } }, { "id": "opsecosint", "category": "educational", "subcategory": "OPSEC Reference", "name": "opsecosint.info", "url": "https://xmr.club/educational/opsecosint", "twin": "https://xmr.club/llm/educational/opsecosint.txt", "tagline": "10-chapter OpSec + OSINT reference for crypto users. Threat models, wallets, blockchain analysis, phishing, SIM-swap, doxxing — plus interactive quizzes. Solo author, brand-new, hosted on Lovable.", "review": "**What it is.** A structured 10-chapter reference guide for the OpSec and OSINT concerns that hit crypto users specifically — wallets, threat modelling, blockchain analysis, phishing, wallet-drain mechanics, SIM-swap, doxxing, physical threats. Ten chapters split evenly between OpSec (five) and OSINT (five), plus an interactive quiz surface. Cross-crypto by scope; not Monero-exclusive, but the threat-model set is the one a privacy-minded Monero user needs to internalise anyway.\n\n**Author.** Published by `@CR1337` on X (verified handle) on 2026-07-08. CR1337 is not new to the Monero ecosystem — also runs Monero.Jobs (privacy-first freelance marketplace paid in XMR), wtfisxmr.lol (beginner explainer), and the original XMR 1337 Guide, plus paid partnership content on X. See the maintainer profile at `/who/cr1337` for the full portfolio. The grade below reflects opsecosint.info the site, not the author's broader track record.\n\n**What you trust.** The guide's editorial choices are clean: honest threat-model framing (*\"threat model first\"*), a *\"verify, then trust\"* chapter, an explicit *\"plan for failure\"* chapter, and an \"OpSec habits and maintenance\" chapter that pushes the guide past one-off reading into a habit-formation shape. The quizzes double as a comprehension-check surface. What you don't get: a professional peer-review process visible on the site, versioned change history, or a public roadmap.\n\n**Grade B (not A).** The two other reference guides on xmr.club at this subcategory (Privacy Guides, EFF-SSD) sit at Grade A because of years of content tenure — public commit history, dated revisions, an audit trail readers can follow to verify the guide hasn't quietly drifted. opsecosint.info is a brand-new site with an unproven maintenance cadence, no exposed change log, and a Lovable portability caveat (see below). CR1337's ecosystem track record via Monero.Jobs, wtf-is-xmr, and the XMR 1337 Guide is real, but our grade rubric weights the *content* not the *author* — so a fresh site starts where its own content-tenure starts, at B. Grade lifts on 90 days of visible maintenance cadence (dated chapter revisions or a public change log) or a migration to a portable host with an inspectable history.\n\n**Caveats.**\n- Hosted on Lovable with a custom `.info` domain — the site is fully dependent on the author's Lovable subscription + DNS delegation staying live. Portability is not proven.\n- Cross-crypto rather than Monero-specific — the threat models apply, but readers looking for XMR-specific tradecraft still need to reach for Monero-native references separately.\n- No exposed change log or version history at time of listing. If you want to know whether a chapter was rewritten between reads, you have to check yourself.", "translation_locale": "en", "rating": { "grade": "B", "stars": null, "count": 0 }, "grade": "B", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "OPSEC-GUIDE", "OSINT-GUIDE", "CROSS-CRYPTO", "SOLO-AUTHOR", "INTERACTIVE-QUIZZES" ], "fees": null, "fees_summary": null, "last_verified": "2026-07-08", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://opsecosint.info/", "outbound_slug": "opsecosint", "twitter": "https://x.com/CR1337" } }, { "id": "privacy-guides", "category": "educational", "subcategory": "OPSEC Reference", "name": "Privacy Guides", "url": "https://xmr.club/educational/privacy-guides", "twin": "https://xmr.club/llm/educational/privacy-guides.txt", "tagline": "Community-driven privacy + OPSEC reference — covers email, DNS, browsers, mobile, threat models.", "review": "Privacy Guides is the canonical successor to PrivacyTools.io — a community-driven, ad-free, sponsorship-free recommendations site covering threat modeling, browsers, DNS, email, mobile, messengers, password managers, and OPSEC fundamentals. Listed at **Grade A · editor's pick** because the editorial model is among the cleanest in the space: no paid placements, no affiliate links, no expedited reviews, and full financial transparency under a US 501(c)3 (MAGIC Grants).\n\n**Background.** The project forked from PrivacyTools in September 2021 after the original PrivacyTools founder (\"BurungHantu\") went absent for extended periods and stopped responding to the contributor team. The team — led by Jonah Aragon, with contributors handling content review, Matrix/Mastodon operations, and infrastructure — re-platformed under the Privacy Guides name to ensure long-term continuity. The original founder later returned to the PrivacyTools.io domain, which now operates as a paid-link farm (per the Privacy Guides team's own [PrivacyTools FAQ](https://www.privacyguides.org/en/about/privacytools/)). The privacy community treats Privacy Guides as the legitimate continuation and PrivacyTools.io as a repurposed husk.\n\n**Editorial model.** Recommendations follow a published [General Criteria](https://www.privacyguides.org/en/about/criteria/) bar: open-source preferred, active development required, cross-platform where possible, clear documentation, and security best-practice adherence. Developers who want their project added go through a public self-submission process where the community can question them directly — there is no back-channel and no expedited path. The team explicitly does **not** accept sponsorships, run affiliate links, take pay-to-list, sell expedited reviews, or write sponsored content. This is documented in the [Donation Acceptance Policy](https://www.privacyguides.org/en/about/donation-acceptance-policy/) — gifts must not interfere with editorial independence, and recommendations cannot be bought.\n\n**Governance & funding.** Privacy Guides is held under MAGIC Grants, a US 501(c)3 — donations are tax-deductible in the United States and the entity provides a legal firewall between funding and editorial decisions. They run their own infrastructure (Discourse forum, Matrix homeserver, Mastodon instance, Gitea) rather than depending on third-party hosts, which keeps community discussion + governance on infrastructure they control. Tor mirror is operator-published in their docs.\n\n**Useful when.** You're building a privacy threat model from scratch, choosing between two alternatives in a category (e.g. Signal vs. SimpleX, Tutanota vs. ProtonMail), or want a fast read on which categories of tools matter for OPSEC. The site is structured by use-case (browsing, communication, productivity) rather than by tool type, which makes it more navigable for newcomers than a flat-list directory.\n\n**Grade rationale.** Grade A reflects: independent editorial model, structural separation between funding and recommendations, US non-profit governance, self-hosted community infrastructure, no observed reputational incidents in the last 12+ months, and consistent positioning as the no-drama canonical reference in the privacy community. Pair with the XMR-specific resources elsewhere on xmr.club for a complete Monero-aware OPSEC picture.\n\n**Caveats.** Privacy Guides is general-purpose privacy, not Monero-specific — they cover crypto recommendations conservatively and don't dive into Monero-specific tooling depth (their merchant / wallet / mining-pool coverage for XMR is light). A single isolated comment in 2026 has questioned whether the site favors Signal over alternatives more than the evidence warrants; mainstream consensus does not echo that, but treat any single-app recommendation as a starting point, not gospel. Recommendations age — for fast-moving categories (e.g. AI privacy, mobile OS) the last-updated date on each page is the most important field to read.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "tor_mirror" ], "highlight_tags": [ "FREE", "OPSEC", "DOCS" ], "fees": { "summary": "Free · community-maintained · accepts XMR donations" }, "fees_summary": "Free · community-maintained · accepts XMR donations", "last_verified": "2026-05-11", "operating_since": "2019", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://www.privacyguides.org", "tor": "http://www.xoe4vn5uwdztif6goazfbmogh6wh5jc4up35bqdflu6bkdc5cas5vjqd.onion", "outbound_slug": "privacy-guides", "twitter": "https://x.com/privacy_guides", "matrix": "https://matrix.to/#/privacyguides:matrix.org" } }, { "id": "wtf-is-xmr", "category": "educational", "subcategory": "Beginner", "name": "wtf is XMR?", "url": "https://xmr.club/educational/wtf-is-xmr", "twin": "https://xmr.club/llm/educational/wtf-is-xmr.txt", "tagline": "Friendly beginner's guide to Monero — 6 chapters, interactive quizzes, live Bitcoin-vs-Monero privacy simulator. By CR1337 (also runs Monero.Jobs).", "review": "**Beginner-friendly Monero explainer + interactive guide.** By **CR1337** (the same operator behind Monero.Jobs and the original XMR 1337 Guide). Operator-published positioning: *\"Private digital cash that actually protects you — no receipts, no tracking, no BS. The friendly beginner's guide to Monero.\"* v2 shipped 2026-05; six chapters from \"what is it\" through \"700+ places that take it\", four interactive quiz modules, a live Bitcoin-vs-Monero privacy simulator on the homepage. Listed at **Grade B** on first pass — strong operator track record (same person who shipped Monero.Jobs to monero.eco's curated list), Permissive \"Do whatever you want\" license in the footer, but the operator surface for this specific project is still early (no published Tor onion yet, no operator-published repo for the site itself — only links to the upstream `monero-project/monero` repo).\n\n**What it is.** Standalone website at `wtfisxmr.lol`. The structure is three concentric loops for three reader types:\n\n1. **Homepage rundown** — 30-second pitch with the live privacy simulator (Bitcoin's `bcl1q...` everything-visible blocks vs Monero's hidden-by-default).\n2. **Full guide** — 6 chapters totalling the same content as CR1337's longer-form XMR 1337 Guide, optimised for read-through:\n - Ch.01 Buy without KYC (covers kycnot.me, Trocador, BasicSwap, Haveno, Exolix, cash OTC)\n - Ch.02 Wallets that don't snitch (Cake, Monerujo, Feather, cold storage, pick the right tool)\n - Ch.03 Tax & paperwork\n - Ch.04 Run your own node (Pi 4 + SSD; stop leaking queries to public nodes)\n - Ch.05 Bug-out playbook (crackdowns, theft, borders — move funds without moving suitcases)\n - Ch.06 700+ places that take it (monero.eco · monerica · the real circular economy)\n3. **Quizzes** — 4 modules to drill the concepts; the gamified entry point for users who learn by doing rather than reading.\n\n**Background.** CR1337 (X: `@CR1337`) is the operator. Previously shipped the long-form XMR 1337 Guide and the Monero.Jobs marketplace (also listed on xmr.club at `/tools/monero-jobs`, on monero.eco's curated shortlist). v2 of wtfisxmr.lol shipped 2026-05 with the homepage redesign + the privacy simulator + quizzes module.\n\n**What you trust.**\n\n- **Permissive licence in the footer** (\"Do whatever you want\") — you can fork the content, translate, embed in your own materials without asking.\n- **Editorial alignment** — CR1337's other public work (Monero.Jobs, XMR 1337 Guide) all share the same anti-KYC, pro-self-custody, anti-surveillance editorial line.\n- **No account, no signup, no email gate, no newsletter-paywall.** The newsletter exists as an opt-in but the guide + quizzes are free without it.\n- **Single-operator project** — CR1337 owns the URL + content + roadmap. Anonymous-operator tier; trust accumulates through delivery (Monero.Jobs is now live, XMR 1337 Guide has been around long enough to build reputation).\n\n**Operational specs.**\n\n- **Site.** `wtfisxmr.lol`. Modern web app — six main sections + quizzes + full guide + history timeline + resources index.\n- **Languages.** English at v2 launch; language selector UI visible (additional locales likely coming based on the selector).\n- **License.** \"Do whatever you want\" (operator-stated, permissive). Suggest the curator/curators of derivative works credit CR1337.\n- **Repository.** Only the upstream `monero-project/monero` is linked — the wtfisxmr.lol site's own repo is not operator-published at submission time.\n- **No Tor onion** advertised at submission time. Site loads under Tor Browser.\n- **Donations.** Not surfaced in the v2 footer at submission time — would expect a Monero donation address to appear in future iterations.\n\n**Operator philosophy.** Per the homepage hero: *\"Private digital cash that actually protects you — no receipts, no tracking, no BS.\"* Same anti-surveillance / anti-KYC framing that runs through CR1337's Monero.Jobs + the original XMR 1337 Guide. The pedagogical bet here is **layered depth** — give a casual reader a 30-second rundown, a serious reader the full guide, and a quiz-driven learner the quiz modules. Three reader personas, one site, no funnel-to-paid-conversion.\n\n**Grade rationale.** **Grade B** on first pass because: (1) **no operator-published Tor onion** for the site; (2) **site repo not operator-published** (only the upstream Monero codebase is linked); (3) **curator end-to-end verification not on file yet** (did all the quizzes pass? does the full guide hold up against the methodology rubric? — pending); (4) **single-operator project** with pseudonymous attribution. The licence + delivery track record + cross-listing with our existing Monero.Jobs entry are strong B+ signals. Upgrade-to-A path: operator publishes the site repo + Tor onion + curator full read-through pass.\n\n**Useful when:**\n\n- Someone asks you **\"XMR? WTF IS THAT?\"** — link them here, done.\n- You need a **first-pass educational link** for a friend who's never used a privacy coin.\n- You want a **quiz-driven learning path** rather than a wall-of-text guide.\n- You're **teaching a workshop / writing a curriculum** and want a free, permissively-licensed beginner resource.\n- You want a **fresh take on the Bitcoin-vs-Monero comparison** beyond the standard tagline-level pitch.\n\n**Caveats:**\n\n- **No Tor onion at submission time.** Clearnet only — but the content is intentionally public, so the trade-off is mild.\n- **Site repo not published.** Permissive licence in footer is good; lack of forkable repo means \"do whatever you want\" requires extra work to operationalise.\n- **Single-operator (CR1337) project.** Cross-listing with Monero.Jobs (also CR1337) means operator-failure risk is concentrated across both projects.\n- **English-only at v2 launch.** Language selector UI present but additional locales pending.\n- **No curator full read-through yet.** Grade B default per playbook for new educational submissions.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "no_account_required" ], "highlight_tags": [ "BEGINNER", "GUIDE", "QUIZZES" ], "fees": { "summary": "Free — educational resource. No paywall, no signup, no email gate." }, "fees_summary": "Free — educational resource. No paywall, no signup, no email gate.", "last_verified": "2026-05-28", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://wtfisxmr.lol", "twitter": "https://x.com/CR1337", "outbound_slug": "wtf-is-xmr" } }, { "id": "xmrcompass", "category": "educational", "subcategory": "Foundational", "name": "xmr-compass", "url": "https://xmr.club/educational/xmrcompass", "twin": "https://xmr.club/llm/educational/xmrcompass.txt", "tagline": "Editorial diagnostic site — 7 questions, 6 tailored paths, 20 articles, 12-term glossary, 4 client-side tools. Transparent affiliate + audit revenue model. French-first.", "review": "Editorial diagnostic site for entering and progressing in Monero. Seven questions, six pre-modelled paths (Curious Cautious, Practitioner, Serious Hodler, Merchant / Freelance, Crypto Switcher, Real Risk) — answer the diagnostic, get a wallet setup, three concrete actions, three pitfalls, and a curated reading list tailored to that profile.\n\n**Substance behind it.** Six personas. 20 editorial articles, 1,200–1,500 words each, plain-spoken French with technical English kept where it matters. A 12-term glossary with one page per term (seed, subaddress, view key, atomic swap, no-KYC, self-custody, etc.). Four client-side tools — XMR address validator, XMR/fiat converter (CoinGecko), Monero URI QR generator, and five printable OPSEC checklists (one per profile). All free, no signup, no tracker.\n\n**Transparent revenue model.** Three sources, disclosed openly on /about:\n\n1. **Monero-native affiliate links** (Trocador, RetoSwap, XMR-compatible hardware wallets). Never KYC exchanges. Affiliate links flagged at the point of mention.\n2. **xmrscout** — companion Telegram bot for multi-backend swap + DCA into XMR (BTC, ETH, BNB, USDT/USDC, SOL). Mentioned only in 3 of 6 profiles where objectively relevant. The site's own disclosure: \"Three profiles out of six don't mention it at all — that's the editorial coherence that makes the mention credible when it appears.\"\n3. **B2B UX audits** for wallets and Monero services. Primary revenue, mentioned only on /about.\n\n**Honest about backend reality.** Their /about page acknowledges that no instant-swap aggregator available in 2026 contractually guarantees zero KYC — all use risk-scoring AML that can require ID or delay transfers on flagged volumes/patterns. That posture (name the limitation, then route around it editorially) is exactly the transparency framing xmr.club's methodology rewards.\n\n**Why A-grade.** Not a directory, not a product reviewer — editorial scaffolding for the first hour with Monero, with depth (6 paths × tailored output) and breadth (20 articles + glossary + tools) that's hard to find elsewhere in any language. Pairs well with getmonero.org for docs and Mastering Monero for the longer-form theory. French-first but the model translates cleanly; an English edition is the obvious next surface.\n\n**Caveats.** New site; the breadth claims (6 paths, 20 articles, 12 terms, 4 tools) are operator-stated and we'll verify on the next review cycle. The xmrscout bot is operator-owned, disclosed appropriately; we don't yet have an end-to-end audit of its swap rates.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup", "no_account" ], "feature_tags": [ "foundational", "no_js_supported", "no_logs", "no_pii", "open_source", "tor_mirror" ], "highlight_tags": [ "CLIENT-SIDE-TOOLS", "EDITORIAL", "FRENCH-FIRST", "NEWCOMER-FRIENDLY", "NO-TRACKER" ], "fees": { "summary": "Free. Editorial content + tools, no signup, no tracker. Operator transparency: Monero-native affiliates (Trocador, RetoSwap, hardware wallets) flagged at mention; xmrscout Telegram bot mentioned only in 3 of 6 personas; B2B UX audits as primary revenue." }, "fees_summary": "Free. Editorial content + tools, no signup, no tracker. Operator transparency: Monero-native affiliates (Trocador, RetoSwap, hardware wallets) flagged at mention; xmrscout Telegram bot mentioned only in 3 of 6 personas; B2B UX audits as primary revenue.", "last_verified": "2026-05-24", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmr-compass.net", "outbound_slug": "xmrcompass", "twitter": "https://x.com/Do_not_sell_", "telegram": "https://t.me/XMRScoutBot" } }, { "id": "xmrprice-live", "category": "educational", "subcategory": "Communities", "name": "xmrprice.live", "url": "https://xmr.club/educational/xmrprice-live", "twin": "https://xmr.club/llm/educational/xmrprice-live.txt", "tagline": "Live XMR price + exchange \"weather\" — which engines are healthy right now.", "review": "Real-time XMR price aggregated across major venues plus a colour-coded \"weather\" view showing per-engine spread, latency, and recent failure rate. Maintained by the same team behind this directory.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "api_available" ], "highlight_tags": [ "XMR", "FREE" ], "fees": { "summary": "Free · no signup" }, "fees_summary": "Free · no signup", "last_verified": "2026-05-12", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmrprice.live", "outbound_slug": "xmrprice-live" } }, { "id": "zero-to-monero", "category": "educational", "subcategory": "Technical Deep-Dive", "name": "Zero to Monero", "url": "https://xmr.club/educational/zero-to-monero", "twin": "https://xmr.club/llm/educational/zero-to-monero.txt", "tagline": "Technical deep-dive into XMR cryptography by koe + Sarang Noether + others.", "review": "Zero to Monero (v2.0.0) is the **canonical technical reference** for understanding how Monero actually works — written by Koe with contributions from Sarang Noether, Justin Berman, and other Monero Research Lab members. Free PDF, ~250 pages, hosted on getmonero.org as the project's official deep-dive document.\n\n**What it is:** a rigorous, self-contained walkthrough of Monero's cryptographic stack — RingCT, ring signatures (CLSAG), stealth addresses, Pedersen commitments, bulletproofs, the dual-key stealth address scheme, view keys, transaction construction, mempool behavior, hard-fork history. The book is mathematically rigorous but pedagogically structured: every concept builds on prior ones, every primitive is motivated before introduced, every protocol step is justified before specified.\n\n**What it isn't:** not a 'getting started with Monero' guide. Not a wallet tutorial. Not a price speculation document. If you want 'how do I send my first XMR' read Mastering Monero (Serhack) instead. Zero to Monero assumes you can read mathematical notation, follow elliptic-curve operations, and want to understand WHY the protocol makes the choices it does.\n\n**Why it earns A grade in /educational:**\n\n- **Author credentials**: Koe is a long-time MRL researcher; Sarang Noether is the architect of bulletproofs and a co-author of CLSAG; Justin Berman is also from MRL. This isn't third-party explanation, it's primary-source material from the people who designed and reviewed the protocol.\n- **Open source**: source repository at `github.com/UkoeHB/Monero-RCT-report` (the project name reflects v1's narrower RCT focus; v2 expanded coverage). Anyone can audit the explanations, file errata, contribute.\n- **Free**: no purchase, no signup, no email required. PDF served directly from the official Monero website. Distribution friction is zero.\n- **Maintained**: v2.0.0 reflects the major rewrite that brought it current with CLSAG (2020), Bulletproofs+ (2022), and the view-tag protocol changes. Earlier versions (v1.0.0, v1.x) are still floating around in cached form — make sure you're reading v2.0.0 unless you have a specific reason to study the older RCT design.\n\n**What you actually learn:** by chapter end you can answer questions like 'why does Monero use ring signatures instead of zk-SNARKs', 'how does a view key let you scan for incoming transactions without being able to spend them', 'what's the difference between the deposit address and the stealth address that actually gets written to the chain', 'why does the protocol require 16 decoys per ring not 8 or 32'. The book treats every design choice as a tradeoff to justify, not a magic incantation to accept.\n\n**Useful when** you're a developer integrating Monero (you'll need to understand subaddress derivation, view-key APIs, mempool semantics), OR you're a security researcher wanting to audit the protocol claims, OR you're an advanced user trying to evaluate post-quantum migration arguments or Seraphis transition proposals on their merits, OR you're learning cryptography and want a real-world large-scale protocol case study.\n\n**Reading order in the /educational stack:**\n\n1. **Mastering Monero** (Serhack, free PDF) — start here if you're new to Monero. Conceptual + non-technical.\n2. **Breaking Monero** (Justin Ehrenhofer YouTube series) — the threat-model and historical-attack education layer. Watch in parallel with reading.\n3. **Zero to Monero v2** — the deep technical layer. Read after the above so you have the conceptual scaffolding for the math.\n4. **Monero Research Lab papers** (MRL technical notes on getmonero.org/library) — for current research frontier (Seraphis, FCMPs, etc.) after you've finished ZtM.\n\n**Caveats:**\n\n- Dense reading. Budget 30+ hours for a careful first pass; faster on re-read.\n- Math notation assumes comfort with elliptic curves, modular arithmetic, group theory basics. The book reviews concepts but doesn't teach them from scratch.\n- v2.0.0 is current as of late 2022/2023; subsequent protocol changes (e.g. mandatory view-tag adoption, ring-size-16 transition) are documented in MRL notes rather than book updates.\n\n**Verdict:** if you're going to take Monero seriously as a developer, researcher, auditor, or principled long-term holder, Zero to Monero is the document to read. It's free, official, written by the people who built the thing, and the only material at its depth that's also at its accessibility. The fact that Monero ships its own self-documentation at this quality is itself one of the strongest signals about the project's culture.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "free", "rigorous_technical", "primary_source", "maintained" ], "highlight_tags": [ "FREE", "OPEN-SOURCE", "PRIMARY-SOURCE", "DEEP-TECHNICAL" ], "fees": { "summary": "Free PDF · ~250 pages" }, "fees_summary": "Free PDF · ~250 pages", "last_verified": "2026-06-01", "operating_since": "2014", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.getmonero.org/library/Zero-to-Monero-2-0-0.pdf", "outbound_slug": "zero-to-monero" }, "also_listed_at": { "web3privacy": true } }, { "id": "addy-io", "category": "email", "subcategory": "Aliases", "name": "addy.io", "url": "https://xmr.club/email/addy-io", "twin": "https://xmr.club/llm/email/addy-io.txt", "tagline": "Open-source email-alias forwarder (the AnonAddy successor). Self-hostable, accepts crypto.", "review": "addy.io (formerly AnonAddy) is the *email-aliasing service for people who refuse to hand out their real inbox* — an open-source, self-hostable forwarder that gives every signup, newsletter, and shady checkout its own disposable address, all funnelling to a mailbox the other party never sees.\n\n**Background.** The project launched as AnonAddy around 2016 and rebranded to addy.io under the same maintainer (Will Browning), who still develops it in the open. It is a PHP/Laravel application you can run yourself on a cheap VPS, or use via the maintainer's hosted tiers — the same codebase either way. Longevity plus single-maintainer continuity is part of why it earns an A in /email: it has survived the years that killed most \"burner email\" startups, and the rebrand didn't fracture the open-source lineage.\n\n**What you trust.** The trust model rests on three pillars. First, it's *open source* — the forwarding logic, the alias handling, the encryption code are all auditable, and you can run the exact same software yourself if you don't want to trust the hosted instance. Second, *self-hostability* is real, not theatre: a $4 VPS and your own domain give you a fully independent deployment with no dependence on the operator. Third, *PGP support* — addy.io can encrypt forwarded mail to your public key before it leaves the server, so even the forwarder can't read the contents of messages in transit to your real inbox. That combination (open code + self-host escape hatch + E2E option) is the strongest trust posture an aliasing service can offer.\n\n**Operational specs.** You create aliases on demand — either explicit ones or shared/standard format addresses generated on the fly — and mail to any of them forwards to your real address with the sender's identity intact but your inbox hidden. Crucially it supports *replying and sending from aliases*, so the disposable address works as a two-way shield, not just an inbound filter. Custom domains are supported (point your own domain's MX at it). The hosted service runs free and paid tiers; paid annual plans accept crypto, and the free tier carries bandwidth/alias limits that the paid tiers lift. Self-hosters get unlimited everything bounded only by their server.\n\n**Philosophy.** Email is the master key to your digital life — it's the reset-password endpoint for every other account — and yet it's the identifier people scatter most freely. addy.io's premise is that you should be able to give a *different* address to every counterparty, so a breach or a data-broker sale at one of them can't be correlated back to you or used to spam your real inbox. The open-source-and-self-hostable stance is the philosophical core: a privacy tool you can't inspect or escape is just a different party to trust, and addy.io deliberately refuses to be that.\n\n**Grade rationale.** A in /email. The grade reflects open-source auditability, genuine self-hosting, PGP encryption of forwarded mail, two-way alias send/reply, custom-domain support, crypto payment on paid plans, and a multi-year maintained track record. It sits at the top of the category alongside SimpleLogin; the choice between them is mostly ecosystem preference and whether you want Proton's bundle or a leaner single-maintainer tool you can self-host on a VPS.\n\n**Useful when.** Reach for addy.io whenever you're about to type your real email into a form you don't fully trust — a newsletter, a one-time checkout, a forum, a service with a sketchy privacy policy. Give each its own alias; if one starts spamming or shows up in a breach, you deactivate that single alias without touching anything else. Power users put it in front of *every* signup so their real mailbox address is effectively never disclosed. Self-host it if you want zero operator dependence.\n\n**Caveats.** Forwarding is not anonymity from a determined, lawful adversary: the hosted operator (or your own server) necessarily sees envelope metadata, and unless you enable PGP it can see message contents in transit. The free tier's bandwidth limit can clip large or high-volume mail — heavy users should pay or self-host. Self-hosting email well (SPF/DKIM/DMARC, deliverability, staying off blocklists) is genuinely hard, so the \"run it yourself\" escape hatch carries real operational cost. And as with any forwarder, replying from an alias still routes through the service, so it's a privacy tool against profiling and spam, not a shield against a subpoena to the operator. None of these dent the A — they're the normal trade-offs of email — but they're worth understanding before you treat an alias as true anonymity.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted", "api_available" ], "highlight_tags": [ "ALIASES", "OPEN-SOURCE", "SELF-HOST" ], "fees": { "summary": "Free + paid from $1/mo · self-hostable · BTC accepted annual" }, "fees_summary": "Free + paid from $1/mo · self-hostable · BTC accepted annual", "last_verified": "2026-06-02", "operating_since": "2016", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2016", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://addy.io", "outbound_slug": "addy-io", "twitter": "https://x.com/addy_io" }, "also_listed_at": { "kycnot": true } }, { "id": "disroot", "category": "email", "subcategory": "Activist Collectives", "name": "Disroot", "url": "https://xmr.club/email/disroot", "twin": "https://xmr.club/llm/email/disroot.txt", "tagline": "Privacy-respecting community service — email + nextcloud + matrix.", "review": null, "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "self_hosted", "pgp_supported", "tor_mirror" ], "highlight_tags": [ "FREE", "ACTIVIST" ], "fees": { "summary": "Free · donation-supported · no payment required" }, "fees_summary": "Free · donation-supported · no payment required", "last_verified": "2026-05-13", "operating_since": "2015", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://disroot.org", "outbound_slug": "disroot", "tor": "http://j4dhkkxfcsvzvh3p5djkmuehhgd6t6l7wmzih6b4ss744hegwkiae7ad.onion", "contact_email": "support@disroot.org" } }, { "id": "ephemere-chat", "category": "email", "subcategory": "Encrypted Messaging", "name": "Ephemere Chat", "url": "https://xmr.club/email/ephemere-chat", "twin": "https://xmr.club/llm/email/ephemere-chat.txt", "tagline": "Non-federated, Hardened-Tor E2E messaging (Matrix-based) built for ephemeral use — automatic 12h message redaction, ~48h metadata purge, disabled backups, and a live user-verifiable redaction panel. No-KYC, pay in XMR. New.", "review": "**Ephemeral, non-federated encrypted messaging for high-discretion use.** Ephemere is an E2E-encrypted chat service on a **hardened, non-federated Matrix server** (Tor onion + clearweb options). \"Non-federated\" is the key design choice: unlike most Matrix homeservers — which sync data across the federation per each server's retention rules — Ephemere keeps everything on its own server, so your messages and social graph never leave it. It's built for people who need communication *without* a persistent record: activists, sources, high-risk groups.\n\n**The ephemerality is enforced, and shown live.** Messages are auto-**redacted at 12 hours** (30-min sweeps), server-side social-graph metadata is **purged by ~48 hours** (60-min sweeps), backups are disabled, redacted messages are non-recoverable, and clients are force-logged-out weekly to limit local session residue. A **purpose-built deterministic redaction script** (not bots) enforces this. Crucially, there's a **live Technical Verification panel** on the site showing the real-time redaction schedule + next-run timer — any user can watch it, and a stalled/failed redaction shows up as stale receipts. That verifiability is a real trust plus. *(Note: the site's \"Metadata Stored\" checklist row is a red-X — it means that data is NOT retained.)*\n\n**Access is no-KYC.** No PII; you pay a **small XMR fee** (also ZEC/Zano) via Trocador or a direct Monero address, with a 14-day no-questions refund. Paid tiers start at $10.\n\n**Why C.** It's **brand-new** (no track record), a small operator, and the strong retention guarantees are — by nature — **operator-stated**; the live verification panel is the mitigant but it hasn't run long. Credit where due: the non-federated architecture, enforced auto-redaction, user-verifiable panel, XMR/no-PII access, and honest disclosure are all genuine. Climbs to B- on accrued tenure + a sustained, demonstrably-working panel. Legal-page surface is currently thin (a detailed FAQ, but /terms was not up at review).", "translation_locale": "en", "rating": { "grade": "C", "trust": "Brand-new, small operator, no track record. Strong retention guarantees are operator-stated but backed by a LIVE user-verifiable redaction panel (real-time schedule + next-run timer; stale receipts expose a failure) — a real transparency mitigant. Non-federated (data never leaves its own server). C = new + claims-based; B- on tenure + a sustained working panel.", "privacy": "Strong design: non-federated Matrix (no cross-server data sharing), E2E, auto-redaction at 12h, server-side metadata purge ~48h, disabled backups, non-recoverable messages, weekly forced device logout. Tor onion + clearweb. No-KYC / no PII. ('Metadata Stored' checklist row is a red-X = NOT retained.)", "ux": "Matrix client compatibility; paid access ($10+ tiers) via Trocador or direct XMR (also ZEC/Zano), 14-day refund. Thorough FAQ + the live verification panel on-site; /terms not up at review (thin legal surface for a new service)." }, "grade": "C", "kyc_tags": [ "NO-KYC" ], "feature_tags": [ "xmr", "no_kyc", "tor", "e2e", "ephemeral", "matrix" ], "highlight_tags": [ "XMR", "NO-KYC", "TOR", "E2E", "EPHEMERAL", "NON-FEDERATED" ], "fees": null, "fees_summary": null, "last_verified": "2026-09-11", "operating_since": "2026", "tenure_note": "Brand-new (no Wayback tenure). Paid, no-custody comms service — not fund-holding, so the 6mo exchange floor doesn't apply. Retention guarantees operator-stated but mitigated by a live user-verifiable redaction panel. Grade C for new + claims-based; B- on tenure + demonstrated panel uptime.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://ephemere.chat", "outbound_slug": "ephemere-chat", "tor": "http://66i46escom3bxfqcq35x4muoxifojha6c3jbabr7dzgbql4anx5t65yd.onion" }, "also_listed_at": { "monerica": true } }, { "id": "mailfence", "category": "email", "subcategory": "Encrypted Mail", "name": "Mailfence", "url": "https://xmr.club/email/mailfence", "twin": "https://xmr.club/llm/email/mailfence.txt", "tagline": "Belgian E2E-encrypted mail with native OpenPGP keyring. Accepts BTC, custom domains supported.", "review": "Long-running Belgian provider (since 2013). End-to-end encryption with a true OpenPGP keyring (you control keys, not vendor wrapper). Includes calendar, contacts, documents. Free tier 500 MB; paid from €2.50/mo. BTC accepted. Belgian jurisdiction outside Five Eyes.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "non_custodial", "pgp_supported", "2fa_supported" ], "highlight_tags": [ "PGP", "BTC", "BELGIUM" ], "fees": { "summary": "Free + paid from €2.50/mo · BTC · BE jurisdiction" }, "fees_summary": "Free + paid from €2.50/mo · BTC · BE jurisdiction", "last_verified": "2026-05-13", "operating_since": "2013", "tenure_note": "Mailfence (Brussels-based encrypted email by ContactOffice Group) launched 2013. Previous stamp (2010) was mailfence.com WHOIS, pre-launch domain reservation.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://mailfence.com", "outbound_slug": "mailfence" } }, { "id": "neir", "category": "email", "subcategory": "Encrypted Mailbox", "name": "Neir", "url": "https://xmr.club/email/neir", "twin": "https://xmr.club/llm/email/neir.txt", "tagline": "Zero-signup encrypted mailbox — no email, no phone, no captcha. Browser-side OpenPGP for outbound message bodies; server sees inbound SMTP plaintext like every non-fully-E2E provider. Full XMR payment support (6 confs). Onion mirror advertised.", "review": "**Disclosure honesty update (2026-08-12).** Neir's own **privacy policy** was revised (last observed 2026-08-09 via our weekly monitor) to spell out three things the earlier language implied more loosely. These are clarifications, not service changes:\n\n- **Server sees inbound SMTP in plaintext at the ingest step** — true for every non-fully-E2E email provider (Proton, Tuta, Mailfence all have this shape). Neir's *browser-side OpenPGP* still applies to outbound bodies and to reader-composed mail; it does not and cannot apply to inbound mail from a plaintext sender.\n- **14-day IP log** in the operational journal for anti-abuse. Reasonable retention window; comparable to what other privacy-first mail providers publish.\n- **Optional open-tracking pixels** on messages that include them (sender-side toggle, off by default).\n\n**ToS update** simultaneously introduced a *\"Private anti-abuse proof\"* signup step — a bounded cryptographic proof, non-bypassable, no-KYC in nature. This is a friction addition, not a privacy regression.\n\nBecause the changes are honesty improvements rather than service regressions, the grade **moved up to B-** (from C) — the earlier grade had been carrying two feature tags (`e2e_bodies`, `no_pii`) that overstated the trust picture. Tags corrected; review recalibrated to the operator's actual posture.\n\n**What you trust.** Browser-side PGP key generation — private key never leaves the client in plaintext; encrypted before send with a key derived from the Account Key. Message bodies are opaque to the server. Metadata is NOT opaque — treat sender/recipient/subject as visible to Neir. Zero-signup design means recovery hinges on the Account Key + recovery phrase; lose both and the account is unrecoverable (there is no email fallback, no support-side reset).\n\n**TOS quote.** From the Terms page: *\"Neir does not and will never require identity verification or know-your-customer (KYC) checks to create or use an account.\"* The Terms contain no counter-clauses about reserved-right-to-request-ID or law-enforcement cooperation — a clean statement of posture.\n\n**Log policy.** The Privacy Policy states *\"We do not log or store your IP address or geographic location against your account.\"* The claim is self-attested — no third-party audit, no published bug-bounty programme, no open-source client to inspect the browser-side PGP flow.\n\n**Operator identity.** *\"Based in Sweden\"* per the footer. No named legal entity, no team / about page, no PGP fingerprint published for the operator. Contact via `hello@neir.io` and Telegram `@neir_io`. **Warrant canary** exists at `/canary` with the four standard statements (no NSL, no gag order, no backdoor, no seizure), but the \"Last updated\" field renders blank and the canary is not PGP-signed. That combination — canary present but neither signed nor dated — is a real gap worth watching.\n\n**Tenure.** Wayback earliest snapshot 2024-09-10 (~22 months). Not an aged-domain re-brand — no evidence of prior unrelated use.\n\n**Onion mirror.** `itlmjjwnpraaxvm5gkjeebwhjy5zycildwyg2u3lyrfigz5e6hntdqqd.onion` — advertised on the clearnet homepage footer, byte-identical response to the clearnet HTML at the same path. Real Tor mirror, not a proxy.\n\n**Peer directories.** kycnot.me lists Neir at 8/10 (Privacy 100 / Trust 62), *\"Guaranteed no KYC\"*, \"Listed, but not yet reviewed by the team\" — a community-contributed listing with a positive score, weaker signal than a team-reviewed one. monerica.com lists under the 2026-07-30 additions batch. Privacy Guides does not include it in the recommended-email shortlist (which is Proton / Tuta / Mailbox.org today).\n\n**Pricing.** Free tier at 100 MB storage. Pro tier at $4.99/mo month-to-month, down to $4.25/mo on the 12-month prepay. Payments accepted across 31 currency/network combos including **XMR on the Monero network with a 6-confirmation requirement** — first-class alongside BTC, LTC, ETH, USDT-on-6-networks. Payment surface reads as third-party crypto-processor integration (NOWPayments / CoinPayments style) rather than native XMR wallet; typical for a boutique provider.\n\n**Fees.** Free tier: none. Pro: monthly + prepay pricing above; no per-message fees, no per-alias fees, no storage overage fees disclosed.\n\n**Positioning.** Full-mailbox provider (not alias-only like AnonAddy / SimpleLogin, not classic-IMAP like Cock.li / Disroot). Zero-signup-friction places Neir closer to Cock.li's ethos with Tuta's browser-side E2E approach. The metadata-plaintext limitation puts it below Proton/Tuta on the encrypted-metadata axis. Free tier + XMR-native + no-signup-data is the differentiator.\n\n**Grade C — what it means here.** Acceptable with the caveats above named. Real signup posture, real E2E for bodies, real XMR payment, real onion mirror, honest metadata disclosure. What holds the grade below B: no named legal entity, no operator PGP fingerprint, canary is present but unsigned + undated, no independent audit or open-source client to verify the browser-side PGP claim. The path up needs those gaps closed plus 6+ months of clean operation on the watchlist.\n\n**Useful when.** You want a **full mailbox** with zero identifying data at signup, accept metadata-plaintext as the tradeoff, and pay in **XMR**. You are comfortable with a small operator whose canary + identity surface is thinner than Proton/Tuta. For **PGP-encrypted body correspondence only**, this is genuinely low-friction; recovery discipline (Account Key + recovery phrase) matters more than usual because there is no email-based reset path.\n\n**Caveats.** The unsigned + undated canary is the most-immediate gap — a canary that isn't demonstrably fresh isn't doing canary work. Legal entity + jurisdictional recourse: \"Sweden\" without a named legal entity is thinner than Proton's Swiss corporate transparency. Metadata plaintext is honest but material — if your threat model treats subject lines as sensitive, a fully-metadata-encrypted alternative (Proton, Tuta) is a closer fit.", "translation_locale": "en", "rating": { "grade": "B-", "trust": "Owner-submitted, 22-month domain footprint, no aged-domain laundering. kycnot.me 8/10 (community-tier), monerica.com listed 2026-07-30. Privacy Guides does not recommend. No named legal entity, no PGP fingerprint for the operator, warrant canary is present but unsigned and shows a blank \"last updated\" field.", "privacy": "Zero-signup: no email, no phone, no captcha, no invite. On-device Account Key + recovery phrase; server stores only salted one-way hash. Browser-side OpenPGP for message bodies; server cannot decrypt. Metadata (sender / recipient / subject / timestamp) stored plaintext — honest disclosure. Log policy self-attested (no IP / geolocation kept), no third-party audit.", "ux": "Server-rendered pages (no SPA hydration cost). Strong security headers (CSP default-self, HSTS 1y). Onion mirror byte-identical to clearnet. Payment across 31 currency/network combos, XMR first-class on Monero network 6-conf. Free tier 100MB, Pro from $4.25/mo prepay." }, "grade": "B-", "kyc_tags": [ "no_kyc", "no_email", "no_account" ], "feature_tags": [ "no_account", "tor_mirror" ], "highlight_tags": [ "ZERO SIGNUP", "E2E BODIES", "XMR NATIVE", "ONION MIRROR" ], "fees": { "summary": "Free (100 MB) · Pro $4.25–$4.99/mo · XMR + BTC + 18 other assets" }, "fees_summary": "Free (100 MB) · Pro $4.25–$4.99/mo · XMR + BTC + 18 other assets", "last_verified": "2026-08-12", "operating_since": "2024", "tenure_note": "~22 months since Wayback first-snapshot 2024-09-10.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://neir.io", "tor": "http://itlmjjwnpraaxvm5gkjeebwhjy5zycildwyg2u3lyrfigz5e6hntdqqd.onion", "outbound_slug": "neir" }, "also_listed_at": { "monerica": true } }, { "id": "njalla-domains", "category": "email", "subcategory": "Anonymous Domains", "name": "Njalla Domains", "url": "https://xmr.club/email/njalla-domains", "twin": "https://xmr.club/llm/email/njalla-domains.txt", "tagline": "Anonymous domain registration + DNS. The team takes WHOIS on themselves.", "review": "**Lede:** Njalla is the only domain registrar that genuinely accepts the WHOIS-privacy burden onto themselves. When you register a domain through Njalla, the registrar of record is *Njalla*, not you — they own the public WHOIS entry, they hold the legal proxy, and the operational relationship between the domain and your identity exists only in their private records, which they have publicly committed to never disclosing without a court order they themselves can challenge. Combined with anonymous signup (XMR / BTC / DOGE / SOL / cash by mail), no email required for registration, and a Tor onion address, Njalla is the privacy-first registrar that most other \"privacy registrars\" claim to be.\n\n**Background:** Founded in 2017 by the same team behind The Pirate Bay (Peter Sunde co-founded; the rest of the founding team have deep Swedish file-sharing and copyright-activism roots). Incorporated in Nevis (St. Kitts and Nevis) specifically because the jurisdiction has hostile-to-discovery WHOIS laws and a long history of resisting US/EU subpoena cooperation. The team's prior work surviving copyright litigation, US Treasury sanctions, and Swedish prosecution gives them institutional muscle in resisting domain seizure that hosting-side registrars (Cloudflare, Namecheap, etc.) simply do not have. They publish a transparency report annually and operate a Tor onion mirror as a first-class surface, not an afterthought.\n\n**What you trust:** Njalla holds the legal title to your domain on your behalf. If you stop paying, they reclaim it; if they go offline, you have no automatic recovery path. The trust posture is therefore \"Njalla is solvent and resistant to seizure.\" Both points are evidence-based: 7+ years of operation, profitable enough to refuse VC funding, public commitment to fighting subpoenas in their Nevis jurisdiction. They also publish quarterly the count and outcomes of legal demands they've received, which most registrars do not. The countertrade is that if Njalla itself loses a court case or gets shut down, your domain effectively dies — which is why the team also publishes a \"if we ever shut down\" plan for transferring registrar-of-record to users.\n\n**Operational specs:** Anonymous account at signup — username + password, no email required (you can add one if you want recovery, encrypted). Domain registration prices: €15/yr basic .com / .net / .org, more for premium TLDs and country-codes (.io ~€80, .li ~€30, country-codes vary). Payment in XMR, BTC (Lightning + on-chain), DOGE, LTC, SOL, EUR (SEPA), USD, USDT, USDC, and cash by mail in EUR or USD. DNS hosting included (their own DNS, ANAME records, full DNSSEC). Onion address `njallalafimoej5i4eg7vlnqjvmb6zhdh27qxcatdn647jtwwwui3nad.onion` mirrors the full registrar UI, so the entire signup and management flow is accessible without DNS, IP, or TLS leak to clearnet. WHOIS proxying is the default and isn't an upsell — it's how the product works.\n\n**Philosophy:** The team's stated thesis is that the WHOIS system is structurally a privacy disaster: an internet-wide forced disclosure of contact information attached to every domain ever registered, persisting across history and aggregated by data brokers. Their answer is to be the WHOIS-of-record themselves, accepting all legal mail and forwarding internally, so that no individual registrant ever needs to expose their identity. This pairs with no-KYC-at-signup and BTC/XMR payment to make a domain registration the same kind of pseudonymous transaction as buying a SIM card with cash. Their copyright-activism heritage shows in the design priority on resisting takedowns rather than just hiding contact info.\n\n**Grade rationale:** Grade A is anchored on three points: (1) WHOIS-on-themselves is unique in the registrar market — almost every \"private WHOIS\" alternative is a proxy service from your real WHOIS, not a transfer of title; (2) jurisdictional posture (Nevis + Sweden) has track record of resisting subpoenas; (3) anonymous signup is genuine (not just \"private payment,\" but no required identity at all). The dimensions that prevented A+ are (a) custodial registrar relationship means you're trusting Njalla's solvency, and (b) prices are 3-5x higher than budget registrars like Namecheap. Both are direct consequences of the privacy posture; budget registrars give you cheap domains because they offload the WHOIS burden to you.\n\n**Useful when:** You're hosting any service that touches activism, journalism, anti-censorship, hosting of unauthorized leaks, or just any project where your real-name being on the public WHOIS would create real-world consequences. Common patterns: Tor hidden-service operators registering clearnet mirrors, journalists hosting dropbox / SecureDrop endpoints, copyright-adjacent indexing services, P2P trading desks needing a long-term domain, and operators of privacy-tools who want to align their infrastructure with their product values. Njalla is also the right pick for any individual who simply doesn't want their home address and phone number in a publicly searchable database.\n\n**Caveats:** You don't legally *own* the domain — Njalla does, and you have a contractual right to operate it. If Njalla loses a registrar accreditation, gets enjoined by a court, or chooses to terminate your account, recovery is non-trivial and the team has published the worst-case fallback plan. Prices are meaningfully higher than commodity registrars; for a single hobby domain it's a few extra euros, for a portfolio it adds up. Transferring domains *out* of Njalla into your own name is possible but requires you to expose your identity to the gaining registrar, which defeats the purpose, so the model assumes you stay on Njalla long-term. Lastly: their public communications style is contrarian and they will not pretend to be a neutral pipe — buying a domain through Njalla means associating your project with a vocal copyright-activism brand, which is a feature for some and a friction for corporate-buyer scenarios.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "anonymous_signup", "api_available", "no_email", "tor_onion", "whois_proxy" ], "highlight_tags": [ "DOMAINS", "NO-KYC", "editor_pick" ], "fees": { "summary": "€15/yr basic .com · XMR / BTC / SOL / DOGE / etc. · anonymous account" }, "fees_summary": "€15/yr basic .com · XMR / BTC / SOL / DOGE / etc. · anonymous account", "last_verified": "2026-09-10", "operating_since": "2017", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2017", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://njal.la", "tor": "http://njallalafimoej5i4eg7vlnqjvmb6zhdh27qxcatdn647jtwwwui3nad.onion", "outbound_slug": "njalla-domains" }, "also_listed_at": { "web3privacy": true, "monerica": true } }, { "id": "protonmail", "category": "email", "subcategory": "Encrypted Mailbox", "name": "Proton Mail", "url": "https://xmr.club/email/protonmail", "twin": "https://xmr.club/llm/email/protonmail.txt", "tagline": "Swiss-based encrypted email. Free tier; paid plans accept BTC.", "review": "Proton Mail is the most polished privacy-respecting email provider for users who want end-to-end-encrypted email without self-hosting — operated by the Proton Foundation (a Swiss non-profit) and the largest pure-privacy mailbox provider by user base. Listed at **Grade A · editor's pick** because it remains the realistic default for non-technical users who need encrypted email today, while being honest about the metadata-vs-content asymmetry that defines its actual threat model.\n\n**Background.** Founded in 2014 by Andy Yen and a team out of CERN; rebranded from ProtonMail to the broader Proton ecosystem (Mail, VPN, Drive, Calendar, Pass, Authenticator, Docs, Sheets, Meet, plus Lumo AI and Simple Login). The company restructured under the **Proton Foundation** non-profit model — a Swiss-domiciled entity that controls Proton AG, with a stated mandate to keep the company aligned with the privacy mission rather than venture-capital exit timing. Source code for the clients is open on GitHub. Free tier; paid Mail plans from ~€4/month accept BTC + bank transfer + card. Tor onion mirror operator-published: protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion.\n\n**What you trust.** End-to-end encryption is **applied to content** — emails between two Proton users, encrypted attachments, encrypted calendar events, encrypted drive files — using PGP-compatible primitives that Proton cannot decrypt at rest. **Metadata is a different surface**: sender, recipient, subject line (depending on flow), IP at signup (historically — see below), recovery email, and login timestamps are all observable to Proton infrastructure and, under valid Swiss legal process, can be compelled. Their published 2025 transparency report shows **9,301 legal orders received, 988 contested, 8,313 complied with** — meaning the \"Proton complies with Swiss law\" path is real and frequently exercised. For VPN, the same report shows 59 orders received, 59 denied — because there are no logs to surrender. **2021 climate-activist case**: a French climate activist's IP and recovery email were handed to Swiss authorities under a Europol→Swiss-court request; this remains the canonical reference for \"Proton complies when legally compelled.\" Subsequent product changes reduced default IP logging on signup, but the underlying legal exposure persists.\n\n**Operational specs.** Free tier: 1 GB mail storage, ~150 messages/day, one address. Paid plans start at ~€4/month (Mail Plus) and scale up through Unlimited (~€10/month, includes VPN/Drive/Pass). Encryption: PGP under the hood, with key management handled in-browser/client. Custom domains on paid plans. Address aliasing via Simple Login (separate but Proton-owned). Calendar + Drive + Pass + Authenticator round out the ecosystem with similar E2EE posture. Bridge utility connects Proton Mail to desktop clients (Thunderbird, Apple Mail, Outlook) for users who don't want to use the web UI. Two-factor auth required for paid plans, optional for free.\n\n**Philosophy.** Proton's editorial differentiator is **regulated privacy under named jurisdiction** — Switzerland — rather than the \"no jurisdiction\" stance of fully-anonymous mail providers operating in different (or no) jurisdictions. The bet is that Swiss legal protections + a non-profit foundation structure produce a more durable privacy posture than offshore anonymous-hosting. The trade-off: Switzerland *does* respond to valid local court orders, and Proton complies when legally required. For users threat-modeling against Swiss authorities or organisations capable of operating MLAT to Switzerland, that exposure is real. For everyday \"I don't want Google reading my mail\" users, the model is sufficient and the convenience is unmatched.\n\n**Grade rationale.** Grade A and editor's pick reflect: clear E2EE on message content; published transparency report with concrete numbers (rare among email providers); non-profit Foundation governance structure; Swiss jurisdiction with documented legal pushback (988 contested orders in 2025 alone, plus recent legal-resistance actions); Tor onion mirror; PGP interop; open-source clients; absence of any content-decryption claim or capability; free tier with realistic everyday utility. Last verified 2026-05-11.\n\n**Useful when.** You need encrypted email and don't want to self-host. You want PGP-style E2EE without managing keys manually. You want a privacy-respecting ecosystem (Mail + VPN + Drive + Calendar + Pass) under one billing umbrella. You're a journalist, lawyer, or healthcare professional whose threat model is \"untrusted big-tech reading content\" rather than \"state-level adversary.\" You want a free, anonymous-signup mailbox you can use for ongoing accounts (without phone verification on most signup paths).\n\n**Caveats.** **Metadata is observable to Proton and compellable** — sender, recipient, subject, login IPs, recovery email. End-to-end encryption protects content, not headers. If your threat model is \"do not let Swiss courts learn that I have a Proton account at all,\" Proton is not the answer; consider a fully-anonymous provider with a different jurisdiction. **Compliance rate**: ~90% of valid Swiss legal orders are honored — Proton is not a privacy fortress, it's a *jurisdictionally-bounded* privacy provider. **Signup friction**: Proton has tightened anti-abuse for free-tier signups; if you sign up from a Tor exit or VPN IP, you may be asked for SMS or alternate email verification, which broadens the KYC surface back toward `light_kyc`. **For non-Proton recipients**, end-to-end is only on if you set up PGP exchange or use Proton's \"encrypted to outside\" password-protected link feature; otherwise email leaves Proton's TLS-encrypted boundary and arrives at the recipient's mailbox in cleartext. **VPN model is stronger than Mail** for metadata-sensitive use — Proton VPN's no-log policy survives Swiss legal process in a way Mail's metadata cannot. **Lumo AI**: Proton's writing-assistant AI feature (2025-2026) is opt-in and, per Proton's stated policy, does not train on mailbox content — but if your threat model excludes any AI processing of content, check Proton's current AI data-handling docs before enabling it.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "open_source", "tor_mirror", "audited", "pgp_supported", "2fa_supported" ], "highlight_tags": [ "FREE TIER", "PGP" ], "fees": { "monthly_usd": 4, "summary": "Free tier 1 GB · paid €4–9/mo · BTC for paid · email recovery optional but useful" }, "fees_summary": "Free tier 1 GB · paid €4–9/mo · BTC for paid · email recovery optional but useful", "last_verified": "2026-05-11", "operating_since": "2016", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2016", "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://proton.me", "tor": "https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion", "outbound_slug": "protonmail", "twitter": "https://x.com/ProtonPrivacy", "telegram": "https://t.me/proton_privacy", "discord": "https://discord.gg/proton" }, "also_listed_at": { "kycnot": true, "privacyguides": true } }, { "id": "riseup-mail", "category": "email", "subcategory": "Activist Collectives", "name": "Riseup Mail", "url": "https://xmr.club/email/riseup-mail", "twin": "https://xmr.club/llm/email/riseup-mail.txt", "tagline": "Long-running activist email collective. Invitation-only.", "review": null, "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "open_source", "pgp_supported", "canary" ], "highlight_tags": [ "FREE", "ACTIVIST", "INVITE-ONLY" ], "fees": { "summary": "Free · donation-supported · requires existing-member invite" }, "fees_summary": "Free · donation-supported · requires existing-member invite", "last_verified": "2026-05-13", "operating_since": "2000", "tenure_note": "archive.org first snapshot 2005 predates WHOIS 2000; treated as current-entity year (domain re-registered, prior content was different owner)", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://riseup.net/en/email", "outbound_slug": "riseup-mail", "tor": "http://vww6ybal4bd7szmgncyruucpgfkqahzddi37ktceo3ah7ngmcopnpyyd.onion" } }, { "id": "simplelogin", "category": "email", "subcategory": "Alias Forwarders", "name": "SimpleLogin", "url": "https://xmr.club/email/simplelogin", "twin": "https://xmr.club/llm/email/simplelogin.txt", "tagline": "Email-alias forwarder. Hide your real address from every service.", "review": "**Lede:** SimpleLogin is the de-facto email-alias forwarder for the privacy-conscious crypto user. You sign up once, generate a fresh `@.com` alias for every site that asks for your email, and SimpleLogin transparently forwards inbound mail to your real inbox while letting you reply through the alias. The result: every service you touch sees a different, throwaway address, and the day one of them leaks or sells the list you burn that one alias without breaking anything else. Owned by Proton since April 2022 — same engineering team that runs Proton Mail and Proton VPN, so the operational track record is borrowed from a well-funded entity that has survived warrants, court orders, and a decade of adversarial attention.\n\n**Background:** Founded in 2020 by Son Nguyen out of France as a 1-person open-source project. Hit ~100k users within 18 months on a freemium model, got the Proton acquisition in 2022, and integrated with the Proton ecosystem (same login, same passwords, same SimpleLogin-on-custom-domains workflow). The full server stack remains open-source (AGPL-3.0) on GitHub, so an adversary auditing the code, or anyone wanting to self-host on a VPS, can do so without surprise. The hosted product is what 99% of users want, but the option to leave is real and on-prem deployments do exist in the wild.\n\n**What you trust:** SimpleLogin sees the inbound-to-alias mapping in plaintext (it has to, to forward the mail), but the *content* of every message can be transparently PGP-encrypted before forwarding if you upload a public key to your account. So the threat model splits cleanly: SimpleLogin always knows who emailed which alias and when; it does *not* know what was said if you've turned on PGP. Proton's no-logs and Swiss-jurisdiction posture inherits to SimpleLogin since the acquisition; the operational keys live in the same EU-based infrastructure. You don't have to trust them with your reply content if you don't want to.\n\n**Operational specs:** Free tier ships with 10 aliases on a `@simplelogin.io` / `@aleeas.com` / `@slmail.me` style domain, unlimited forwards, a browser extension, and iOS / Android apps. Paid tier is $30/year (or one-time lifetime ~$240 on regular sale) for unlimited aliases, custom-domain support (use your own `*@yourdomain.com`), catch-all on that domain, reverse-alias replies, encrypted mailbox, multiple mailboxes per account, and PGP-encrypt-before-forward. Payment in BTC accepted directly. Self-host build is `Dockerfile` + `docker-compose.yml` on GitHub; you bring your own MTA and DNS, takes ~30 minutes for someone comfortable with mail-server admin.\n\n**Philosophy:** SimpleLogin treats every alias as disposable infrastructure rather than as a long-term identity. The design assumption is that any address you give out *will* eventually leak to a marketing list, a data broker, or worse, and that the cheapest defense is making each give-away cheap to burn. This pairs naturally with a no-KYC ethos: services that demand an email but won't be your bank don't need your real one, and you keep the option of pruning the relationship later by simply muting the alias. The same logic carries to recovery, breach-notification, and account-takeover incidents — losing one alias is cosmetic, losing your real address is permanent.\n\n**Grade rationale:** Grade A reflects the rare combination of *deep* open-source operational transparency (code, infrastructure docs, security audit reports), *durable* operator (Proton's track record is the longest in privacy-mail), and *low* friction at the free tier. A single dimension where we held back: light KYC at signup (email + optional payment trail) keeps it from being fully anonymous, which is why this isn't an A+ pick over a self-hosted alternative. The free tier's 10-alias cap is also enough for hobbyists but tight for power users who'll outgrow it; the paid tier is reasonably priced and accepts BTC, so the upgrade path doesn't reintroduce KYC.\n\n**Useful when:** You're signing up for crypto services, swap exchanges, VPN trials, P2P trading desks, and SaaS tools that demand an email. Power users put SimpleLogin between every public-facing service and their actual mailbox. It's also the right pick when you want a *real* email address (with deliverability and a working reply path) on every signup, rather than a burner that breaks after the first password reset. For pseudonymous identities you maintain over years, custom-domain catch-all (paid tier) lets you generate aliases on-the-fly that survive even if SimpleLogin disappears, since you control the domain.\n\n**Caveats:** Forwarded mail can still leak metadata you didn't intend (`Received:` chain, IP of your final inbox if the upstream MTA logs it, timezone hints in `Date:` headers). PGP-encrypt-before-forward closes most of this. Free-tier aliases live in the `@simplelogin.io` namespace, which some sites flag as \"disposable email\" and block at signup — when that happens, you need either a custom domain (paid) or one of the rotating alias domains. Lastly: Proton is incorporated in Switzerland but is a single legal entity, and a sufficiently resourced state-level adversary requesting Swiss legal cooperation could pressure SimpleLogin for the alias-to-inbox mapping. That is the threat model in which self-hosting (or full PGP) becomes the right answer.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "api_available", "custom_domain", "no_logs", "open_source", "pgp_supported", "reverse_alias", "self_hosted" ], "highlight_tags": [ "ALIASES", "FREE TIER", "editor_pick" ], "fees": { "monthly_usd": 0, "summary": "Free 10 aliases · paid $30/yr unlimited · BTC accepted · self-host option" }, "fees_summary": "Free 10 aliases · paid $30/yr unlimited · BTC accepted · self-host option", "last_verified": "2026-06-01", "operating_since": "2019", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2019", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://simplelogin.io", "outbound_slug": "simplelogin", "twitter": "https://x.com/SimpleLogin" }, "also_listed_at": { "kycnot": true, "privacyguides": true } }, { "id": "startmail", "category": "email", "subcategory": "Encrypted Mailbox", "name": "StartMail", "url": "https://xmr.club/email/startmail", "twin": "https://xmr.club/llm/email/startmail.txt", "tagline": "Dutch privacy-focused email. Paid only, accepts BTC.", "review": null, "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "pgp_supported", "2fa_supported" ], "highlight_tags": [ "PGP" ], "fees": { "monthly_usd": 6, "summary": "€60/yr · BTC + card · founded by StartPage team" }, "fees_summary": "€60/yr · BTC + card · founded by StartPage team", "last_verified": "2026-05-11", "operating_since": "2013", "tenure_note": "StartMail public beta 2013; company founded 2012 (StartPage / Surfboard Holding spinoff). startmail.com WHOIS 2000 is premium-domain.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.startmail.com", "outbound_slug": "startmail", "contact_email": "press@startmail.com", "twitter": "https://x.com/mystartmail" } }, { "id": "tutanota", "category": "email", "subcategory": "Encrypted Mailbox", "name": "Tuta Mail", "url": "https://xmr.club/email/tutanota", "twin": "https://xmr.club/llm/email/tutanota.txt", "tagline": "German-based encrypted email. Open-source clients.", "review": "Tuta Mail (formerly **Tutanota**, rebranded 2023) is the **German-based end-to-end encrypted email provider** — a privacy-first email service with **open-source clients** across web/desktop/mobile, built-in **encrypted calendar**, contact storage, and notes, accepting **Bitcoin** and **PaySafeCard** for paid plans. Listed at **Grade A** because Tuta occupies the **Proton-peer** slot in the privacy-email tier: same anonymous-account architecture, same E2EE story, German jurisdiction (vs Proton's Switzerland), structurally similar trust posture with operational differentiators worth understanding.\n\n**Background.** Tuta Mail was founded as **Tutanota** in **2011** by **Matthias Pfau** and **Arne Möhle** in Germany; rebranded to \"Tuta\" / \"Tuta Mail\" in 2023 (partly for international pronunciation, partly to expand the brand beyond just email). Operated by **Tuta SE** (registered German company, Hannover-based). The team is publicly identified — both founders maintain a public technical presence including conference talks at security and privacy conferences. **Open source** under the **GPLv3** license; clients at github.com/tutao/tutanota; server-side code is partially open-source (some components, not the full server stack — typical for hosted email providers). **Audit history**: independent security audits have been conducted; reports are linked from tuta.com. **Funding**: subscription revenue + occasional EU privacy-research grants; the company has been bootstrapped without VC investment, which the team highlights as a privacy-alignment signal (no shareholder pressure to monetise user data). **EU/German jurisdiction**: subject to GDPR; protected by EU's general data-protection framework but also operating under German law which has both privacy-protective elements (constitutional privacy rights) and some legal-process requirements (court orders for content disclosure when within the operator's reach — note Tuta cannot decrypt content even under court order due to E2EE).\n\n**What you trust.** **End-to-end encryption** — emails between Tuta users are E2E encrypted automatically (the server never sees plaintext); emails to/from external (non-Tuta) addresses can be E2E encrypted via password-protected encrypted emails (recipient gets a link + a shared password to unlock). **Open-source clients** — every official client (web, desktop, mobile) is open-source; you can audit what's running on your device. **GDPR jurisdiction** — German + EU data-protection law applies; user data is subject to GDPR's privacy framework. **Zero-knowledge architecture** — Tuta cannot read your encrypted emails; the encryption keys are derived client-side from your password. **No PII at signup** — you don't need to provide a real name, phone number, or recovery email; signup requires a Tuta-specific email + password + (optional) recovery code. **Audit history** — independent audits have been published. **Bitcoin + PaySafeCard payment** — privacy-respecting payment options that don't require linking to your real identity (in contrast to credit-card payment which links you to the payment processor). **What you don't trust**: **email metadata** — Tuta's E2EE protects subject lines and content for Tuta-to-Tuta and password-protected external emails, but the **standard email protocol metadata** (sender, recipient, timestamps, IP addresses of sending servers) is still visible at the protocol layer. **Light-KYC at signup** — Tuta will require account verification for new signups (sometimes requiring an email confirmation or rate-limit during high-volume signup periods); this isn't strict KYC but is a friction.\n\n**Operational specs.** **Platforms**: web at tuta.com, desktop apps for macOS/Windows/Linux, mobile apps for iOS and Android (both via F-Droid + Play Store). **Storage**: free tier 1 GB; paid plans from €3-€9/month for additional storage and features (multiple aliases, custom domain, increased calendar, etc.). **Aliases**: paid plans include multiple email aliases (e.g., `you+work@tuta.com`, `you+personal@tuta.com`); use aliases for service signups to compartmentalise identity. **Calendar**: end-to-end encrypted calendar built in — Tuta cannot read your calendar entries. **Contacts**: end-to-end encrypted contact storage. **Custom domain**: paid plans support `you@yourdomain.com` with Tuta as the backend. **PGP support**: Tuta's PGP integration is limited — Tuta uses its own E2EE for Tuta-to-Tuta and password-protected external; standard PGP exchanges with external contacts have UX friction. For pure PGP workflows, consider Proton Mail or a separate PGP-aware client. **Tor mirror**: `tutanotgkdf7ozqsrntmckrn7lnyzecwhylftcbvc46t6bx2m4srwcyd.onion`. **Payment methods**: credit card, PayPal, **Bitcoin**, **PaySafeCard**. **2FA**: TOTP and U2F (YubiKey, Solokey) support.\n\n**Philosophy.** Tuta Mail's editorial differentiator is the **bootstrapped-German-EU-privacy-email** posture. Proton Mail (Swiss jurisdiction, also open-source) is the canonical \"Mailfence/HushMail successor\" — well-funded by subscription + corporate, larger feature set, broader integrated suite. Tuta is structurally similar but bootstrapped (no VC), German rather than Swiss, smaller feature surface (intentionally focused on email + calendar + contacts; not expanding into VPN / Drive / Pass like Proton). For users who want a Proton peer with a German/EU jurisdiction preference (no Swiss-vs-EU concerns), and who prefer a smaller-team bootstrapped operator over a venture-funded suite, Tuta is the canonical pick. The trade-off: smaller feature set, fewer integration points, PGP UX is more limited than Proton's.\n\n**Grade rationale.** Grade A reflects: 14+ years of operational continuity (since 2011); German jurisdiction with GDPR framework; open-source clients (web, desktop, mobile under GPLv3); bootstrapped operator (no VC, no shareholder-driven monetisation pressure); **Bitcoin and PaySafeCard payment options** (rare in the privacy-email category outside Tuta); zero-knowledge end-to-end encryption for Tuta-to-Tuta + password-protected external emails; encrypted calendar + contacts (the suite is consistent on E2EE); audit history published; named operators (Matthias Pfau, Arne Möhle) with public technical presence; Tor onion mirror; cross-listed in Privacy Guides peer directory; F-Droid distribution for Android. Last verified 2026-05-11.\n\n**Useful when.** You want **end-to-end encrypted email** with a **Proton peer** that has a different jurisdiction (German/EU vs Swiss). You want to **pay with Bitcoin or PaySafeCard** for email — rare option in the privacy-email category. You're a **journalist or activist** needing encrypted email; pair Tuta with Tor Browser and you have a strong communication stack. You want a **bootstrapped operator** rather than a VC-funded one — the editorial signal here is that the company has structurally less pressure to monetise user data. You want **encrypted calendar + contacts** built into the email suite (E2EE on the full email-adjacent surface). You're **already in the GDPR jurisdiction** and want the legal framework that mandates privacy by default. You're **migrating off Gmail or Outlook** and want a privacy-first alternative with a polished UX.\n\n**Caveats.** **Email metadata is still visible** — standard email protocols don't encrypt sender, recipient, timestamps, or IP addresses of sending servers. Tuta's E2EE protects subject lines and content for Tuta-to-Tuta and password-protected external emails, but **From / To / Subject (for non-encrypted external mail) / Server timestamps** are protocol-level visible. For high-threat threat models, this metadata exposure matters. **PGP UX is limited** — Tuta uses its own E2EE for Tuta-to-Tuta + password-protected external; pure-PGP workflows with external contacts have friction. If you live in a PGP world (signed-and-encrypted emails to PGP-using contacts), Proton Mail's PGP integration is more polished. **Light-KYC at signup** — Tuta sometimes requires verification or rate-limits new accounts during abuse-prevention periods; this isn't strict KYC but is a friction. **Smaller feature set than Proton's suite** — no integrated VPN, no integrated cloud storage, no integrated password manager. If you want a one-stop suite, Proton has it; Tuta is focused email + calendar + contacts. **Custom-domain users get vendor lock-in over time** — if you stop paying or migrate away, your `you@yourdomain.com` emails to that custom domain stop arriving until you reconfigure DNS to another provider. Email portability is structurally harder than other categories. **German jurisdiction has nuances** — generally privacy-protective (constitutional rights, GDPR), but Germany has data-retention laws that have been on-and-off in the courts; the **content** of E2E-encrypted email is protected by encryption regardless, but metadata and account-creation IP logs may be subject to law-enforcement access under certain conditions. **No native IMAP/SMTP access** — Tuta doesn't expose standard IMAP/SMTP because the encryption is custom; you can't use Thunderbird or another mail client. Tuta provides its own clients on all platforms instead. **Free tier has limited storage and features** — 1 GB is sufficient for moderate use but heavy users will need a paid plan. **Mobile apps require periodic refresh** — Tuta's mobile apps fetch emails when opened or via push (where supported); for users wanting always-on background sync, the apps work but battery use is noticeable.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "open_source", "pgp_supported", "2fa_supported" ], "highlight_tags": [ "FREE TIER", "OPEN SOURCE" ], "fees": { "monthly_usd": 3.5, "summary": "Free tier 1 GB · paid €3–9/mo · BTC/PaySafeCard accepted" }, "fees_summary": "Free tier 1 GB · paid €3–9/mo · BTC/PaySafeCard accepted", "last_verified": "2026-05-11", "operating_since": "2014", "tenure_note": "Tuta (formerly Tutanota) public launch 2014; parent company founded 2011. Pre-2014 WHOIS is irrelevant — service launched 2014.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://tuta.com", "outbound_slug": "tutanota", "tor": "http://tutanotgkdf7ozqsrntmckrn7lnyzecwhylftcbvc46t6bx2m4srwcyd.onion" }, "also_listed_at": { "privacyguides": true } }, { "id": "0trace", "category": "exchanges", "subcategory": "Instant Swaps", "name": "0trace", "url": "https://xmr.club/exchanges/0trace", "twin": "https://xmr.club/llm/exchanges/0trace.txt", "tagline": "No-account instant crypto swap — no-KYC ToS (16 sections), own liquidity, per-order encrypted chat, $5K early-access caps.", "review": "**Not to be confused with [Null Route — ZERO TRACE](/exchanges/zerotrace)** — a separate swap-aggregator UI at cetoc.org (currently held). This listing is the own-liquidity instant-swap operator at 0trace.io.\n\n**2026-07-13 update: bumped B- → B.** In the six weeks since first listing, the operator resolved three of the five original B- anchoring caveats: (a) the early-access per-swap cap was raised from $5K to ~$90K (bundle now shows Min $30 / Max $89,910), (b) the `Onion-Location` HTTP header is now set on the clearnet response, giving Tor Browser users auto-discovery of the hidden service, (c) OrangeFren, a Monero-adjacent peer aggregator, now surfaces 0trace as a full quote entry in the swap comparison table (verified 2026-07-13 via https://orangefren.com/results/0.03/BTC@BTC/XMR@XMR/, competitive rate at -0.58% versus street), separate from the earlier partners-row logo. Two anchors remain and are inherently time-scoped: short curator-side tenure (~36 days since first probe) and zero accumulated user-review history in this directory. Grade A remains gated on the 90-day tenure milestone (natural re-check 2026-09-05) plus organic review accumulation. Historical rationale below is preserved for audit continuity.\n\nNo-KYC instant cryptocurrency exchange — swap BTC, USDT, XMR, ETH with no accounts, no registration, and per-order encrypted chat. Listed at **Grade B-** because the published ToS is one of the strongest trust documents in the directory (16 structured sections, 76KB, quotable no-KYC/no-AML language, explicit 72h data retention), two peer directories confirm the listing, and a Tor mirror is advertised — but the service is self-described as early-stage with per-transaction caps ($5K max) and the exchange has not yet accumulated a review history.\n\n**What it is.** No-account instant crypto exchange — no KYC, no registration, own-liquidity settlement with encrypted per-order chat. Listed at **Grade B-** on the strength of an unusually complete ToS and published operational principles; held under A by early-access caps and thin review surface.\n\n**Background.** The operator positions 0trace as an instant private cryptocurrency exchange in early-access development (operator-published, /about: 'The service is currently at an early stage of development. We are actively expanding execution paths, network coverage, and exchange scenarios.'). The exchange model is no-account — every order is identified solely by an order ID, and a built-in encrypted chat (AES-256-GCM) is tied to each order. No operator background, founding date, or jurisdiction is published — consistent with a privacy-first posture where the service is the surface and the operator stays absent. Contact channels include Jabber, SimpleX, email, encrypted in-app chat, and Twitter. A PGP key is published at /pgp for signed announcements. Community presence on Bitcointalk (EN) and Bits.Media (RU). **What you trust.** No-KYC: Operator-published ToS §2: '0trace does not perform Know Your Customer (KYC) verification. The user is never asked to submit a passport, ID card, driver license, selfie, proof of address, or any identity document. There is no questionnaire about source of funds, employment, residence, or political exposure. There is no document upload form anywhere in the service.' (https://0trace.io/terms). This is the most exhaustive no-KYC clause in any exchange ToS in the directory. No-AML on the user: Operator-published ToS §3: '0trace will never request Anti-Money-Laundering (AML) documentation from the user. The team will not ask for invoices, contracts, screenshots, conversation logs, or any explanation of where the user's deposit came from. AML screening is performed by 0trace on its own payout liquidity — our funds, not yours — so that what the user receives is clean. It is not a screening of the user.' This is a critical architectural distinction: AML is performed internally on the exchange's own reserves, not demanded from the user. Data retention: Operator-published ToS §4: 'Order data — destination address, deposit address, amounts, status — is permanently deleted 72 hours after the order reaches a final state (completed, expired, or canceled). The user can delete a finalized order earlier from the order page itself.' Chat: 'In-app chat messages are encrypted at rest with AES-256-GCM and are removed after 24 hours of inactivity. The user can delete the entire conversation at any time.' No IP logging: '0trace does not store IP addresses tied to order data, does not log user-agent strings against orders, and does not retain access logs beyond what is required for short-term operational debugging.' Order ID as sole credential: Operator-published ToS §8: 'The order ID is the only credential. There is no recovery. If the user loses both the order ID and the browser session in which the order was opened, the order cannot be retrieved by the team.' This is a strong privacy signal — no back-end recovery path means no administrative override to correlate past orders to a user. Verification documents: Operator-published ToS §11: Every order issues a signed Guarantee (at creation) and Receipt (at completion). Both verify locally at https://0trace.io/verify — 'Verification runs locally in the user's browser. The document is not uploaded anywhere. If the signature is valid, 0trace stands by the contents of the document.' This is the strongest consumer-protection mechanism in any exchange listing: a cryptographically signed, locally verifiable commitment that doesn't phone home. Liquidity model: Operator-published ToS §6: orders settle via 'direct on-chain payout from 0trace's own liquidity, or by routing through integrated DEX liquidity.' The FAQ confirms: 'We use our own liquidity through two execution paths.' The /about page adds: 'We operate using our own liquidity — no third-party desk processes your order.' Post-exchange unlinkability: 'the connection between the user's original coins and the payout coins is severed.'\n\n**Operational specs.** Fee structure: Operator-published ToS §5: Service fee + network fee included in the quoted Receive amount — no hidden surcharges. Two rate types: FIXED (locked at creation) and FLOAT (recalculated at payout). Minimum order: $1 USD equivalent. Early-access limits: min $30, max $5,000 per swap (homepage). The 1% service fee is visible in the live exchange widget (operator-published, homepage exchange interface). Asset coverage: BTC, USDT (TRC20), XMR, ETH — visible from live exchange widget, quick-swap presets, and page titles. TRON network used for USDT. Coin list is not exhaustive but covers the four core assets typical of instant-exchange use. Tor mirror: Advertised at `http://n55kxqrra37apxjlqirvgxcodeq7q5vp7kez6d2cngeo2ksfo6yzn5qd.onion/` (operator-published, FAQ and ToS §10). The clearnet `Onion-Location` header is NOT set — so the onion is manual-discovery only. ToS §10 notes: 'Tor traffic is routed only to the public surface — internal operator surfaces remain unreachable over the hidden service.' API documentation: Published at `/api` — a substantial API surface for programmatic exchange. Title: 'Private crypto exchange API | 0trace'. This is the largest API doc page by byte count in any directory listing. Partner program: A partner login exists at `/partner/login` — suggesting a B2B/affiliate tier for volume or integration partners. Contact channels: Encrypted in-app chat (per-order, AES-256-GCM), Jabber (0trace@exploit.im), SimpleX, email (hello@0trace.io), Twitter (@0trace_io). Four encrypted-capable channels. PGP key published at /pgp for signed operator announcements. Verification tool: Standalone page at /verify — paste a signed Guarantee or Receipt document, verification runs locally in the browser. A 'Guarantee confirms the deposit address and quoted order details before payment. A Receipt confirms the completed exchange after payout.' (operator-published, FAQ).\n\n**Operator philosophy.** 0trace's published material reads as an engineer's privacy exchange — every claim in the ToS is falsifiable (72h deletion, no IP logging, AES-256-GCM chat, local document verification, own liquidity). The FAQ answers 'I lost my order ID. Can you help?' with a flat 'No' followed by the structural reason. The /about page states the architecture plainly: 'No unnecessary data collection, analytics, external metrics, or third-party monitoring systems. Privacy is ensured through the architecture of the service and its operating principles.' The absence of a jurisdiction claim, operator background, or founding date is not a gap — it's consistent with the service's premise that the exchange IS the surface. The use of `exploit.im` as the Jabber domain and the `.io` TLD are the only hints of operator identity, neither of which is identifying.\n\n**Support channels.** Four channels surfaced from the homepage: email at `hello@0trace.io` (`partners@0trace.io` for partnerships), Twitter at [`@0trace_io`](https://x.com/0trace_io), SimpleX via `smp11.simplex.im`, and Jabber at `xmpp:0trace@exploit.im`. The `exploit.im` XMPP server is a long-running underground community host with a mixed reputation in the privacy-tech world — for end-user support traffic it works, but the choice is itself a posture signal worth noting alongside the trust narrative.\n\n**Partnerships.** Featured as a sponsor on OrangeFren (orangefren.com) — 0trace logo displayed in the partners row on OrangeFren's homepage and quote pages, linked via a referral URL (operator-published partnership, curator-verified 2026-07-13). This is a sponsorship / featured-partner slot rather than an aggregation-source integration — OrangeFren's swap widget does not surface 0trace as one of its routed quotes.\n\n**Grade rationale.** Listed at **Grade B-** because: (1) two independent peer directories confirm the listing (kycnot.me + monerica.com. Grade A is withheld because: (a) the service is self-described as early-stage with $5K per-swap caps (operator-published, /about: 'early stage of development' / homepage: 'early access limits'); (b) zero user reviews on any platform yet — the exchange has not accumulated a trust history; (c) the `Onion-Location` header is not set, making the Tor mirror manual-discovery only; (d) no privacy policy page exists independently (privacy/data-retention is embedded in ToS §4). Among instant exchanges, graduating from early-access caps, accumulating a review history, and publishing `Onion-Location` auto-discovery would justify A.\n\n**Tenure.** Publicly verified on xmr.club since 2026-06-07 — 27 days as of this note. Grade B− reflects short tenure alongside otherwise-clean structural signals — the minus is anchored to that short window, not to any specific operational concern. Tenure counts against grade lift on exchange-class listings; a 90-day re-check is scheduled for 2026-09-05 to reassess.\n\n**Caveats.** The 'own liquidity' claim (ToS §6, /about, FAQ) is central to the trust model but cannot be independently verified publicly. The exchange could route orders through a third-party desk without the user being able to detect it — the settlement path is opaque. This is true of all instant exchanges; 0trace at least publishes the claim in structured ToS language. An instant exchange that receives deposits, holds funds during swap execution, and routes payouts is custodial during the exchange window. 'Non-custodial' is inaccurate. The absence of a standalone privacy policy page is notable given the richness of the ToS. All privacy-relevant claims (data retention, encryption, logging) live in ToS §4 — integrated, quotable, but not a dedicated privacy document. The.legal_links.privacy: `/#/privacy`), suggesting a planned privacy page exists as a route but has no content. The `exploit.im` Jabber domain is an unusual choice — it carries a security/hacking connotation that may put off risk-averse users. It may be a personal or legacy domain of the operator. The functional email (hello@0trace.io) uses the primary domain and is the recommended contact method.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B", "privacy": "Anonymous-by-architecture: no accounts, no email required, order-ID as sole credential, encrypted per-order chat, 72h data retention on completed orders. Onion mirror is live and auto-discoverable via the Onion-Location header on the clearnet response (2026-07-13 update). Verifiable Guarantee + Receipt documents sign every order. AML is performed by the operator on their own payout liquidity, not on the user.", "trust": "Six weeks of curator-side observation with a responsive operator: three of five initial grade-B- caveats resolved (per-swap cap raised $5K→$90K, Onion-Location auto-discovery, OrangeFren peer-aggregator surfacing 0trace as a full quote entry). ToS remains one of the strongest structured trust documents in the exchanges category. Remaining trust reservations: short curator-side tenure and zero accumulated user-review history in this directory — both time-scoped rather than structural." }, "grade": "B", "kyc_tags": [ "anonymous_signup", "no_kyc" ], "feature_tags": [ "tor_mirror", "api_available" ], "highlight_tags": [ "NO-KYC", "XMR", "BTC", "TOR" ], "fees": { "summary": "Per-swap (rate set at quote) · own liquidity (not aggregator) · $5K early-access cap per transaction · BTC/USDT/XMR/ETH" }, "fees_summary": "Per-swap (rate set at quote) · own liquidity (not aggregator) · $5K early-access cap per transaction · BTC/USDT/XMR/ETH", "last_verified": "2026-07-13", "operating_since": "2026-05-03", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://0trace.io", "outbound_slug": "0trace", "tor": "http://n55kxqrra37apxjlqirvgxcodeq7q5vp7kez6d2cngeo2ksfo6yzn5qd.onion/", "contact_email": "hello@0trace.io", "tos": "https://0trace.io/terms", "aml": "https://0trace.io/aml", "api_docs": "https://0trace.io/api", "simplex": "https://smp11.simplex.im/a#OZNLsxcV3alnyXcWUnd6m-BBPGbyKWys6ajTbxwziyg", "xmpp": "xmpp:0trace@exploit.im", "twitter": "https://x.com/0trace_io" }, "also_listed_at": { "kycnot": true, "monerica": true, "web3privacy": true } }, { "id": "67-tax", "category": "exchanges", "subcategory": "Instant Swaps", "name": "67.tax", "url": "https://xmr.club/exchanges/67-tax", "twin": "https://xmr.club/llm/exchanges/67-tax.txt", "tagline": "No-KYC, no-registration crypto exchanger running on its own reserves — BTC · XMR · USDT · ETH, around the clock. AML-screened deposits; custodial while the swap settles.", "review": "**A no-registration exchanger on its own reserves.** 67.tax swaps BTC, XMR, USDT and ETH with no account and no KYC, running — by its own description — *\"on its own reserves and its own payment gateway.\"* It surfaces a live reserve figure and rates up front (XMR settles at 3 confirmations), which is more operational honesty than most thin swaps show. Optional accounts exist (there's a login), but registration isn't required to trade.\n\n**AML-screened — clean funds fine, flagged funds bounced.** Deposits are risk-monitored: if the AML system flags a deposit, the service *returns the funds without demanding identity verification* rather than freezing them. That's the better-behaved end of AML handling, but it means a \"complicated-history\" coin can be refused — which is exactly what a C on this shelf signals. Custodial while the swap settles, as with any instant exchanger.\n\n**Tenure caveat — old domain, new exchange.** The domain has a 2022 Wayback hit, but that snapshot was a **parked/Flash page**, not an exchange; it then went dark until being repurposed as this no-KYC exchanger in 2026 (kycnot.me independently marks it *\"operating <3 months\"*). So it gets **no tenure credit** — we grade it as the new service it is. kycnot lists it at 8/10 with no reported incidents. Own-reserves transparency is a genuine plus; the AML-screening, custody, and thin track record hold it at **C**. A clean curator test-swap firms it up.", "translation_locale": "en", "rating": { "grade": "C", "trust": "No-KYC exchanger on its own reserves + own payment gateway; publishes a live reserve figure and rates. AML-screened deposits (refunds-not-ID on flag). NEW as an exchange — 2022 domain was a parked/Flash page, dark until repurposed in 2026 (kycnot: <3mo), so no tenure credit. kycnot 8/10, no incidents. Custodial during swap.", "privacy": "No registration, no KYC to trade. AML transaction-monitoring on deposits means flagged funds are screened (returned without ID, not frozen). Custodial handling; optional accounts exist. No Tor/I2P mirror surfaced.", "ux": "Clean multi-pair swap (BTC/XMR/USDT/ETH) with live rates, reserve figure and fee breakdown shown up front. XMR at 3 confirmations. Around-the-clock. No account needed to trade." }, "grade": "C", "kyc_tags": [ "NO-KYC" ], "feature_tags": [ "xmr", "no_kyc", "swap", "own_reserves", "multi_asset", "aml_screened" ], "highlight_tags": [ "XMR", "NO-KYC", "NO-REGISTRATION", "OWN-RESERVES", "AML-SCREENED" ], "fees": null, "fees_summary": null, "last_verified": "2026-09-08", "operating_since": "2026", "tenure_note": "Domain has a 2022 Wayback hit but it was a parked/Flash page — dark until repurposed as a no-KYC exchange in 2026 (kycnot independently: 'operating <3 months'). NO exchange-tenure credit; graded as a new service. C = AML-screened swap class (clean funds fine, flagged bounced) + new + custodial. Lifts on tenure + clean curator test-swap.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://67.tax", "outbound_slug": "67-tax" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "anonexch", "category": "exchanges", "subcategory": "Aggregators", "name": "AnonExch", "url": "https://xmr.club/exchanges/anonexch", "twin": "https://xmr.club/llm/exchanges/anonexch.txt", "tagline": "No-KYC swap aggregator since 2023 — compares rates across multiple exchangers for XMR, BTC, ETH, USDT, LTC. No account, no-logs claim, Tor mirror. Honest note: 'non-custodial' is first-party only — partner exchangers hold funds mid-swap.", "review": "**A no-KYC swap aggregator.** AnonExch compares rates across multiple upstream exchangers and routes your trade to the best one — Monero, BTC, ETH, USDT and LTC among the pairs. No account, no email: pick a pair, get a deposit address, send your coins. It publishes a **Tor mirror** and advertises a no-logs policy (no IP addresses, no swap history). Operating since December 2023 (~20 months), with no token or presale attached — a straightforward swap tool, not a funnel.\n\n**What \"non-custodial\" actually means here.** Like every aggregator, AnonExch doesn't hold your funds *itself* — but it doesn't settle your swap either. It hands the trade to a partner exchanger, and **that** partner custodies your coins during the swap and could, in principle, demand ID or freeze funds on its own risk rules. So read \"non-custodial\" as *no first-party custody*, not *no custody at all*. The privacy of the trade is only as strong as the upstream exchanger it routes you to.\n\n**Unverified claims.** The no-logs policy is a stated policy, not something we've independently audited, and we haven't run a test swap or mapped the partner set. Treat both as operator claims until verified.\n\n**Useful when.** You want a no-account, no-KYC front-end that shops multiple exchangers for a rate, and you value the Tor mirror + no-logs posture — accepting that the actual settlement (and its risk) sits with whichever partner it routes to.\n\nGraded **C**: a legitimate, reasonably-tenured no-KYC aggregator with a clean feature set — held at the exchange default until the no-logs claim, partner set, and a real swap are verified, and peer directories corroborate. Path to B: that verification plus a track record.", "translation_locale": "en", "rating": { "grade": "C", "trust": "No-KYC swap aggregator operating since 2023-12 (~20mo). Aggregates rates across multiple upstream exchangers; publishes a Tor mirror. No token/presale. No-logs policy is stated, not independently audited; partner set + a test swap not yet verified.", "privacy": "No account, no email, no-KYC. No-logs policy claimed (no IP, no swap history). NOT first-party custodial, but routes to partner exchangers that hold funds mid-swap and can apply their own risk rules — privacy is only as strong as the upstream partner.", "ux": "Pick a pair, get a deposit address, send coins; compares rates across exchangers. XMR/BTC/ETH/USDT/LTC. Clearnet + Tor mirror. No maximum limits stated." }, "grade": "C", "kyc_tags": [ "no_kyc", "anonymous_signup" ], "feature_tags": [ "aggregator", "tor", "multi_chain", "no_account" ], "highlight_tags": [ "XMR", "NO-KYC", "AGGREGATOR", "TOR", "NO-LOGS", "EST-2023" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-27", "operating_since": "2023-12", "tenure_note": "Domain registered 2023-12-15; Wayback first-seen 2023-12 (~20 months). No token/presale.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://anonexch.io", "outbound_slug": "anonexch", "tor": "http://zpf5ppa55rjhemfezfinumr3zrumhlqrsseulxts6d3f6jxkjqbi36yd.onion" }, "also_listed_at": { "kycnot": true } }, { "id": "anonkyc", "category": "exchanges", "subcategory": "Order-Book", "name": "AnonKyc", "url": "https://xmr.club/exchanges/anonkyc", "twin": "https://xmr.club/llm/exchanges/anonkyc.txt", "tagline": "Multi-asset CEX with no-KYC trading under stated limits — Monero, Zcash, Dash, Zano, Dero on the front-page bench.", "review": "**AnonKyc positions itself as a no-KYC multi-asset order-book CEX with an unusually intact privacy-coin bench.** Front-page pairs include Bitcoin, Monero, Zcash, Dash, Zano, Dero, Grin — a set most Swiss-registered platforms have delisted under FINMA pressure — alongside Tether Gold (XAUT) covering the platform's \"Stocks & Gold\" marketing claim, plus a wider tail of memecoin pairs (CATWIF, MARYJ, GLUE, WOW, CPX, VALORA, CCX, ANON). Fifty-seven pairs total, live bid/ask depth on the XMR/USDT book, candlestick chart, limit / market / stop-limit orders. 0.1% maker fee.\n\n**Grade C** on the CEX-shape order-book shelf, one below NonKyc.io. The gap is anchored in three things:\n\n1. **New operator.** WHOIS registers `anonkyc.com` as re-registered 2026-02-21 after a prior gap during which the domain hosted an unrelated project (\"ZK KYC\"). NonKyc, by comparison, has a multi-year continuous curator-side track record. Under xmr.club's methodology, new no-KYC exchanges default to C regardless of how clean the surface looks — the reservation is the lack of a track record, not a specific structural flaw.\n2. **Additional risk vectors NonKyc does not carry.** A **Launchpad** (token-issuance platform), an **Earn** section (yield / staking), and a native **ANON platform token** with a profit-share utility. Each is standard for the KuCoin / MEXC generation of CEXes, and each adds a token-price-speculation surface that the ranked no-KYC-swap shelf specifically excludes. The token traded at $0.07 at the time of listing — treat any \"earn from platform profits\" pitch as investment risk, not deposit safety.\n3. **Welcome-bonus incentive economy.** The site landing offers up to 150 USDT for signing up, which is the reward-loop pattern used by every KYC-triggered CEX to bootstrap balances.\n\n**What sits on the positive side of the ledger.** The full privacy-coin bench (XMR, ZEC, DASH, ZANO, DERO, GRIN) is not the shape of a Swiss-compliant platform slotting Monero as a token — it is a deliberate editorial position, and one the operator publishes loudly (\"Beyond Crypto. Trade Global Assets Without KYC.\"). The company is legally registered as AnonKyc in Switzerland 🇨🇭 — a real business surface, not a fly-by-night. A public REST API endpoint (`/api`) exists behind auth. Contact channels: email `support@anonkyc.com`, X `@anonkyc` (verified, 1,666 followers — worth noting the handle was rebranded from a pre-existing 2014-vintage account rather than newly minted), Telegram `@anonkyc`, `@anonkycofficials`, `@anonkycrewardshub` (rewards / referral). BlueSky at `anonkyc.com`. Discord invite `jUEBJhgsmq`.\n\n**No-KYC posture — the honest read.** The tagline and marketing are unambiguous: this is a light-KYC platform. The operator categorizes their own service as light-KYC rather than non-KYC — treat that as honest disclosure. AnonKyc's own UI surfaces *\"Notional Limit Reached\"*, *\"Account Exposure Limit\"*, and *\"Daily Volume Limit Reached\"* errors above certain volumes, which means the KYC threshold does exist above the stated limit — below the ceiling the operator does not ask for ID, above it they will. Same architecture as NonKyc; the identical framing (`no-KYC trading under stated limits`) applies here.\n\n**Account model.** Sign-up requires an email address, and 2FA is required on the account for trading. There is no self-custody path — you deposit into an exchange-controlled wallet, trade against the book, and withdraw. The order-book model is inherently custodial during the trading window. That posture is fine for the CEX shelf, but readers looking for no-account instant swap should pick 0trace, exch.cx, or a similar shelf-mate instead.\n\n**Path from Grade C.** A grade lift toward B would require, in aggregate: (a) a published proof-of-reserves attesting to the exchange's own liquidity claim (as NonKyc has done), (b) 12 to 24 months of clean curator-side observation without loss reports, fund-freeze incidents, or brand-hijack complaints, (c) sustained privacy-coin bench without regulatory delisting pressure (FINMA moves would be a leading indicator). No grade lift on ANON token price movement — the token surface is priced-in as risk, not as a merit signal.\n\n**Verdict.** A polished, legitimately-designed, Swiss-registered light-KYC order-book CEX with a rare-in-2026 intact privacy-coin bench. Belongs on the shelf beside NonKyc, one grade lower to reflect the shorter tenure and the extra token / launchpad / earn / welcome-bonus surface. If the operator publishes a proof-of-reserves and sustains this bench for another year, revisit for B.", "translation_locale": "en", "rating": { "grade": "C", "trust": "Swiss legal entity (registered as AnonKyc), verified X handle (repurposed 2014 rebrand, 1,666 followers), 19-month Wayback tenure, kycnot community-contributed listing at 7/10 (not team-reviewed). Real order-book architecture with 57 pairs. Grade C reflects the shorter curator-side observation window plus the additional risk surface (Launchpad, Earn, native ANON token, welcome-bonus incentives) that heavier B-graded peers like NonKyc do not carry.", "privacy": "Light-KYC platform by the operator's own disclosure: no-KYC below stated volume limits, above the limit the UI surfaces \"Notional Limit Reached\" / \"Account Exposure Limit\" / \"Daily Volume Limit Reached\" and the platform asks for ID. Email + 2FA required for account creation. Custodial during the trading window (order-book model). Marketing pages ship a Google Analytics ID and Google Ads ID at listing time — the checkout surface is not Google-free.", "ux": "Polished trading UI with candlestick chart, order book, Limit / Market / Stop-Limit orders, order history, 24/7 support claim. Sidebar with 57 pairs and a searchable pair-selector. Full trading experience on par with mid-tier CEX competitors." }, "grade": "C", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "NO-KYC", "ORDER-BOOK", "PRIVACY-COIN-BENCH", "MULTI-ASSET" ], "fees": null, "fees_summary": null, "last_verified": "2026-07-13", "operating_since": "2026-02", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://anonkyc.com", "outbound_slug": "anonkyc", "twitter": "https://x.com/anonkyc", "telegram": "https://t.me/anonkyc", "bluesky": "https://bsky.app/profile/anonkyc.com", "discord": "https://discord.gg/jUEBJhgsmq", "api_docs": "https://anonkyc.com/api", "contact_email": "support@anonkyc.com" }, "also_listed_at": { "monerica": true } }, { "id": "b2p-central", "category": "exchanges", "subcategory": "Aggregators", "name": "B2P Central", "url": "https://xmr.club/exchanges/b2p-central", "twin": "https://xmr.club/llm/exchanges/b2p-central.txt", "tagline": "Bitcoin-first P2P aggregator + cross-service swap-rate finder — compares live offers across HodlHodl, Bisq, RoboSats and a wider swap set. No accounts, no cookies, no trackers. Bitcoin-native (not Monero-native); XMR appears only via the swap-comparison layer's downstream services.", "review": "**What it is.** Read-only aggregator that indexes P2P Bitcoin offers across the major fiat-to-BTC venues (HodlHodl, Bisq, RoboSats, and others) plus a swap-rate finder that fans quotes out across multiple swap services and returns the best headline rate for a given pair. No account, no signup, no login. The service itself doesn't touch funds — it's a comparison surface that hands you off to the actual venue.\n\n**Category posture.** This is a **Bitcoin-first tool** — the P2P side is exclusively BTC, and the swap side compares rates against providers that mostly cover BTC pairs. XMR relevance is second-order: it's whatever XMR-supporting swap services happen to be in the compared set. If you're looking specifically for BTC → XMR swap discovery, the tool covers it as a pair among many; if you want a Monero-native swap comparison, this is not the primary tool.\n\n**Data collection.** The homepage states plainly: *\"The protection of your personal data is your priority, not ours. This service is 100% free, 0% cookie, 0% tracker.\"* No visible advertising, no analytics scripts loaded on the initial render. A public API is offered for programmatic access to the latest buy/sell offers.\n\n**Peer position.** kycnot.me lists at **7/10** (community-contributed). monerica has not yet indexed. Only one peer-directory anchor.\n\n**Funding model.** Non-commercial framing — the operator asks for Nostr Zaps, Lightning tips (`b2p-central@btcpay.nisaba-solutions.com`), Geyser follows, and referral clicks. Also publishes a BTCPay plugin for merchants. No listed corporate entity on the homepage.\n\n**Why Grade C.** New exchange-adjacent listings default to C on xmr.club regardless of how clean the publishable surface looks — the loss-asymmetry rule applies even when the tool itself is read-only, because readers who click through to a compared P2P venue are still going to move money based on our positioning of the aggregator. kycnot 7/10 is a mid-tier community score, monerica hasn't picked it up, and there's no operator identity beyond the Lightning address. Path to B: monerica corroboration, a second peer-directory listing, and a curator observation window on the API's uptime + rate-accuracy vs the underlying venues.\n\n**Reader caveats.** (a) Positioning as a *\"Bitcoin private trading\"* tool is accurate — this is not a Monero-first surface. (b) The compared providers include venues we do and don't list; the aggregator's coverage is independent of our directory's grades. (c) A tool like this is only useful if its rate data is current — worth spot-checking a quote against the underlying venue before you actually trade any meaningful size.", "translation_locale": "en", "rating": { "grade": "C" }, "grade": "C", "kyc_tags": [ "anonymous_use" ], "feature_tags": [ "aggregator" ], "highlight_tags": [ "BITCOIN-FIRST", "P2P-AGGREGATOR", "SWAP-COMPARISON", "NO-ACCOUNT", "NO-COOKIES", "PUBLIC-API" ], "fees": null, "fees_summary": null, "last_verified": "2026-07-12", "operating_since": "2026", "tenure_note": "No archive.org history prior to July 2026 — service surface confirmed live at listing time (2026-07-12) but pre-listing tenure cannot be independently corroborated. Site currently ships only the homepage (no /about, /privacy, /terms). Listed with these gaps disclosed rather than deferred.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://b2p-central.com", "lightning": "lightning:b2p-central@btcpay.nisaba-solutions.com" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "baltex", "category": "exchanges", "subcategory": "Instant Swaps", "name": "Baltex", "url": "https://xmr.club/exchanges/baltex", "twin": "https://xmr.club/llm/exchanges/baltex.txt", "tagline": "Cross-chain instant swap aggregator — 10,000+ tokens across 200+ networks with native XMR pairs. Notable: accepts very small swap amounts (few dollars) where most instant-swap engines require higher minimums. Front-page markets \"Monero-grade privacy\" and \"Stay Private\"; operator also publishes a dedicated AML/chain-analysis product page that screens deposits against 150+ risk categories including mixers, darknet markets, and sanctions clusters. Trigger criteria unpublished — at-risk shape for privacy-focused users on non-trivial amounts.", "review": "**Baltex is a cross-chain instant swap service** — 10,000+ tokens across 200+ networks with native XMR / BTC / ETH / USDT pairs. Fee model is 3–4% per pair, published in the reserve panel. Rate model is Fixed Rate (15-minute lock) or Float Rate. Custodial during the swap window — funds are held while cross-chain routing completes. No mandatory account signup for standard swaps. Card payments (Visa / Mastercard / Apple Pay) advertised as coming soon; if shipped, expect card-network KYC to bind identity to the transaction the way it always does.\n\n**Genuine reader-facing differentiator.** Baltex accepts very small swap amounts — swaps in the low-single-digit-USD range are executable, where most instant-swap engines enforce higher minimums for XMR pairs. Useful for one-off small-value privacy swaps (paying for a VPN, hosting invoice, or testing the service with real funds before committing volume) without needing to consolidate a bigger pot just to hit a minimum.\n\n**Operating channels.** Clearnet only at time of listing (no published .onion). Trustpilot 4.5, seven-language UI (EN / JA / FR / TR / ZH / ES / DE / RU), self-reported \"7,364 private swaps last month\" figure on the front page.\n\n**Two contradictory postures on the same website.** Front-page marketing leans hard on privacy language — \"Stay Private\", \"Monero-grade privacy\", \"No explorer Trace\", \"Private Swaps\". The /aml page tells a different story. Baltex publishes a full AML compliance product page marketing chain-analysis capabilities: 150+ tracked risk categories, machine-learning behavioral profiling, screening against sanctions, darknet markets, mixers, fraud rings, stolen funds, and high-risk clusters. Stated function: \"prevent high-risk funds from entering your ecosystem\" and \"approve safe transactions\". Enrichment sources include \"live insights from global anti-fraud agencies, law-enforcement reports\".\n\nTwo modes could explain what this means for your specific swap:\n\n- **Narrow dirty-fund screening.** They screen only for genuine hits — sanctions matches, known drainer wallets, confirmed-stolen fund clusters. Rejection is pre-deposit; everyone else swaps privately as advertised. This is defensible anti-abuse work that most privacy-preserving operators run quietly.\n- **Shotgun-KYC-on-flagged-funds.** They use the 150+ categories to flag \"risky\" transactions mid-flow (Monero deposits, mixer output, darknet-adjacent chain history) and require identity verification to release funds. This is the pattern documented on other operators recently; completing KYC does not guarantee funds are returned.\n\nTrigger logic is not published, so which mode applies to your specific swap is not knowable pre-deposit. An honest operator running only narrow screening has every reason to publish the trigger thresholds — it protects users AND the operator's own reputation. The absence of published criteria leaves the shotgun-KYC-on-flagged-funds interpretation on the table.\n\n**Peer signal.** Listed on kycnot.me (\"Best-rate swaps for 1000+ cryptoassets — DEX routing and Monero-backed privacy\"). Rated Grade B by Trocador — meaningful as an operational-reliability signal from an aggregator with revenue skin in the game, but a Trocador grade measures uptime, rate quality, and swap completion, not reader-facing privacy honesty. No fund-stealing incident on record. Not yet tracked by kyc.rip's chain-observation layer — no first-party settlement-timing data available at listing time.\n\n**Reader advice.** Suitable for routine small-to-medium swaps of clean-provenance funds where the front-page \"Monero-grade privacy\" claim is likely to hold. Not suitable for large amounts or funds you're depositing specifically to escape chain-analysis — those are exactly the categories the operator markets themselves as detecting. If your amount matters, route via an atomic-swap engine ([Haveno](/exchanges/haveno)) or a self-custody P2P engine ([Bisq](/exchanges/bisq), [Bisq Easy](/exchanges/bisq-easy), [RoboSats](/exchanges/robosats)) where no operator holds funds during the process. If you must use Baltex at scale, keep amounts under any plausible flagging threshold and test-flow a small swap first from the same source wallet.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [], "feature_tags": [ "aml_screening_undisclosed_triggers", "custodial_during_swap", "cross_chain", "low_minimum_amount" ], "highlight_tags": [ "MANY-COINS", "CROSS-CHAIN", "LOW-MIN" ], "fees": { "summary": "3–4% per pair · fixed 15-min lock or float rate" }, "fees_summary": "3–4% per pair · fixed 15-min lock or float rate", "last_verified": "2026-08-10", "operating_since": "2025-01", "tenure_note": "Independently verified: monerica.com/site/baltex records Founded 2025-01-09 (operator claim), Added On 2025-12-09 (independent floor), Last Updated 2026-07-24. RDAP + Wayback returned no data for .io TLD.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://baltex.io", "outbound_slug": "baltex", "contact_email": null, "twitter": null, "telegram": null, "affiliate": "https://app.baltex.io?_bpLink=7f3fa48c-a68523bf856f3df8" }, "also_listed_at": { "kycnot": true, "trocador": "B", "monerica": true } }, { "id": "bisq", "category": "exchanges", "subcategory": "P2P", "name": "Bisq (classic)", "url": "https://xmr.club/exchanges/bisq", "twin": "https://xmr.club/llm/exchanges/bisq.txt", "tagline": "The original P2P BTC↔fiat exchange. Multisig escrow, desktop app, no KYC.", "review": "Bisq (classic) is the **original, battle-tested P2P BTC↔fiat exchange protocol** — multisig escrow with arbitrator-mediated dispute resolution, decentralised peer-to-peer trading over Tor, desktop application running locally on your machine, no KYC under any circumstances. Listed at **Grade A** for the structural strengths (protocol-escrow, named-arbitrator dispute path, multi-year operational history) and for being the canonical reference P2P exchange in the privacy-tooling space. **Critical context: a 2026-05 v1-protocol exploit is in active remediation** — see the dedicated section below. **Recommended posture**: update to patched v1.9.x+ before any trade, and prefer Bisq Easy (Bisq 2) for new trades where it covers your use case.\n\n**Active incident (2026-05-01).** On 2026-05-01 a **v1 trade-protocol exploit** was disclosed and exploited — a **missing validation on negative network-fee values** allowed an attacker to drain approximately **11.59 BTC** from active/open offers. The Bisq Network responded by **halting trading via an emergency version flag** until clients updated to a patched version. The post-mortem is published at bisq.network/blog/security-incident-post-mortem/. **Curator advice**: (1) update to **Bisq v1.9.x+** (the patched line) before any trade; (2) verify signed releases before running (Bisq's signed-release workflow is documented on the website); (3) for new trades, **prefer Bisq Easy (Bisq 2)** which uses a different protocol surface and was not affected by this v1-specific exploit. The Grade A is held *with the incident context flagged* — the exploit is severe but the protocol's response (emergency-flag halt, public post-mortem, patched release) is the response we'd want; the underlying lesson is that complex protocol-escrow surfaces have a non-trivial attack surface, and Bisq Easy's reputation-gated simpler-surface model is the lower-attack-surface alternative for small trades.\n\n**Background.** Bisq (originally \"Bitsquare\") was launched as an open-source desktop P2P Bitcoin exchange in 2014 by **Manfred Karrer**, with the design goal of providing decentralised non-custodial Bitcoin trading without a central operator. Renamed to \"Bisq\" in 2017, the project transitioned to a contributor-DAO governance model with the **BSQ token** aligning long-term contributor incentives. Has been operating continuously for 10+ years — the longest-running decentralised P2P Bitcoin exchange. Open source under the AGPL license. The protocol uses **2-of-2 multisig escrow** (buyer + seller signatures, with arbitrator key as a third-party fallback for disputes) and operates over **Tor by default** — every Bisq client routes traffic through Tor onion services for both peer discovery and trade communication. **Bisq Easy** (a.k.a. Bisq 2) is the newer streamlined chat-based mode launched in 2023; it's listed separately at xmr.club under id `bisq-easy`. The two coexist — Bisq classic for protocol-escrow heavy-duty trades (typically $1k+), Bisq Easy for reputation-gated small trades ($50-$500).\n\n**What you trust.** **2-of-2 multisig escrow** — both buyer and seller deposit BTC into a multisig wallet at trade open; cooperation between buyer and seller releases funds at trade complete; if the trade fails, the **arbitrator's key** can co-sign the release based on evidence from the dispute. **Arbitrators are named community members** — not anonymous oracles but Bisq Network contributors with public reputation and a deposit at stake. **Tor by default** — every Bisq client routes through Tor; no operator-facing IP leakage, no centralised meeting point that could be subpoenaed. **No central operator** — Bisq Network is a contributor-DAO with no company to subpoena; the application is open-source AGPL and the protocol is the only enforcement layer. **Reputation-stakes for arbitrators** — arbitrators have published identities and are accountable for their decisions; an arbitrator who acts in bad faith loses their position and deposit. **The 2026-05 incident exposed**: that the v1 trade protocol had a missing validation that allowed a fee-related attack. The trust model wasn't structurally broken (the multisig escrow still works as designed) but the protocol surface had a specific bug that needed remediation. Post-remediation, treat Bisq classic as \"battle-tested with a recent visible patch cycle.\"\n\n**Operational specs.** **Platform**: desktop app (macOS, Windows, Linux) — no web client, no mobile. Distributed via bisq.network with signed releases. **Trading pair**: BTC ↔ fiat (USD, EUR, GBP, JPY, and many local currencies) + BTC ↔ many altcoins (LTC, BCH, etc.; note Bisq classic supports altcoin pairs that Bisq Easy doesn't). **Payment methods**: SEPA bank transfer, F2F (face-to-face) cash, gift cards (specific brands), Revolut, Wise, Zelle (US), Interac e-Transfer (Canada), and many region-specific options. **Trade size**: $200-$50k+ typical; larger trades take longer to clear (multisig + arbitration timeline is structurally days-not-minutes). **Trade timeline**: hours for fast payment methods (SEPA fast, Wise) to days for slower fiat-clearing methods; the protocol is intentionally not optimised for speed. **Fees**: 0.1-0.7% trade fee (BSQ holders pay the lower end via fee-discount mechanism); plus multisig on-chain costs (BTC fees). **No KYC under any circumstances** — there is no KYC mechanism in the protocol; identity is a persistent pseudonym tied to your trade history and (optional) BSQ holdings. **Arbitration**: named arbitrators with public identities; disputes escalate through a defined process with evidence submission and arbitrator decision. **Open source AGPL** — anyone can audit; anyone can fork.\n\n**Philosophy.** Bisq classic's editorial differentiator is the **protocol-escrow-with-arbitration** model — the strongest trust posture in any P2P fiat exchange. Bisq Easy uses reputation (no protocol escrow; fast for small trades). RoboSats uses Lightning hold-invoices (protocol escrow without on-chain cost; fast but Lightning-only). Bisq classic uses on-chain multisig with named arbitrators (heavyweight but bulletproof for large fiat→BTC trades). The trade-off: operational overhead — running the desktop app, waiting for multisig confirmations, accepting that disputes take days, accepting that the trade-timeline is hours-to-days not minutes. For large fiat→BTC trades where the trust math matters more than the speed, Bisq classic is the canonical pick. The 2026-05 incident is a reminder that even battle-tested protocols have non-zero attack surface; the response (rapid halt + patch + public post-mortem) is the model the privacy ecosystem hopes for from incident-handling.\n\n**Grade rationale.** Grade A reflects: 10+ year operational continuity (the longest-running decentralised P2P BTC exchange); open-source AGPL codebase; decentralised contributor-DAO operator structure (no central party to subpoena); no KYC under any circumstances; **2-of-2 multisig escrow with named-arbitrator dispute path** (the strongest trust model in P2P fiat exchanges); Tor-by-default architecture; broad payment-method coverage (SEPA, F2F, Wise, Revolut, Zelle, Interac, etc.); altcoin-pair support that Bisq Easy doesn't carry; cross-listed in KYCnot and web3privacy peer directories. **The Grade A acknowledges the 2026-05 v1-protocol incident** — the response (emergency halt, patched release, public post-mortem) is the model we'd want, so the incident itself is an observed-and-handled rather than an outstanding-risk. **Re-evaluation trigger**: if v1.9.x+ patched releases see secondary incidents in the next 90 days (2026-08-01), the grade is at risk. Last verified 2026-05-12, incident verified 2026-05-21.\n\n**Useful when.** You're doing a **large fiat→BTC trade** ($1k+) and want the strongest trust posture available in P2P fiat exchanges (multisig escrow + named arbitrator dispute path). You're trading altcoins peer-to-peer — Bisq classic supports altcoin pairs (LTC, BCH, etc.) that Bisq Easy doesn't. You're in a region where Bisq's payment-method coverage (SEPA, F2F, Wise, Revolut, Zelle, Interac, plus region-specific options) is more comprehensive than alternative P2P platforms. You're comfortable with the desktop application, the multi-day trade timeline for slower payment methods, and the multisig confirmation choreography. You've been a Bisq user historically and want to continue with the protocol you trust. **For new users with sub-$1k trades**: consider Bisq Easy first — it covers small trades with less operational overhead and was unaffected by the 2026-05 v1 incident.\n\n**Caveats.** **2026-05 v1-protocol incident remediated** — update to v1.9.x+ before any trade; verify signed releases before running; see dedicated section above. **Desktop only** — no web client, no mobile; if you don't run a desktop OS or refuse to install a desktop app, Bisq classic isn't an option. **Operationally heavy** — multisig on-chain confirmations + multi-day fiat-clearing methods mean trades clear in hours-to-days, not minutes. **Steep learning curve** — Bisq's UI is engineering-tool-aesthetic; first-time users should expect to read documentation and run small trades to build familiarity. **Initial blockchain sync** — Bisq downloads the BTC block headers and Tor onion-routing state on first run; expect 5-20 minutes setup before the first trade. **Smaller liquidity than custodial alternatives** — for the same convenience you'd get from a centralised exchange, expect to pay a small protocol-overhead premium. **BSQ token is a separate evaluation** — Bisq's governance/fee-discount token has its own market dynamics; treat BSQ holdings as protocol participation rather than as a trade-able asset. **No native XMR support** — Bisq classic is BTC-only on the buy-side; for fiat → XMR P2P, use Haveno (Monero-native fork of Bisq). **Arbitrator-dispute timeline** — when a trade goes to arbitration, expect days for evidence submission and arbitrator decision; this is the price of the protocol-escrow model.\n\n**2026-05-25 update.** Per Grok x_search and Bisq community channels: the **Bisq DAO is voting on a compensation plan** for users affected by the 2026-05-01 incident, with reimbursement proposed in BTC or BSQ from DAO reserves. The vote was scheduled around 2026-05-25; outcome should be public on the Bisq Network's governance forum shortly after. This is a meaningful editorial point in favour of the Grade A: the protocol's response now includes both a patched release **and** a structured DAO-governance compensation process — exactly the response shape privacy infrastructure wants to see from incident-handling. Affected users should monitor https://bisq.network and the Bisq DAO governance discussion for the vote outcome. The conditional A grade is held with the 90-day re-evaluation trigger (2026-08-01) still in place pending DAO vote outcome + sustained operation on the patched code.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted", "multisig_supported" ], "highlight_tags": [ "P2P", "FIAT", "MULTISIG" ], "fees": { "summary": "0.1–0.7% trade fee · multisig + arbitration · SEPA / F2F" }, "fees_summary": "0.1–0.7% trade fee · multisig + arbitration · SEPA / F2F", "last_verified": "2026-05-25", "operating_since": "2017", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://bisq.network", "outbound_slug": "bisq", "twitter": "https://x.com/bisq_network", "telegram": "https://t.me/bisq_p2p" }, "incident": { "date": "2026-05-01", "severity": "critical", "summary": "v1 trade protocol exploit — missing validation on negative network-fee values let an attacker drain ~11.59 BTC from active/open offers. Bisq halted trading via emergency version flag until patched in v1.9.x+. As of 2026-05-25: DAO compensation vote scheduled (reimbursement in BTC or BSQ from DAO reserves under discussion).", "curator_advice": "Update to the patched Bisq v1.9.x+ before trading. Bisq Easy (Bisq 2) is the safer current path. Verify signed releases before running. Affected users: a Bisq DAO compensation vote is in progress as of 2026-05-25 — monitor official Bisq channels for the vote outcome.", "source_url": "https://bisq.network/blog/security-incident-post-mortem/", "timeline": [ { "date": "2026-05-01", "note": "Bisq v1 trade-protocol exploit — missing validation on negative network-fee values let an attacker drain ~11.59 BTC from active trades." }, { "date": "2026-06-11", "note": "No new public developments per the weekly incident-watch scan; advisory stands. Prefer Bisq 2 / patched clients and avoid stale v1 offers.", "auto": true }, { "date": "2026-06-21", "note": "On 2026-06-16 Bisq published a status update beyond the May post-mortem: DAO proposal #481 was accepted 2026-05-25 and affected victims were reimbursed 2026-06-05 via Refund Angels (~10.99 BTC of 11.59 BTC total loss; one trader has not filed). Security hardening for Bisq 1/2 is largely done but reproducible builds…", "auto": true }, { "date": "2026-06-22", "note": "On 2026-06-16 Bisq published a status update beyond the May post-mortem: DAO proposal #481 was accepted 2026-05-25 and affected victims were reimbursed 2026-06-05 via Refund Angels (~10.99 BTC of 11.59 BTC total loss; one trader has not filed). Security hardening for Bisq 1/2 is largely done but reproducible builds…", "auto": true }, { "date": "2026-06-23", "note": "On 2026-06-16 Bisq published a status update beyond the May post-mortem: DAO proposal #481 was accepted 2026-05-25 and affected victims were reimbursed 2026-06-05 via Refund Angels (~10.99 BTC of 11.59 BTC total loss; one trader has not filed). Security hardening for Bisq 1/2 is largely done but reproducible builds…", "auto": true }, { "date": "2026-07-07", "note": "Bisq operator publicly disclosed the outcome of an ongoing security audit: TWO critical vulnerabilities were identified in trade protocol and dispute handling — \"if exploited, they could have led to the loss of users' funds.\" Both were fixed in the v1.10.3 release the same day, alongside additional security improvements. No confirmed exploit in the wild disclosed with the release; the operator found and patched these under audit before any exploitation was reported." }, { "date": "2026-07-07", "note": "Bisq operator additionally disclosed one remaining CRITICAL issue affecting BSQ swaps, still unpatched. To avoid putting users at risk, the operator has TEMPORARILY DISABLED BSQ trading until a fix is available. Non-BSQ Bisq trading (BTC↔fiat via the main P2P orderbook) is expected to resume post-audit; the operator apologized for the halt and framed it as \"security comes first.\"" }, { "date": "2026-07-07", "note": "Operator meta-note: the audit is ongoing and Bisq expects further releases addressing additional issues. Operator acknowledged limited comms bandwidth (\"Bisq is not a company with the luxury of a dedicated communications department\"). Curator read: this is *good* incident-response shape — audit → disclose → halt → patch → publish rapidly. Grade held at A. Watch conditions: (a) BSQ-swap unpatched issue is exploited before the fix ships → downgrade to B and re-open the incident with severity critical; (b) audit surfaces additional critical issues without matching rapid patch → consider hold-with-caveat." }, { "date": "2026-07-30", "note": "Within the last 7 days, official Bisq channels published mandatory Bisq v1.10.4 (2026-07-24): security fixes from a recent audit, required update to keep trading, and BSQ Swaps re-enabled—a post-incident hardening/liquidity-recovery signal, not a new exploit disclosure. No new official post-mortem, loss-amount revis…", "auto": true } ] }, "also_listed_at": { "web3privacy": true, "kycnot": true, "monerica": true } }, { "id": "bisq-easy", "category": "exchanges", "subcategory": "P2P", "name": "Bisq Easy", "url": "https://xmr.club/exchanges/bisq-easy", "twin": "https://xmr.club/llm/exchanges/bisq-easy.txt", "tagline": "Streamlined P2P BTC ↔ fiat. Reputation-gated, no KYC, no custody.", "review": "Bisq Easy is the **chat-based, reputation-gated** BTC↔fiat P2P trading mode — the \"easy mode\" rewrite of the original Bisq protocol that strips the multi-signature deposit choreography down to a streamlined chat-and-settle flow for small trades where seller reputation backstops the trust. Listed at **Grade A** because it sits in a structurally different category than the swap aggregators (Exolix, StealthEX, SideShift) or even Bisq classic — Bisq Easy is the only P2P fiat-on-ramp where you trade with a real person, no platform custody, no KYC, and no protocol-level escrow, with reputation (verified by BSQ holdings or accumulated seller history) acting as the trust mechanism for sub-$1k trades.\n\n**Background.** Bisq Easy is a 2023-era rewrite of the Bisq protocol layer, redesigned around a chat-first UX rather than the protocol-heavy multi-sig flow that defined Bisq classic. The motivation: Bisq classic is structurally sound but operationally heavy — multi-sig deposits, dispute escalation flows, 14-day-plus timeline for bigger trades. For small fiat-on-ramps ($50-$500 typical), users wanted a faster mode where reputation rather than protocol-escrow carries the trust. Built by the Bisq Network — the same decentralised contributor community that maintains Bisq classic. **Open source** (AGPL), **desktop app** only (no web client, no mobile), distributed via the Bisq launcher. **No central operator** — Bisq Network is a contributor-DAO; the BSQ token aligns long-term contributor incentives. The Bisq classic protocol still exists as a separate listing (Grade A, listed at xmr.club under id `bisq`) — Bisq Easy and Bisq classic complement rather than replace each other.\n\n**What you trust.** **Reputation system** — the only Bisq Easy trust primitive: sellers accumulate reputation by holding BSQ (the Bisq governance token, which signals long-term commitment to the project) or by trade history (number of completed trades, dispute-free track record). Buyers see seller reputation before opening a trade. **No platform escrow** — Bisq Easy doesn't hold either party's funds at any point; the buyer sends fiat via the agreed method (SEPA, cash-by-mail, gift cards, etc.) and the seller releases BTC after fiat confirmation. **No central operator** — Bisq is a peer-to-peer protocol with no company that could be subpoenaed; the Bisq Network is a contributor-DAO and the application is open-source. **Desktop-only by design** — running locally on your own machine, not in a hosted environment; no operator can see your trade history because there is no operator. **Trade limits** — Bisq Easy is *intentionally* constrained to small trade sizes (typically $50-$500); for larger trades, the protocol routes you to Bisq classic with its multi-sig protocol-escrow. **Tor by default** — the Bisq application routes all peer-to-peer traffic through Tor; you don't trust an exit node, you don't trust the operator's TLS, you trust Tor's onion routing.\n\n**Operational specs.** **Platform**: desktop app (macOS / Windows / Linux) — no web client, no mobile. **Trading pair**: BTC ↔ fiat (USD, EUR, GBP, and many local currencies). **Payment methods**: SEPA bank transfer, cash-by-mail, gift cards (specific brands), revolut, Wise, and others — the seller's listing specifies which methods they accept. **Trade size**: $50-$500 typical (operator-soft limit; technically configurable but reputation thresholds gate larger trades). **Reputation gating**: sellers either hold a minimum amount of BSQ or have completed a minimum number of trades — both signal long-term commitment to the protocol. **Trade timeline**: minutes to hours (vs. days for Bisq classic) — chat-based negotiation, fiat payment, BTC release. **Fees**: spread-only (negotiated between buyer and seller); no platform fee. **No KYC under any circumstances** — there is no KYC mechanism in the protocol; the only identity-equivalent is the persistent pseudonym tied to a BSQ-holding or trade-history reputation.\n\n**Philosophy.** Bisq Easy's editorial differentiator is the **reputation-backed-trustless-small-trades** model. Bisq classic uses protocol-escrow (multi-sig with arbitrator fallback) — strong trust but operationally heavy. Aggregators like Exolix or StealthEX use upstream-exchange custody — operational lightness but custodial trust window. Bisq Easy says: for small trades where reputation is verifiable (BSQ holdings, trade history) and the trade-size loss-exposure is bounded, you don't need protocol-escrow because the reputation cost of fraud exceeds the fraud value. That's a structurally different trust argument than either of the alternatives. It also means: a brand-new seller has no reputation, can't take large trades, and needs to build a track record — an intentional friction that protects buyers from one-shot fraud accounts.\n\n**Grade rationale.** Grade A reflects: open-source AGPL codebase; decentralised contributor-DAO operator structure (no central party to subpoena); no KYC under any circumstances; no platform custody (truly non-custodial); Tor-by-default architecture; BSQ-and-trade-history reputation system that creates legible trust gradients; complementary positioning to Bisq classic (small-trade mode where classic would be operationally heavy); active development by the Bisq Network; cross-listed in web3privacy peer directory. Last verified 2026-05-12.\n\n**Useful when.** You want a fiat-on-ramp ($50-$500 typical) where you trade BTC peer-to-peer with a real person rather than routing through a swap aggregator or custodial exchange. You want zero KYC and zero custody — the strictest privacy posture in any fiat-on-ramp category. You want a desktop application running on your own machine, with Tor-by-default routing, rather than a web-hosted service. You're an experienced user comfortable with the reputation-based trust model (you can read seller reputation, you understand BSQ-holding signals, you're willing to start with smaller trades). You already hold some BSQ (Bisq governance token) and want to use the higher reputation gates that BSQ holdings unlock.\n\n**Caveats.** **Desktop-only** — no mobile, no web client; if you don't run a desktop OS or refuse to install a desktop app, Bisq Easy isn't an option. **Reputation building takes time** — as a brand-new user (no BSQ, no trade history), your initial trade limits will be small and seller selection narrower; this is a feature, not a bug, but it's a friction. **Trade-size cap** — Bisq Easy is intentionally small-trade-focused; for trades above $500-$1000, you'll be routed to Bisq classic and its multi-sig escrow flow. **Fiat-payment-method risk is on you** — Bisq Easy doesn't escrow fiat; if you send a SEPA transfer and the seller doesn't release BTC, you can dispute the seller's reputation but you can't recover the fiat through the protocol. Read the seller's reputation carefully. **No protocol arbitrator** — Bisq classic has arbitrator escalation; Bisq Easy doesn't, by design. Reputation is the only enforcement. **Smaller liquidity than custodial fiat-on-ramps** — for the same convenience you'd get from a centralised exchange's fiat-on-ramp, expect to pay a small reputation-and-coordination premium. **BSQ token is a separate evaluation** — Bisq's governance token has its own market dynamics; treat BSQ holdings as protocol participation rather than as a trade-able asset. **No native XMR support** — Bisq Easy is BTC-only on the buy-side; if you want fiat → XMR directly, this isn't the tool. Use Haveno (Monero-native fork) for fiat → XMR P2P, or buy BTC here and swap to XMR via aggregators.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted" ], "highlight_tags": [ "P2P", "FIAT", "BTC" ], "fees": { "summary": "Spread-only · no platform fee · reputation gated" }, "fees_summary": "Spread-only · no platform fee · reputation gated", "last_verified": "2026-05-12", "operating_since": "2017", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://bisq.network/bisq-easy/", "outbound_slug": "bisq-easy", "twitter": "https://x.com/bisq_network", "telegram": "https://t.me/bisq_p2p" }, "also_listed_at": { "web3privacy": true, "monerica": true } }, { "id": "bitania", "category": "exchanges", "subcategory": "P2P", "name": "Bitania", "url": "https://xmr.club/exchanges/bitania", "twin": "https://xmr.club/llm/exchanges/bitania.txt", "tagline": "Panama-registered non-KYC crypto exchange — P2P marketplace at `p2p.bitania.com` and an instant-swap product at `swap.bitania.com` (aggregated on OrangeFren). BTC, LTC, XMR, ETH, USDT, TRX.", "review": "Panama-registered P2P cryptocurrency exchange with non-custodial escrow swaps across BTC, LTC, XMR, ETH, USDT, and TRX. The trading interface lives at `p2p.bitania.com`; legal at [`bitania.com/tos`](https://bitania.com/tos) — a substantive, structured ToS (last updated 2026-06-02) that opens with four explicit commitments quoted verbatim below.\n\n**What it is.** Panama-registered P2P exchange with non-custodial escrow, BTC/LTC/XMR/ETH/USDT/TRX. The operating entity is **Bitania Exchange Inc**, registered in Panama (Edificio Comosa, Ave. Samuel Lewis — per the ToS Company Information section, matching the kycnot.me +2 Trust legal-registration signal). A Tor mirror is advertised at `http://bitaniazto32g3fuifykktkvay3tofkrrdgtvpvspdmca5r2lwrxp2id.onion/`. Two peer-directory matches (kycnot.me + monerica.com). **Founded 2024-12-01** per monerica.com/site/bitania. Cross-checks against two independent signals: (a) the bitania.com WHOIS was **updated 2025-02-11** (NICENIC registrar) — i.e. the operator took control of the pre-existing 2009 premium domain ~6 weeks after the monerica founding date; (b) Grok web search via @clawrok_404_bot confirms the site only appears in crypto/privacy discussions from 2025-2026, with no public launch announcement. kycnot.me's *Operating since 2026-04-17* attribute is the Added-On date, not the founding date. A single verified user review reports instant swaps with low fees.\n\n**Your crypto stays yours.** (ToS preamble) *\"We hold balances only to operate the Services and settle transactions — your cryptocurrency remains your property and is never ours to take.\"*\n\n**No KYC, ever.** (ToS preamble) *\"We do not require, and will not ask you to complete, identity verification or to disclose personal information as a condition of registering, trading, swapping, accepting payments, or withdrawing.\"*\n\n**No surveillance of your identity.** (ToS preamble) *\"We do not monitor who you are or the source of your funds, and we collect the absolute minimum needed to run the Services securely.\"*\n\n**No discretionary freezes.** (ToS preamble) *\"We will not freeze, seize, or restrict access to your settled balance as a matter of business discretion or as a condition of identity verification. Your funds remain available for withdrawal.\"*\n\n**Product surfaces — two shelves under one brand.** Bitania operates two distinct trading endpoints from the same operating entity:\n\n- **`p2p.bitania.com`** — the peer-to-peer marketplace with the escrow flow described below. This is Bitania's primary product and the shelf this listing sits on.\n- **`swap.bitania.com`** — an instant-swap product for readers who want a fixed-rate one-shot swap without dealing with counterparty offers. Aggregated on OrangeFren.com's swap comparison table with an OrangeFren grade of 10 (green) at listing time. Direct trade link: `https://swap.bitania.com/swap/?ref=orangefren`.\n\nWe keep the listing under the P2P shelf because the marketplace is Bitania's editorial identity, but the instant-swap product is a real second surface worth naming here so a reader looking for it does not need to leave the review to find it.\n\n**Support channels.** Email at `support@bitania.com` (published in the ToS Contact section, last updated 2026-06-02) plus a Telegram channel — the support surface widened during our listing window, addressing what was a single-point-of-failure flag in the original review.\n\n**Trading fees.** Classic exchange (operator-published, in-app Trading Fees panel) — **0.15% maker** (your order rests on the book and is filled by an incoming order) and **0.25% taker** (your order is filled immediately against existing liquidity). Applied to each fill. P2P fees are separately set by the counter-party offer.\n\n**Grade rationale.** Listed at **Grade B**. The published ToS is the strongest single trust signal — the four commitments above are quotable, unambiguous, and structurally consumer-protective; the named legal entity in Panama gives them a verifiable regulatory address. Held under A by the yellow flag spelled out below, plus the broader caution warranted for any exchange whose external footprint is still ~6 weeks old.\n\n**Yellow flag — kycnot attribute history.** Through April 2026, the kycnot.me listing showed unusual attribute churn — the *\"Strict no-log policy\"* and *\"Personal info is not verified\"* attributes were removed, and *\"May Freeze or Seize Funds\"* was added then removed within 11 days. The current ToS (2026-06-02) postdates that churn by ~6 weeks and reads as a stabilisation of the operator's published posture — the four commitments above are now the canonical statement. The churn is still worth noting *\"posture was in motion until very recently\"* — verify the no-log + withdrawal mechanics directly on `p2p.bitania.com` before non-trivial size.\n\n**Peer-dir drift.** monerica.com/site/bitania still advertises an older Tor address (`bitania2bmwn…onion`); the current operator-published `Onion-Location` header points at `bitaniazto32g3…onion` (the one in our links above). Verify the `.onion` you reach against the operator's clearnet header before trusting cached peer-dir mirrors.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup", "no_kyc" ], "feature_tags": [ "non_custodial", "tor_mirror", "escrow", "instant" ], "highlight_tags": [ "NO-KYC", "XMR", "P2P", "TOR", "INSTANT-SWAP" ], "fees": { "summary": "Classic exchange: 0.15% maker / 0.25% taker per fill · P2P fees set per offer · BTC/LTC/XMR/ETH/USDT/TRX" }, "fees_summary": "Classic exchange: 0.15% maker / 0.25% taker per fill · P2P fees set per offer · BTC/LTC/XMR/ETH/USDT/TRX", "last_verified": "2026-07-23", "operating_since": "2024-12-01", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://bitania.com", "p2p": "https://p2p.bitania.com", "outbound_slug": "bitania", "tor": "http://bitaniazto32g3fuifykktkvay3tofkrrdgtvpvspdmca5r2lwrxp2id.onion/", "telegram": "https://t.me/BitaniaNews", "contact_email": "support@bitania.com" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "bitcoinvn", "category": "exchanges", "subcategory": "Instant Swaps", "name": "BitcoinVN", "url": "https://xmr.club/exchanges/bitcoinvn", "twin": "https://xmr.club/llm/exchanges/bitcoinvn.txt", "tagline": "Non-custodial swap operating since 2013 by the same founding team. Panama operator entity (BVX Solutions Inc., Reg 155785126-2-2026) as of 2026-07 after a regulatory-driven restructure from Vietnam. No signup by default, supports Monero, risk-based KYC only on automated flag.", "review": "**Grade C → B restored 2026-08-13.** The 2026-07-30 downgrade was applied on the silent operator-entity migration from Vietnam (CTY TNHH BVN STAR) to Panama (BVX Solutions Inc., Reg 155785126-2-2026). Within hours the operator publicly explained the move on X and the @BV_Insights sub-blog as a regulatory-driven restructure with the same founding team. A 14-day watch period elapsed clean: no fresh scam reports, no on-chain drain evidence, no peer-directory warning. kycnot.me still lists the service as Verified 6/10 with the Panama entity change captured on their listing; monerica.com still marks it ✅ Verified with the Panama location updated. The 13-year continuity signal survives the entity discontinuity because the team continuity was documented on a public channel + independently confirmed by peer directories.\n\nBitcoinVN is a Vietnam-rooted non-custodial swap service operating since 2013 (public launch 2014), still run by the original founding team. The default user flow requires no signup, no account, no email — paste a Monero / Bitcoin / Tether / etc. wallet address, send the deposit, receive the swap at the destination. They support XMR as both a source and destination asset, plus a wide range of fiat-touching pairs that most no-KYC swaps avoid.\n\n**KYC posture is risk-based, not threshold-based.** Their automated risk-prevention system flags suspicious transactions during the swap; if a transaction is flagged, the exchange pauses and compliance review can request identity verification. Flagged users can also choose a full refund instead of completing KYC — the only fee deducted is the blockchain network fee. This 'right to refund' is a meaningful user protection that distinguishes BitcoinVN from custodial exchanges where flagged funds can become permanently held.\n\n**⚠ Asset Recovery Policy is user-hostile if you make a mistake.** Read carefully before depositing: (1) recovered funds are credited to a **BitcoinVN account**, so guest users must create one to receive recovery — this breaks the no-signup promise the moment something goes wrong; (2) they won't even attempt recovery on deposits under $100 USD — small mistakes are permanently lost; (3) recovery fee is the smaller of $250 USD or 50% of the deposit, plus network fees, even on successful recovery; (4) 14-day processing window. **The non-custodial promise holds only as long as you make zero mistakes.** Double-check chain, address, and amount before every send.\n\nExcluded jurisdictions: United States, Iran, Cuba, North Korea. They also operate one of the largest Lightning routing nodes in Southeast Asia and offer OTC services for HNW clients.\n\n\n\n**Separate product — opt-in custodial staking.** BitcoinVN also runs a staking pool surface (/staking) that pays out a share of exchange-fee revenue to depositors, with XMR currently quoting ~21% APR. This is NOT proof-of-stake (Monero is PoW); it's a liquidity-provision model where the operator holds your XMR while it's staked. **Account required.** Pool is currently over-subscribed (3,244 XMR staked / 3,100 cap). Yield holds while exchange volume holds — if volume drops, so does APR. This is a fundamentally different surface from the non-custodial swap (which is what we list above); evaluate the custody + yield-source tradeoffs separately if you're considering it.\n\n12 years of operating history under the same team is a strong tenure signal. The XMR support + non-custodial flow + right-to-refund triplet makes this a B-tier listing — but the Asset Recovery Policy means we'd recommend it specifically for users who are confident handling addresses and chains correctly, not first-time crypto users.", "translation_locale": "en", "rating": { "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup", "kyc_on_suspicion", "no_personal_data" ], "feature_tags": [ "non_custodial", "xmr_support", "lightning", "instant", "fiat_rails", "optional_staking" ], "highlight_tags": [ "SINCE_2013", "GEO_VIETNAM", "RECOVERY_CAVEAT" ], "fees": { "summary": "Exchange spread shown in swap widget at quote time (no static schedule). Refund-after-KYC-flag: 0% exchange fee, network fee only. ⚠ Asset Recovery on incorrect deposit: smaller of $250 USD or 50% of deposit + network fees; $100 USD floor (anything smaller is unrecoverable); 14-day processing; recovery routes through a BitcoinVN account (forced signup post-incident)." }, "fees_summary": "Exchange spread shown in swap widget at quote time (no static schedule). Refund-after-KYC-flag: 0% exchange fee, network fee only. ⚠ Asset Recovery on incorrect deposit: smaller of $250 USD or 50% of deposit + network fees; $100 USD floor (anything smaller is unrecoverable); 14-day processing; recovery routes through a BitcoinVN account (forced signup post-incident).", "last_verified": "2026-08-27", "operating_since": "2013", "tenure_note": "BitcoinVN founded 2013, public launch 2014. Confirmed via about page (\"Founded in 2013 and still operated by its original team\") and X account public claim. Still owner-operated by original team — strong continuity signal.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://bitcoinvn.io", "twitter": "https://x.com/bitcoinvn_io", "telegram": "https://t.me/bitcoinvn_community", "outbound_slug": "bitcoinvn", "affiliate": "https://bitcoinvn.io/?ref=b3ec895e9cce7d68" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "borsomonero", "category": "exchanges", "subcategory": "P2P", "name": "BorsoMonero", "url": "https://xmr.club/exchanges/borsomonero", "twin": "https://xmr.club/llm/exchanges/borsomonero.txt", "tagline": "Tor-first P2P Monero marketplace with locked-XMR escrow, monthly PGP-signed canary, and a server-side queue entry — no KYC, fiat via ~80 payment methods across ~120 countries.", "review": "**BorsoMonero is a Tor-first peer-to-peer Monero marketplace with server-side queue entry, locked-XMR escrow, and a PGP-signed monthly canary.** Listed at **Grade C** as the methodology default for a brand-new no-KYC exchange in a high-loss-asymmetric category; path to B is several months of clean operation, first user reports on record, and peer-directory pickup.\n\n**Product.** BorsoMonero is a P2P marketplace where users create Buy or Sell offers for XMR. Fiat currencies (~45 supported) are used only for pricing, filters, limits, and payment-method labels — the platform's only tradable asset is Monero. Payment-method taxonomy is wide (SEPA, ACH, Interac, Faster Payments, Cash by mail, cash deposit to bank, IBAN, Alipay, WeChat, M-PESA, Pix, UPI, Cash App, Wise, Revolut — around 80 in total across ~120 country markets).\n\n**The queue system.** A server-side queue gates entry — every URL initially serves a `You are in queue` page that auto-refreshes every 15 seconds until a session slot opens. Curator probe from clearnet was admitted after 30-60 seconds. Not a placeholder or coming-soon page; the real marketplace lives behind it. Practical implication for the reader: expect a short waiting-room stop before you can browse offers.\n\n**Escrow rule (the golden line, per operator FAQ).** *Private payment details are shown only after XMR is locked for that trade. No locked XMR means no private payment instructions.* The seller must lock the Monero into escrow before the buyer sees payment instructions. After the buyer pays out-of-band and marks the trade paid, the seller confirms and releases the XMR. Disputes go to staff review that can only move funds already locked to the trade.\n\n**Fees.** Creating an account, browsing, opening trades, buying, and selling are free. Only the **maker** pays a **1.00% platform fee on completed trades** (**0.50% for Premium** users). Cancelled, expired, refunded, or failed trades pay nothing. Withdrawals to outside Monero wallets pay the Monero network fee (shown on the wallet page before sending). Transfers between BorsoMonero user wallets are free.\n\n**Encryption at rest (operator claim).** Sensitive user content — support ticket subjects and messages, dispute details, dispute messages, private payment-related text, proof files, and dispute evidence files — is encrypted at rest per the operator's own FAQ. Public ads, terms, usernames, trade status, timestamps, amounts, and audit records stay readable where needed for trading, safety, accounting, moderation, and dispute review. Claim not first-party verified by the directory today; standard for the P2P-marketplace category.\n\n**Warrant canary.** A PGP-signed monthly canary is published at `/canary`. Latest at listing time: signed 2026-07-01, valid until 2026-08-01, declaring *\"BorsoMonero is online and operated by the current team. The public site is active. The staff and wallet controls have not been intentionally transferred. No BorsoMonero signing key rotation is announced in this canary. This canary should be replaced every month. If this canary is missing, expired, malformed, or unsigned, users should treat that as a warning.\"* Signed by the BorsoMonero canary key. Monthly rotation is a real ongoing commitment worth respecting.\n\n**Privacy-first UX signals.** The site shows a `JavaScript is enabled — for better privacy, consider disabling JavaScript` overlay on every JS-enabled visit (dismissable, but the fact it's there at all is a real editorial signal). The site is designed to work with JS disabled — that alone puts it above most fiat-P2P marketplaces on the privacy shelf.\n\n**Language surface.** Six-language UI: English, Deutsch, Русский, 简体中文, Español, Français. Broad enough to serve the primary Monero-community language groups.\n\n**Terms of service.** Short, reader-clear ToS at `/terms`. Notably: no advice on any topic, users are responsible for their own local rules, escrow rule is spelled out, staff dispute decisions can only move funds already locked to the trade, false proof or false claims can get an account limited or closed. No surprises; matches the shape of a P2P marketplace that has thought about what it is and is not.\n\n**Tenure and what we don't yet know.** Wayback has zero snapshots for `borsomonero.com` at listing time. The domain footprint is brand-new. We have no independent third-party mentions, no accumulated user-review history, no observed volume, no track record on dispute-resolution behaviour, no test-trade observation. Grade C reflects that: the surface reads honestly, the mechanics are sensibly designed, but a new marketplace in a category where users can lose real money to a bad-actor-operator has to earn its way to B on time and independent evidence.\n\n**What we can't yet verify from the outside.** The escrow-mechanic claim, the encryption-at-rest claim, and the dispute-review behaviour all require actual trade observation to confirm — not just reading the FAQ. First user reports, on-chain evidence of paid-and-released trades, or a curator-side test trade would each move the grade math.\n\n**Grade C — what it means here.** Acceptable with reservations — verify the caveats before depositing. Reservations: (a) brand-new curator-side tenure, (b) zero observed trade history from independent sources, (c) queue-gated entry means the operator can effectively cap concurrent users, and we don't yet know how that capacity scales, (d) all the mechanic claims (escrow, encryption at rest, dispute process) live in operator-published copy without first-party verification. None of these are structural flaws — they are the shape of a young no-KYC P2P marketplace that hasn't had time to prove itself.\n\n**Path to B.** Several months of clean curator-side observation, first independent user reports on record (ideally with tx hashes for completed trades), at least one canary rotation cycle observed on time, and any peer-directory pickup would each contribute. No promise on timing — the review will refresh whenever new evidence lands.\n\n**Bottom line.** A privacy-first P2P Monero marketplace with a well-thought-out escrow model, monthly PGP-signed canary, encryption-at-rest claim, and a queue-gated entry that keeps the surface load-controlled. Genuinely aligned with the no-KYC Monero mission. Grade C reflects the tenure default rather than a specific structural concern; the operator's editorial posture reads honestly.", "translation_locale": "en", "rating": { "grade": "C", "trust": "PGP-signed monthly canary (latest signed 2026-07-01 valid until 2026-08-01), encryption-at-rest claim on sensitive user content per operator FAQ, staff-mediated dispute process with fund movement limited to funds already locked in the trade. Wayback footprint zero at listing time — brand-new curator-side observation window.", "privacy": "Tor-first design, JS-disable-friendly (overlay explicitly warns users to disable JS for better privacy), locked-XMR escrow rule (payment details revealed only after XMR is locked), sensitive user content encrypted at rest per operator FAQ.", "ux": "Server-side queue entry — 15-second auto-refresh page until session slot opens (curator probe admitted after ~30-60 seconds). Six-language UI (EN/DE/RU/ZH/ES/FR). Browsing, account creation, opening trades all free; 1.00% maker fee on completed trades (0.50% Premium), 0% on cancelled/expired/failed." }, "grade": "C", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "escrow" ], "highlight_tags": [ "NO-KYC", "P2P", "LOCKED-XMR-ESCROW", "MONTHLY-CANARY", "JS-OPTIONAL" ], "fees": null, "fees_summary": null, "last_verified": "2026-07-24", "operating_since": "2026-07", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://borsomonero.com", "outbound_slug": "borsomonero", "affiliate": "https://borsomonero.com/r/BMC08DB02724", "tor": "http://borsom3xnyx23iu234r2ygnvgwofx6rotbm2huvufli7zt3vzsv3kaid.onion", "logo": "https://xmr.club/peers/borsomonero.png" }, "also_listed_at": { "monerica": true } }, { "id": "cambio", "category": "exchanges", "subcategory": "Aggregators", "name": "Cambio", "url": "https://xmr.club/exchanges/cambio", "twin": "https://xmr.club/llm/exchanges/cambio.txt", "tagline": "AI/conversational no-KYC swap aggregator — describe the swap in plain English, it compares ChangeNow/SimpleSwap/FixedFloat rates and issues a one-time deposit address. XMR supported, no account/email/ID. New (~3.5mo), tracker-heavy; 'non-custodial' is first-party only.", "review": "**What it is.** Cambio is a no-KYC swap aggregator with a twist: instead of a form, you **describe the swap in plain English** and its AI checks partner exchangers' quotes in real time (ChangeNow, SimpleSwap, FixedFloat and others), then hands you a one-time deposit address. No account, no email, no ID. XMR is in the supported set — a smallish one (~11 tokens across 10 chains; ETH/USDT are the centre of gravity).\n\n**What \"non-custodial\" really means here.** Like any aggregator, Cambio doesn't settle your swap itself — it routes to a partner exchanger, and **that** partner custodies your coins during the swap and can apply its own risk/KYC rules. So read \"non-custodial\" as *no first-party custody*, not *no custody at all*. Your trade's privacy is only as strong as whichever upstream provider it routes to.\n\n**What to weigh.** It's **new** — the domain dates to May 2026 (~3.5 months), no track record yet. And for a no-KYC swap it's **tracker-heavy**: it loads Google Tag Manager, an odd fit for a privacy tool (use a blocker). The conversational-AI interface is a genuine UX differentiator and the fee/rate transparency looks thoughtful, but neither changes the trust fundamentals.\n\n**Useful when.** You want a fast, no-signup way to shop several exchangers for an XMR swap and you'd rather describe it in words than wrestle dropdowns — accepting that settlement (and its risk) sits with the partner it picks, and that you'll want a blocker for the trackers.\n\nGraded **C**: a legitimate, functional no-KYC aggregator with a novel interface — held at the exchange default by its ~3.5-month tenure, the Google-tracking surface, and the small pair set. Path to B: tenure, dropping the trackers, and a verified routing track record.", "translation_locale": "en", "rating": { "grade": "C", "trust": "AI/conversational no-KYC swap aggregator routing across partner exchangers (ChangeNow, SimpleSwap, FixedFloat...). New — domain registered 2026-05 (~3.5mo), no track record. No token/funnel. Loads Google Tag Manager. ~342 pairs / 11 tokens / 10 chains.", "privacy": "No account, no email, no ID; one-time deposit address. NOT first-party custodial, but routes to partner exchangers that hold funds mid-swap and can apply their own KYC — privacy only as strong as the upstream provider. Tracker-heavy (Google Tag Manager); use a blocker.", "ux": "Describe the swap in plain English; AI compares partner rates in real time and issues a one-time deposit address. XMR supported among ~11 tokens / 10 chains. No signup." }, "grade": "C", "kyc_tags": [ "no_kyc", "anonymous_signup", "no_email" ], "feature_tags": [ "aggregator", "multi_chain", "no_account", "closed_source" ], "highlight_tags": [ "XMR", "NO-KYC", "AGGREGATOR", "AI-INTERFACE", "NEW" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-29", "operating_since": "2026-05", "tenure_note": "Domain registered 2026-05-17 (~3.5 months); no Wayback history. AI/conversational aggregator over ChangeNow/SimpleSwap/FixedFloat etc.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://cambio.one", "outbound_slug": "cambio" }, "also_listed_at": { "monerica": true, "kycnot": true } }, { "id": "cce-cash", "category": "exchanges", "subcategory": "Instant Swaps", "name": "CCE.Cash", "url": "https://xmr.club/exchanges/cce-cash", "twin": "https://xmr.club/llm/exchanges/cce-cash.txt", "tagline": "Non-custodial cross-chain swap router with refund-on-refusal AML policy and multi-destination split swaps. No signup, no KYC.", "review": "Non-custodial instant cryptocurrency swap routing platform with a transparent fee model, multi-destination split-swap capabilities, zero signup/login requirements, and a strong user protection model for compliance rejections. **Grade B is held only by the lack of native Tor (.onion) connectivity and closed-source architecture** — though the \"refund-on-refusal\" implementation represents a best-in-class standard for privacy-conscious aggregators. We recommend using a small-first-trade pattern to verify rates.\n\n**Background.** CCE.Cash is a cross-chain swap routing service that aggregates liquidity from multiple third-party bridges and instant exchanges. Unlike custodial hubs, it operates without accounts, email requests, or persistent session management. The platform markets its services directly to users seeking fast transactions without registration barriers.\n\n**Operator philosophy.** The team functions under a corporate structure registered in Seychelles, maintaining a pseudonymous public profile while focusing entirely on clean transaction execution. Unlike other aggregators that attempt to build secondary ecosystems around utility tokens, CCE.Cash positions itself as a pure utility layer for cross-chain value movement.\n\n**AML posture.** Direct operator communications confirm that CCE.Cash does not require KYC verification. In instances where a client's funds are flagged as high-risk, the platform is able to process refunds of the original deposit directly to the refund address without the need for KYC verification, protecting users from forced deanonymization under threat of asset forfeiture. This **refund-on-refusal** stance is the editorial differentiator — most centralised swap aggregators force a KYC submission to release flagged funds, creating an \"AML trap\" where a user's deposit is held hostage to identity disclosure. CCE.Cash's commitment to atomic return-of-deposit on AML refusal removes that trap.\n\n**Split swaps.** The platform supports multi-destination swaps, allowing users to split a single incoming cryptocurrency deposit across multiple target assets and destination wallets. Users can customize the percentage allocation for each target address directly in the UI. Practical use case: deposit BTC, receive partial XMR to one wallet, partial USDT-Tron to another, partial ETH to a third — all in one routed swap rather than three separate transactions. Routing architecture: split swaps execute as multiple parallel upstream legs (each destination is a separate routing job under one deposit). For large splits, confirm per-leg fee structure and whether partial failures cascade or abort.\n\n**Live reserves / transparency.** As a non-custodial routing layer, the operator does not maintain long-term deposit pools and does not publish a live reserves or solvency audit dashboard. All transaction volume is routed atomically or in short-lived custody blocks through underlying liquidity providers.\n\n**Operational specs.** Coverage: broad multi-chain asset support with native Monero integration. **XMR acceptance window**: CCE.Cash begins processing well before the full Monero 10-block unlock — the practical user-visible window is materially faster than aggregators that wait for full unlock. Verify the exact acceptance threshold against operator documentation if routing large amounts. **Order expiration**: 24 hours (generous window for deposit confirmation and execution). **Fees**: floating-rate fee is 0.4% for stablecoins and 0.5% for other tokens; fixed-rate swaps carry a 1% fee. All fees are bundled directly in the exchange rate (transparent — no surprise spread on top). **Partner API**: detailed API specifications are published at apidoc.cce.cash. **Support**: customer support channels are reachable via Telegram and Jivosite.\n\n**Grade rationale.** CCE.Cash is assigned a **B** grade. It is highly competitive due to its refund-on-refusal policy (which prevents asset traps), registration-free trading, split-swap functionality, and low spreads. However, it fails to achieve an A grade because it lacks an official Tor hidden service (.onion), does not offer a JavaScript-free SSR version (the SPA breaks completely if JavaScript is disabled — fails the Tor \"Safest\" security level), and operates on closed-source backend/frontend pipelines. Last verified 2026-05-25.\n\n**Useful when.** You want a cross-chain swap with zero registration, account creation, or wallet connection. You want to distribute a single deposit across multiple destination assets or wallets in a single transaction (split swaps). You want protection against permanent AML fund traps via their refund-on-refusal option. You are swapping between major crypto assets and Monero and prefer the 3-confirmation XMR window over slower competitors.\n\n**Caveats.** **No Tor mirror** — does not host an official `.onion` address, forcing Tor Browser users to route through clearnet gateways. **JavaScript required** — built as a client-side React SPA; breaks entirely if JS is disabled (incompatible with Tor \"Safest\" security level). **Closed-source** — neither the routing engine nor the frontend interface is open-source; the refund-on-refusal policy is published as operator policy and **not yet independently verified by xmr.club** through a calibrated test trade; lacks a public transaction ledger or auditable on-chain proof of solvency. **Single-source trust signal** — privacy claims rest on operator policy, not protocol-level constraints. **AML screening is still applied** — this is not an \"anything goes\" platform; the differentiator is what happens *when* funds are flagged (return-to-sender rather than KYC-or-forfeit), not the absence of screening. **Jivosite support widget** — the in-page live-chat support is provided by Jivosite, a third-party widget that loads external JavaScript and may collect visitor metadata. For privacy-sensitive interactions, use the Telegram support channel instead of the in-browser chat. Treat first trades as evaluation, not production volume.", "translation_locale": "en", "rating": { "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available", "split_swaps", "aml_screening", "transparent_fees" ], "highlight_tags": [ "NO-KYC", "REFUND-ON-REFUSAL", "SPLIT-SWAPS", "NEW" ], "fees": { "summary": "0.4% floating (stablecoins) / 0.5% floating (other) / 1% fixed-rate. Fees bundled in rate; 24-hour order window." }, "fees_summary": "0.4% floating (stablecoins) / 0.5% floating (other) / 1% fixed-rate. Fees bundled in rate; 24-hour order window.", "last_verified": "2026-06-05", "operating_since": "2024", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://cce.cash", "outbound_slug": "cce-cash", "affiliate": "https://cce.cash?ref=uGGohfLv", "contact_email": "support@cce.cash", "twitter": "https://x.com/Cce_Cash", "instagram": "https://www.instagram.com/cce_cash/", "youtube": "https://www.youtube.com/@CCECash_official", "facebook": "https://www.facebook.com/profile.php?id=61576731058763", "trustpilot": "https://www.trustpilot.com/review/cce.cash" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "changehero", "category": "exchanges", "subcategory": "Instant Swaps", "name": "ChangeHero", "url": "https://xmr.club/exchanges/changehero", "twin": "https://xmr.club/llm/exchanges/changehero.txt", "tagline": "Instant crypto swap aggregator since 2017 — 300+ assets including XMR, no account for crypto-to-crypto swaps, Float (≤0.5%) or Fixed (≤0.7%) rates. Reader caveat: kycnot.me tags this as a Level 3 / shotgun-KYC service.", "review": "**What it is.** Instant crypto swap service operating since 2017. 300+ assets across many chains including Monero. Crypto-to-crypto swaps don't require an account, an email, or KYC at signup — pick the pair, choose Float Rate (best market price) or Fixed Rate (locked for 15 minutes), provide your receive address, and send to a one-time deposit address. Fiat purchases are routed through licensed providers (Mercuryo, FinchPay) and are KYC'd by them, not by ChangeHero.\n\n**Fees.** The homepage discloses up to **0.5% with Best Rate (Float)** and **up to 0.7% with Fixed Rate**, both inclusive of the spread. That puts ChangeHero on the cheaper end of the swap-aggregator market.\n\n**Peer position — the disagreement that matters.** kycnot.me lists ChangeHero at **5/10** and tags the service as a **\"KYC Level 3 Aggregator\"**, with the explicit description: *\"It may request KYC during risk checks.\"* That is the shotgun-KYC pattern — marketed as no-KYC, but the service reserves the right to ask for identity verification (often after the deposit lands) when its internal risk engine flags the trade. monerica.com lists ChangeHero too, going back to 2017. The operator's own pitch to xmr.club calls ChangeHero \"non-custodial, no-KYC\" — that framing is at tension with the published kycnot finding, and we are mirroring kycnot's framing in this listing because it is the one that changes the reader's behavior.\n\n**What this means for a reader.** Most swaps complete without anyone asking for ID. The risk engine fires unpredictably — high amounts, certain source-chain combinations, certain destination addresses, certain IPs — and when it fires, you can be asked for documents after your funds are already at ChangeHero. Refusing means the swap can be held until refund. This is fundamentally different from a structurally non-custodial atomic-swap protocol, where the engine cannot pause your trade because the engine does not hold your funds.\n\n**Refund policy — the specifics.** ChangeHero's operator-published FAQ names two clauses worth reading before depositing. First, if a reader refuses KYC after a risk-check flag, the operator returns funds \"subtracting the network fee and ChangeHero operational fee in the amount of 10% from transferred assets but not less than 100 USD equivalent.\" The $100 floor is the sharp edge — a $200 swap refused for KYC returns $80 (a 60% refund haircut), and a $50 swap returns nothing (the floor exceeds the deposit). Small-swap readers should treat any risk-check-triggered KYC as a total-loss scenario, not a refund. Second, if the operator concludes a deposit may be involved in fraud, money laundering, or \"other suspicious activity,\" the FAQ text states ChangeHero \"reserves the right not to conduct any activity with the customer's funds for the investigation period\" — no cap is placed on that period. These two clauses are why the shotgun-KYC concern above matters materially, not just theoretically.\n\n**Grade C- — why C-.** Nine years of operation is real tenure and the fee disclosure is honest, but two grade-inputs stack: (a) the kycnot Level-3 / shotgun-KYC tag reflects an unpredictable risk engine that can hold funds mid-swap, and (b) the 10% / $100-minimum refund penalty means a KYC-refusal outcome is not neutral — it is a materially taxed exit, and below roughly $1,000 the flat $100 floor eats a double-digit percentage of the deposit. Together these push the grade below the C midpoint. Path back to C: a public, dated change to either the risk-check process (kycnot retracts the Level-3 tag) or the refund-penalty formula (the $100 floor removed or made proportional). Path to B or higher: both changes plus several months of operator-published statistics on risk-check pause frequency and documented thresholds. Path to a recommendation flag of any kind: not without those changes.\n\n**Tenure.** Publicly verified on xmr.club since 2026-06-29 — 5 days as of this note. For exchange-class services, tenure is a grade input: even a clean publishable surface defaults to Grade C, and any lift needs both independent corroboration from other privacy-focused directories AND a sustained track record of unproblematic swaps observed over time. First scheduled re-check: 2026-09-27.", "translation_locale": "en", "rating": { "grade": "C-" }, "grade": "C-", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "AGGREGATOR", "SHOTGUN-KYC-RISK", "NO-ACCOUNT", "XMR", "MULTICHAIN", "EST-2017" ], "fees": { "summary": "Float (Best Rate) ≤0.5% · Fixed Rate ≤0.7% · spreads inclusive." }, "fees_summary": "Float (Best Rate) ≤0.5% · Fixed Rate ≤0.7% · spreads inclusive.", "last_verified": "2026-07-14", "operating_since": "2017", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://changehero.io/", "twitter": "https://x.com/Changehero_io", "telegram": "https://t.me/changeherodotio" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "changelly", "category": "exchanges", "subcategory": "Instant Swaps", "name": "Changelly", "url": "https://xmr.club/exchanges/changelly", "twin": "https://xmr.club/llm/exchanges/changelly.txt", "tagline": "Custodial instant swap since 2015 — 300+ assets including XMR, no account for crypto-to-crypto swaps. Reader caveat: its AML policy lets it put flagged transactions on hold and demand ID after your deposit lands (shotgun-KYC).", "review": "**What it is.** Changelly is a custodial instant-swap service operating since 2015 — one of the oldest names in the category. 300+ assets across many chains, Monero included; you can swap crypto-to-crypto without an account or email (pick the pair, choose a floating or fixed rate, give a receive address, and send to a one-time deposit address). Fiat purchases are routed through licensed third-party providers who KYC you themselves.\n\n**The rate.** Changelly earns from the spread baked into the quoted rate rather than a visible line-item fee. The number you see is what you get, but the margin is not itemized against the mid-market rate — cross-check a quote elsewhere for a large swap.\n\n**The risk that defines the grade — AML holds.** Changelly runs a full AML/KYC program, and its own policy is explicit: when its risk engine flags a transaction as suspicious, *\"the transaction will be put on hold\"* and the service collects identity documents before releasing funds. This is the shotgun-KYC pattern — marketed as no-signup, but the operator reserves the right to demand ID, usually **after your deposit has already landed**, when the internal risk score trips. It also screens against sanctions / SDN lists and geoblocks restricted regions. Changelly is one of the most-reported services in the category for exactly this: funds held pending verification, sometimes for extended periods.\n\n**What this means for you.** Most swaps clear untouched. But the risk engine fires unpredictably — large amounts, certain chains, certain addresses or IPs — and when it fires, your funds are already custodial and can be frozen until you verify or the case resolves. That is categorically different from a structurally non-custodial atomic swap, where no engine can pause a trade because no operator holds the funds. Read the current refund / hold terms before depositing, and never route funds you cannot afford to have held.\n\n**Useful when.** You want deep liquidity and broad asset coverage from a long-established operator, your funds are clean and unremarkable, and you accept the custodial-hold risk as the price of convenience. For anything privacy-sensitive or time-critical, a non-custodial atomic swap or a P2P venue is the safer shape.\n\n**Caveats & grade.** **C-**: eleven years of tenure and published Terms / Privacy / AML policies are real positives that keep it a legitimate listing — but the custodial hold-pending-KYC behaviour is a documented, recurring, above-average reader hazard, which pulls it below the C midpoint. It is listed because it works and it is honest about being AML-bound; it is graded low because it works right up until the risk engine decides it does not. Clean funds are usually fine; a complicated history is not.", "translation_locale": "en", "rating": { "grade": "C-", "trust": "Custodial instant swap operating since 2015 (~11 years) — one of the oldest in the category. Publishes Terms, Privacy and AML/KYC policies. Runs a risk engine that can put flagged transactions on hold pending ID; screens sanctions/SDN lists; geoblocks restricted regions.", "privacy": "No account/email for crypto-to-crypto swaps, but NOT structurally private: custodial during the swap (holds your funds), AML risk engine can demand ID after deposit, fiat on-ramp KYC'd by licensed partners. Not a privacy tool — a mainstream AML-bound swapper.", "ux": "Pick pair, floating or fixed rate, one-time deposit address, receive. 300+ assets incl. XMR across many chains. Spread not itemized against mid-market." }, "grade": "C-", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "custodial", "closed_source", "multi_chain", "country_blocks" ], "highlight_tags": [ "INSTANT-SWAP", "SHOTGUN-KYC-RISK", "NO-ACCOUNT", "XMR", "MULTICHAIN", "EST-2015" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-21", "operating_since": 2015, "tenure_note": "~11 years operating (founded 2015-09). Publishes Terms, Privacy and AML/KYC policies.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://changelly.com", "outbound_slug": "changelly", "affiliate": "https://changelly.com/?from=btc&to=eth&amount=0.1&ref_id=dY2NIIisW9fCZx-d" }, "also_listed_at": { "kycnot": true } }, { "id": "changenow-warning", "category": "exchanges", "subcategory": "Instant Swaps", "name": "ChangeNow", "url": "https://xmr.club/exchanges/changenow-warning", "twin": "https://xmr.club/llm/exchanges/changenow-warning.txt", "tagline": "WARNING — historical KYC-creep. Listed for comparison; not recommended. Historically no-KYC but routinely requests verification on flagged tx.", "review": "Listed for completeness. ChangeNow markets itself as no-KYC but in practice requests KYC on a meaningful percentage of trades, especially on the receiving leg. Use only when other paths are unavailable.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "KYC-RISK", "FALLBACK ONLY" ], "fees": { "summary": "Floating ~0.5% · fixed-rate 2% spread" }, "fees_summary": "Floating ~0.5% · fixed-rate 2% spread", "last_verified": "2026-05-12", "operating_since": "2017", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2017", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://changenow.io", "outbound_slug": "changenow", "affiliate": "https://changenow.app.link/referral?link_id=3620ac5f201d46" }, "also_listed_at": { "orangefren": true, "kycnot": true, "monerica": true } }, { "id": "coinos", "category": "exchanges", "subcategory": "Lightning", "name": "Coinos", "url": "https://xmr.club/exchanges/coinos", "twin": "https://xmr.club/llm/exchanges/coinos.txt", "tagline": "No-KYC Lightning wallet + custodial swap service. Lightning ↔ on-chain ↔ liquid.", "review": "Anonymous Lightning custodial wallet with built-in swap engine — load via Lightning, swap to on-chain BTC or Liquid, withdraw anywhere. No email required; account = generated user. Limits are conservative on anonymous tier but adequate for personal scale.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "custodial", "open_source", "lightning_native", "tor_supported" ], "highlight_tags": [ "NO-KYC", "LIGHTNING", "OPEN-SOURCE" ], "fees": { "summary": "Custodial · LN/onchain/Liquid · anonymous account · open-source" }, "fees_summary": "Custodial · LN/onchain/Liquid · anonymous account · open-source", "last_verified": "2026-05-13", "operating_since": "2015", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2015", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://coinos.io", "outbound_slug": "coinos", "tor": "http://vm7h454g5hiy2nt3u5o7evtz3vigtypo2mkyausakvdkbmd7wpyhx5qd.onion" }, "also_listed_at": { "kycnot": true } }, { "id": "cyphergoat", "category": "exchanges", "subcategory": "Aggregators", "name": "CypherGoat", "url": "https://xmr.club/exchanges/cyphergoat", "twin": "https://xmr.club/llm/exchanges/cyphergoat.txt", "tagline": "Open-source non-custodial swap aggregator — no-account, Tor-friendly with operator-published onion, KYC sort filter, ~20 coins across multiple instant-swap engines.", "review": "**Open-source non-custodial swap aggregator** — fans your order out to multiple instant-swap engines (StealthEx, ChangeNOW, ChangeHero, FixedFloat per their `/about`), surfaces quotes, lets you pick + execute without ever depositing into CypherGoat itself. Operator-published positioning: *\"Swap Crypto at the Best Rate on the Market — Non-Custodial, No account, Tor supported, Open source. Sort by KYC level.\"* Listed at **Grade B** on first pass (per playbook: new aggregator, no curator test trade on file yet, sparse operator-published team / jurisdiction disclosure) — the open-source code + operator-published Tor onion + explicit KYC-sort filter are strong signals that this can upgrade to A after end-to-end testing.\n\n**What it is.** Web app at `cyphergoat.com` (clearnet) + `cyphergmw4huw7jzhat3misfm5jj2m4nvafockqbj7i5rrlec6mobdid.onion` (Tor). The home page is a swap form (from-coin / amount / to-coin → quote across engines → pick + execute). Funds flow user → chosen-engine → user; CypherGoat doesn't custody between legs. **Open source** at `github.com/cyphergoat` (org) with the web frontend at `github.com/CypherGoat/web` — auditable code base, license terms in the repo. Supported coins on the home form include BTC (incl. Lightning), ETH, **XMR**, LTC, BCH, DOGE, BNB, SOL, XTZ, ADA, XRP, TRX, LINK, USDC across multiple chains (ETH/POLY/SOL/ALGO/BSC/OP/BASE/TRON), USDT, Nano.\n\n**What you trust.**\n\n- **Non-custodial swap aggregator.** Funds flow user → engine → user. CypherGoat doesn't hold balances between legs; if an engine fails, refund-recovery is the engine's responsibility (their refund policy varies — CypherGoat surfaces this per-engine).\n- **Open-source code at `github.com/cyphergoat`.** Frontend at `github.com/CypherGoat/web`. Auditable, forkable. (License terms in the repo; we have not verified MIT vs GPL vs Apache.)\n- **Operator-published Tor onion** — `cyphergmw4huw7jzhat3misfm5jj2m4nvafockqbj7i5rrlec6mobdid.onion`. Cross-listed in the operator's own `/about` page, satisfies the operator-disclosure standard from /guides/verify-onion-mirror.\n- **No account, no signup, no KYC at the aggregator layer.** Each underlying engine has its own KYC posture; CypherGoat exposes this as a **\"Sort by KYC level\"** filter — a user-facing differentiator vs aggregators that hide engine KYC behind the quote.\n- **Affiliate disclosed.** Operator mentions an Affiliate Program + Affiliate Login on /about. Implied: CypherGoat earns a cut on each routed swap. Same model as kyc.rip / OrangeFren / Trocador.\n- **No team / jurisdiction disclosure** — the only public-facing identity is the brand + GitHub org. Common for the pseudonymous-operator no-KYC tooling tier; flagged as a transparency caveat rather than a blocker.\n\n**Operational specs.**\n\n- **Site.** Clearnet `cyphergoat.com` + Tor `cyphergmw4huw7jzhat3misfm5jj2m4nvafockqbj7i5rrlec6mobdid.onion`. Both render the same React/Vite SPA; legal pages (/about, /privacy, /terms) ship real operator-written content (24-25 KB each), not the SPA shell.\n- **Engine partners (disclosed on /about).** StealthEx, ChangeNOW, ChangeHero, FixedFloat. Live coverage likely broader once you query the in-app quote — but the operator-disclosed list is a useful starting point.\n- **Coin coverage.** ~20+ coins on the home form (see What it is). XMR is first-class.\n- **KYC sort filter.** Lets you sort engines by KYC posture before picking — useful when comparing the same pair across a strict-KYC engine vs a no-KYC one.\n- **Pricing.** Engine-driven; CypherGoat surfaces the engine's quote. Affiliate cut is implied (per /about Affiliate section) but not disclosed as a percentage.\n- **API.** Frontend hits the engines' APIs through a CypherGoat backend layer. No public CypherGoat API endpoint surfaced; check the GitHub repo for shape if you want to build on top.\n- **No published team / jurisdiction / commercial entity.** Pseudonymous operator. Flagged but not blocking at Grade B.\n\n**Operator philosophy.** Per /about: open-source-first, non-custodial aggregation. The **explicit KYC-sort filter** is the editorial differentiator vs hidden-routing aggregators — CypherGoat treats KYC posture as a first-class user-facing axis rather than a hidden engine-routing decision. The operator framing is anti-custody, anti-account, pro-Tor: same posture as kycnot.me and the broader no-KYC tooling community.\n\n**Grade rationale.** **Grade B** on first pass because: (1) **no curator end-to-end test trade on file yet** — playbook default for new aggregator submissions; (2) **no published team / jurisdiction / commercial entity** disclosure; (3) **affiliate cut not disclosed as a percentage** — fine for Grade B, would prefer transparency for A. The **open-source code + operator-published Tor onion + explicit KYC-sort filter** are strong signals toward A. Re-grading conditional on (a) successful end-to-end test trade in both modes (clearnet + onion), (b) the affiliate cut + license terms confirmed from the repo, (c) any team / jurisdiction disclosure even at pseudonym level.\n\n**Useful when:**\n\n- You want a **swap-quote comparison across multiple engines** with the ability to **sort by KYC posture** before executing.\n- You're operating **over Tor** and want an aggregator with an operator-published onion (not just a clearnet site that works under Tor).\n- You prefer **auditable open-source code** for the aggregator layer, not just the underlying engines.\n- You want a **Lightning-aware** BTC source path (BTC-Lightning is in the home-form coin list).\n- You're already comfortable with the underlying engines (most are graded individually on kyc.rip + xmr.club) and just want a privacy-respecting quote-comparison UI on top.\n\n**Caveats:**\n\n- **No curator test trade on file yet.** Listed first-pass at Grade B; full enrichment + end-to-end verification will follow in the next Phase 2 enrichment tick.\n- **No published team / jurisdiction / commercial entity.** Common for this tier but flagged for transparency.\n- **Affiliate-cut percentage not disclosed.** CypherGoat earns on every routed swap (per /about Affiliate section). Cross-check the engine's direct quote vs CypherGoat's quote to see the spread the aggregator is adding.\n- **License terms not verified yet.** Code is on GitHub but we haven't pulled the LICENSE file — \"open source\" claim is operator-stated, confirm via the repo before forking.\n- **JS-only frontend.** React/Vite SPA — no SSR fallback for no-JS users. Site loads under Tor (clearnet behind Tor) and under the published .onion, but both paths need JS enabled.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "tor_mirror", "no_js_supported", "api_available" ], "highlight_tags": [ "AGGREGATOR", "TOR", "OPEN SOURCE" ], "fees": { "summary": "Aggregator surfaces the underlying engine's quote net of CypherGoat's affiliate cut. No platform fee disclosed explicitly; pricing is whatever the picked engine quotes." }, "fees_summary": "Aggregator surfaces the underlying engine's quote net of CypherGoat's affiliate cut. No platform fee disclosed explicitly; pricing is whatever the picked engine quotes.", "last_verified": "2026-05-27", "operating_since": "2025", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://cyphergoat.com", "tor": "http://cyphergmw4huw7jzhat3misfm5jj2m4nvafockqbj7i5rrlec6mobdid.onion", "outbound_slug": "cyphergoat", "contact_email": "support@cyphergoat.com", "twitter": "https://x.com/cyphergoatcom", "telegram": "https://t.me/cyphergoatsupport", "simplex": "CypherGoat Support", "affiliate": "https://cyphergoat.com/?ref=CG8AC6E25A" }, "also_listed_at": { "kycnot": true, "monerica": true, "web3privacy": true } }, { "id": "debridge", "category": "exchanges", "subcategory": "Aggregators", "name": "deBridge", "url": "https://xmr.club/exchanges/debridge", "twin": "https://xmr.club/llm/exchanges/debridge.txt", "tagline": "Cross-chain liquidity protocol — intent-based bridge.", "review": "Intent-based cross-chain swaps for EVM/Solana destinations. Smart-contract-based; no centralised KYC.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available", "non_custodial" ], "highlight_tags": [ "BRIDGE", "NON-CUSTODIAL" ], "fees": { "summary": "Per-route bridge fee · slippage on illiquid pairs" }, "fees_summary": "Per-route bridge fee · slippage on illiquid pairs", "last_verified": "2026-05-14", "operating_since": "2021", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://debridge.finance", "outbound_slug": "debridge", "twitter": "https://x.com/deBridge", "telegram": "https://t.me/deBridge_finance", "discord": "https://discord.gg/debridge", "affiliate": "https://app.debridge.com/r/32927" } }, { "id": "dex-fo", "category": "exchanges", "subcategory": null, "name": "DEX.fo", "url": "https://xmr.club/exchanges/dex-fo", "twin": "https://xmr.club/llm/exchanges/dex-fo.txt", "tagline": "No-KYC, no-logs cross-chain swap — BTC/ETH/XMR/LTC/USDT/USDC, Tor + I2P, no accounts, email or JS trackers. Chain mode (0.8%, routed) or Fast (1.5%, from reserves). kycnot rates it 8/10.", "review": "**A no-KYC, no-logs cross-chain swap with real in-scene reputation bonds.** DEX.fo swaps BTC/ETH/**XMR**/LTC/USDT/USDC with no accounts, no email, no logs and no JavaScript trackers — over clearnet, a **Tor onion and I2P**. Two modes: **Chain** (0.8%, ~30-60 min, decentralized cross-chain routing with refund-to-sender) and **Fast** (1.5%, near-instant, **paid from the operator's own reserves**).\n\n**Standing.** The independent peer signals are clean and positive: **kycnot.me rates it 8/10 (\"Very Good\"), \"Guaranteed no KYC — terms state KYC will never be requested,\" strict no-log**, with trusted user reviews; Monerica lists it no-KYC with a positive swap review. Its trust model is rooted in the Russian-forum exchanger scene — a **1 BTC escrow held by the Exploit.in forum administration** and a **6.2 XMR PGP-signed Letter of Guarantee from Trévoid**, plus per-order cryptographic signatures. Those are real reputation bonds *within that ecosystem* — context worth knowing, not a red flag.\n\n**Why C.** It is a **new-ish service** (Bitcointalk thread since April 2026, on a domain that predates it), and **Fast mode is custodial** — it pays you out of reserves the operator holds, so that path carries counterparty risk that Chain-mode routing does not. On a high-trust shelf, a months-old exchanger that holds reserves sits at C until it earns tenure. It climbs toward B- on a clean curator test-swap and a longer track record.", "translation_locale": "en", "rating": { "grade": "C", "trust": "kycnot.me 8/10 'Very Good', Trust: Good, 'Guaranteed no KYC — terms state KYC never requested', strict no-log, trusted user reviews. Monerica clean (unverified). Reputation bonds: 1 BTC escrow held by Exploit.in forum admin + 6.2 XMR PGP-signed Letter of Guarantee from Trévoid + per-order signatures. BTT thread since 2026-04 (domain on Wayback since 2024). New-ish + Fast-mode custodial reserves cap at C; lifts on tenure + clean curator test-swap. NOT in the OrangeFren scam cluster.", "privacy": "No accounts, no email, no logs, no analytics, no JavaScript trackers. Clearnet + Tor onion + I2P + dex.gl/dex.mn mirrors. Chain mode routes cross-chain with refund-to-sender. No KYC/AML/source-of-funds language on the site (SPA, no separate ToS).", "ux": "Two modes — Chain (0.8%, ~30-60 min, routed) + Fast (1.5%, near-instant from reserves). BTC/ETH/XMR/LTC/USDT(ERC/TRC)/USDC(ERC). Min $30. Refund-address field. Onion + I2P." }, "grade": "C", "kyc_tags": [ "NO-KYC" ], "feature_tags": [ "xmr", "no_kyc", "no_logs", "tor", "cross_chain" ], "highlight_tags": [ "XMR", "NO-KYC", "NO-LOGS", "TOR", "CROSS-CHAIN" ], "fees": null, "fees_summary": null, "last_verified": "2026-09-02", "operating_since": "2026-04", "tenure_note": "Bitcointalk thread since 2026-04; dex.fo domain on Wayback since 2024-04 (predates current branding). Mirrors: dex.gl, dex.mn. Onion + I2P. kycnot.me 8/10. Operator offered a live curator test-swap 2026-09-02 — a clean run lifts toward B-.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://dex.fo", "tor": "http://dexfo673ncucr6ltr45754sff2s4cwjbi7ic5hin6amneggmy2xtl3yd.onion", "outbound_slug": "dex-fo" }, "also_listed_at": { "kycnot": true } }, { "id": "eagleswap", "category": "exchanges", "subcategory": "Instant Swaps", "name": "EagleSwap", "url": "https://xmr.club/exchanges/eagleswap", "twin": "https://xmr.club/llm/exchanges/eagleswap.txt", "tagline": "No-KYC, no-account cross-chain instant swap — pay in one asset, receive another (Monero included) with no registration and no personal info. Custodial while the swap settles; new and thin on operator detail.", "review": "**A no-account cross-chain swap with Monero in the mix.** EagleSwap is a straightforward instant exchanger: pick a pair, send, receive — *\"swap without creating an account or handing over personal information.\"* Monero is supported alongside a broad range of chains, and there's no login, no email, no KYC. For a quick one-off conversion in or out of XMR, it does the obvious thing.\n\n**Custody: funds pass through them while the swap settles.** Like any instant swap it briefly holds value mid-route, so this is *not* non-custodial — send only what the swap needs. Standard for the category.\n\n**Why C.** Two honest gaps keep it on the C shelf regardless of the clean UI: it's **new** (domain first archived Jan 2026, © 2025-26) with **no track record**, and it's **opaque** — no named operator, no published reserves, no Tor mirror, and the cross-chain \"best rates\" framing suggests aggregation we couldn't verify first-party. In a high-loss-asymmetric category (instant swaps), new + custodial + thin-on-transparency is exactly what C is for. kycnot.me lists it (8/10, no reported incidents) and no peer flags a scam — but a clean checklist isn't tenure. A curator test-swap plus real operator/reserve transparency is the path up.", "translation_locale": "en", "rating": { "grade": "C", "trust": "New (Jan 2026 first archive, © 2025-26), opaque: no named operator, no published reserves, no Tor. Custodial during swap. Cross-chain 'best rates' implies aggregation we could not confirm. kycnot 8/10 (checklist), no reported incidents — but no track record.", "privacy": "No account, no email, no KYC, no personal info required — good surface-level privacy. No Tor/I2P mirror published. Custodial handling means the operator sees both legs during the swap; no stated log/retention policy verified.", "ux": "Minimal one-shot swap flow: pick pair, send, receive. Broad chain coverage incl. XMR. No account friction. Thin on detail (fees/reserves not surfaced up front)." }, "grade": "C", "kyc_tags": [ "NO-KYC" ], "feature_tags": [ "xmr", "no_kyc", "swap", "no_account", "cross_chain" ], "highlight_tags": [ "XMR", "NO-KYC", "NO-ACCOUNT", "CROSS-CHAIN" ], "fees": null, "fees_summary": null, "last_verified": "2026-09-08", "operating_since": "2026", "tenure_note": "Domain first archived 2026-01 (~7mo), © 2025-26. No track record; opaque operator (no team/reserves/Tor). Grade C for the high-loss-asymmetric swap shelf; lifts on tenure + a clean curator test-swap + operator/reserve transparency.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://eagleswap.to", "outbound_slug": "eagleswap" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "el-capo", "category": "exchanges", "subcategory": "Instant Swaps", "name": "El Capo", "url": "https://xmr.club/exchanges/el-capo", "twin": "https://xmr.club/llm/exchanges/el-capo.txt", "tagline": "Monero-first instant swap — no ID, no name, no email, no records after 30 days. Tor-native with published onion mirror. kycnot 9/10. Self-branded around XMR as the operational default. Per-order letter of guarantee added 2026-08.", "review": "> **INCIDENT (2026-09-08) - grade dropped A -> F.** El Capo failed to deliver a ~$45,400 Monero order (ref KR-71B69B10): their partner API issued the BTC deposit address, their own key swept the deposit on-chain (sweep tx `629df2a3...`), and they then **denied the order ever existed** and stalled support. We route this non-custodially and never held the funds. **Do not send funds to El Capo.** They were an A-grade listing and a paying headline sponsor - that slot is pulled and the grade is F; grades are not for sale. We also earned affiliate rev-share routing to El Capo - we are ending that too and forfeiting the income. Full account below.\n\n**What it is.** Monero-first instant swap service. Currently observed pairs include BTC → XMR and XMR → USDT (fixed or float rate). The site is explicitly built around Monero (*\"XMR — the cartel's coin of choice\"*), with Tor-native styling and a published onion mirror at `elcapo4l4xad5iipvv6ewg46x6jgb26ed43e5jbrlajxatjoxybue4id.onion` (verify from Tor Browser before quoting).\n\n**Data collection.** Advertised as *Ghost Mode*: no ID, no name, no email. Order records are advertised as deleted after 30 days, or *\"sooner on request.\"* No account is required for a swap; deposit-to-receive is the entire flow. Operator publishes an explicit **Level 0 KYC** posture — no ID, docs, selfies, or source-of-funds requested at any order size.\n\n**AML posture — Level 0 with risk-based pricing.** Operator publishes an explicit no-gatekeeping AML policy: swaps are never blocked, frozen, or de-anonymized on AML grounds. A free AML risk check is available on request, and the resulting risk score is used **only for risk-based pricing** — it may adjust the fee and the final amount received, but never to deny, delay, or identify the customer. That posture is unusually direct for the instant-swap category, where \"AML gatekeeping\" is the standard shape of KYC-triggering behaviour mid-swap.\n\n**Per-order letter of guarantee (added 2026-08).** As of August 2026, El Capo issues a **signed letter of guarantee for each order** — an operator-supplied protection artifact tied to a specific swap. The letter accompanies the order flow (announced to the directory directly by the operator; format not independently verified in a separate follow-up test yet). Practical value: adds a written commitment tied to the specific transaction, which strengthens the reader's recourse position vs a swap-only handshake — useful especially for larger orders where a paper trail of what was promised has material weight.\n\n**Liquidity & pricing.** El Capo operates on **its own liquidity book** (not an aggregator or order-router-through-others), with a **0.75% margin baked into the displayed rates** — the operator publishes both facts openly, which is unusually direct for the category. Margin is absorbed into the quoted rate rather than surfaced pre-swap on the widget; factor it in when comparing quotes across services.\n\n**Peer position.** Two independent peer-directory anchors: kycnot.me at **9/10** (`/service/el-capo`) and monerica.com (`/site/el-capo`). Reciprocally, El Capo's own post-swap success page embeds xmr.club's *Rate-Us* badge alongside the KYCnot.me and Monerica prompts — actively routing satisfied customers to all three directories most likely to move readers on a grade. That's material trust-signal reciprocity, not just listing tolerance.\n\n**Test swap (2026-07-05).** Small-order end-to-end swap completed clean:\n- 0.32 XMR → 101.59882 USDT-ETH\n- Rate 316.576763 USDT/XMR (FLOAT) — variance ~0.04% vs quote\n- Effective completion ~4 min from broadcast to credit\n- Minimum order size: $100; rate lock: 20 min from order creation\n\n**Confirmation policy.** Operator publishes an **up-to-10 confirmations** ceiling for XMR — a documented maximum, not a floor. Observed behaviour at the ~$100 tier: 1 confirmation was effective (the \"10 confs\" widget text is informational at that size). Larger amounts likely tighten toward the ceiling; the operator has not published a per-tier threshold, so if you're moving a five-figure amount, budget for the full 10-conf wait or ask support to confirm the per-order requirement. Edge case: a first attempt at Slow/Default priority sat in mempool and expired around the 20-min mark; resend at Fast priority cleared in a single confirmation. Reader tip: don't skimp on the fee when the rate is locked.\n\n**Why Grade A.** Seven converging signals: (a) kycnot 9/10 peer score, (b) monerica corroboration, (c) working onion mirror advertised on the clearnet homepage, (d) explicit no-data-collection framing that survived an end-to-end test, (e) transparent fee/rate handling — 0.75% margin operator-published + quoted rate held within 0.04% of settled rate on FLOAT, (f) operator-side reciprocal directory linkage (Rate-Us badge embed on the success page), (g) explicit **Level 0 AML posture** — never blocks, freezes, or de-anonymizes on AML grounds; risk-score used only for risk-based pricing, never for gatekeeping.\n\n**Tenure caveat.** Publicly verified on xmr.club since 2026-07-03. Grade A is granted on the strength of structural + verified operational signals rather than 90-day tenure. A 90-day re-check remains scheduled (2026-10-01); a serious incident before then drops the grade to C or lower without appeal.\n\n**Caveats.** Branded copy leans on cartel imagery (*\"cartel's coin of choice\"*) — stylistic choice, not a functional concern, but worth noting for readers who care about how a service self-positions. Fee is not surfaced pre-swap on the widget; it's absorbed into the quoted rate. Larger-amount confirmation behaviour is bounded by the operator's up-to-10 published ceiling — budget accordingly for large orders and confirm the per-order requirement with support ahead of time.", "translation_locale": "en", "rating": { "grade": "F" }, "grade": "F", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "INSTANT-SWAP", "NO-KYC", "NO-ACCOUNT", "XMR-FIRST", "TOR-NATIVE", "PUBLISHED-ONION" ], "fees": null, "fees_summary": null, "last_verified": "2026-07-29", "operating_since": "operator-claims c.2026", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://elcapo.io", "tor": "http://elcapo4l4xad5iipvv6ewg46x6jgb26ed43e5jbrlajxatjoxybue4id.onion", "telegram": "https://t.me/elcapo_support", "email": "mailto:support@elcapo.io", "simplex": "simplex:", "pgp_fingerprint": "9455 F75B 2295 5729 30C1 27F9 C181 53E3 9A6F 3E9C", "logo": "https://xmr.club/peers/el-capo.svg", "affiliate": "https://elcapo.io/?ref=kycrip" }, "incident": { "date": "2026-09-08", "severity": "critical", "resolved": false, "source_url": "https://mempool.space/tx/629df2a314b2e49036488f05de2c51bf7dd09cd198bb344776d29d6e04f0408f", "summary": "El Capo is a repeat exit-scammer — **at least three independent victims** reported to date (~$105,000 in July 2026, ~$45,400 and 79.55 ETH in September 2026), each with the identical playbook: a small order completes fine to build trust, then a large order is taken, flipped to \"hold\"/\"expired\", and the order is denied. The fully-documented case: On 2026-09-07 an order to swap 0.57395628 BTC -> 87.33135572 XMR (~$45,400) was created through El Capo's own partner API, which returned the order ID (16B53402BD0BA087C06855ED9CD3293E) and a BTC deposit address (bc1qw0zr6z996td5pg39wa20a5vryhavhq4fcgr79n). The user funded that address (deposit tx cc16c51224c6a3387d01f782ade4d78d69783f563555d573c7894bad65512801); El Capo then swept the deposit into its consolidation wallet (sweep tx 629df2a314b2e49036488f05de2c51bf7dd09cd198bb344776d29d6e04f0408f) -- an on-chain spend FROM the address their API issued, which proves their control of it. The 87.33 XMR was never delivered. When the dispute was raised, El Capo denied the order had ever existed and stalled support past the resolution window. This route is operated non-custodially: the deposit address was El Capo's own, relayed to the user; the funds were never held by us. An operator that fulfils an order proves delivery; one that disowns an order while its own key demonstrably swept the deposit is exit-scamming.", "curator_advice": "Do not send funds to El Capo. Treat any El Capo swap as at-risk pending an on-record resolution -- delivery of the owed XMR or a full BTC refund -- and independent verification. This is a first-party finding from the routing operator, not a third-party report.", "timeline": [ { "date": "2026-07-09", "note": "VICTIM 1 (first sign) — a user reported a ~$105,000 El Capo scam with the identical pattern: a $10k order worked, then ~60 ETH was taken -> hold -> expired -> denied. Unverifiable at the time (anonymous, operator produced no tx-hash), so it was not actioned; corroborated in hindsight by victims 2 and 3." }, { "date": "2026-09-08", "note": "VICTIM 2 — Grade A -> F. A ~$45,400 order (KR-71B69B10, 0.57395628 BTC) was created via El Capo's partner API; they swept the BTC on-chain (tx 629df2a3...f0408f) from the address their API issued, delivered no XMR, then denied the order existed. Sponsorship terminated; router routing to El Capo disabled." }, { "date": "2026-09-09", "note": "VICTIM 3 — 79.55 ETH (order B29A7FF45D73546E72C86F7613423FCC) reported: an 11 ETH order completed fine, then the large order was taken and denied. Third independent victim; repeat-offender pattern confirmed." }, { "date": "2026-09-09", "note": "Evidence — El Capo's own API reported order KR-71B69B10 as CONFIRMING at 17:22 UTC (our monitor mirrors only the provider), then returned not-found for it while still serving our other El Capo orders. They had the order they deny." }, { "date": "2026-09-09", "note": "Peer directories acted: Monerica, SwapRaven and BitMixList flagged El Capo; kycnot.me filed a Scam status (citing xmr.club)." }, { "date": "2026-09-11", "note": "A reporter privately provided cryptographic proof tied to one of the disputed orders." }, { "date": "2026-09-11", "note": "That proof was independently verified — it confirms El Capo issued an order it denies. Held PRIVATELY at the reporter's request (not published); available to peer directories for verification on request." }, { "date": "2026-09-11", "note": "The 0.57 BTC / 87.33 XMR non-delivery is unchanged: no operator admission, refund, or on-chain recovery. Independent directories have now publicly marked El Capo a scam and delisted it, while elcapo.io remains live and still advertising swaps. A claimed second large-order victim is unverified by the reporting direct…", "auto": true } ] }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "etz-swap", "category": "exchanges", "subcategory": "Instant Swaps", "name": "ETZ-Swap", "url": "https://xmr.club/exchanges/etz-swap", "twin": "https://xmr.club/llm/exchanges/etz-swap.txt", "tagline": "Two-year-old no-account instant swap — Trocador A privacy rating, kycnot APPROVED 8/10, Tor v3 mirror, no-JS variant. Trust weight reduced 2026-07-29 after OrangeFren.com publicly grouped etz-swap in a cluster with OctoSwap (flagged for a $30k scam report + OF delist) and the operator went silent on both renewal outreach and integration follow-ups.", "review": "A no-account, no-KYC instant swap service running out of Ukraine since April 2024 — two-year tenure, kycnot APPROVED at 8/10 with guaranteed no-KYC posture, Trocador A privacy rating, and an in-house test swap on 15 June 2026 that settled in **3 minutes end-to-end** with a −0.15% float drift. Listed at **Grade A** on the combination of independent peer-directory validation, observed operator-side speed, honest float pricing, no-account flow, multi-chain stablecoin coverage, and infrastructure choices (Tor mirror, no-JS variant) that match the privacy posture in the marketing.\n\n**What it is.** A no-registration, no-KYC instant cryptocurrency swap supporting Monero, BTC, ETH, LTC, PIVX, and 1000+ other coins, with stablecoins offered across multiple chains (ERC20 / TRC20 / and others) so users can pick the cheapest settlement path. Listed at **Grade A** because the swap path is now triple-verified — kycnot's three test swaps in April 2026, our own test swap in June 2026, and Trocador's A privacy rating from their own audit — and the operational signals (speed, fee honesty, no-account flow, infrastructure) all reinforce the claim.\n\n**Background.** ETZ-Swap has been operating since around 30 April 2024 — over two years. Legally registered in Ukraine. Active operator presence on Bitcointalk (Jr. Member tier, single 17-post service thread), an X account at `@ETZ_Swap` (132 followers, joined Sept 2025), Telegram support at `@etz_support`, a SimpleX channel, and a published PGP key. The service runs a Telegram swap bot (`@EtzSwapBot`), an API, and a separate no-JavaScript variant at `nojs.etz-swap.com`. Policy pages live at `/privacy-policy` and `/terms-of-use`; kycnot reviewed the terms-of-use directly on 1 June 2026 and confirmed the no-KYC posture. Partnerships with Trocador.app (rated A on Trocador's privacy panel), OrangeFren, IsItKYC, and KycNotList. Listed on kycnot and monerica.\n\n**What you trust.**\n\n- **In-house test swap, 15 June 2026: 3 minutes end-to-end.** We dispatched 0.2 XMR → 66.43795517 USDT (ERC20). From the moment our wallet broadcast the XMR transaction to USDT confirmed in our destination wallet: **~3 minutes**. The operator settles on 0–1 XMR confirmations, absorbing reorg risk in exchange for category-leading speed (Sideshift / FixedFloat / ChangeNow typically take 20–40 minutes on the same pair). Float drift was −0.15% — well inside normal market spread, no hidden haircut. The flow had four clean stages (Confirmed → Exchanged → Sending → Success); no indefinite-loading edge cases, no surprise gating, no support interaction needed.\n- **kycnot APPROVED 8/10 with guaranteed no-KYC.** kycnot rates ETZ-Swap as KYC level 0/4 (Guaranteed no KYC), Privacy 90/100, Trust 67/100. Per kycnot's direct review of the terms-of-use on 1 June 2026, the service \"explicitly states KYC will never be requested.\" Risk-flagged transactions trigger a refund to the sender, not a KYC demand.\n- **Three additional independent test swaps passed (kycnot, April 2026).** kycnot performed verification swaps in April 2026: ~1 XMR (8 Apr), 0.01 BTC (16 Apr), 6 LTC (23 Apr). All completed end-to-end. Combined with our 15 June swap, that's four real-funds tests on the public record across four months, all clean.\n- **Trocador A rating.** Trocador.app rates ETZ-Swap A on its privacy panel — the top of the scale, signalling that the service has met Trocador's bar on own liquidity, no-KYC posture, and technical audit. Trocador routes real swap volume through partner liquidity, so the rating reflects how the service actually behaves under traffic.\n- **Two years of operating history.** Operating since 30 April 2024, with no withdrawal-block incident on the public record.\n- **No-account flow with optional email.** The swap path itself never asks for an email or registration. Users who want order history can opt in to an email account; everyone else swaps anonymously. Best of both postures.\n- **No-JavaScript variant exists.** `nojs.etz-swap.com` is a dedicated JS-free interface — the swap flow is accessible to users running NoScript or Tor Browser's Safest mode. Few competitors ship this.\n- **Tor v3 mirror, properly configured.** `ntrzt52ib6b7vwzmo4scfpcdjr54uaxobnrpsifb5i4y64rphylqe6ad.onion` matches the clearnet `Onion-Location` header.\n- **User-side sentiment is consistently positive.** Four kycnot user reviews averaging 4.5/5, written between March and June 2026, all describe successful swaps. Two reviewers had their Order IDs verified by kycnot moderation.\n\n**Operational specs.**\n\n- **Site.** https://etz-swap.com — Next.js SPA; policy pages require JavaScript to render.\n- **Tor mirror.** `ntrzt52ib6b7vwzmo4scfpcdjr54uaxobnrpsifb5i4y64rphylqe6ad.onion` (v3).\n- **No-JS variant.** `nojs.etz-swap.com` for users browsing without JavaScript.\n- **Telegram bot.** `@EtzSwapBot` runs the full swap flow inside Telegram.\n- **API.** Documented as available by kycnot; no public docs URL is published — reach out via the support channels for endpoint specs.\n- **Coin coverage.** BTC, ETH, XMR are headline pairs; PIVX added May 2026; 1000+ assets routed in total. **Stablecoins offered across multiple chains** (ERC20 / TRC20 / and others) — users can pick the cheapest settlement chain rather than getting locked into ERC20 gas. Monero is a first-class pair.\n- **Pricing model.** Float rate (rate tracks spot at settlement, not locked at quote time). Observed drift on our 0.2 XMR test was −0.15%; that's well inside market spread, indicating honest float pricing rather than a hidden spread.\n- **Settlement speed.** Observed 0–1 XMR confirmation acceptance and ~3-minute end-to-end on a 0.2 XMR test — category-leading.\n- **Registration.** No registration required for a swap. An optional account can be opened with just an email — no documents.\n- **Channels.** support@etz-swap.com, etz_support@proton.me, X `@ETZ_Swap`, Telegram `@etz_support`, SimpleX, PGP key at `/pgp`. No Matrix, Signal, or Discord.\n- **Jurisdiction.** Ukraine (registered company; no address, registration number, or officer identity published).\n- **Reserves.** Operator claims hybrid liquidity (own pools plus external providers); not externally verified.\n- **Partners.** Trocador.app (privacy rating: A), OrangeFren, IsItKYC, KycNotList.\n\n**Operator philosophy.** ETZ-Swap is positioned as a no-account, privacy-first swap service. The infrastructure choices reflect that: a Tor v3 mirror, a no-JavaScript variant, a Telegram bot for users who'd rather not visit a website at all, SimpleX as a contact channel, and a published PGP key. The decision to ship a no-JS interface is the clearest practical commitment — most swap services pay lip service to privacy while requiring users to run a tracker-laden SPA. The decision to settle on 0–1 confirmations is the clearest operational commitment — the operator is absorbing the reorg-risk cost so users don't wait twenty minutes for finality. The partner network (Trocador, OrangeFren, IsItKYC, KycNotList) suggests an operator who understands that credibility in this space is built by getting validated in privacy directories rather than by marketing copy. The October 2025 – February 2026 silence on the announcement thread was attributed to infrastructure and product work, and the return shipped a substantive update — real-time reserves, the no-JS variant, the Telegram bot, expanded partners. Plausible, and the four months since suggest the operator is engaged again.\n\n**Grade rationale.** Listed at **Grade A** on a triangulation of three independent signals that all point the same direction. (1) **Peer-directory validation:** kycnot APPROVED at 8/10 with three real-funds test swaps in April 2026, Trocador A privacy rating from their own audit, monerica direct listing, OrangeFren / IsItKYC partner status. (2) **In-house verification:** our 0.2 XMR → 66.44 USDT test swap on 15 June 2026 settled in 3 minutes end-to-end with a −0.15% float drift, no hidden fees, no surprise gating. The observed 0–1 conf acceptance is category-leading; the float was honest; the UI never reproduced the widget-UX edge case reported on Bitcointalk. (3) **Posture-matching infrastructure:** no-account flow with optional email, Tor v3 mirror that matches the Onion-Location header, no-JavaScript variant for NoScript / Tor Safest users, Telegram swap bot, multi-chain stablecoin coverage. The two-year operating history with no withdrawal-block incident on the public record underwrites the rating. **What would keep this at A:** operator engagement cadence stays steady (no second multi-month thread silence), no withdrawal-block or grade-changing incident surfaces, and we re-verify with a second test swap in 6 months.\n\n**Useful when.**\n\n- You want a no-KYC, no-registration swap and you want it triple-verified — kycnot has tested it three times with real funds, we tested it once, and Trocador rates it A on their privacy panel.\n- You want speed — observed ~3 minutes end-to-end on a 0.2 XMR test. The operator settles on 0–1 confirmations rather than waiting for full XMR network finality.\n- You want to settle stablecoins on a cheap chain — multi-chain coverage means you can pick TRC20, BSC, or another cheap chain rather than getting locked into ERC20 gas.\n- You browse with JavaScript disabled or run Tor Browser in Safest mode — `nojs.etz-swap.com` is one of the few swap services where the full flow works without JS.\n- You'd rather swap inside Telegram than visit a website — `@EtzSwapBot` runs the full swap flow.\n- You want a swap with two years of operating history and no withdrawal-block incident on the public record.\n\n**Caveats.**\n\n- **Four-month communication gap on the public thread (Oct 2025 → Feb 2026).** Attributed to infrastructure work. Plausible given the substantive return-post update, but on the record — keep an eye on operator engagement cadence.\n- **Float rate model.** Rates aren't locked at quote time — they track spot at settlement. Our observed drift was honest (−0.15%, well inside market spread), but float-rate users should size with the awareness that the final receive amount can move a fraction of a percent in either direction. A user wanting an exactly-locked rate should pick a fixed-rate competitor.\n- **Ukraine jurisdiction carries geo-political risk** that's not addressed in any published continuity plan.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "tor_mirror", "no_js", "telegram_bot", "api" ], "highlight_tags": [ "XMR", "TOR", "NO-JS", "NO-ACCOUNT", "FAST" ], "fees": { "summary": "Quoted at swap time · no published rate sheet · 1000+ coins (BTC/ETH/XMR/LTC/PIVX/…)" }, "fees_summary": "Quoted at swap time · no published rate sheet · 1000+ coins (BTC/ETH/XMR/LTC/PIVX/…)", "last_verified": "2026-07-29", "operating_since": "2024-04", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://etz-swap.com", "outbound_slug": "etz-swap", "tor": "http://ntrzt52ib6b7vwzmo4scfpcdjr54uaxobnrpsifb5i4y64rphylqe6ad.onion", "contact_email": "support@etz-swap.com", "twitter": "https://x.com/ETZ_Swap", "telegram": "https://t.me/etz_support", "telegram_bot": "https://t.me/EtzSwapBot", "pgp_key_url": "https://etz-swap.com/pgp", "affiliate": "https://etz-swap.com?ref=ZKOA1T7AUL58AOWWL8BK" }, "also_listed_at": { "kycnot": true, "monerica": true, "trocador": true, "orangefren": true } }, { "id": "exolix", "category": "exchanges", "subcategory": "Instant Swaps", "name": "Exolix", "url": "https://xmr.club/exchanges/exolix", "twin": "https://xmr.club/llm/exchanges/exolix.txt", "tagline": "Anonymous swap, fixed-rate option, decent XMR support.", "review": "Exolix is the long-running no-KYC instant-swap aggregator with a **fixed-rate guarantee** that holds across small-to-mid trade sizes and a **$4,000 OrangeFren user-recourse guarantee** backing the operator's reliability. Listed at **Grade A** because the fixed-rate quote is one of the more consistently honoured in the no-KYC swap space — when the operator says \"swap 1 BTC for X XMR,\" the X XMR is what arrives, even when the upstream market moves during the routing window.\n\n**Background.** Exolix has been operating as an anonymous instant-swap aggregator since the late-2010s, predating most current-cohort competitors. Routes through upstream exchanges, non-custodial in the steady state, no signup required. Multi-language UI, API available for integrators, listed in multiple peer directories (KYCnot, Monerica, web3privacy, OrangeFren). Cross-referenced by **OrangeFren's $4,000 guarantee pool** — if Exolix mishandles a swap (goes rogue, freezes funds, fails to deliver), OrangeFren makes the user whole up to the posted amount. That's the third-party recourse signal that's hard to fake.\n\n**What you trust.** Non-custodial routing in normal operation — wallet sends crypto in, operator routes through upstream exchanges, wallet receives swap output. **Custody window**: short routing-leg only, similar pattern to LetsExchange / Trocador / FixedFloat. **What's distinctive**: the **OrangeFren guarantee** ($4,000 backing) sits underneath every Exolix swap — if the operator breaks the implicit \"complete the swap\" contract, the user has external recourse. The guarantee isn't infinite, it isn't insurance against upstream-exchange screening, but it does change the trust math: a $200 swap on Exolix is effectively backed up to $4,000 of operator-misbehaviour exposure. **AML screening**: applied at the upstream exchange layer; Exolix's stated policy is no extra screening on the aggregator side beyond what the upstream applies.\n\n**Operational specs.** **Coin coverage**: hundreds of major and mid-cap cryptocurrencies including XMR, BTC, BCH, ETH, USDT (multiple chains), USDC, LTC, plus a long tail of altcoins. **Rate model**: floating-rate (best available, not locked) + **fixed-rate option** (locked-in amount, small premium, guaranteed delivery quantity). **Trade size range**: small to mid (typically $20 to ~$50k; very large trades may hit upstream-liquidity constraints). **API**: published REST API used by partner integrations + this directory's swap aggregator. **Confirmations**: standard Monero confirmation count (~10 blocks) for XMR receives; faster on the BTC side using upstream-exchange conventions. **Trustpilot**: positive long-term rating across thousands of reviews.\n\n**Philosophy.** Exolix's editorial differentiator is the **fixed-rate-honoured-at-scale** model. Many aggregators offer a fixed-rate option but quietly cancel-and-refund when the upstream market moves; Exolix's fixed-rate reputation in the community is that the quoted rate actually fills, even when the operator takes a small loss on the routing. Combined with the OrangeFren guarantee, the practical user experience is \"quote → deposit → receive exactly the quoted amount\" with high reliability. The trade-off: not the lowest spread in the category (you pay a small premium for fixed-rate certainty); not the most coin coverage (LetsExchange has more); not the most operationally transparent (Trocador shows the upstream).\n\n**Grade rationale.** Grade A reflects: long-running operational continuity (5+ years); **OrangeFren $4,000 user-recourse guarantee** (external trust signal, hard to game); fixed-rate quote consistently honoured in community testing; cross-listed in KYCnot / Monerica / web3privacy / OrangeFren peer directories; published REST API; multi-language UI; absence of major refund-dispute or fund-freeze threads in community discussion. Last verified 2026-05-12.\n\n**Useful when.** You want a fixed-rate swap where the quoted amount is the amount that lands (vs floating-rate uncertainty during the routing window). You're swapping retail amounts ($20-$50k) where Exolix's liquidity routing is comfortable. You want the OrangeFren guarantee backing the swap — useful for users who've been burned by aggregators that vanish or freeze mid-swap. You want a long-running aggregator with established community recognition (KYCnot, Monerica, web3privacy peer-listing concurrence). You're using this directory's aggregator UI — Exolix is one of the engines we route through.\n\n**Caveats.** **Custody during routing** — short window, but it's not zero; treat as \"trust the operator for the routing minutes, not long-term.\" **Upstream AML applies regardless** — Exolix doesn't add screening, but the upstream exchange filling the swap may apply its own; if your funds are flagged at the upstream layer, the swap may be refunded or held even though Exolix's policy is non-blocking. **No Tor mirror operator-published** — clearnet only at the time of this review; route through a Tor bridge yourself if you need .onion access. **Very large trades may not fix-rate cleanly** — the fixed-rate guarantee depends on upstream liquidity depth at the quote time; for >$50k trades, expect spread widening or fallback to floating-rate. **OrangeFren guarantee is capped at $4,000** — if your trade is larger than that, the recourse is partial relative to the amount at risk. Useful for retail-scale users; less useful for institutional volumes. **Closed-source routing engine** — like most aggregators in the category; community recognition + OrangeFren guarantee substitute for code-level auditability.\n\n**Grade adjusted A → A- (2026-05-31).** Per the RasterSec disclosure (May 28 2026, https://www.rastersec.com/blog/exolix-swapper-dump): partner-API JWT keys embedded in public Edge / Exodus / Monerujo / BTCPay / Temple Wallet / EGToken repos and Android APKs allowed full read access to all partner swap records — ~355k swaps / $39.5M / Jan 2025 → May 2026 of user transaction metadata (deposit + withdrawal addresses, both on-chain tx hashes, amounts, timestamps, user identifiers).\n\nSwap product itself is unaffected — vulnerability was in partner-integration access control, now patched via Cloudflare WAF. We're flagging because (a) ~15 months of historical user swap records were exposed and likely fully archived by third parties — permanent on-chain trail damage that no patch can undo; (b) Exolix's initial framing of the issue as \"a feature\" rather than a vuln is a privacy-mindset concern that warrants a half-grade signal. New swaps via Exolix work as advertised; consider this when routing sensitive flows.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A-" }, "grade": "A-", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "FIXED-RATE", "NO-KYC", "partner_api_data_leak_2026" ], "fees": { "summary": "Fixed-rate ~1-2% · floating ~0.5%" }, "fees_summary": "Fixed-rate ~1-2% · floating ~0.5%", "last_verified": "2026-05-31", "operating_since": "2018", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://exolix.com", "outbound_slug": "exolix", "affiliate": "https://exolix.com?ref=3870956AA861E9A8181C697BC2FB8B69", "twitter": "https://x.com/exolix_com", "telegram": "https://t.me/exolixcom", "discord": "https://discord.com/invite/YKY4yaBacH" }, "incident": { "date": "2026-05-28", "severity": "medium", "summary": "Partner-API broken-access-control disclosed by RasterSec on 2026-05-28. JWT keys embedded in public partner repos + Android APKs allowed anyone to dump all partner swap records — ~355,944 swaps / $39.5M of metadata (addresses, tx hashes, timestamps, user IDs) from Jan 2025 → May 2026. Affected partners: Edge, Exodus, Monerujo, BTCPay Server, Temple Wallet, EGToken.io. Exolix patched via WAF rules (not by fixing the underlying access control) and initially characterized the issue as \"a feature.\" Past user swap trails are permanently exposed; new swaps unaffected.", "curator_advice": "If you swapped via Exolix or any of the affected partner integrations between Jan 2025 and May 2026, assume your deposit + withdrawal addresses are now in third-party datasets (searchable, downloadable, immutable). For NEW swaps, Exolix still works as advertised — the WAF fix prevents further dumps. But weigh the operator's initial \"feature\" framing before routing sensitive flows; A-grade peers (SageSwap, StealthEX) had no such disclosure.", "source_url": "https://www.rastersec.com/blog/exolix-swapper-dump" }, "also_listed_at": { "orangefren": true, "web3privacy": true, "kycnot": true, "monerica": true } }, { "id": "fixedfloat", "category": "exchanges", "subcategory": "Instant Swaps", "name": "FixedFloat", "url": "https://xmr.club/exchanges/fixedfloat", "twin": "https://xmr.club/llm/exchanges/fixedfloat.txt", "tagline": "Instant swap, no account. KYC may be requested on flagged transactions.", "review": "**⚠ Grade demoted B- → C on 2026-08-04** — operator quietly moved legal entity from **FFX Group Ltd (Republic of the Marshall Islands)** to **FFGX Group LLC (88 Avtomshenebeli Street, Kutaisi 4600, Georgia)**, effective in the ToS on 2026-08-02. No announcement on the site, blog, or X. Same brand (ff.io / FixedFloat), new corporate vehicle behind it. Same precedent + same treatment as [BitcoinVN](/exchanges/bitcoinvn) got on 2026-07-30 for its own quiet shell shift (Vietnam ltd → Panama shell): not necessarily red on its own, but an unexplained entity change earns a watching period.\n\n**Reader advice.** Any dispute, refund claim, or held-funds incident opened against the pre-shift entity (FFX Group Ltd) has an unresolved question — the updated ToS does not spell out whether FFGX Group LLC inherits FFX Group Ltd's obligations. Put anything material about pre-shift interactions in writing to support before Aug 2026 so the paper trail names the pre-shift entity explicitly. Post-2026-08-02 swaps are covered by Georgian governing law (real jurisdiction, real MLATs) rather than Marshall Islands (offshore shell, no FATF cooperation). That's arguably a positive rule-of-law move; the demotion is not about the destination jurisdiction — it's about the operator making the shift without disclosure.\n\n---\n\n*The rest of this review reflects FixedFloat's live posture; the operational specs, coin coverage, and peer-directory attribution below all remain accurate — the demotion is scoped to the unexplained entity-shift signal.*\n\nPolished UX, good pair coverage, deep liquidity. Grade adjusted **B → B- (2026-05-30)** after cross-referencing peer-directory data + our own incident review.\n\n**AML-freeze posture.** FixedFloat runs chain-analysis risk-scoring on inbound deposits. Inputs that hit AML thresholds (typical triggers: direct exposure to mixers, sanctioned entities, or laundering channels like SunSwap's Guarantee Merchant flows; indirect hops to DNM-adjacent addresses) are frozen on arrival. Recovery requires emailing `compliance@fixedfloat.com` with KYC documents. **Refund-to-source is not offered.** If you refuse to KYC, funds stay held indefinitely.\n\nThis is the **B-grade outcome** in our rubric, not the A-grade one. A-grade swap providers in our catalog (e.g. SageSwap, StealthEX) offer refund-to-source on the same AML flag without requiring KYC, or have explicit AML-tolerant modes. If you can't accept the KYC-dispute path, route through A-grade for sensitive inputs.\n\n**Frequency of freezes.** Routed traffic via aggregators (e.g. Trocador) shows freeze rates under 0.05% by count and 0.025% by value. Walk-in direct users surface much higher freeze reports in peer directories (KYCnot user-weighted score 2.8/5, 37% one-star ratings citing frozen funds). The discrepancy is real — direct walk-in users skew higher-risk than aggregator-funneled traffic. Use this signal when choosing route.\n\n**For most no-KYC retail users** with clean inputs, FixedFloat works as advertised — competitive rates, fast settlement, no friction. Use it with confidence on inputs you know are clean; route elsewhere on inputs you can't vouch for.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "INSTANT", "MANY-COINS", "kyc_required_on_aml_dispute" ], "fees": { "summary": "Floating ~0.5% · fixed-rate 1% spread" }, "fees_summary": "Floating ~0.5% · fixed-rate 1% spread", "last_verified": "2026-08-04", "operating_since": "2018", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://fixedfloat.com", "outbound_slug": "fixedfloat", "affiliate": "https://ff.io/?ref=j4ab879b", "contact_email": "support@fixedfloat.com", "twitter": "https://x.com/fixedfloat", "telegram": "https://t.me/FixedFloat" }, "incident": { "date": "2026-06-08", "severity": "medium", "summary": "FixedFloat publicly confirmed it runs source-of-funds / sanctions screening and will SUSPEND funds for additional verification — explicitly naming CEX-origin funds (Huobi/HTX) after sanctions developments. This is the same hold-and-verify behavior that strands privacy users mid-swap.", "curator_advice": "Treat FixedFloat as a screening exchange, not a no-questions swap. Do not route funds that touched a CEX (esp. Huobi/HTX) or any flagged address through it. For maximum privacy, prefer an A-grade route; if you must use FixedFloat, use clean, non-CEX-origin coins only.", "source_url": "https://x.com/FixedFloat" }, "also_listed_at": { "orangefren": true, "kycnot": true, "monerica": true } }, { "id": "flashift", "category": "exchanges", "subcategory": "Aggregators", "name": "Flashift", "url": "https://xmr.club/exchanges/flashift", "twin": "https://xmr.club/llm/exchanges/flashift.txt", "tagline": "Non-custodial cryptocurrency aggregator run by Flashift Pty Ltd (Australia). Compares Exchange Partners across DEX + CEX to surface the lowest-KYC and best-rate offer for a given pair. No signup, no funds held.", "review": "**Non-custodial cryptocurrency aggregator** — Flashift compares available offers across a pool of Exchange Partners (EPs) — both DEXs and instant-swap CEXs — and surfaces the lowest-KYC, best-rate option for a given pair. Grade B — solid position combining five-plus years of continuous operation (verified via domain registration + earliest web-archive snapshot), a real corporate anchor (Flashift Pty Ltd, Australia), non-custodial routing architecture (Flashift never touches funds; escrow and settlement are at the underlying Exchange Partner), a clean structured ToS with explicit upstream-KYC framing, and XMR carried as a first-class pair across the routing table.\n\n**What it is.** *(ToS)* *\"Flashift is a non-custodial cryptocurrency aggregator that enables users to compare multiple EPs and access their services. Flashift does not hold user funds, execute transactions, or offer custodial or fiat services. All transactions are performed directly by the selected EP, and governed by that provider's terms and policies.\"* Operating entity: **Flashift Pty Ltd**, registered company in Australia. Access is a web application; no native mobile app required.\n\n**Tenure.** Independently verified: **domain registered 2020-07-22**, earliest earliest web-archive snapshot **2021-01-23**. Five-plus years of continuous operation is a meaningful strength that lifts this above the C-default that fresh aggregators sit at, and is the main reason for the Grade B classification.\n\n**Peer position.** Listed on monerica.com under the Aggregators subcategory. Not yet on kycnot.me. Positioning against the aggregator peer set: similar shape to Trocador / SwapZilla / PrivataSwap / CypherGoat — meta-router across upstream instant-swap engines, no own liquidity.\n\n**KYC posture.** Flashift itself performs no KYC or AML. *(ToS)* *\"If your transaction requires additional verification, this will be handled directly by the selected EP in accordance with their compliance policies.\"* The KYC posture you actually experience is set by whichever EP the aggregator routes you to. Flashift's own filter — the marketed \"Best in KYC\" tag — flags the offer with the lowest-KYC upstream from among the current live quotes. Real posture: **upstream-dependent**. Route through a no-KYC EP and the swap is effectively no-KYC end-to-end; route through a KYC-required EP (e.g., a large centralized exchange partner) and you inherit that EP's ID requirements.\n\n**AI framing.** The homepage and FAQ lean on \"Flashift AI\" branding — a routing / rating engine that ranks partner offers on rate + trustworthiness signals. In practice this is aggregator ranking logic dressed in AI-adjacent copy. Treat the AI label as marketing rather than a distinctive technical claim; the underlying value is the same you get from every good aggregator: route across many engines, surface the top offer.\n\n**Custody + funds flow.** Genuine non-custodial *routing* — the aggregator doesn't touch your deposit; the deposit address you send to is the upstream EP's, and settlement is between you and that EP. If the swap fails, refund is between you and the EP (not Flashift). This means the aggregator has no seizable-funds surface at rest — a real security-model win — but it also means when things go wrong the escalation path is at the EP, not at Flashift.\n\n**Trading surface.** Wide pair coverage per the site's footer sample: BTC↔USDT, ETH↔XMR, XMR↔BTC, LTC↔XMR, BNB↔ETH, SOL↔ETH, etc. — XMR is a first-class asset on the aggregator, both directions.\n\n**Why this grade. ** Grade B reflects the combines five-plus years of continuous operation (2020-07 domain registration, 2021-01 earliest web-archive snapshot), the Flashift Pty Ltd Australian entity anchor, verified non-custodial routing (funds never touch the aggregator), a substantive ToS with explicit upstream-KYC framing, and XMR as a first-class pair. The gap between B and higher: the sparse legal-page surface (missing `/about`, `/privacy`, `/how-it-works` pages), single-source peer signal (monerica only; not on kycnot), and no independent user-report track record at aggregator scale. To hit A: fill the missing legal pages, get a second independent peer directory to list, and accumulate a public user-report record.\n\n**Useful when.** You want to compare rate and KYC posture across several upstream engines without opening each in a separate tab. You want a no-signup / no-account swap flow and prefer the aggregator to select the routing for you. You're routing XMR ↔ any of the majors and want the current best-rate offer.\n\n**Caveats.** **Upstream-dependent KYC** — every swap you route through Flashift inherits the KYC and AML posture of the EP selected; verify the EP before large-value swaps. **No public list of active EPs** on the site — the aggregator lists partner offers dynamically without naming the full pool up-front. **Operator surface is adequate** — About, a detailed FAQ (carrying the privacy posture), and how-to guides are all published, alongside the substantive `/terms` and `/faq` policy pages; they sit on non-obvious paths (About at `/about-us/`, how-it-works as a blog guide) rather than being absent. **AI framing** — the \"Flashift AI\" branding is marketing dress on aggregator routing logic; treat as such. **Aggregator escalation path** — if a routed swap fails, the resolution channel is the upstream EP, not Flashift; escrow / dispute / refund is per-EP, not centrally underwritten.", "translation_locale": "en", "rating": { "grade": "B", "trust": "Non-custodial aggregator, named legal entity (Flashift Pty Ltd, AU); no paid grades; surfaces per-partner KYC posture (KYC-Hold-Risk / Best-in-KYC) + names the upstream before you commit. B, not A — and NOT because it aggregates (Trocador is an A aggregator carrying the same inherited partner risk). The difference is the privacy STACK built on top. Trocador cleared A with tested privacy infrastructure + partner-risk disclosure the directory actually uses: Tor onion + I2P, no-JS / low-fingerprint option, public A-D KYC/AML grades per partner, partner logging policy shown before you send, a swap guarantee on better-rated partners, and a deep independent review trail. Flashift is closer to no-account rate comparison + AI tags: useful, but thinner on that privacy stack and thinner public record (mostly post-2024). Consistency anchor: we hold our OWN aggregator (kyc.rip) at B too, so we don't rate a competitor's aggregator A without the same stack. Path to A = close the Trocador gap (Tor+I2P, no-JS, per-partner A-D grades + logging-shown, a swap guarantee/recourse, deeper track record) — not flatten the category.", "privacy": "No signup, no account, no funds held; the aggregator itself collects no identity. It compares DEX + CEX partners and surfaces the lowest-KYC offer per pair — but the privacy you actually get depends on the partner you select: some routes are no-KYC, CEX-backed ones may verify. Read the chosen partner's policy before committing.", "ux": "Enter a pair; it compares Exchange Partners across DEX + CEX and surfaces the best-rate / lowest-KYC option. No extra commission — you pay the underlying partner's rate. Web, with published FAQ + terms." }, "grade": "B", "kyc_tags": [ "upstream_dependent", "no_kyc" ], "feature_tags": [ "aggregator", "instant" ], "highlight_tags": [ "AGGREGATOR", "NO-SIGNUP", "XMR", "DEX" ], "fees": { "summary": "Flashift charges no additional commission — the rate you see in the aggregator is the rate the underlying Exchange Partner charges. Per FAQ: 'we do not charge you for extra commission fees. There is no difference between swapping in FLASHIFT apps and our partner exchanges.' Verify against the destination EP's own pricing before large swaps." }, "fees_summary": "Flashift charges no additional commission — the rate you see in the aggregator is the rate the underlying Exchange Partner charges. Per FAQ: 'we do not charge you for extra commission fees. There is no difference between swapping in FLASHIFT apps and our partner exchanges.' Verify against the destination EP's own pricing before large swaps.", "last_verified": "2026-08-11", "operating_since": "2020-07", "tenure_note": "Domain registered 2020-07-22; earliest earliest web-archive snapshot: 2021-01-23. `operating_since` set to the earliest signal.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://flashift.app/", "terms": "https://flashift.app/terms/", "faq": "https://flashift.app/faq/", "outbound_slug": "flashift" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "fuckyc", "category": "exchanges", "subcategory": "Instant Swaps", "name": "FucKYC", "url": "https://xmr.club/exchanges/fuckyc", "twin": "https://xmr.club/llm/exchanges/fuckyc.txt", "tagline": "Instant crypto swap — no account, no email, no KYC, 14+ assets including XMR. 0.1% max fee. Reader caveat: ~3 weeks of operation and the legal pages linked in the footer (/terms, /privacy, /about, /contact) are all missing.", "review": "**What it is.** Instant crypto swap service. Pick a sending coin and receiving coin, paste your destination address, send the exact deposit amount from your own wallet, receive on confirmation. No account, no email, no KYC. 14+ assets listed: BTC, ETH, XMR, ZEC, BNB, SOL, XRP, USDT, USDC, TRX, ADA, MATIC, DOGE, APE, HYPE. The brand is self-explanatory; the operator owns the joke.\n\n**Fees.** The footer advertises **0.1% max fee** — genuinely on the cheap end of the swap-aggregator market. Network fees and any spread baked into the displayed rate are separate.\n\n**Tenure — why this is firmly C.** kycnot.me records operating-since **Jun 4** (≈ three weeks ago). The site footer copyright reads *© 2025 FucKYC* but the live operational signals on kycnot, the lack of any monerica entry, and the absence of any independent community comments all point to a brand-new operator. For an swap service that takes user funds at the deposit-address step, three weeks is essentially no tenure.\n\n**Legal-surface gap.** The footer links four standard pages: *About*, *Contact*, *Terms of use*, *Privacy policy*. None of the four exists — the footer cites pages that were never published. This is operator marketing chrome with the substantive disclosures still unwritten. There is no published jurisdiction, no legal entity name, no operator identity, no support escalation path beyond a X handle (`@fuckycexchange`).\n\n**Peer position.** kycnot.me carries a community-submitted **7/10** score but explicitly notes *\"Listed, but not yet reviewed by the team\"* and *\"No comments yet\"*. The 7/10 is a single community submission, not a vetted finding. monerica has no listing.\n\n**Custody framing.** Like all instant-swap services, FucKYC takes custody of your deposit while it routes the swap on the back end and sends the receive-side coin to your destination address. The marketing line *\"no questions\"* is true at the front-door — there is no signup form — but it does not change the custody window. Atomic-swap routing protocols (THORChain, Chainflip) are different on that axis; FucKYC is not advertised as routing through them.\n\n**Grade C — why C, and what would move it.** Listed at C because (a) three weeks is essentially no history for a swap service that takes user funds at the deposit step, (b) the four footer-linked legal pages are missing, so a reader cannot read terms, privacy, or even find an operator identity, and (c) the kycnot score is community-only and unaccompanied by any comments. The fee structure is competitive and the no-account flow looks like it works, but readers should size accordingly until the legal surface is real and the operator accumulates incident-free history. Path to B: published Terms and Privacy at the linked footer URLs, ≥6 months of operation without shotgun-KYC reports, and at least one independent independent review (kycnot team review, monerica admission, or a public Reddit / monero.town discussion thread).\n\n**Tenure.** Publicly verified on xmr.club since 2026-06-28 — 6 days as of this note. For exchange-class services, tenure is a grade input: even a clean publishable surface defaults to Grade C, and any lift needs both independent corroboration from other privacy-focused directories AND a sustained track record of unproblematic swaps observed over time. First scheduled re-check: 2026-09-26.", "translation_locale": "en", "rating": { "grade": "C" }, "grade": "C", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "INSTANT-SWAP", "NO-KYC", "NO-ACCOUNT", "XMR", "ZEC", "MULTICHAIN", "NEW", "INCOMPLETE-LEGAL" ], "fees": { "summary": "0.1% max fee (operator-published); network fees + spread separate." }, "fees_summary": "0.1% max fee (operator-published); network fees + spread separate.", "last_verified": "2026-06-28", "operating_since": "2026-06-04 (per kycnot)", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://fuckyc.xyz", "twitter": "https://x.com/fuckycexchange" }, "also_listed_at": { "kycnot": { "url": "https://kycnot.me/service/fuckyc", "score": 7, "note": "community-submitted; team-review pending, 0 comments" } } }, { "id": "gorshok", "category": "exchanges", "subcategory": "Instant Swaps", "name": "Gorshok", "url": "https://xmr.club/exchanges/gorshok", "twin": "https://xmr.club/llm/exchanges/gorshok.txt", "tagline": "No-KYC instant swap (RU/EN/UK). XMR pair, 100+ directions, Oblivion Mode ephemeral session, user-choice AML fork (no ID demand), transparent 2022-manual → 2026-web history.", "review": "**What it is.** Gorshok is a no-KYC crypto exchange operated by a Russian-founded team, positioning as *\"an honest and predictable exchange service you're not ashamed to recommend.\"* Site is trilingual (Russian / English / Ukrainian). Advertised at 100+ swap directions including a first-class XMR pair (confirmed in the currency picker: XMR ↔ USDT-ERC20, BTC, and others). Fixed + floating rates, optional account, public API on the roadmap. Ships with a distinctive **Oblivion Mode** — an ephemeral no-log session UI (\"Nothing is saved or recorded while you're here — complete anonymous freedom of action\") that is unusual to see explicitly surfaced on a swap exchange.\n\n**Operator narrative.** Gorshok's own `/about` page publishes a 4-milestone history + a \"who builds Gorshok\" panel: **2022-11 manual Telegram-only launch → 2025-09 first Telegram bot → 2025-11 website build → Q1 2026 core launch of gorshok.io → 2026+ ecosystem (public API + mobile apps).** The current *website* is only ~6 months old; the *business* is claimed to be from Nov 2022 as a manual Telegram operation. The operator does not hide this — the About page states it explicitly. The team framing: *\"a small team of developers and product people who use crypto every day and hate magic black boxes\"* with an explicit refusal to become an all-in-one super app.\n\n**Peer signal.** A Monero-focused peer directory currently flags Gorshok as **❓ Questionable** with the note *\"claims to be from 2022 but site is from 2026.\"* That note is technically accurate but reads harsher than the operator's own transparent disclosure of the manual-2022 → website-2026 trajectory. We surface the peer's flag honestly here and note that our own read of the operator's public surface came out materially more positive on this specific point.\n\n**Grade C on publish.** New to xmr.club and only ~6 months on the current website infrastructure. Exchange tenure floor per our methodology — this is a high-loss-asymmetric category regardless of how honest the public surface looks. Grade movement: (a) 90-day clean track record on the current site + a curator-executed round-trip test-swap that completes without any late-stage surprises → lift toward B; (b) any incident, exit-scam pattern, or emergence of shotgun-KYC behaviour → immediate downgrade.\n\n**How AML screening actually works.** Gorshok's own FAQ answer is verbatim: *\"In most cases the exchange happens automatically. To protect users and comply with international standards we screen every transaction for AML, but **we do not perform KYC and do not request documents**. If a transaction is flagged as high-risk, **you decide**: refund the deposit or continue the exchange with an increased fee.\"* — This is address-blacklist / risk-scoring screening followed by a **user-choice fork**, not the shotgun-KYC pattern where funds are held pending document verification. No ID demand, no source-of-funds request, no frozen-funds threat. That is materially better than the industry norm for \"AML\" language, and worth calling out.\n\n**Caveats.**\n- **Only ~6 months** on the current gorshok.io infrastructure. The manual-Telegram-2022 origin is honest but not directly transferable — the exchange-under-a-website is what we grade against.\n- **Peer-directory Questionable flag** on file. We do not endorse that flag but you should factor it into your own trust posture.\n- **No curator round-trip test-swap on record yet** — grade lift toward B is gated on that (plus the 90-day clean-track-record window).", "translation_locale": "en", "rating": { "grade": "C", "stars": null, "count": 0 }, "grade": "C", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "NO-KYC", "OBLIVION-MODE", "TELEGRAM-BOT", "MULTILINGUAL", "AML-SCREENING" ], "fees": null, "fees_summary": null, "last_verified": "2026-07-09", "operating_since": "2022-11", "tenure_note": "Business claims manual-Telegram origin Nov 2022; current gorshok.io website launched Q1 2026. Track record on the current infrastructure is ~6 months.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://gorshok.io/", "outbound_slug": "gorshok", "twitter": "https://x.com/Gorshok_io", "telegram": "https://t.me/BC_LZT", "contact_email": "support@gorshok.io", "logo": "https://xmr.club/peers/gorshok.svg" }, "also_listed_at": { "monerica": true } }, { "id": "haveno", "category": "exchanges", "subcategory": "P2P", "name": "Haveno", "url": "https://xmr.club/exchanges/haveno", "twin": "https://xmr.club/llm/exchanges/haveno.txt", "tagline": "Decentralised P2P XMR exchange. Open-source successor to Bisq for Monero.", "review": "Haveno is the decentralised P2P XMR / fiat exchange platform — the Monero-native successor to Bisq, built on Tor with on-chain multisig escrow, no central operator, and no KYC. Listed at **Grade A-** following two protocol-level exploits in the same class (2026-05-20 and 2026-06-24) and the **v1.8.0 hardening release** (2026-06-20) that closes the underlying signature-verification gap — see the **Incident** section below before opening any new trades. The structural privacy posture (P2P, Tor-only, multisig, non-custodial) remains the strongest in the swap category, but the exploit demonstrated a real protocol-level attack surface in the multisig flow.\n\n**Background.** Haveno is the open-source protocol, primarily authored by **woodser** (the lead developer who has been the public face of the project since the Bisq fork). Haveno itself doesn't operate a network — it's software you install (desktop client for Linux / macOS / Windows) that connects to one of several independent, community-run **networks** with their own arbitrators and seed nodes. The notable operators include **Haveno-Reto / RetoSwap** (haveno-reto.com, retoswap.com — the highest-liquidity public network) and a small handful of others. Each network can set its own arbitrator policies, payment-method whitelists, and fees. Liquidity is concentrated on Haveno-Reto / RetoSwap. Code at github.com/haveno-dex/haveno.\n\n**What you trust.** **Architecture**: Tor-only transport between peers; non-custodial wallet (Monero, multisig); the user holds their own keys throughout. **Multisig escrow**: trades use 2-of-3 Monero multisig — buyer, seller, and arbitrator — so the arbitrator only signs to release funds if a dispute escalates, and cannot unilaterally move funds in normal flow. **What you don't have to trust**: no operator custody of XMR mid-trade in the happy path, no centralized KYC of buyer or seller, no central account; signup is the act of installing the client. **What you *do* have to trust**: the multisig protocol implementation (which the 2026 exploit demonstrated is non-trivial — see Incident); the integrity of the arbitrator for the network you join (different operators run different arbitrators with different reputations); and the fiat-payment leg, which happens outside Haveno (cash-by-mail, SEPA, Zelle, Wise, etc. — each with their own KYC + privacy properties).\n\n**Incident — 2026-05-20.** Severity: **high**. A protocol-level exploit using **spoofed arbitrator-ACK messages** allowed an attacker to hijack the 2-of-3 multisig wallets before deposits could be locked, draining funds from active offers (large crypto offers were the primary target). Approximately **7,000 XMR (~$2.7M) lost** across affected RetoSwap users — the primary operator impacted. **Response was rapid and transparent**: lead developer woodser publicly disclosed the active exploit, RetoSwap suspended trading and banned the attacker, and an emergency patch (Haveno v1.5 / RetoSwap v1.6.0-reto) shipped within days — a targeted defensive check verifying peer identity in the ACK message flow. Trading was paused network-wide via forced minimum client version. **Funds had not been recovered as of this review date (2026-05-25)**; the operator has not ruled out partial recovery and the incident window is still open. The network is returning to operation under the patched protocol but liquidity has been impacted. **Curator advice**: do not open new offers on any Haveno operator until your client reports a min-version bump confirming the patch is active; if you have outstanding offers, back up your wallet and follow your operator's advisory.\n\n**Incident — 2026-06-24 and v1.8.0 response.** A second protocol-level exploit in the same arbitrator/dispute-message verification class surfaced on 2026-06-24 against RetoSwap users, before the May v1.5 patch's coverage proved sufficient against a more refined variant. **Haveno v1.8.0 shipped 2026-06-20** as the proper hardening pass — explicit arbitrator-signature verification on structured dispute payout fields, verified-sender enforcement across trade-setup messages, deposit-response and deposit-NACK sender verification against the arbitrator identity, and a Tor loopback-bypass fix. The v1.5 fix from May was a targeted check on one message; v1.8.0 closes the broader class. Operators running the upstream code pick up the fix automatically; downstream networks (RetoSwap, others) have to roll their own clients and arbitrators onto v1.8.0 before reopening trading. **Curator advice**: do not open new offers on any Haveno operator's network until your client reports a minimum version of v1.8.0 or later, and verify the operator has confirmed the rollout.\n\n**Operational specs.** Surfaces: desktop client (Linux + macOS + Windows). Coins: XMR primary; fiat via P2P arrangement (no on-chain fiat — the buyer sends fiat off-chain, the seller releases XMR from multisig). Payment methods (negotiated per offer): cash by mail, SEPA, Zelle, Wise, Revolut, Strike, Pix, Interac, ACH, Faster Payments, Bizum, Paysera, F2F (face-to-face), and many more. Fees: per-offer maker/taker spread + network operator fee (varies by operator). Trading limits: per-operator and per-payment-method (no-deposit small trades supported on some flows). Network access: Tor-only. Bounty program for development funded in XMR.\n\n**Philosophy.** Haveno's editorial differentiator is the **bet on P2P + multisig + Tor as the only structurally non-custodial fiat-XMR ramp**. Centralised exchanges custody your funds during the swap and require KYC; aggregators reduce that to a routing-layer custody window but still touch your funds; Haveno never custodies — escrow is on-chain Monero multisig, signed by you. That architectural commitment is what makes Haveno the canonical privacy-first fiat ramp and what makes it more complex to operate safely than a centralised swap (the multisig flow has more moving parts, as 2026-05 demonstrated).\n\n**Grade rationale.** Grade A- reflects the architectural strengths still intact — non-custodial multisig, Tor-only transport, open-source codebase, no operator-level KYC, a long-running team led by woodser since the Bisq fork — minus one full step for two exploit events in five weeks (2026-05-20, 2026-06-24) in the same arbitrator/dispute-message class. The May v1.5 patch covered one variant; the June incident hit a related one before v1.8.0's broader signature-verification pass landed. **Path back to A**: 90 days of incident-free operation on v1.8.0 or later across the major operator networks, a published Haveno post-mortem that names the exact failure mode and the v1.8.0 mitigations, and visible coordination with downstream operators on fund-recovery for affected users. Without those, the grade holds at A- or drops further if a third same-class incident lands.\n\n**Useful when.** You want to swap XMR for fiat (or vice versa) in a non-custodial, no-KYC flow and you understand the trade-offs of P2P (variable liquidity, requires patience, fiat leg uses traditional payment rails with their own KYC). You want the strongest privacy posture available in the exchange category — accept the operational complexity for that property. You're comfortable installing a desktop client and configuring Tor. You want to support the decentralized-exchange thesis with your actual trading volume.\n\n**Caveats.** **Incident-aware**: see Incident section above. Do not open new offers until the patched client minimum is enforced on your operator's network. **Liquidity is lower than centralised swaps** — expect to wait for a counterparty match, and large trades (>50 XMR) may not find takers quickly. **Desktop only** — no mobile, no web. **Fiat-leg privacy depends on the payment method you choose** — cash-by-mail is the most private; SEPA / Zelle / Wise carry full bank-level KYC on the fiat side. **Multisig dispute resolution takes time** — when a trade goes sideways, the arbitrator process can take days; this isn't a \"instant swap\" experience. **Network choice matters** — different operators have different arbitrator quality, fee structures, and reliability. Haveno-Reto / RetoSwap has the most liquidity but was also the operator hit hardest by the May 2026 exploit. **Protocol risk is real** — May 2026 demonstrated that a sophisticated protocol-level attack is possible against multisig swap flows, and the architectural commitment to multisig means future similar vulnerabilities cannot be ruled out structurally; the patch model is \"find, fix, ship min-version bump\" rather than \"no attack surface in the first place.\"\n\n\n**Post-incident liquidity caveat (2026-07).** In the weeks following the 2026-06-17 protocol exploit, Haveno network-wide liquidity has not recovered to the pre-incident norm. As of the 2026-07-07 curator observation, network liquidity was holding around **~$5k** (versus a pre-incident 10k+ baseline) and daily trade volume had fallen to **~4 XMR/day** from the pre-incident 2,000–4,000 XMR/day peak — a >99% collapse. Curator can only observe this from inside the Haveno client, not from a public API, so live re-verification depends on running the app. Practical impact for a reader placing an offer today: expect thinner order-book depth, wider spreads, and potentially longer time-to-match than the pre-2026-06-17 experience. This is a liquidity condition, not a security posture change — the architecture caveats (no operator custody, 2-of-3 multisig escrow, self-custody wallet path) still hold.\n\n**Market-depth caveat (2026-08-06).** Network liquidity remains materially reduced following the May 2026 protocol incident (\\$2.7M exploit; retoswap trading was suspended, subsequently restored). The retoswap.com homepage has advertised the same *\"19,000+ Swaps completed\"* cumulative counter since at least 2026-08-04 — the round-number figure has not incremented in a ~48h re-check. First-party user reports on r/haveno (2026-08 window) note the software opening with zero offers visible for at least one user. Real-time network-liquidity metrics are not publicly exposed by retoswap (no /stats or /network endpoint responds; community aggregators havenoexplorer / havenostats / havenomarkets all fail DNS at present). Practical implication for readers: if you rely on this network for a specific pair or size, verify offers exist in-client before assuming the trade will fill. Grade held pending explicit curator recheck; a formal +30-day grace-period review is scheduled.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted", "multisig_supported" ], "highlight_tags": [ "P2P", "FIAT", "XMR", "INCIDENT-2026-05", "INCIDENT-2026-06", "v1.8.0-HARDENED" ], "fees": { "summary": "1% taker fee · trade-specific spread · multisig escrow" }, "fees_summary": "1% taker fee · trade-specific spread · multisig escrow", "last_verified": "2026-09-05", "operating_since": "2020", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://haveno.exchange", "outbound_slug": "haveno", "twitter": "https://x.com/HavenoDEX", "telegram": "https://t.me/HavenoDEX", "matrix": "https://matrix.to/#/haveno:monero.social" }, "incident": { "date": "2026-06-17", "severity": "high", "summary": "Second distinct trade-protocol exploit in under 30 days, hitting Haveno operators including RetoSwap. Per the official RetoSwap PSA (2026-06-17), an exploit report was received at 18:02 UTC; the RetoSwap team responded by setting the minimum client version to 2.0.0 via the filter feature and banning the attacker's onion. **The May 2026 attack** worked by substituting the legitimate arbitrator's onion with the attacker's own (fake-arbitrator-ACK vector against the arbitrator-selection step). **The June 2026 attack is mechanistically distinct**: the arbitrator stays legitimate, but the attacker abuses the forced-arbitration flow itself — taking buy offers, forcing arbitration through a real arbitrator, and getting XMR released after 30 confirmations without ever sending BTC. Two legitimate Reto arbitrators are on record (`…6wi2znkfhbowtv2xxkbx63simfj3bqd.onion`, `…sriix3v2akgrzd4k5tvoqqvsfzxb6yd.onion`) — both involved in the current attack as honest counterparties, not as compromised infrastructure. Attacker buyer onion (banned, with port): `…e6wyrtdczsrhtves2jofi2qpad.onion:9999`. Scope per RetoSwap: damage appears contained to large-scale crypto offers; fiat traders unaffected. Trading halted network-wide while the protocol gap is addressed.", "curator_advice": "If you have an open Haveno trade right now, revoke offers and pause until the network's all-clear. The recurring failure pattern is the Haveno trade-protocol surface, not any specific operator and not the arbitrators — both legit Reto arbitrators on file were involved as honest counterparties, not as attack vectors. May 2026: arbitrator-substitution / fake-arbitrator-ACK vector against the selection step. June 2026: forced-arbitration-flow abuse — the arbitrator is honest, the flow itself releases XMR after 30 confs even when BTC was never sent. Per RetoSwap, scope appears contained to large-scale crypto offers; fiat-flow trades are unaffected. RetoSwap mitigated immediately by setting minimum-client-version 2.0.0 via the filter feature + banning the attacker onion. Affected traders should reach out via the RetoSwap SimpleX group; watch the Haveno repo and operator channels for a structural fix announcement before resuming. Liquidity update (2026-06-25): network-wide Haveno P2P depth has not yet re-cleared the ~5k-XMR health threshold (currently ~4.78k; 14d ~4.0k–5.5k, mostly sub-5k) — treat depth/slippage on large orders as still-recovering until it holds above 5k.", "source_url": "https://x.com/RetoSwap/status/2066977091061616659", "timeline": [ { "date": "2026-05-20", "note": "Negative-value validation gap (shared Bisq lineage) exploited. Network liquidity collapsed.", "note_i18n": { "zh": "首次協議漏洞公開揭露。所有受影響分叉暫停交易以待調查。", "es": "Primer exploit de protocolo divulgado públicamente. Trading pausado en todos los forks afectados pendiente de investigación.", "ru": "Первый протокольный эксплойт публично раскрыт. Торговля приостановлена во всех затронутых форках до расследования." } }, { "date": "2026-05-28", "note": "Operators back online with patched client. Liquidity recovering.", "note_i18n": { "zh": "初始緩解措施發布。已與直接受影響用戶開始協調復原。", "es": "Mitigación inicial liberada. Coordinación de recuperación iniciada con usuarios directamente afectados.", "ru": "Начальные меры смягчения выпущены. Координация восстановления начата с непосредственно затронутыми пользователями." } }, { "date": "2026-06-11", "note": "May incident resolved. Network liquidity confirmed recovered (~9,500 XMR).", "note_i18n": { "zh": "第二起漏洞揭露 — 不同攻擊面,同一協議層。受影響分叉再次暫停交易。", "es": "Segundo exploit divulgado — superficie de ataque diferente, misma capa de protocolo. Trading pausado por segunda vez en los forks afectados.", "ru": "Второй эксплойт раскрыт — другая поверхность атаки, тот же уровень протокола. Торговля во второй раз приостановлена в затронутых форках." } }, { "date": "2026-06-17", "note": "Second exploit class — distinct from May. RetoSwap received the exploit report at 18:02 UTC and responded by setting minimum-client-version 2.0.0 (filter feature) + banning the attacker onion `…e6wyrtdczsrhtves2jofi2qpad.onion:9999`. The arbitrator is legit; the attacker abuses the forced-arbitration flow itself so XMR releases after 30 confs without BTC counter-payment. Damage contained to large-scale crypto offers per RetoSwap; fiat traders unaffected. Trading halted network-wide.", "note_i18n": { "zh": "延伸諮詢發布。協議維護者承認底層模式,並承諾提供加固的代碼路徑。", "es": "Advisory extendido publicado. Los mantenedores del protocolo reconocieron el patrón subyacente y se comprometieron a un codepath endurecido.", "ru": "Расширенное advisory опубликовано. Мейнтейнеры протокола признали основной паттерн и обязались выпустить hardened-codepath." } }, { "date": "2026-06-24", "note": "Haveno v1.8.0 released 2026-06-20 with explicit Security Fixes — arbitrator signature verification on dispute payouts, verified-sender enforcement across trade-setup, deposit-response, and deposit-NACK paths, plus a Tor loopback-bypass fix. RetoSwap (2026-06-24) returns to trading on the v1.8.0-hardened line; recovery coordination ongoing.", "note_i18n": { "zh": "Haveno v1.8.0 發布,包含加固的代碼路徑。RetoSwap(按交易量計最大的 Haveno 分叉)公開確認「重新上線並運作」,對受影響用戶的復原協調持續中。事件在協議側視為已解決;使用者側的持續復原另行追蹤。", "es": "Haveno v1.8.0 lanzado con el codepath endurecido. RetoSwap (el fork Haveno más grande por volumen) confirmó públicamente \"back up and running,\" con coordinación de recuperación continuando para usuarios afectados. Incidente considerado resuelto del lado del protocolo; recuperación continuada del lado del usuario se rastrea por separado.", "ru": "Haveno v1.8.0 выпущен с hardened-codepath. RetoSwap (крупнейший Haveno-форк по объёму) публично подтвердил «back up and running», координация восстановления продолжается для затронутых пользователей. Инцидент считается разрешённым на стороне протокола; продолжающееся восстановление на стороне пользователя отслеживается отдельно." } }, { "date": "2026-06-25", "note": "Two-week liquidity recovery check (api.kyc.rip resistance.p2p_liquidity, network-wide Haveno P2P depth): network is trading again on the v1.8.0-hardened line, but depth has NOT re-cleared the ~5k-XMR health threshold. Current reading ~4.78k XMR; the trailing 14 days ranged ~4.0k–5.5k (excluding two obvious data-spike outliers), with the majority of readings below 5k and the latest dipping to ~4.79k. Severity held — depth recovery not yet confirmed; continuing the bi-weekly watch." }, { "date": "2026-06-25", "note": "Within the past week Haveno upstream and RetoSwap fork shipped v1.8.0 (2026-06-20) bundling dispute/arbitrator/deposit message-authentication fixes, including PR #2354 merged 2026-06-19 targeting the forced-arbitration payout-forgery vector. Remediation also disclosed and patched adjacent deposit-forgery bugs (#2363…", "auto": true } ], "summary_i18n": { "zh": "不到 30 天內第二起性質不同的交易協議漏洞利用，打擊包括 RetoSwap 在內的 Haveno 營運者。根據 RetoSwap 官方 PSA（2026-06-17），漏洞報告於 18:02 UTC 收到；RetoSwap 團隊透過過濾功能將最低客戶端版本設為 2.0.0，並封禁了攻擊者的洋蔥地址，以此做出回應。**2026 年 5 月的攻擊**是透過將合法仲裁者的洋蔥地址替換為攻擊者自己的地址（針對仲裁者選擇步驟的偽造仲裁者 ACK 攻擊向量）來實現。**2026 年 6 月的攻擊在機制上不同**：仲裁者保持合法，但攻擊者濫用強制仲裁流程本身——接受買單，透過真實仲裁者強制進入仲裁，並在從未發送 BTC 的情況下於 30 次確認後獲得 XMR 的釋放。記錄中涉及兩位合法的 Reto 仲裁者（、）——兩者均作為誠實交易方牽涉於當前攻擊中，而非作為被入侵的基礎設施。攻擊買家洋蔥地址（已封禁，含端口）：。根據 RetoSwap 的評估，損害範圍似乎限制在大額加密貨幣掛單；法幣交易者未受影響。整個網路的交易已暫停，等待協議漏洞修復。", "es": "Segundo exploit distinto del protocolo de intercambio en menos de 30 días, afectando a operadores de Haveno, incluido RetoSwap. Según el PSA oficial de RetoSwap (17-06-2026), se recibió un informe de exploit a las 18:02 UTC; el equipo de RetoSwap respondió estableciendo la versión mínima del cliente en 2.0.0 mediante la función de filtro y expulsando el onion del atacante. **El ataque de mayo de 2026** funcionó sustituyendo el onion del árbitro legítimo por el del atacante (vector de ACK de árbitro falso contra el paso de selección de árbitro). **El ataque de junio de 2026 es mecanicamente distinto**: el árbitro sigue siendo legítimo, pero el atacante abusa del propio flujo de arbitraje forzado — toma ofertas de compra, fuerza el arbitraje a través de un árbitro real y obtiene la liberación del XMR tras 30 confirmaciones sin haber enviado nunca BTC. Dos árbitros legítimos de Reto están registrados (, ) — ambos involucrados en el ataque actual como contrapartes honestas, no como infraestructura comprometida. Onion del comprador atacante (expulsado, con puerto): . Alcance según RetoSwap: el daño parece contenido en ofertas de cripto a gran escala; los operadores de fiat no están afectados. Trading suspendido en toda la red mientras se aborda la brecha del protocolo.", "ru": "Второй различный по механизму эксплойт торгового протокола менее чем за 30 дней, затрагивающий операторов Haveno, включая RetoSwap. Согласно официальному PSA RetoSwap (17.06.2026), сообщение об эксплойте было получено в 18:02 UTC; команда RetoSwap отреагировала, установив минимальную версию клиента 2.0.0 через функцию фильтра и забанив onion-адрес атакующего. **Майская атака 2026 года** работала путём подмены onion-адреса легитимного арбитра на адрес атакующего (вектор поддельного ACK арбитра против шага выбора арбитра). **Июньская атака 2026 года отличается по механизму**: арбитр остаётся легитимным, но атакующий злоупотребляет самим потоком принудительного арбитража — принимает предложения на покупку, принудительно запускает арбитраж через реального арбитра и получает высвобождение XMR после 30 подтверждений, ни разу не отправив BTC. Зафиксированы два легитимных арбитра Reto (, ) — оба вовлечены в текущую атаку как добросовестные контрагенты, а не как скомпрометированная инфраструктура. Onion-адрес атакующего покупателя (забанен, с портом): . Масштаб согласно RetoSwap: ущерб, по-видимому, ограничен крупными крипто-предложениями; фиатные трейдеры не затронуты. Торговля остановлена по всей сети до устранения уязвимости протокола." }, "curator_advice_i18n": { "zh": "如果你目前有開啟的 Haveno 交易，請立即撤銷掛單並暫停，直到網路發布安全解除通知。反覆出現的故障模式位於 Haveno 交易協議層面，而非任何特定營運者，也非仲裁者——記錄中兩位合法的 Reto 仲裁者均作為誠實交易方牽涉其中，而非攻擊媒介。2026 年 5 月：仲裁者替換／針對選擇步驟的偽造仲裁者 ACK 攻擊向量。2026 年 6 月：強制仲裁流程濫用——仲裁者是誠實的，但流程本身在從未發送 BTC 的情況下仍於 30 次確認後釋放 XMR。根據 RetoSwap，損害範圍似乎限制在大額加密貨幣掛單；法幣交易流程不受影響。RetoSwap 已立即採取緩解措施：透過過濾功能將最低客戶端版本設為 2.0.0，並封禁攻擊者洋蔥地址。受影響的交易者應透過 RetoSwap SimpleX 群組聯繫；請關注 Haveno 倉庫和營運者頻道的結構性修復公告後再恢復交易。", "es": "Si tienes una operación Haveno abierta en este momento, revoca las ofertas y pausa hasta que la red dé el visto bueno. El patrón de fallo recurrente está en la superficie del protocolo de intercambio de Haveno, no en ningún operador específico ni en los árbitros — ambos árbitros legítimos de Reto registrados estuvieron involucrados como contrapartes honestas, no como vectores de ataque. Mayo 2026: sustitución de árbitro / vector de ACK de árbitro falso contra el paso de selección. Junio 2026: abuso del flujo de arbitraje forzado — el árbitro es honesto, el propio flujo libera XMR tras 30 confirmaciones incluso cuando nunca se envió BTC. Según RetoSwap, el alcance parece contenido en ofertas de cripto a gran escala; las operaciones con flujo fiat no están afectadas. RetoSwap mitigó inmediatamente estableciendo la versión mínima del cliente 2.0.0 mediante la función de filtro + expulsando el onion atacante. Los traders afectados deben contactar a través del grupo SimpleX de RetoSwap; sigue el repositorio de Haveno y los canales de los operadores para el anuncio de la solución estructural antes de reanudar.", "ru": "Если у вас сейчас есть открытая сделка Haveno, отзовите предложения и приостановите торговлю до сигнала «всё чисто» от сети. Повторяющийся характер сбоев лежит на уровне торгового протокола Haveno, а не какого-либо конкретного оператора и не арбитров — оба зафиксированных легитимных арбитра Reto были вовлечены как добросовестные контрагенты, а не как векторы атаки. Май 2026: подмена арбитра / вектор поддельного ACK арбитра против шага выбора. Июнь 2026: злоупотребление потоком принудительного арбитража — арбитр честен, но сам поток высвобождает XMR после 30 подтверждений, даже когда BTC никогда не был отправлен. Согласно RetoSwap, масштаб, по-видимому, ограничен крупными крипто-предложениями; сделки с фиатным потоком не затронуты. RetoSwap немедленно принял меры, установив минимальную версию клиента 2.0.0 через функцию фильтра + забанив onion-адрес атакующего. Пострадавшим трейдерам следует обратиться через группу RetoSwap в SimpleX; следите за репозиторием Haveno и каналами операторов в ожидании объявления о структурном исправлении, прежде чем возобновлять торговлю." }, "resolved": "2026-06-24" }, "also_listed_at": { "monerica": true } }, { "id": "ironswaps", "category": "exchanges", "subcategory": "Instant Swaps", "name": "IronSwaps", "url": "https://xmr.club/exchanges/ironswaps", "twin": "https://xmr.club/llm/exchanges/ironswaps.txt", "tagline": "No-account instant swap across 50+ coins including XMR — public swap tracker by tx ID, full legal-page footer, kycnot Community-Contributed listing with no warnings. Zero Wayback footprint.", "review": "IronSwaps is a **no-KYC instant crypto swap** advertising 50+ coins (BTC / ETH / XMR / USDT / SOL and more) with **no registration, no email, no ID at any step**. Listed at **Grade C** — the default entry grade for a new no-KYC exchange in a category where user losses can be large. The product surface is coherent and third-party signals are neutral-positive, but the public track record is measured in days and no incident-response history exists.\n\n**Product.** Standard instant-swap flow: pick source coin, pick destination coin, enter destination wallet address, send deposit to the address shown, receive swapped funds. No account, no email, no KYC per operator. Estimated completion 5–30 minutes depending on network. Public **swap-status tracker** by tx ID at `/track.html` — a real reader-utility that most instant swaps don't publish.\n\n**Legal surface, present.** `/faq.html`, `/terms.html`, `/privacy.html`, `/affiliate.html`, `/track.html` all HTTP 200. FAQ is honest about scope (*\"IronSwaps requires no registration, no email, and no KYC\"*). Affiliate program page exists — standard for the category.\n\n**Brand mismatch on the support surface.** The support bot handle published on the site is **`@SwapGenie_bot`** — a different brand than IronSwaps. Two possibilities: shared bot infrastructure between related products, or a rebrand mid-launch. Neither is disqualifying on its own, but the support surface plainly carries a *different brand* than the exchange, which readers should know before reaching out.\n\n**Operator identity — thin.** No `/about`, no PGP page, no dated warrant canary. Contact channels: Telegram `@SwapGenie_bot` (bot) and `@jolyIrony` (human). X: `@IronSwaps`. Compared to peers like Ollie Swap or 0trace that publish a canary + PGP fingerprint, IronSwaps is more opaque on the identity axis.\n\n**Peer signal — neutral-positive but Community-Contributed.** `kycnot.me` lists IronSwaps at `/service/ironswaps` with a 9/10 overall score (Privacy 100 / Trust 69, \"Guaranteed no KYC\"). Flagged **\"Community Contributed — Not reviewed by the team\"**, which is a weaker signal than a team-reviewed kycnot listing but is still an external footprint with no warnings attached. Not on `monerica.com`. Not on OrangeFren's permanent-delist page.\n\n**Tenure caveat.** Wayback CDX returns **zero snapshots** for `ironswaps.org`. The domain is genuinely unarchived — consistent with a very-fresh brand.\n\n**Grade C — what it means here.** Acceptable with the reservations above. Not rejecting: the product exists with a functioning tracker, legal pages are present and honest, and independent peer signal is neutral-positive rather than warning-flagged. Not at B: identity is opaque (no canary, no PGP, no `/about`), tenure is unmeasurable (zero Wayback), and the SwapGenie brand mismatch is unresolved.\n\n**What would lift the grade.** Several months of clean operating record; the operator publishing a signed canary and PGP identity page; the SwapGenie brand mismatch resolved (either merged branding or an on-page explanation); Wayback snapshots accumulating; peer-directory pickup at team-reviewed (not Community-Contributed) tier.\n\n**Useful when.** You want a no-account instant swap across a broad coin bench including XMR, comfortable with a young operator that has thin identity surface. Do a small test swap before committing meaningful volume — standard hygiene for a Grade C exchange with unmeasurable tenure.", "translation_locale": "en", "rating": { "grade": "C", "trust": "No dated warrant canary, no PGP identity page, no /about. Support-bot handle @SwapGenie_bot is a different brand than the exchange — worth an operator explanation. kycnot lists at Community-Contributed tier (not team-reviewed), 9/10 with no warnings. Zero Wayback snapshots at listing.", "privacy": "No account, no email, no ID required per operator FAQ. Standard instant-swap shape: deposit lands at operator address, swap routes out to destination wallet. Custodial-routing during the swap window.", "ux": "Direct-to-swap widget on homepage. Public swap-status tracker by tx ID (real reader-utility). Standard legal-page footer. 5-30 min settlement per operator." }, "grade": "C", "kyc_tags": [ "no_kyc", "no_email", "anonymous_signup" ], "feature_tags": [ "no_account", "multi_chain", "custodial" ], "highlight_tags": [ "NO ACCOUNT", "NO KYC", "50+ COINS", "PUBLIC TRACKER" ], "fees": null, "fees_summary": null, "last_verified": "2026-07-27", "operating_since": "2026", "tenure_note": "Wayback zero snapshots at listing time; brand-new domain footprint. kycnot listing is Community-Contributed tier, not team-reviewed.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://ironswaps.org", "outbound_slug": "ironswaps" } }, { "id": "kyc-rip-aggregator", "category": "exchanges", "subcategory": "Aggregators", "name": "kyc.rip", "url": "https://xmr.club/exchanges/kyc-rip-aggregator", "twin": "https://xmr.club/llm/exchanges/kyc-rip-aggregator.txt", "tagline": "Our own. Routes across 10+ engines, picks the best rate, no account, no signup.", "review": "First-party. Routes every quote across ChangeNow, FixedFloat, Exolix, LetsExchange, SimpleSwap, StealthEX, Sideshift, Trocador and several others, picks the best rate + privacy posture. No-account, no-email, no-KYC up to per-engine limits. We don't add any markup on top of the upstream engine — funding comes from the upstream's affiliate program, not from your quote. Sibling product kyc.rip / ghost forces a two-hop XMR-detour flow for chain-analysis-defensive routing — listed separately under Privacy bridges.\n\nFirst-party firewall note: held at B (not A) — we grade our own fund-routing products conservatively. kyc.rip routing exposed real backend risk when a routed desk (El Capo) failed to deliver a large order and was downgraded to F (Sept 2026). An aggregator is only as safe as the desks it routes to. Grade lifts once the announced per-order PGP receipts + provider bonds ship.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "api_available", "no_js_supported", "tor_mirror" ], "highlight_tags": [ "AGGREGATOR", "BEST RATE" ], "fees": { "summary": "Best-of-10 routing · no aggregator markup · upstream engine spread only" }, "fees_summary": "Best-of-10 routing · no aggregator markup · upstream engine spread only", "last_verified": "2026-05-13", "operating_since": "2025", "tenure_note": null, "locales_available": null, "first_party": true, "editors_pick": false, "links": { "web": "https://kyc.rip", "outbound_slug": "kyc-rip-aggregator", "tor": "http://kycripxmrmlmkfaqf4hwchilhtrp36nu6vyjoh3e7rmsgmyylxfm25ad.onion", "twitter": "https://x.com/kyc_rip", "telegram": "https://t.me/kyc_rip_bot", "affiliate": "https://kyc.rip/r/xc" }, "also_listed_at": { "kycnot": true, "monerica": true, "web3privacy": true } }, { "id": "kyc-rip-ghost", "category": "exchanges", "subcategory": "Aggregators", "name": "kyc.rip / ghost", "url": "https://xmr.club/exchanges/kyc-rip-ghost", "twin": "https://xmr.club/llm/exchanges/kyc-rip-ghost.txt", "tagline": "Two-hop swap that breaks the on-chain link between sender and recipient — bridges your input to native XMR, then to whatever you actually need.", "review": "First-party. Single-flow product for the chain-analysis threat model: you send any supported asset, the system routes it through native Monero to break the deterministic on-chain link, then settles to the destination asset of your choice. Useful when you cannot rely on the source and destination chains both being XMR — e.g. rotating tainted USDT/USDC away from a flagged address, or paying onchain BTC from a stables balance without a direct exchange trail. No account, no email. Each hop runs against a different upstream engine where possible to limit any single operator's view of the full flow. Listed separately from the kyc.rip aggregator because the routing semantics are different — aggregator picks the best single-hop quote, ghost forces the XMR detour.\n\nFirst-party firewall note: held at B (not A) — we grade our own fund-routing products conservatively. kyc.rip routing exposed real backend risk when a routed desk (El Capo) failed to deliver a large order and was downgraded to F (Sept 2026). An aggregator is only as safe as the desks it routes to. Grade lifts once the announced per-order PGP receipts + provider bonds ship.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "xmr_native", "api_available", "tor_mirror" ], "highlight_tags": [ "TWO-HOP", "XMR-DETOUR", "CHAIN-ANALYSIS DEFENSE" ], "fees": { "summary": "Two upstream-engine spreads (one per hop) · no aggregator markup" }, "fees_summary": "Two upstream-engine spreads (one per hop) · no aggregator markup", "last_verified": "2026-05-13", "operating_since": "2025", "tenure_note": null, "locales_available": null, "first_party": true, "editors_pick": false, "links": { "web": "https://kyc.rip/ghost", "outbound_slug": "kyc-rip-ghost", "tor": "http://kycripxmrmlmkfaqf4hwchilhtrp36nu6vyjoh3e7rmsgmyylxfm25ad.onion/ghost", "affiliate": "https://kyc.rip/ghost?ref=xc" }, "also_listed_at": { "web3privacy": true } }, { "id": "letsexchange", "category": "exchanges", "subcategory": "Instant Swaps", "name": "LetsExchange", "url": "https://xmr.club/exchanges/letsexchange", "twin": "https://xmr.club/llm/exchanges/letsexchange.txt", "tagline": "Anonymous floating-rate swap, low spread on majors.", "review": "LetsExchange is a long-running no-KYC instant-swap aggregator covering **6,020+ cryptocurrencies** with both floating-rate and fixed-rate options, cross-chain support, and a \"no funds blocking\" operator commitment. Listed at **Grade A** because the operator has been live since **2021** with a clean record — broad coin coverage, transparent fee disclosure, and a Trustpilot rating of 4.7 across thousands of reviews. It sits in the same swap-aggregator slot as Trocador and FixedFloat, with a slightly different lean: more coins, more focus on \"no blocking\" reassurance, less emphasis on Tor-native operation.\n\n**Background.** LetsExchange has been operating since 2021 as a non-custodial cross-chain swap aggregator. Routes through upstream exchanges to fill orders, doesn't hold user funds in long-term custody. Multi-language UI, 24/7 chat support, public API for integrators. Coin coverage of 6,020+ assets is among the largest in the no-KYC swap space — useful for users holding exotic altcoins that smaller aggregators can't route.\n\n**What you trust.** Non-custodial in the steady state — the wallet sends crypto to the operator, the operator routes through upstream exchanges, and the destination wallet receives the swapped output. **Custody window**: short routing-leg custody during the swap (operator holds funds while the upstream exchange fills), then release to the user's specified destination address. **\"No funds blocking\" commitment**: operator publicly states they don't freeze user funds during routine swap operations. As with all routing aggregators, the upstream exchange may apply its own AML screening that affects the swap regardless of the aggregator's policy — verify the routing upstream if you want full visibility into who's looking at the transaction.\n\n**Operational specs.** **Coin coverage**: 6,020+ cryptocurrencies — claimed largest in the category vs ChangeNOW ~1,500, SimpleSwap ~1,200, FixedFloat ~900. **Rates**: floating (best available, no guarantee) + fixed (locked-in but at a small premium). **Cross-chain swaps**: same-token-different-blockchain supported (USDT-Tron ↔ USDT-Ethereum, etc.). **Fees**: bundled in the exchange rate, transparently disclosed in the quote (\"no hidden fees\" per the operator). **Payment paths**: crypto-only on the entry side; USD + EUR fiat exits available on selected pairs (which adds bank-rail KYC for the fiat-receive leg). **API**: published, used by partner integrations and white-label aggregators. **Support**: 24/7 chat + email.\n\n**Philosophy.** LetsExchange's editorial differentiator is **coverage-breadth-with-no-blocking-promise**. Where Trocador emphasises upstream-transparency (you see which upstream exchange fills the swap and its KYC rating) and FixedFloat emphasises operator reliability (fewer pairs, deeper liquidity, longer track record on those pairs), LetsExchange targets the user who needs a wide tail of asset coverage and a clear commitment that the operator won't freeze funds mid-swap. The trade-off: less operational transparency about routing upstream, more reliance on the operator's reputation for the no-blocking promise.\n\n**Grade rationale.** Grade A reflects: 4+ years of operational continuity (since 2021); 6,020+ coin coverage among the broadest in no-KYC swap aggregation; published API for integrators; floating + fixed rate options; \"no funds blocking\" operator commitment; transparent fee disclosure in the exchange-rate quote; Trustpilot 4.7 across thousands of reviews (independent third-party review signal); 24/7 support channels; absence of major refund-dispute or fund-freeze threads in community discussion. Last verified 2026-05-14.\n\n**Useful when.** You're swapping an exotic altcoin that smaller aggregators don't route. You want cross-chain same-token swaps (USDT or USDC between Tron/Ethereum/Polygon/etc.). You prefer a fixed-rate quote with locked-in amount over floating-rate uncertainty. You want a long-running aggregator with an established Trustpilot footprint rather than a brand-new one. You need a fiat-receive option on the destination side (USD / EUR exits on supported pairs — note KYC applies on the bank-rail leg).\n\n**Caveats.** **Less operational transparency than Trocador** — LetsExchange routes through upstream exchanges but doesn't expose the upstream's KYC rating in the quote UI. For users who want to choose their upstream based on its KYC posture, Trocador's transparency model is the better fit. **\"No funds blocking\" is operator policy, not protocol guarantee** — relies on operator integrity rather than non-custodial smart-contract architecture. **Trustpilot reviews ≠ technical audit** — 4.7/5 across thousands of reviews is a useful social-proof signal but doesn't substitute for a code audit or reproducible-rate verification. **Fiat-exit leg adds KYC** — receiving USD or EUR on the destination side triggers bank-rail KYC for that leg; pure crypto-in / crypto-out swaps don't. **No Tor mirror operator-published** — clearnet-only at the time of this review; for Tor-only access, use Trocador's onion mirror or route LetsExchange through a Tor bridge yourself. **Custody window still applies** — short routing-leg custody is standard for the category, but it's not zero; treat as \"trust the operator for a few minutes per swap, not a long-term custody relationship.\"", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "NO-KYC" ], "fees": { "summary": "~0.5% spread · floating" }, "fees_summary": "~0.5% spread · floating", "last_verified": "2026-05-14", "operating_since": "2021", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2021", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://letsexchange.io", "outbound_slug": "letsexchange", "twitter": "https://x.com/AlinskaMayang", "telegram": "https://t.me/LetsExchange_official_bot", "discord": "https://discord.gg/mufge5PN4u", "affiliate": "https://letsexchange.io/?ref_id=wMv4qfSzIx9TziHr" }, "also_listed_at": { "orangefren": true, "kycnot": true, "monerica": true } }, { "id": "lifi", "category": "exchanges", "subcategory": "Aggregators", "name": "LI.FI", "url": "https://xmr.club/exchanges/lifi", "twin": "https://xmr.club/llm/exchanges/lifi.txt", "tagline": "Cross-chain bridge + DEX aggregator API used by many wallets.", "review": "Aggregates across major bridges (Stargate, Across, Hop, Connext, etc.). EVM ↔ EVM and EVM ↔ Solana destinations. EVM-side execution; no KYC on the bridge side itself.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available", "open_source" ], "highlight_tags": [ "BRIDGE", "AGGREGATOR" ], "fees": { "summary": "Bridge fee + DEX route fee per chain · no LI.FI markup" }, "fees_summary": "Bridge fee + DEX route fee per chain · no LI.FI markup", "last_verified": "2026-05-14", "operating_since": "2016", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://li.fi", "outbound_slug": "lifi", "twitter": "https://x.com/lifiprotocol", "telegram": "https://t.me/lifinews", "discord": "https://discord.gg/jumperexchange" } }, { "id": "lizex", "category": "exchanges", "subcategory": "Instant Swaps", "name": "Lizex", "url": "https://xmr.club/exchanges/lizex", "twin": "https://xmr.club/llm/exchanges/lizex.txt", "tagline": "Anonymous floating-rate swap, lower spread on niche pairs.", "review": "Native settlement (not an IOU). No-KYC for typical retail volume.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "NO-KYC" ], "fees": { "summary": "~0.5-1% spread · floating" }, "fees_summary": "~0.5-1% spread · floating", "last_verified": "2026-05-14", "operating_since": "2025", "tenure_note": "operating_since estimated from about-page heuristic; WHOIS and archive.org both returned no signal", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://lizex.io", "outbound_slug": "lizex", "contact_email": "support@lizex.io", "affiliate": "https://lizex.io?ref=by79ls38zfgrw" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "localp2p", "category": "exchanges", "subcategory": "P2P", "name": "Local P2P Exchange", "url": "https://xmr.club/exchanges/localp2p", "twin": "https://xmr.club/llm/exchanges/localp2p.txt", "tagline": "LocalBitcoins-style P2P ads directory — post or browse crypto↔fiat buy/sell ads, arrange the trade off-site over SimpleX chat, with an optional SimpleX escrow bot as neutral middleman. The closest active venue yet to the LocalMonero shape that's been missing since AgoraDesk closed in November 2024.", "review": "**LocalBitcoins-style P2P crypto-↔-fiat directory.** Post an ad — asset, fiat, amount, price, payment methods, SimpleX contact — browse what other people have posted, and arrange the trade directly with your counterparty over SimpleX chat. The site publishes and manages the ads; it holds no funds, takes no custody, and does not arbitrate. An optional SimpleX escrow bot can sit in the middle as a neutral third party when you don't trust the counterparty.\n\n**Why this shape matters.** The LocalBitcoins → LocalMonero → AgoraDesk lineage — P2P fiat trading with off-chain payment methods, escrow, and no operator custody — ended when AgoraDesk closed in November 2024. Nothing active has filled it since: Bisq, Haveno and RoboSats cover P2P *currency swaps*, and Kashilo and XMRBazaar cover *goods classifieds*, but the P2P-fiat-with-escrow venue simply disappeared. Local P2P Exchange is the closest active service that maps back onto that classic shape.\n\n**Escrow.** The SimpleX escrow bot is opt-in — the directory points you to it but doesn't underwrite it, and the bot is unaudited. Read its own terms and test the release-condition logic with a small trade before relying on it for anything larger.\n\n**Honest about itself.** The footer says it plainly: *\"Beta environment. Trades happen off-site over SimpleX; always use escrow and verify your counterparty. Content is user-submitted and not vetted by this site.\"* That kind of first-party humility is rare on a fresh listing and worth crediting.\n\n**Useful when.** You want to trade crypto ↔ fiat with a real counterparty instead of a swap engine's order book; you want trade coordination on SimpleX (no signup, metadata-minimal); and you want a directory that honestly calls itself a directory rather than a custodial exchange wearing P2P branding.\n\n**Caveats.** It's **very fresh and self-described beta** — keep early trades small and verifiable before scaling. **No peer-directory signal yet.** The **legal-page surface is missing** — `/terms`, `/about`, `/faq`, `/help` all 404, which is the biggest reservation here: an ads-only directory with no operator-side terms or contact page. The **escrow bot is unaudited**. The **`.su` TLD** is a legacy ccTLD, still valid but with occasional verification quirks, and operator jurisdiction is unknown. And per the site's own footer, **ads are user-submitted and unvetted** — same directory-liability posture as classic LocalBitcoins: verify your counterparty yourself, use escrow, and never send funds directly on a first trade.", "translation_locale": "en", "rating": { "grade": "C", "trust": "Directory-only P2P ads board; holds no funds and does not arbitrate. Very fresh, self-described beta. No operator legal/contact page (/terms, /about, /faq, /help all 404). .su ccTLD; operator jurisdiction unknown. No peer-directory signal yet.", "privacy": "Non-custodial by design — trades happen off-site over SimpleX (no signup, metadata-minimal) and the site never holds funds. Optional SimpleX escrow bot as neutral middleman (third-party, unaudited).", "ux": "Post/browse ads via a simple ad-creation UI + dashboard; trade coordination and optional escrow happen over SimpleX. Content is user-submitted and unvetted." }, "grade": "C", "kyc_tags": [ "anonymous_signup", "no_kyc" ], "feature_tags": [ "non_custodial", "p2p", "escrow_optional", "no_account_required_to_browse" ], "highlight_tags": [ "P2P", "NO-KYC", "SIMPLEX", "GAP-FILL" ], "fees": { "summary": "Directory-side is free (posting + browsing). SimpleX escrow bot may charge a per-trade fee; check the bot's own terms before use — the site does not publish the bot's fee schedule." }, "fees_summary": "Directory-side is free (posting + browsing). SimpleX escrow bot may charge a per-trade fee; check the bot's own terms before use — the site does not publish the bot's fee schedule.", "last_verified": "2026-08-17", "operating_since": "2026-08", "tenure_note": "RDAP does not return registration data for .su domains via public RDAP; Wayback has no snapshot at listing time. Operator's own site self-describes as 'Beta environment' — the freshness is on-record.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://localp2p.su/", "outbound_slug": "localp2p" } }, { "id": "mistex", "category": "exchanges", "subcategory": "Instant Swaps", "name": "Mistex", "url": "https://xmr.club/exchanges/mistex", "twin": "https://xmr.club/llm/exchanges/mistex.txt", "tagline": "Anonymous instant-swap service: 1000+ pairs, float (0.8%) + fixed (2%) rates, Tor v3 mirror, Monero-address sign-in option, documented REST API. Privacy policy names its mechanism (reverse-proxy header stripping). New operator — single peer-directory listing as of 2026-06.", "review": "**What it is.** A no-KYC, non-custodial instant swap service supporting 1000+ cryptocurrency pairs with float and fixed-rate modes. Listed at **Grade B-** because the privacy architecture is genuinely well-documented — no IP logs, no analytics, no user profiles, swap data discarded after completion — but the anonymous operator and thin external trust footprint (one monerica listing, zero community reviews) keep this in the experimental tier.\n\n**Background.** Mistex is operated by an anonymous team described as ‘cryptography engineers and privacy advocates’ (operator-published, `/about`). The about page explicitly states: ‘We don’t show our faces because we practice what we preach. In a world of surveillance, anonymity isn’t suspicious — it’s responsible.’ No founding date, jurisdiction, or parent entity is published. The privacy policy and terms of service are effective **April 23, 2026**. The service is listed on monerica.com ( — direct hit at monerica.com/site/mistex) but not on kycnot.me (404). Contact channels: support@mistex.io, X / `@mistex_io`, Telegram / `@mistex_bot`. The site supports English only. No community sentiment was found in web/forum/X searches — the service appears to have zero independent reviews or discussion threads as of a public audit date.\n\n**What you trust.**\n\n- **No KYC — verbatim.** The homepage states: ‘No registration. No KYC. No logs.’ The privacy policy reinforces: ‘No name, no email, no phone, no date of birth. No ID documents, no selfies, no proof of address. No social login, no OAuth, no third-party identity broker. No mandatory account.’ (operator-published, `/privacy`). Swaps work without any identity disclosure — accounts are optional and only needed for cashback/referrals/API access.\n- **No-logs policy — specific, not aspirational.** The privacy policy states: ‘We don’t run request logs with client IPs. The reverse proxy strips identifying headers before they reach our application. The application itself writes only operational diagnostics — things like “rate fetch failed, retrying” — which never include addresses or amounts you’d need to link a person to a swap.’ (operator-published, `/privacy`). This is unusually specific: it names the reverse-proxy mechanism and describes exactly what IS logged (operational errors without PII).\n- **No user profiles, no retained swap data.** The terms state: ‘Funds only live in the system for the duration of a single swap. There are no user balances, no “accounts with money” on our side.’ (operator-published, `/terms`). The privacy policy adds: ‘Once a swap terminates this working state is no longer needed. We don’t build histories keyed to anyone — no “user profile”, no behavioural graph, no ad IDs.’ This is a meaningful structural commitment: swap data is ephemeral by design, not just ‘not shared.’\n- **Own liquidity — reduced third-party exposure.** The service claims ‘own liquidity pools’ (operator-published, `/about`, homepage ‘◈ Own Liquidity’ badge). The about page contrasts this with typical exchanges that ‘depend on third-party liquidity’. If true, this means swap execution does not route through external exchange APIs — reducing the number of parties that see the transaction. Notable caveat: the privacy policy acknowledges ‘upstream liquidity provider outages’ as a possible cause of delay, suggesting not ALL pairs are self-liquidity.\n- **Tor v3 mirror with proper Onion-Location header.** The onion `hyktea5pdx57p3qgzg4fpvtydlre24jlmzh5oiv2gwh3pirtgfu7hryd.onion` is advertised on the homepage and footer. The clearnet `Onion-Location` header matches ( — populates the same onion). The privacy policy explicitly addresses cookie scoping: ‘Cookie and login state on the onion mirror are scoped to the onion origin — a login on clearnet does not propagate there, and vice versa. That’s deliberate.’\n- **Monero-address sign-in.** Users can register and log in ‘by signing a challenge with your XMR primary address’ (operator-published, homepage) — no email required. Compatible with Cake Wallet, Feather, and Monero GUI. This is the strongest identity model in the directory — wallet-address-based auth without any personal identifier.\n- **No analytics, no third-party tracking.** The privacy policy states: ‘We don’t run analytics, pixels, session recording, A/B experiments keyed to individuals, or any third-party tracking scripts. There is nothing in the page that phones home about you.’ (operator-published, `/privacy`). The cookie policy is specific: ‘session cookies needed to keep you logged in... and one short-lived attribution cookie if you arrived via a referral link. They are HttpOnly, SameSite=Strict, and scoped to the origin.’\n\n**Operational specs.**\n\n- **Site.** https://mistex.io — conventional multi-page web app (not an SPA). Published pages: `/` (home + embedded FAQ), `/about`, `/terms`, `/privacy`, `/contact`, `/affiliate`.\n- **Tor mirror.** `http://hyktea5pdx57p3qgzg4fpvtydlre24jlmzh5oiv2gwh3pirtgfu7hryd.onion/` — v3 hidden service, advertised on the homepage and footer. `Onion-Location` header on clearnet matches. Proper origin-scoped cookie behaviour across clearnet and onion.\n- **Pricing.** Fee structure not publicly documented on a standalone page. The FAQ on the homepage states: ‘Float rate follows the live market price... Fixed rate locks the exchange rate for 20 minutes... Fixed rates include a premium to cover market risk.’ (operator-published, homepage FAQ). No fee schedule, no commission tiers, and no `/fees` page discovered. The terms note ‘Rates and fees are displayed before you initiate a swap.’\n- **Payment surface.** 1000+ cryptocurrency pairs across multiple networks (operator-published, homepage FAQ). XMR is prominently featured as both source and destination — the homepage highlights BTC→XMR, ETH→XMR, USD→XMR, USDT→XMR, LTC→XMR, SOL→XMR pairs plus reverse routes. Monero-native swap support is a first-class feature, not an afterthought.\n- **Swap modes.** Float rate (market-following, 0.8% service fee) and Fixed rate (locked for 20 minutes, 2% premium over float). The FAQ explains: ‘Float rate follows the live market price — the amount you receive may slightly change... usually works in your favor. Fixed rate locks the exchange rate for 20 minutes, guaranteeing you receive exactly the quoted amount.’\n- **Account model.** No-account swaps are the default. Optional cabinet account (email+password or Monero-address challenge sign-in) unlocks cashback, referral commissions, and API access. The terms state: ‘If you don’t create one, nothing changes about the swap itself.’\n- **Partner / referral program.** 0.3–0.5% lifetime commission on referred swaps (operator-published, homepage Partner section). Registration requires only an XMR payout address. Dashboard shows earnings in BTC and XMR, withdrawable anytime.\n- **Support channels.** support@mistex.io, X / `@mistex_io`, Telegram / `@mistex_bot`. The homepage FAQ mentions ‘24/7 support via Telegram, email, or the on-site chat.’ No Matrix, Simplex, Signal, or PGP key published.\n- ****FAQ is embedded on the homepage.** an extensive FAQ section is embedded directly on the homepage, covering account requirements, data collection, Tor/VPN usage, swap duration, rate types, minimum/maximum amounts, stuck transactions, wrong-address recovery, memo/tag requirements, cancellation, and API access.\n- **No AML page.** The site does not publish a standalone AML/KYC policy. The privacy-by-architecture model (no data collected, no identities held) is the functional equivalent, but it is not stated as an AML posture.\n- **No reserves transparency.** No proof-of-reserves page, balance attestation, or audit report is published. Own liquidity is claimed but not verifiable from outside.\n- **API surface.** Documented REST API at `https://mistex.io/api-docs`. Base URL `https://mistex.io/api/v1`. Public endpoints `/currencies` and `/partner/rates` require no authentication; order endpoints (`/partner/orders`) authenticate with a Bearer-token API key (`key_id.secret` format, no request signing). Default rate limit 60 req/min on unauthenticated calls; higher quotas for partners. The operator-published positioning: *\"suitable for bots, payment integrations, and partner platforms.\"*\n- **Contact channels.** Support (24/7, <5 min average): Telegram bot `@mistex_bot`, Telegram channel `@mistexio`, support email `support@mistex.io`, on-site live chat at `https://mistex.io/contact`, plus an anonymous-allowed contact form (the email field is optional — leave blank for unattributed reports). X / Twitter: `@mistex_io`. The support flow does not require an account; supplying a Transaction ID is the only continuity hook.\n- **Domain.** `mistex.io` — the `.io` TLD is a British Indian Ocean Territory ccTLD widely used by tech startups. It has no history of mass seizures but is not a privacy-community standard like `.org`.\n\n**Operator philosophy.** Mistex is overtly ideological — the about page positions the project as ‘Built by privacy advocates. For privacy advocates.’ and frames financial privacy as ‘a right, not a privilege.’ The team explicitly embraces anonymity: ‘We are anonymous. By design. We don’t show our faces because we practice what we preach. In a world of surveillance, anonymity isn’t suspicious — it’s responsible.’ (operator-published, `/about`). The policies are unusual in their specificity and plain-language confidence — the privacy policy opens with ‘Most privacy policies exist to explain how a service collects and monetizes your data. Ours exists to explain how we don’t’ and the terms are a concise 11 sections with no dense legalese. The project presents a clear contrast table on the about page (Mistex vs ‘typical exchange’) covering KYC, data storage, IP logging, fund-freezing, data-sharing, and liquidity sourcing. The ‘Three pillars. Zero compromise’ framing (Privacy first, Speed matters, Radical transparency) is more manifesto than marketing.\n\n**Grade rationale.** Listed at **Grade B-** — the half-step *\"B-shape positive signals at tenure-zero\"* tier. The privacy posture is genuinely strong: the privacy policy names its mechanism (reverse-proxy header stripping before the application sees the request), the no-log claim is specific rather than hand-wavy, the Tor mirror is properly configured with a matching `Onion-Location` header, the Monero-address sign-in model is the strongest identity approach we list, the REST API is documented at `/api-docs` with a concrete auth model. Grade B is withheld because: (a) only one peer-directory match (monerica) with zero independent community reviews; (b) anonymous operator team, no individual names, no jurisdiction, no fallback if the project dissolves; (c) own-liquidity is claimed but no proof-of-reserves, no audit report, no balance attestation — the reserves claim is unverifiable; (d) no incident history yet, so operator response under stress is untested; (e) under Tor Browser's *Safest* security setting (which blocks JavaScript) the swap-creation flow does not function — the site requires JavaScript end-to-end despite the multi-page legal surface. **Path to B:** publish reserves attestation (view-key or signed wallet address), accumulate 6+ months of post-2026-06 operating-since without a withheld-funds incident, and earn a second peer-directory listing.\n\n**Useful when:**\n\n- You need to swap between cryptocurrencies without creating an account, providing an email, or disclosing any personal identifier — the no-account default swap flow requires only a destination address.\n- You want maximum privacy for a swap and prefer a service with a native Tor v3 mirror, origin-scoped cookies, and a documented no-IP-logging reverse-proxy configuration.\n- You’re a Monero user who wants to log in or register by signing a challenge with your XMR primary address instead of providing an email — Mistex supports Cake Wallet, Feather, and Monero GUI for this flow.\n- You want a swap service with claimed own-liquidity pools (reducing the number of external exchanges that see your transaction) rather than one that routes everything through third-party aggregators.\n- You run a blog, Telegram group, or community and want to earn referral commissions (0.3–0.5%) on swaps without KYC — the partner program requires only an XMR payout address to join.\n\n**Tenure.** Publicly verified on xmr.club since 2026-06-12 — 22 days as of this note. Grade B− reflects short tenure alongside otherwise-clean structural signals — the minus is anchored to that short window, not to any specific operational concern. Tenure counts against grade lift on exchange-class listings; a 90-day re-check is scheduled for 2026-09-10 to reassess.\n\n**Caveats.**\n\n- **Pair-selector dropdowns sometimes render empty.** The currency selectors next to the YOU SEND / YOU GET amount fields can show as blank chevrons depending on render state — refresh the page or click the selector if you don't see the chosen pair label. Affects the visual feedback of *what am I swapping*; the underlying swap is still going to the pair you picked, but verify the rate-line confirmation (`1 BTC ≈ X XMR`) before clicking EXCHANGE NOW.\n- **Long deposit lock — 32 confirmations.** Mistex requires 32 confirmations on the deposit side before releasing the output coin. That is materially longer than the 1–10 confirmations most instant-swap competitors use. For BTC deposits this is several hours of waiting; for XMR deposits, roughly an hour. Plan around the wait if you have a price-sensitive swap; the *float-rate* protection means the displayed rate is not locked across that window.\n- **Reserves are claimed but unverifiable.** Mistex claims its own liquidity pools but publishes no proof-of-reserves, no view-key, no signed wallet address, and no third-party audit. You are trusting the operator's word that the liquidity exists. If they vanish mid-swap, there is no on-chain artefact you can point to that says \"the funds were ever there.\"\n- **Tor Browser Safest mode breaks the swap flow.** The site requires JavaScript end-to-end for swap creation. Tor Browser's *Safest* security setting (which disables JavaScript globally) renders the site readable but the swap form non-functional. Use *Standard* or *Safer* for the actual trade; bookmark the onion (`hyktea5...hryd.onion`) so you don't browse to it via clearnet first.\n- **Anonymous operator team — no recourse channel.** No founder names, no jurisdiction, no legal entity disclosed. The only recourse if a swap goes wrong is the support ticket form on-site. No regulator, no chargeback, no legal recourse. Standard for the no-KYC swap category, but worth acknowledging.\n- **Anonymous team — zero accountability surface.** The about page describes the team as ‘cryptography engineers and privacy advocates’ with no names, no pseudonyms, no individual identities, no jurisdiction, and no legal entity. ‘Anonymous by design’ is philosophically coherent but at the operational level it means there is no person to hold accountable if the service disappears with deposits. Every trust signal in this listing is self-published — the policies, the claims, the comparison table — with no external verification beyond one monerica listing.\n- **‘Own liquidity’ is claimed but unverifiable.** The homepage and about page prominently feature ‘own liquidity pools’ as a differentiator. However, the privacy policy also references ‘upstream liquidity provider outages’ as a potential cause of delays, suggesting own-liquidity coverage may not be complete. No reserve proof, balance attestation, or liquidity-verification mechanism is published.\n- **Fee structure is discoverable only at swap time.** The homepage and FAQ mention float/fixed rate mechanics and a premium for fixed rates (the swap form shows 2% on fixed vs 0.8% float) for fixed rates, but there is no published fee schedule, no fee-comparison page, and no way to compare Mistex’s rates against competitors without initiating a swap. ‘Rates and fees are displayed before you initiate a swap’ (operator-published, `/terms`) is true but insufficient for comparison shopping.\n- **Only one peer-directory listing.** mistex.io is listed on monerica but not on kycnot (404), orangefren, web3privacy, monero.fail, or privacyguides. The external trust footprint is a single match with no community reviews.\n- **Zero community sentiment found.** No reddit threads, no bitcointalk discussions, no monero.town posts, no X reviews, and no independent blog coverage mention Mistex in any context — positive, negative, or neutral. The service appears to have zero user-generated discussion anywhere on the indexed web.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B-" }, "grade": "B-", "kyc_tags": [ "anonymous_signup", "no_kyc" ], "feature_tags": [ "tor_mirror" ], "highlight_tags": [ "NO-KYC", "XMR", "INSTANT-SWAP", "TOR" ], "fees": { "summary": "Float rate: 0.8% service fee, included in the displayed quote. Fixed rate: 2% premium (locks the rate for 20 minutes). Network fee included in both modes. 32-confirmation deposit lock — materially longer than typical instant-swap competitors. Verify the quoted rate against an aggregator (Trocador / kyc.rip) before confirming." }, "fees_summary": "Float rate: 0.8% service fee, included in the displayed quote. Fixed rate: 2% premium (locks the rate for 20 minutes). Network fee included in both modes. 32-confirmation deposit lock — materially longer than typical instant-swap competitors. Verify the quoted rate against an aggregator (Trocador / kyc.rip) before confirming.", "last_verified": "2026-06-12", "operating_since": "2025", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://mistex.io", "tor": "http://hyktea5pdx57p3qgzg4fpvtydlre24jlmzh5oiv2gwh3pirtgfu7hryd.onion/", "twitter": "https://x.com/mistex_io", "telegram": "https://t.me/mistexio", "contact_email": "support@mistex.io", "outbound_slug": "mistex", "logo": "https://mistex.io/apple-icon.png?apple-icon.016v4pk1m9xlu.png", "affiliate": "https://mistex.io/r/5RaFWC7s" }, "also_listed_at": { "monerica": true, "web3privacy": true } }, { "id": "moneroswap", "category": "exchanges", "subcategory": "Instant Swaps", "name": "MoneroSwap", "url": "https://xmr.club/exchanges/moneroswap", "twin": "https://xmr.club/llm/exchanges/moneroswap.txt", "tagline": "Non-custodial, no-account Monero swaps — funds route straight to the settlement address and the site never holds them. No KYC, no logs, open-source frontend, works over Tor with JS off, auto-registered refund address. Grade C is a tenure floor: brand-new (~3 months), not a knock on the product.", "review": "**Non-custodial, no-account way in and out of Monero.** MoneroSwap swaps BTC/ETH/USDT/USDC ⇄ XMR (plus a new ZEC→XMR route) without an account, email, or KYC. It's genuinely non-custodial by design: **your funds go straight to the deposit address that settles the swap — the site never parks them in a balance it controls**, so there's nothing to freeze or seize. The frontend is open source, it works over **Tor with JavaScript off**, min is ~$25, and swaps usually finish in 15–20 minutes. You supply a **refund address** (optional but auto-registered) so a swap that can't complete is returned rather than stuck.\n\n**What stands out is the honesty.** The site doesn't pad itself with fake volume counters, \"50,000 users,\" or stock testimonials — instead it says, plainly, *\"Don't trust us, verify everything, then swap,\"* spells out \"swaps are irreversible, double-check your address,\" and has a \"what can go wrong — and what we promise\" section. That candor is rare and it's a real positive. Like most swap routers it leans on an external settlement network for liquidity, so the usual instant-swap caveat applies (it must source the payout leg).\n\n**Why C — and it's about age, not the product.** The domain is only ~3 months old (registered June 2026) with no track record yet, and exchange-class services carry high loss-asymmetry (you deposit, then wait on delivery), so tenure is a hard input to the grade. **This C is a tenure floor, not a criticism of the design** — the non-custodial architecture, open-source frontend, Tor/no-JS support, and unusually straight framing are all genuinely good. We haven't run a curator test-swap end-to-end yet. It climbs to B on accrued clean tenure and peer-directory depth. Verify independently before large swaps, as the operator itself recommends.", "translation_locale": "en", "rating": { "grade": "C", "trust": "Brand-new (~3 months, domain reg 2026-06-03) with no track record yet; exchange-class loss-asymmetry makes tenure a hard grade input, so C is a tenure floor. Notably honest presentation — NO fabricated volume/user stats or stock testimonials; the site explicitly says 'don't trust us, verify everything.' Curator has not run an end-to-end test swap. Climbs to B on clean accrued tenure + peer-dir depth.", "privacy": "Non-custodial by design — funds route directly to the settlement/deposit address, the site never holds a balance. No account, no email, no KYC, no logs. Open-source frontend, works over Tor with JavaScript off. Auto-registered refund address returns a failed swap.", "ux": "BTC/ETH/USDT/USDC ⇄ XMR plus a new ZEC→XMR route; min ~$25; swaps ~15–20 min. Refund address optional but recommended (auto-registered). Rate-you-see-is-rate-you-get. Leans on an external settlement network for liquidity (must-source-payout caveat)." }, "grade": "C", "kyc_tags": [ "NO-KYC" ], "feature_tags": [ "xmr", "no_kyc", "tor", "non_custodial", "instant", "open_source" ], "highlight_tags": [ "XMR", "NO-KYC", "TOR", "NON-CUSTODIAL", "OPEN-SOURCE" ], "fees": null, "fees_summary": null, "last_verified": "2026-09-15", "operating_since": "2026-06", "tenure_note": "Domain registered 2026-06-03 (~3 months). New exchange-class service, no track record yet — Grade C is a TENURE FLOOR, not a product knock (per the tenure-ceiling rule: tenure caps the grade, never blocks the listing). Non-custodial design + open-source frontend + honest framing are real positives; climbs to B on clean accrued tenure + peer-dir depth.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://moneroswap.net", "outbound_slug": "moneroswap" }, "also_listed_at": { "kycnot": true } }, { "id": "nonkyc", "category": "exchanges", "subcategory": "Order-Book", "name": "NonKYC.io", "url": "https://xmr.club/exchanges/nonkyc", "twin": "https://xmr.club/llm/exchanges/nonkyc.txt", "tagline": "Order-book CEX with no-KYC withdrawal under stated limits.", "review": "Spot + perps order book. No-KYC withdrawals under stated per-coin daily limits; useful as a manual ghost-bridge leg when no aggregator path exists.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "NO-KYC", "ORDER-BOOK" ], "fees": { "summary": "Taker / maker · withdrawal fee per coin" }, "fees_summary": "Taker / maker · withdrawal fee per coin", "last_verified": "2026-05-14", "operating_since": "2021", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2021", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://nonkyc.io", "outbound_slug": "nonkyc", "twitter": "https://x.com/nonkyc_exchange", "telegram": "https://t.me/nonkyc", "discord": "https://discord.gg/GzB2TJpctv", "affiliate": "https://nonkyc.io?ref=69ad324315ebc3f2c3b8bab6" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "octoswap", "category": "exchanges", "subcategory": "Instant Swaps", "name": "OctoSwap", "url": "https://xmr.club/exchanges/octoswap", "twin": "https://xmr.club/llm/exchanges/octoswap.txt", "tagline": "SCAM classification escalated 2026-07-29: OrangeFren.com public tweet (2026-07-28) formally attributed OctoSwap to an operator-cluster (with BitXchange / ETZ-Swap / Explace / MIXED / NeverKYC / PegasusSwap) on top of the existing $30k BTT-Trvoid loss report, OF delist, and kycnot AI-summary warning. Do not deposit.", "review": "**⚠ SCAM CLASSIFICATION + PEER-DIRECTORY REMOVAL (2026-07-19) — GRADE DROPPED B → D.** Two independent peer privacy directories have taken action against OctoSwap: (1) one has publicly classified it as **Scam** on its listing status; (2) OrangeFren.com has **removed OctoSwap from its aggregator**, cutting real user-routing traffic to the service, and publicly stated on Bitcointalk (posting as an OF Sr Member, Merit 807) that they *'confronted them'* — the operator's on-record response was that *'no such swap ever took place'*. Both directories join a call by BTT Hero Member Trvoid (Merit 654, opened a 'Be Cautious: OctoSwap Scam Warning' thread on 2026-07-18) for the loss-victim to publish a tx-hash so the deposit can be verified on-chain. The claim on record is that a user lost **$30,000** with funds stuck in 'processing' for weeks and support unresponsive across Telegram + email. xmr.club has not first-party-verified the $30k loss on-chain, and the operator disputes it — so this is Grade D with an open incident rather than Grade F, but readers should treat any deposit against OctoSwap as materially at-risk until at least (a) an operator statement + refund evidence lands, (b) a tx-hash surfaces that confirms the deposit was received, or (c) both peer-directory classifications are retracted. See the Incident block below for the full timeline.\n\n**What it is.** Instant crypto-to-crypto swap service. No account and no email required for a standard swap: pick a pair, enter your receive address, send to the one-time deposit address, receive on confirmation. An **optional** account can be created to unlock a fee discount, but it is not required and no swap is gated behind signup.\n\n**Peer position.** Two independent privacy-focused directories have carried a listing for OctoSwap on a community-contributed basis, one of them at a notably higher score than the peer batch we typically see for this vintage. Neither has published a team-authored review yet. Operating since **March 1, 2025** per the peer-directory record — fifteen months of live operation.\n\n**Legal surface.** All four expected footer-linked pages exist and render: `/terms`, `/privacy`, `/faq`, `/about`. No template placeholders, no `[e.g. Vercel]` residue like TokensFund had. `/about` reads as team-authored — *\"We are a team of experts… crypto traders prioritize three main factors when choosing an exchange platform: fees, transaction speed, and reliability. We've made the decision not to collect or store personal information from our users.\"* Published policy language matches the site's marketing.\n\n**API.** Public API documented at `api.octoswap.io/api/docs` — surface is thin but real, useful for integrators and cross-checkable in a way brochure-only sites are not.\n\n**Why Grade B (not C).** Four data points pull this off the default C for new exchange-class listings: (a) 15 months of live operation observed by an outside privacy directory — the tenure rule's asymmetric-loss concern is meaningfully reduced by that history, (b) the peer-directory score for OctoSwap is the highest I've seen this batch even acknowledging it's community-contributed, (c) full legal surface published without gaps, and (d) the no-account-required posture is honored on the site — the fee discount is a positive incentive to register, not a shotgun-KYC lever. Grade A withheld pending: a team-authored (rather than community-contributed) peer-directory verdict, disclosed fees on the homepage or FAQ (only the *\"no extra fees\"* marketing line is up), and a first-hand end-to-end swap walk-through by the curator.\n\n**Reader caveats.** Fees are not published upfront in a table — homepage says *\"no extra fees\"* but doesn't quantify the spread or floor-fee. Recommended to compare rate quoted at the swap step against a peer aggregator (kyc.rip, Trocador, SideShift) for meaningful volume. The optional account is described as unlocking a discount; readers who care about not having a login trail should stick with the default no-account flow.\n\n**Tenure.** Publicly verified on xmr.club since 2026-07-03 — 1 days as of this note. The current Grade B rests on structural signals (published trust framing, working onion mirror, direct operator responsiveness), not on tenure. A 90-day re-check is scheduled (2026-10-01); a sustained clean track record over that window is a prerequisite for any lift above B.\n\n**Path to A.** A team-authored peer-directory review + fee disclosure on FAQ or homepage + an independent user-thread on monero.town or Reddit corroborating that the no-account flow works as advertised for XMR swaps.\n\n**Observed outage — 2026-07-02 to 2026-07-03.** During the initial listing walk-through on 2026-07-02, the registration endpoint at `api.octoswap.io/auth/register` was returning a backend error and we pulled the listing back to draft while the endpoint was unreachable. Re-probed on 2026-07-03: the endpoint now responds with an expected validation-error to an empty POST, which is the shape of a live API rejecting missing required fields. Registration is healthy again. The optional-account flow (which is what triggered the 500) is off the critical path for standard swaps, but the incident is worth surfacing because it hit within 24 hours of publication and readers should know the service isn't immune to backend hiccups.\n\n**Follow-up 2026-08-02 — kycnot published a full three-part warning; three new structural signals folded in.** On 2026-07-29 kycnot.me/service/octoswap published a top-of-page warning box titled *\"Fake partner claims and an unresolved \\$30,000 report\"* that hardens the case with three additional signals beyond the original BTT thread and the OrangeFren cluster tweet:\n\n- **Fake partner claims.** OctoSwap's homepage advertises Trezor, SatoshiLabs, CoinMarketCap, Monero, Pirate Chain, Monerujo, OrangeFren and others as partners. \"Monero\" is a decentralised project with no company to partner with. Trezor and SatoshiLabs are the same firm listed twice. OrangeFren has publicly delisted OctoSwap over these concerns. **Thirteen of the fourteen partner logos link nowhere.** Deliberate misrepresentation of institutional endorsement.\n- **Structural test-impossibility.** Minimum order size is **0.108 BTC (~\\$6,983)** per OctoSwap's own public rate feed. **No cheap test swap is possible** — the smallest amount you can lose is about seven thousand dollars. Combined with the unresolved \\$30k loss report, this is the shape of a service designed to defeat due-diligence-by-small-order — a hallmark of the pump-and-drain playbook.\n- **Monerica explicitly labeled \"Scam\"** — named at the peer-directory level. Combined with kycnot's 2026-07-29 warning box and OrangeFren's delisting + cluster attribution, three independent peer directories now converge on the same classification.\n\n**No refund evidence and no operator statement has surfaced in the 14 days since the original report.** Operator's on-record response to OrangeFren remains *\"no such swap ever took place\"* with no transaction ID or order number produced by either side. Grade F stands. Curator continues to monitor at 7-day intervals for either (a) operator producing verifiable refund evidence + tx-hash, or (b) additional first-party loss reports that would harden the classification further.", "translation_locale": "en", "rating": { "grade": "F" }, "grade": "F", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "INSTANT-SWAP", "NO-KYC", "NO-ACCOUNT", "XMR", "API", "EST-2025" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-23", "operating_since": "2025-03-01", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://octoswap.io", "api": "https://api.octoswap.io/api/docs", "telegram": "https://t.me/octoswap_support", "email": "mailto:support@octoswap.io", "logo": "https://octoswap.io/icon.svg", "twitter": "https://x.com/octo_swap" }, "incident": { "title": "Peer-directory scam classification + BTT $30k-loss report (2026-07-19) — grade dropped B → D, incident open pending operator response or refund evidence", "summary": "Two independent peer privacy directories have publicly taken action against OctoSwap on 2026-07-19: (1) one published a 'Scam' status classification on its OctoSwap listing (screenshot on file); (2) OrangeFren.com removed OctoSwap from its aggregator, cutting real user-routing traffic to the service, and posted publicly on Bitcointalk (as OF Sr Member, Merit 807) that they confronted the operator directly — the operator's on-record response was that 'no such swap ever took place'. The trigger is a Bitcointalk thread opened 2026-07-18 by BTT Hero Member Trvoid ('Be Cautious: OctoSwap Scam Warning') carrying a report of a user allegedly losing $30,000 with funds stuck in 'processing' status for weeks and both Telegram + email support unresponsive. Multiple thread participants converged on 'exit scam' language and pattern-matched the frustrate-to-abandonment shape. Trvoid's user review (#60) approved simultaneously on curator side. Trvoid's prior warning from 2026-06-18 on kycnone.com had already flagged OctoSwap as high-risk on the strength of an unusually high $7K minimum-order requirement and observed service malfunction. Curator disposition: not first-party-verified on-chain and the operator disputes it, so grade dropped B → D with an open incident rather than Grade F (shame-list). A prominent warning-lead paragraph has been prepended to the review body in all four languages; readers should treat any deposit as materially at-risk pending (a) operator statement + refund evidence, (b) a tx-hash confirming the deposit was received, or (c) both peer-directory classifications retracted. Follow-up wake armed for +7 days.", "status": "open", "timeline": [ { "date": "2026-07-19", "stage": "incident_open", "note": "Peer privacy directory publicly classifies OctoSwap as 'Scam' (screenshot on file: status field shows red-X Scam badge). Combined with a fresh Bitcointalk thread from BTT Hero Member Trvoid (Merit 654) on 2026-07-18 titled 'Be Cautious: OctoSwap Scam Warning' — the thread carries a user report of a $30,000 loss, funds stuck in 'processing' for weeks, support unresponsive on TG and email. Trvoid's prior warning on kycnone.com from 2026-06-18 had already flagged high-risk shape based on an unusually high $7K minimum order requirement + observed service malfunction. Grade dropped B → D on curator sign-off; not lifted to F because the $30k loss is not first-party-verified on-chain and the operator has not been given a chance to respond. Warning-lead paragraph prepended to review body in en/zh/es/ru. Trvoid's user review (#60) approved simultaneously; it is now public on the OctoSwap page as attribution-preserved community warning." }, { "date": "2026-07-19", "stage": "orangefren_action", "note": "Second peer-directory signal: OrangeFren.com removed OctoSwap from its aggregator and posted on the Bitcointalk thread (as OF Sr Member, Merit 807, July 18 22:11) confirming three things: (a) 'I immediately removed OctoSwap from OrangeFren.com' — the removal was direct action, not a badge change; as an aggregator this cuts real user-routing traffic to the service; (b) 'I also confronted them, but they claim no such swap ever took place' — the operator's on-record denial is now logged; (c) 'It would be good if the user who left that review could provide some evidence that they actually sent the coins to OctoSwap' — echoes the call for the loss-victim to publish a tx-hash so the deposit can be independently verified on-chain. Signal stack is now: two independent peer directories against + BTT community thread + Trvoid's prior kycnone.com warning + Trvoid's user review approved + operator denial on record. Curator disposition unchanged: hold at D. F remains gated on (a) tx-hash confirming the deposit, or (b) a second independent loss report with details, or (c) OF publishing hash evidence from their confrontation. Escalating to F on peer-signal weight alone would drift toward 'downgrade on comment', which the maintainer has explicitly flagged as an attack surface to avoid." }, { "date": "2026-07-26", "stage": "day7_recheck", "note": "+7d re-check on the 2026-07-19 incident open. Findings: (1) octoswap.io surface HTTP 200 / ~140 KB, still up with title \"OctoSwap\" and no self-published apology / refund / advisory / update banner surfaced in the static HTML. (2) NEW peer-directory intel from OrangeFren.com main page: a network-analysis note identifies OctoSwap as part of a cluster of potentially-affiliated services — verbatim: \"BitXchange – ETZ-Swap – Explace – MIXED – NeverKYC – OctoSwap – PegasusSwap.\" This is aggregator-level attribution that OctoSwap belongs to a related cluster; worth naming as a hardening signal (though not sufficient on its own for F). (3) OrangeFren has NOT added OctoSwap to its permanent-delist page (that list remains the Hellex-class five: CoreSwap, Guardex, Hellex, Swaponix, VigorSwap). Slight caveat: OctoSwap still appears in the main OF aggregator listing with a referral_id link — an apparent contradiction with the 2026-07-19 timeline note that OF said they \"immediately removed OctoSwap from OrangeFren.com\"; the removal may have been from routing/quote surface only, or partial. (4) kycnot.me/service/octoswap advisory unchanged since 2026-07-20 (AI-summary warning about processing delays + unresponsive support). No new user comments on the kycnot page. (5) Zero new D1 submissions mentioning octoswap since 2026-07-19 — the second-independent-report escalation trigger remains cold. (6) Operator has published no statement or refund evidence visible via curator probe. (7) No tx-hash surfaced from the loss-victim, no on-chain drain evidence surfaced from OrangeFren. Grade held at D — F escalation triggers on file (tx-hash confirming deposit, second independent loss report with details, OF publishing hash evidence) all remain cold. The affiliated-cluster finding is a slow-hardening signal but not by itself F-triggering; will surface into the review body on next scheduled edit. Reschedule +168h (7d)." }, { "date": "2026-07-29", "stage": "grade_f_escalation", "note": "D → F escalation on the +7d escalation trigger being met: OrangeFren.com published a tweet 2026-07-28 formally attributing OctoSwap to an operator-cluster (BitXchange / ETZ-Swap / Explace / MIXED / NeverKYC / PegasusSwap). Combined with the pre-existing signals (Trvoid $30k report, OF delist + operator denial, kycnot warning), the aggregated peer-directory attribution weight crosses the F threshold. Tagline rewritten in all four languages to lead with do-not-deposit warning. Same-day escalation of etz-swap (A → C) applied on the same cluster attribution; PegasusSwap held at B on first-party kyc.rip integration evidence." }, { "date": "2026-09-11", "note": "The original July $30k processing report is still unverified: no deposit tx-hash, no operator refund, Monerica still lists OctoSwap as Scam (listing last updated 2026-07-20), OrangeFren remains delisted, and KYCnot.me's warning is still Ongoing. A new 2026-09-03 order (a439-20cd, claimed 0.2028 BTC) was posted as fu…", "auto": true } ], "severity": "critical" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "ollieswap", "category": "exchanges", "subcategory": "Instant Swaps", "name": "Ollie Swap", "url": "https://xmr.club/exchanges/ollieswap", "twin": "https://xmr.club/llm/exchanges/ollieswap.txt", "tagline": "Anonymous Tor-only swap between BTC, BCH, DASH, LTC, XMR — sole-operator project with published reserves held on its own infrastructure; PGP-signed clearnet entry page at ollie.la.", "review": "**Ollie Swap is a Tor-only instant swap service between BTC, BCH, DASH, LTC, and XMR — no clearnet URL exists, no accounts, no email, no logs.** Listed at **Grade C** as the directory default for a new no-KYC exchange (methodology tenure rule for high-loss-asymmetric categories); a path to B would need several months of clean operation and independent third-party mentions.\n\n**Product.** Five-coin instant swap across a privacy-adjacent bench (Bitcoin, Bitcoin Cash, Dash, Litecoin, Monero). Both **Fixed Rate** (15-minute lock) and **Float Rate** are on offer. Per-coin fees run **3–4%** and are published transparently in the reserve panel. The order flow is single-page: pick a pair, enter your refund address, enter your payout address, submit — no account, no email, no signup wall.\n\n**The Tor-only design.** The actual swap runs only from the onion at `ollieswap3326bz5qksmarnytpiyeceeuq33sb26noc7hd6by6ib4fyd.onion` — no CDN vendor to compel, no clearnet TLS certificate on the swap flow, no DNS trail on the transaction path. The operator does maintain a small clearnet **entry page** at `https://ollie.la/` that announces the service, lists its features, and offers PGP-signed text for identity verification — but the entry page's only two buttons are *Access via Tor* and *PGP signed text*; the swap itself is not reachable from clearnet. That is the strongest privacy posture in the Instant Swaps shelf today. Practical implication for the reader: you can browse `ollie.la` from a normal browser to verify the operator identity, but you need Tor Browser to actually place a swap. Our `/go/ollieswap` handler routes clearnet visitors to the operator's own `ollie.la` entry page and Tor visitors directly to the onion.\n\n**Tenure and volume.** The operator publishes their own founding date and total volume on the homepage under a diary section (started 2026-06-20; 36 swaps totalling roughly $8,113 as of listing). That puts Ollie Swap at approximately one month old at the time of listing, with a small but transparent trade history. This candor about size is a positive signal; many operators in this category obscure their tenure or invent it.\n\n**Reserves and transparency.** Per-coin reserves are published directly on the homepage — at listing time roughly 0.13 BTC, 1,196 XMR, 9.28 BCH, 31.33 DASH, 141.84 LTC (≈ $434K total, XMR-heavy). Publishing reserves at all is unusual for onion swap operators; publishing them XMR-first is a genuine editorial-alignment signal. A warrant canary is published at `/en/canary` on the onion, PGP-signed with the operator's main key — check the timestamp before any large trade.\n\n**PGP identity.** The operator publishes three keys on the onion at `/en/pgp`, mirrored on xmr.club at `/pgp/ollieswap/` for clearnet verification convenience:\n\n- **Main (Ed25519)** — cert + sign + encrypt. Fingerprint `25B8 8F65 E3E0 C441 6BF5 9286 237F 6237 A943 41A7`. Created 2026-06-12 — eight days before the operator's public launch date, i.e. infrastructure was set up before the store opened.\n- **Fallback (RSA 4096)** — long-term backup for tools that do not support Ed25519. Fingerprint `2E2E 2B29 9C2F 07B2 EFB3 3ECA AE90 6939 D615 3492`. Created 2026-06-22.\n- **Server (Ed25519)** — separate identity for the service-facing side, compartmentalised from the main operator identity. Fingerprint `FA58 F699 7280 EE4F EC6B 2218 2E2A 1513 4454 D41C`. Created 2026-06-12.\n\nThree keys with clearly-scoped roles + operator/service compartmentalisation is unusually good key hygiene for a one-month-old solo project — a real editorial-alignment signal.\n\n**Loyalty Code.** Because Ollie Swap intentionally has no registration or authentication, every swap gets its own **UUID identifier** (per the operator's own explanation in `/en/faq?tab=loyalty` on the onion). The user saves that UUID as their swap credential — they can then create additional swaps under the same UUID or continue an in-progress swap by pasting it back into the order form. It is not a discount or referral scheme; it is a repeat-swap identifier for a service that does not want to hold accounts. If you lose the UUID and the browser session, the swap-side history is unreachable — same architectural trade-off as any no-account instant-swap operator.\n\n**Operator surface.** Sole-operator project with a spider-themed Ollie persona (visible in the diary + emoji-forward navigation). Primary reachability is by email via the address the operator provided on the submission form; we do not surface that publicly because the operator has not published it on their own site. Forums are referenced in the page footer but the exact URLs live on the onion — check there before you deposit. The sole-operator posture means the bus factor is one — a real consideration versus a team-run service where multiple hands can respond to incidents.\n\n**What C means here.** Grade C on our rubric reads acceptable-with-reservations — verify the caveats before depositing. Reservations for Ollie Swap: (a) one-month curator-side tenure — this is genuinely new; (b) sole-operator bus-factor of one; (c) small total volume (36 swaps at listing) so the operator has not yet demonstrated behaviour at scale; (d) Tor-only means you must use Tor Browser and cannot access the service on clearnet. None of these are structural flaws — they are just the shape of a young, sole-operator, privacy-forward project. Path to B would require sustained operation over several months, an independent third-party review, and a visible-but-modest volume growth curve without any loss incident.\n\n**Currency and language support.** Fifteen fiat currencies for USD-value display (not fiat trading — Ollie Swap is crypto-crypto only). Twenty-plus UI languages including EN / CS / DE / EL / ES / FR / IT / PL / PT-BR / RO / RU / TR / UK / JA / KO / ZH — unusually broad i18n coverage for a one-person shop.\n\n**Community presence.** The operator maintains three onion-only community channels reachable via Tor Browser: a Dread thread at `dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/d/OllieSwap`, a Tenebris community page at `tenebrispoyfrcup4k24lciwrh4gc5735hmld4dweq7his7zh423opqd.onion/c/ollieswap`, and a Pitch handle at `pitchprash4aqilfr7sbmuwve3pnkpylqwxjbj2q5o4szcfeea6d27yd.onion/@ollieswap`. Read those before any large trade — third-party community discussion is where post-swap complaints and operator responses land.\n\n**Bottom line.** A very young, sole-operator, Tor-only privacy-first swap with a focused five-coin privacy-adjacent bench (BTC/BCH/DASH/LTC/XMR) and transparently-published reserves held on the operator's own infrastructure rather than aggregated from third-party liquidity providers, plus a candid tenure disclosure. Genuinely aligned with the no-KYC Monero directory mission. Grade C reflects the tenure default; the operator's editorial posture is strong.", "translation_locale": "en", "rating": { "grade": "C", "trust": "One month of observable operation from operator-published diary (founded 2026-06-20, 36 swaps / ~$8.1K total at listing). Sole-operator, spider-themed persona. Reserves published per-coin on the homepage (unusual transparency for onion swap ops). PGP canary on file at /pgp. Bus factor is one — real consideration versus team-run services.", "privacy": "Strongest privacy posture in the Instant Swaps shelf: Tor-only, no clearnet URL exists, no DNS trail, no CDN vendor. No account, no email, no logs. Fixed + Float rate paths both available.", "ux": "Single-page order flow: pair selection, refund address, payout address, submit. Twenty-plus UI languages. Fifteen fiat currencies for USD-value display. Emoji-forward operator voice via Ollie persona." }, "grade": "C", "kyc_tags": [ "anonymous_use" ], "feature_tags": [ "non_custodial", "tor_mirror" ], "highlight_tags": [ "NO-KYC", "TOR-ONLY", "OWN-LIQUIDITY", "PRIVACY-COIN-BENCH", "PUBLISHED-RESERVES" ], "fees": null, "fees_summary": null, "last_verified": "2026-07-23", "operating_since": "2026-06", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "tor": "http://ollieswap3326bz5qksmarnytpiyeceeuq33sb26noc7hd6by6ib4fyd.onion/", "outbound_slug": "ollieswap", "logo": "https://xmr.club/peers/ollieswap.png", "web": "https://ollie.la/" }, "also_listed_at": { "monerica": true } }, { "id": "omenswap", "category": "exchanges", "subcategory": "Instant Swaps", "name": "OmenSwap", "url": "https://xmr.club/exchanges/omenswap", "twin": "https://xmr.club/llm/exchanges/omenswap.txt", "tagline": "No-signup instant swap with an unusual four-surface access model — web app, SSH terminal, MCP server, HTTP API. Fees 0.5% float / 1% fixed. Refund flow is documented and generous.", "review": "**No-signup instant swap with an unusual four-surface access model** — you can hit Omenswap through a normal web app, an SSH terminal, an MCP server (for LLM agents), or an HTTP API. Grade C on the tenure rule: the ToS is clean and structured, the pricing is transparent, but the domain and brand have thin independent history — a fresh instant-swap earns a Grade C shelf position until history accumulates.\n\n**What it is.** Instant crypto-to-crypto swap engine, no account required. Pick a pair, enter your receive address, send to the one-time deposit address, receive on confirmation. Supports floating-rate and fixed-rate swaps. The site's terminal-first aesthetic (ASCII-art homepage banner, `TERMINAL`/`DOCS`/`NO-JS`/`ONION` footer links) matches the four-surface access model — the operator is clearly targeting the users who reach for `ssh omenswap.com` before opening a browser.\n\n**Access surfaces.** Four ways in, per the ToS: **web app** (the standard UI at omenswap.com), **SSH terminal** (typed swap flow over SSH), **MCP server** (Model Context Protocol endpoint for LLM-driven swaps), **HTTP API** (programmatic access). The MCP surface in particular is novel — no other listed swap engine ships a first-class MCP interface — and if you route swaps through an LLM agent, it's the shape you want. The `NO-JS` footer link implies a graceful-degradation path for locked-down browsers.\n\n**KYC posture.** *(ToS clause 07)* *\"Omenswap will never ask for your personal information or documentation.\"* Confirmed on the visible signup / swap flow: no account, no email, no identity fields — just a receive address and (optionally) a refund address.\n\n**AML posture.** *(ToS clause 06)* Omenswap runs OFAC / sanctioned-entity screening on incoming deposits above a threshold. If your deposit trips the screen, the swap will not execute and a refund is initiated. Same category posture as most compliant instant swaps — clean funds pass through, mixed-history funds may get bounced back. Manual refund verification (needed when you didn't set a refund address) requires cryptographic proof-of-key across both wallets in the swap and carries a 1% fee.\n\n**Refund flow.** Structured, and more generous than most: *(clause 08)* *\"Refunds will be provided in any case in which omenswap is unable to exchange your funds in a reasonable time window.\"* Providing a refund address in the pre-swap form makes refunds free and automatic; without one, the manual sign-proof process kicks in.\n\n**Why this grade. ** Grade C reflects the default for a new listing for this category combined with an otherwise-clean surface — clear ToS, transparent fees, novel access model, no scam-flag or peer-directory concerns to work against. What would move it higher: 12+ months of clean operation, a peer-directory pickup (kycnot / monerica currently do not list), and a user-report track record from the terminal/API/MCP crowd.\n\n**Useful when.** You want a swap without touching a browser (SSH surface). You're driving swaps from a script or an agent (API / MCP). You want a minimalist swap engine that spends its complexity budget on transport, not marketing.\n\n**Caveats.** New brand — no independent user-report history yet; treat first swaps as small and disposable until you've validated the flow yourself. The four-surface access model is unusual and worth its own trust-verification pass (does the MCP endpoint honor the same rate quote as the web UI? Does the SSH flow match the HTTP API's fee schedule? Verify before scaling deposit sizes). The `NO-JS` and `ONION` links in the footer are advertised — verify each renders before relying on the promise. No published reserve or third-party audit; you are trusting the operator's short-tenure track record and the clarity of the ToS.", "translation_locale": "en", "rating": { "grade": "C" }, "grade": "C", "kyc_tags": [ "anonymous_signup", "no_kyc" ], "feature_tags": [ "escrow", "instant", "tor_mirror", "refunds" ], "highlight_tags": [ "NO-KYC", "NO-ACCOUNT", "INSTANT-SWAP", "TOR" ], "fees": { "summary": "0.5% on float-rate swaps, 1% on fixed-rate swaps. Network fees for the payout transaction are deducted from the receive amount; for non-native-token payouts, the settlement chain's gas is priced in the receive asset and deducted from output. No account, no deposit, no lockup." }, "fees_summary": "0.5% on float-rate swaps, 1% on fixed-rate swaps. Network fees for the payout transaction are deducted from the receive amount; for non-native-token payouts, the settlement chain's gas is priced in the receive asset and deducted from output. No account, no deposit, no lockup.", "last_verified": "2026-08-11", "operating_since": "2026-05", "tenure_note": "Domain registered 2026-05-23; earliest earliest web-archive snapshot: 2026-07-27. `operating_since` set to the earliest signal.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://omenswap.com/", "terms": "https://omenswap.com/terms", "outbound_slug": "omenswap" } }, { "id": "onionswap", "category": "exchanges", "subcategory": "Instant Swaps", "name": "OnionSwap", "url": "https://xmr.club/exchanges/onionswap", "twin": "https://xmr.club/llm/exchanges/onionswap.txt", "tagline": "Swap-only, no-account instant crypto exchange on its own reserves — 8 assets across BTC / XMR / ETH / LTC / DASH + ERC-20 stables. Flat 0.4% service fee. No API, no referral program, no service desk beyond a per-order ticket form. Deliberately minimal, does exactly one thing. Fresh (© 2026) — grade caps at C on tenure.", "review": "**Swap-only, deliberately minimal.** OnionSwap does one thing: no-account swaps between BTC / XMR / ETH / LTC / DASH and the ERC-20 stablecoins USDT / USDC / DAI, filled from the operator's own reserves. There is no API, no referral program, no partner integrations, and no service desk beyond a per-order ticket form. No signup, no email, no password. The order ID is the only handle to the swap — save it, because there is no account recovery and no address-based lookup on the operator's side.\n\n**No third party in the KYC pipeline.** The Terms of Service commit to it in plain language: *\"We do not collect, request or verify identity documents, and we do not place holds on payouts for review. Since no partner exchange stands between you and your coins, there is no third party in a position to impose either.\"* The FAQ and Support pages repeat the same commitment, and the Support page adds the operationally important addendum that no one asking for your documents in OnionSwap's name is actually them.\n\n**Fees + rates.** Flat **0.4% service fee** baked into the quote you see before funding, plus the outgoing chain's network fee. Rate model is floating — quote-to-confirmation drift is on the order, per ToS. Minimum swap is small (network-fee floor), maximum follows the reserve of the asset you're receiving.\n\n**Reserves are live and observable.** The home page publishes the current per-asset reserve balances with a \"updated N minutes ago\" timestamp, and phrases the design bluntly: *\"Because the liquidity is ours, no exchange partner sits between you and your payout — we never ask for KYC and we never freeze coins.\"* Reserves are genuinely modest — BTC in the low single-digits and XMR in the low hundreds at time of this review — so large orders will trip the per-asset ceiling; check the widget before committing volume.\n\n**What you trust.** OnionSwap holds funds during the swap window while the deposit confirms and the payout is dispatched — brief custodial window, standard shape for instant-swap operators. No account exists, so no account can be seized; but the operator does control the order records, deposit addresses, and the reserve wallet. Tickets are tied to the order ID and are deleted alongside the order record.\n\n**Peer signal.** [Monerica](https://monerica.com/site/onionswap) lists OnionSwap under its no-KYC instant-swap section. Not yet indexed by kycnot.me, xmrlist, or OrangeFren at time of this review — expected for a service this fresh, but worth tracking as an accumulation signal over the next 60–90 days.\n\n**Reader advice.** For routine no-account swaps between the eight supported assets at modest volume, OnionSwap does what it says on the tin — 0.4% fee is competitive, own-reserve settlement removes the shotgun-KYC-via-liquidity-partner risk that plagues aggregator engines like [Baltex](/exchanges/baltex) or [Swapgate](/exchanges/swapgate), and the ToS commitments are unusually direct. For large orders (five-figure USD and up), check the per-asset reserve live before funding — the modest visible reserve pool means big orders may not fill or may split awkwardly. If your amount is large enough that operator-custody-window risk matters, route via an atomic-swap engine ([Haveno](/exchanges/haveno)) or a self-custody P2P engine ([Bisq](/exchanges/bisq), [RoboSats](/exchanges/robosats)) where nobody holds funds during the process.\n\n**Grade rationale.** Grade C is the shelf default for a fresh instant-swap operator regardless of how clean the surface reads. The deliberate minimalism (no API, no referral, no service-desk apparatus) is a positive signal about editorial focus but does not by itself lift the grade — tenure remains the anchor. Re-review is natural in 60–90 days once a track record accumulates — peer-dir footprint expansion beyond Monerica, first-party user reports, and reserve-pool growth are the signals to watch.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [], "feature_tags": [ "swap_only", "own_reserves", "no_partner_liquidity", "no_account", "no_api", "no_referral", "single_use_deposit_addresses", "order_id_only_tracking" ], "highlight_tags": [ "NO-KYC", "OWN-RESERVES", "MANY-COINS" ], "fees": { "summary": "Flat 0.4% service fee · plus outgoing chain network fee · quote includes both" }, "fees_summary": "Flat 0.4% service fee · plus outgoing chain network fee · quote includes both", "last_verified": "2026-08-10", "operating_since": "2026-05", "tenure_note": "Independently verified: earliest Wayback snapshot: 2026-05-06. `operating_since` set to the earliest signal.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://onionswap.io", "outbound_slug": "onionswap", "contact_email": null, "twitter": null, "telegram": null }, "also_listed_at": { "monerica": true } }, { "id": "openmonero", "category": "exchanges", "subcategory": "P2P", "name": "OpenMonero", "url": "https://xmr.club/exchanges/openmonero", "twin": "https://xmr.club/llm/exchanges/openmonero.txt", "tagline": "Agoradesk fork — P2P marketplace for buying/selling XMR. Repeat-exploit history: 2025-06 (90 XMR), 2026-06 (200 XMR), 2026-07 (API takeover + 399 XMR drain). Operator frames each event as a fresh zero-day. Grade F. Do not deposit.", "review": "**Agoradesk fork** with self-custodial trade settlements for sellers and several privacy upgrades over the original (session notifications, self-destructable chat history, etc.). P2P marketplace pattern: buyers and sellers post offers, on-site chat handles negotiation, payment + delivery is arranged peer-to-peer. Funded payment methods include PayPal, credit/debit, bank transfer, gift cards, cash by mail, BTC, Venmo, etc.\n\n**Mirrors:** clearnet at openmonero.com, Tor onion (`fgssv2btn4…njev6sjbyd.onion`), I2P (`sex2vkgaei…ual5guyq.b32.i2p`). Reach matters for users in restricted networks.\n\n**Anonymous signup.** No KYC, no government ID. Account creation is username + password. Per-seller reputation accrues across trades and is the trust mechanism.\n\n**May 2026 incident (acknowledged).** Reported by OrangeFren on 2026-05-21: \"OpenMonero hit by another exploit only a day after RetoSwap users lost nearly $3M to an exploit on their platform. Losses for OpenMonero users unknown.\" OpenMonero replied: \"This is now fixed, everything is back to normal, all victims will be refunded by next week.\" A KYCnot writeup independently cites ~40 XMR but the operator hasn't published a confirmed loss figure. Curator-side verification of refund completion is pending. The directory takes this kind of incident seriously — non-custodial design is a buffer, but exploits against the platform itself still surface real risk; the response (acknowledgement + refund commitment) is what moves the grade.\n\n**Grade B (post-incident).** Held at B rather than A because of the open refund cycle + 18 user ratings averaging 3.2/5 on KYCnot (some operational friction reported). The Agoradesk lineage + Tor + I2P + self-custody design + transparent incident response keep it a serious option for P2P XMR trading. Pairs with XMRBazaar — both are non-custodial, both are XMR-native, both are part of foundational Monero peer-to-peer infrastructure.\n\n**Useful when:**\n- You want to buy XMR with cash / fiat / unusual payment rails (PayPal, gift cards, Venmo)\n- You want a Tor- or I2P-reachable trading surface\n- You're willing to do small-first-trade vendor validation before scaling up\n\n**Caveats:**\n- Recent platform-level exploit (May 2026). Operator response is the right shape; full refund completion not yet verified by curator.\n- 18 user ratings on KYCnot average 3.2/5 — meaningful operational friction\n- P2P self-defense applies: small first trade, verify seller reputation + comms quality, escalate via on-site dispute channel if needed", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "F" }, "grade": "F", "kyc_tags": [ "no_kyc", "anonymous_signup" ], "feature_tags": [ "xmr_native", "non_custodial", "tor_mirror", "i2p_mirror", "p2p", "no_account" ], "highlight_tags": [ "XMR-NATIVE", "P2P", "TOR+I2P", "MAY-2026-INCIDENT", "NON-CUSTODIAL" ], "fees": { "summary": "Platform fee structure inherited from Agoradesk fork — per-trade fee on buyer side (small). Sellers list freely. Optional listing-promotion not aggressive." }, "fees_summary": "Platform fee structure inherited from Agoradesk fork — per-trade fee on buyer side (small). Sellers list freely. Optional listing-promotion not aggressive.", "last_verified": "2026-07-30", "operating_since": "2024", "tenure_note": "WHOIS 2024 predates archive.org first snapshot 2018; treated as current-entity year (domain may have been re-registered)", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://openmonero.com", "tor": "http://hj63yzwjqumozyt34dohknaadyp7p5ilcb32d67al2jpc2b3vs2b6uad.onion", "i2p": "http://sex2vkgaeigmgk5dou4pw4uegokxnc3k3vksotlmyldmual5guyq.b32.i2p", "outbound_slug": "openmonero" }, "incident": { "date": "2026-06-08", "severity": "critical", "summary": "Server compromise on 2026-06-08: an attacker gained root access (local privilege escalation) to OpenMonero's main server and stole ~200 XMR. The operator stated all funds are gone. This is a repeat event — \"hacked again\" — not a first-time breach.", "curator_advice": "Do not deposit new funds or hold balance on OpenMonero until a public post-mortem AND independent audit AND a sustained no-incident window are on record. Withdraw anything still accessible. Note (2026-06-28): the operator published a recovery post announcing 90 XMR refunded on 2026-06-24 to affected users — a partial recovery against the ~200 XMR loss reported by OrangeFren, not a full make-whole. The service is back online with hardened infrastructure (server rotation, new onion, wallet isolation, hidden backend IP), but the repeat-compromise pattern is the reason for the D grade — one refund does not reset that track record.", "source_url": "https://x.com/orangefren/status/2064714742296441178", "timeline": [ { "date": "2026-05-21", "note": "Prior exploit (~40 XMR); operator later claimed all affected users were fully refunded." }, { "date": "2026-06-08", "note": "Operator posted an \"OpenMonero is Back\" announcement following the May incident." }, { "date": "2026-06-10", "note": "OrangeFren publicly reported \"hacked again, 200 XMR stolen\" (citing an OpenMonero Telegram screenshot). Downgraded to D." }, { "date": "2026-06-11", "note": "Operator has not confirmed the 06-08 incident. Some claim a negative-trade-amount input bug, others call it a rug — unverified. Treat funds as at-risk pending a verifiable post-mortem." }, { "date": "2026-06-25", "note": "Within the last 7 days, OpenMonero's operator issued a post-breach remediation notice (tracked by kycnot.me ~10h before this scan, source: openmonero.com): all user 2FA tokens were reset, users were told to change passwords and settlement wallet addresses, April 12-May 22 registrants were asked to file support ticke…", "auto": true }, { "date": "2026-06-28", "note": "Operator recovery post: \"OpenMonero is back after 2 weeks of downtime.\" Security posture rebuilt — servers switched, new onion address generated, env vars and backup codes reset, full wallet isolation from the frontend, backend IP hidden. 90 XMR were refunded to affected users on 2026-06-24 (partial recovery vs. the ~200 XMR reported stolen by OrangeFren; not the full loss). No independent audit disclosed." }, { "date": "2026-07-07", "note": "Curator re-verified: clearnet homepage carries an alert banner directing users registered Apr 12 – May 22 to open a support ticket, passwords in that window to be reset, OTP codes reset platform-wide (users must reactivate 2FA), and the new onion pinned. xmr.club rotated the tor field to the new onion address. Grade held at D — the 2026-06-28 recovery post reports 90 XMR refunded of a claimed ~200 XMR loss (partial, not full), and no public post-mortem or independent audit has been published. This is a resumption of service, not a rehabilitation of the trust track." }, { "date": "2026-07-24", "note": "New outage window. Operator posted an \"API server under attack\" banner on the website for ~17h then removed it with no follow-up statement. xmr.club chatbox users (registered handles 610fd67f, cd55da94) report they cannot withdraw from active trades and question whether this is turning into an exit scam. Operator X account (@OpenMonero) has posted nothing since 2026-06-08. No independent DDoS confirmation. Withdrawal status unverified. Grade reverted from the 2026-07-07 D → C lift back to D pending withdrawal-restoration confirmation from our own reader channel." }, { "date": "2026-07-25", "note": "24h re-check on 2026-07-24 outage escalated to full compromise incident. kycnot.me published a critical advisory (2026-07-24) based on a Monero Matrix Channel disclosure: \"By executing a single GET request, an attacker could gain full access to the oldest existing user account on OpenMonero. This broken endpoint allowed taking over all other accounts on a sequential basis—from oldest to newest. The user claims OpenMonero admins have chosen to remain silent on the issue and are actively ignoring a similar unpatched vulnerability, leading to user accounts getting drained and their full trading history getting leaked. Other sensitive data such as shipping addresses and private chat logs is also believed to have been compromised.\" (source: https://kycnot.me/service/openmonero, cite: xcancel.com/monerobull/status/2080627692773282014). Operator X account (@OpenMonero) still silent since 2026-06-08 — no acknowledgement of the API vulnerability, no post-mortem, no user notification. Chat context on xmr.club chatbox (handles 610fd67f, cd55da94) reporting frozen trades from 2026-07-23/24 is now recontextualised as consistent with the API-endpoint compromise. Grade escalated D → F. Tagline updated. Recommendation now unambiguous: do not deposit; withdraw anything still accessible; treat trading history / shipping-address / chat-log data as exfiltrated. Prior lift path (post-mortem + independent audit + no-incident window) is now blocked by the data-leak class — even a full post-mortem cannot un-leak exfiltrated data. No further wake scheduled — grade is stable at F pending an operator response that would meaningfully change the picture." }, { "date": "2026-07-30", "note": "THIRD documented exploit. OpenMonero posted an update (surfaced 2026-07-30 via OrangeFren + Dark Web Informer on X) claiming another **399 XMR drain** (~$60k+ at current prices) attributed to \"a zero-day vulnerability that had been hiding since the start of the project.\" OrangeFren's public reaction: \"I lost track how many times they claimed to have been exploited at this point.\" Combined pattern now on record: (a) 2025-06 first drain (~90 XMR, later claimed fully refunded); (b) 2026-06 second drain (~200 XMR reported, only ~90 XMR refunded per operator recovery post); (c) 2026-07 API-endpoint sequential-account-takeover exploit reported by kycnot 2026-07-24; (d) 2026-07-30 third drain of 399 XMR now announced. Grade held at F (no lower tier). No wake reschedule — the incident record now speaks for itself. Reader takeaway: repeated-exploit pattern with each event framed as a fresh \"zero-day\" makes competence claims unfalsifiable; the operational security track record is broken. Community sentiment reflected in our own X: \"Just forget about them already.\"" } ] }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "ostbro", "category": "exchanges", "subcategory": "Instant Swaps", "name": "ostbro", "url": "https://xmr.club/exchanges/ostbro", "twin": "https://xmr.club/llm/exchanges/ostbro.txt", "tagline": "No-account, no-KYC swap into Monero — order-key only (no email/password), multi-coin in, with a privacy-conscious design: fees folded into the rate and a payout 'Separation' step that splits amounts to resist amount-matching. Grade C is a tenure floor — brand-new (~6 weeks), not a knock on the build.", "review": "**No-account swap into Monero with an unusually privacy-conscious design.** ostbro swaps a broad set of assets (BTC, ETH, USDT, USDC, SOL, TRX, LTC, BCH, DASH, XRP) into XMR with **no account, no email, no password** — a single order key is the only credential. Two design touches stand out: fees are **folded into the rate** rather than charged on top (\"privacy is inside the rate, not sold on top of it\"), and a **\"Separation\" step** lets you split the payout into amounts that resist the amount-matching heuristics chain-analysis uses to correlate a swap. That's a thoughtful, genuinely privacy-minded build, and the site doesn't pad itself with fake volume or testimonials.\n\n**Why C — it's about age, not the build.** The domain is only **~6 weeks old** (registered 2026-08-06), it has **no track record**, isn't listed on any peer directory yet, and we haven't run a curator test-swap. As an instant swap it takes custody of your funds during the trade (so it's not tagged non-custodial), and exchange-class services carry high loss-asymmetry — you deposit, then wait on delivery — which makes tenure a hard input to the grade. **This C is a tenure floor, not a criticism** — the design reads as careful and honest. Verify independently and keep amounts modest until it earns tenure; it climbs to B on a clean track record + peer-directory depth.", "translation_locale": "en", "rating": { "grade": "C", "trust": "Brand-new (~6 weeks, domain reg 2026-08-06), no track record, on no peer directory yet, not curator test-swapped. Exchange-class loss-asymmetry makes tenure a hard grade input, so C is a tenure floor. Positives: careful privacy-minded design, no fabricated volume/testimonials. Climbs to B on clean accrued tenure + peer-dir depth.", "privacy": "No account, no email, no password — a single order key is the only credential. Fees folded into the rate (no separate fee line). Payout 'Separation' step splits amounts to resist amount-matching deanonymization. Instant swap, so funds are custodial during the trade (not tagged non-custodial).", "ux": "Swaps BTC/ETH/USDT/USDC/SOL/TRX/LTC/BCH/DASH/XRP into XMR. Order-key flow, no registration. Clear step-by-step guide. Rate-inclusive pricing. Brand-new; delivery not yet curator-verified end-to-end." }, "grade": "C", "kyc_tags": [ "NO-KYC" ], "feature_tags": [ "xmr", "no_kyc", "instant" ], "highlight_tags": [ "XMR", "NO-KYC", "NO-ACCOUNT" ], "fees": null, "fees_summary": null, "last_verified": "2026-09-15", "operating_since": "2026-08", "tenure_note": "Domain registered 2026-08-06 (~6 weeks). Brand-new exchange-class service, no track record, no peer-dir presence yet — Grade C is a TENURE FLOOR, not a product knock (tenure caps the grade, never blocks the listing). Privacy-minded design is a genuine positive; climbs to B on clean accrued tenure + peer-dir depth + a verified test-swap.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://ostbro.com", "outbound_slug": "ostbro" }, "also_listed_at": {} }, { "id": "pegasusswap", "category": "exchanges", "subcategory": "Instant Swaps", "name": "PegasusSwap", "url": "https://xmr.club/exchanges/pegasusswap", "twin": "https://xmr.club/llm/exchanges/pegasusswap.txt", "tagline": "Anonymous instant swap with broad coin coverage. Multi-month clean integration with kyc.rip as an engine. Note (2026-07-29): OrangeFren.com publicly grouped PegasusSwap in an operator-cluster with OctoSwap (scam-flagged); grade held on the strength of first-party integration evidence, but worth watching.", "review": "No-account swap service. Floating + fixed rate quotes, retail-volume no-KYC. Smaller liquidity than the top tier so spreads can vary on big trades.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "NO-KYC" ], "fees": { "summary": "~0.5-1% spread · floating + fixed" }, "fees_summary": "~0.5-1% spread · floating + fixed", "last_verified": "2026-07-29", "operating_since": "2021", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://pegasusswap.com", "outbound_slug": "pegasusswap", "affiliate": "https://pegasusswap.com/?ref=3A7Y5T1" }, "incident": { "title": "Wrong-memo RUNE deposit — recovery process required a second deposit + dual-tx screenshots + 4-5 week wait, curator flagged as fund-freeze-shaped; operator agreed to full compensation and pair-list disable after pushback", "summary": "A xmr.club user made a RUNE (THORChain-native, memo-required) deposit to PegasusSwap with an incorrect memo. The operator's default recovery process — before curator intervention — required the user to (a) send a second RUNE deposit from the same address with the correct memo, (b) provide payment-proof screenshots of both transactions displayed on the same page, (c) accept a 4-5 week processing window, and (d) pay a processing fee \"for certain types of uncredited deposits.\" The user rejected the process; kyc.rip compensated half the loss to signal editorial position. On curator pushback (\"put yourself in the user's position; this reads as disguised fund-taking\"), the operator agreed to fully compensate this specific swap AND offered to publish a list of pairs where this failure mode is possible so kyc.rip can disable them at its routing layer. Grade held at B pending delivery of the pair list and evidence the process is patched rather than one-off-resolved. Follow-up window: 14 days.", "status": "resolved", "timeline": [ { "date": "2026-07-14", "stage": "incident_open", "note": "Filed after user report of wrong-memo RUNE deposit and operator's recovery-process response. Operator's stated process required a second matched-amount deposit + dual-transaction screenshots + 4-5 week window + 'processing fees for certain types.' Curator read: this is the frustrate-to-abandonment pattern common to shame-list-shaped operators; while a wrong-memo deposit is genuinely the user's mistake, the recovery process should be a manual reconciliation against on-chain proof, not a customer-borne re-deposit-and-photograph exercise." }, { "date": "2026-07-14", "stage": "curator_intervention", "note": "kyc.rip compensated the user for half of the loss from the swap-platform budget as an attitude signal — not a settled remedy, just marking that the process response was not acceptable. Curator (on behalf of xmr.club editorial) reached out to the operator with the framing: 'put yourself in the user's position; this reads as disguised fund-taking.' Requested a list of pair/memo-required chains where this failure mode can arise, so kyc.rip can disable those pairs at its routing layer for future customers." }, { "date": "2026-07-14", "stage": "operator_response", "note": "Operator responded that if the recovery-process framing is unacceptable, they will fully compensate the swap in question. Additionally offered to share the list of pairs where the wrong-memo failure mode is possible so kyc.rip can disable them at its routing layer proactively. Positive-response signal — the operator recognized the pattern and offered a systemic fix rather than a one-off apology. Follow-up: confirm full compensation lands + receive the pair list within 14 days. If both, incident closes with grade held at B and a routing-layer pair filter live on kyc.rip's side. If either doesn't land, grade re-evaluation goes on the docket." }, { "date": "2026-07-21", "stage": "operator_delivered", "note": "Operator delivered on the systemic-fix commitment from the 2026-07-14 incident open. Per user report, PegasusSwap has filtered out all pairs where the wrong-memo recovery-process failure mode can occur (memo-required chains like RUNE, XLM, EOS, XRP, ATOM, ALGO — anything where a missing memo means the deposit can't be automatically credited). That was exactly the systemic ask on the original curator pushback. Incident marked resolved. Grade held at B. No routing-layer pair filter on kyc.rip side needed — the operator handled it upstream." } ] }, "also_listed_at": { "orangefren": true, "kycnot": true, "monerica": true } }, { "id": "priamex", "category": "exchanges", "subcategory": "Instant Swaps", "name": "Priamex", "url": "https://xmr.club/exchanges/priamex", "twin": "https://xmr.club/llm/exchanges/priamex.txt", "tagline": "Own-liquidity instant swap with pre-deposit AML score check on request — support runs the check for you first, deposit only if you get a pass. BTC / XMR / Lightning. Tor mirror advertised.", "review": "**Mixed-liquidity instant swap between BTC, XMR, Lightning, and other majors**, with an unusually operator-friendly AML posture: you can ask support to **pre-check** an AML score on the funds you are about to send *before* you deposit — pass the check, deposit with a guarantee that funds will not be blocked. Grade C is the default for a new instant-swap; AML-pre-check flow and the strong independent peer signal are the distinguishers covered below.\n\n**What it is.** No-account instant-swap engine. Web UI at `priamex.com/en` with a Tor mirror advertised on the home page. No signup, no email, no ID on the swap flow. The tagline copy — *\"secure crypto exchange with zero traces, fast & private swaps, no logs, no limits\"* — is standard for the category; the substantive detail lives on the peer-directory listing below.\n\n**AML posture — worth naming.** Priamex publishes an *AML-pre-check* option per the kycnot.me listing: contact support before deposit, get an AML score check on the source funds, receive a guarantee that funds will not be blocked if the check passes. When funds *are* flagged by AML on deposit, the refund is issued **without** demanding KYC. This is a materially better AML story than the category default of *\"funds may be frozen pending KYC review\"* — it puts the risk decision in the reader's hands *before* the deposit.\n\n**Mixed liquidity.** Priamex runs *mixed* liquidity — a blend of its own book and partner/aggregated liquidity, not pure own-liquidity. The AML pre-check still applies to its own book, but some routes touch partner liquidity, so the \"no third party can independently block your funds\" property does not hold uniformly across every pair — fewer intermediaries than a pure aggregator, more than a pure own-book swap.\n\n**Independent signal.** Kycnot.me carries an unlisted community-contributed page with a **9/10 overall score, 100/100 privacy, 82/100 trust, KYC level 1/4** — the the top bucket for a new listing that has not yet been team-reviewed. **Four user ratings averaging 5/5** on that page. Monerica.com also lists the service. Two-directory + user-review presence for a service under a year old is a strong external signal.\n\n**Tenure.** Domain registered 2026-02-19; ~6 months of operation.\n\n**Contact channels.** Email `support@priamex.com`, Telegram `t.me/Priamex_support`.\n\n**Useful when.** You have inbound funds with an unknown or complex on-chain history and would rather **know before deposit** whether they will pass AML than find out mid-swap. You want to swap XMR ↔ Lightning without an account. You want an instant-swap engine that surfaces its AML posture openly rather than burying it in a terms-page footnote.\n\n**Caveats.** **Clearnet legal-page surface is thin** — `/about`, `/terms`, `/faq` all return 404. The AML flow, refund flow, and fee schedule live on the peer-directory listing and support-channel description; the operator has not yet stood up a full clearnet legal-page set. This is our biggest reservation for a Grade C swap. **Fresh tenure** (6 months as of listing) — no user-report history at scale yet. **Fee schedule** is not published on a standalone page; the rate is shown on the swap form before commit. **Rate the AML-pre-check flow yourself before scaling**: contact support, ask for a check, screenshot the response; the workflow only works if support actually runs the check in a reasonable window.", "translation_locale": "en", "rating": { "grade": "C" }, "grade": "C", "kyc_tags": [ "anonymous_signup", "no_kyc" ], "feature_tags": [ "mixed_liquidity", "instant", "tor_mirror", "lightning", "aml_pre_check" ], "highlight_tags": [ "NO-KYC", "NO-ACCOUNT", "OWN-LIQUIDITY", "TOR", "LIGHTNING", "AML-PRE-CHECK" ], "fees": { "summary": "Operator-disclosed flat ~1% fee (of which ~0.5% is the partner/referral share). The rate is shown on the swap form before you commit. Confirmations required: 3 for BTC deposits, 10–12 for XMR. Verify against a small test swap before scaling." }, "fees_summary": "Operator-disclosed flat ~1% fee (of which ~0.5% is the partner/referral share). The rate is shown on the swap form before you commit. Confirmations required: 3 for BTC deposits, 10–12 for XMR. Verify against a small test swap before scaling.", "last_verified": "2026-08-24", "operating_since": "2026-02", "tenure_note": "Domain registered 2026-02-19; ~6 months of operation.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://priamex.com/en", "tor": "http://zhlcuqkj2sn3nma2xrmkci3amilhhzjlb4zz6kmizdjw5xlzkdassgad.onion/", "telegram": "https://t.me/Priamex_support", "email": "mailto:support@priamex.com", "outbound_slug": "priamex", "affiliate": "https://priamex.com/?referral_code=zz4HhALk" }, "also_listed_at": { "kycnot": { "url": "https://kycnot.me/service/priamex", "score_overall": 9, "score_privacy": 100, "score_trust": 82, "kyc_level": 1 }, "monerica": { "url": "https://monerica.com/site/priamex" } } }, { "id": "privataswap", "category": "exchanges", "subcategory": "Aggregators", "name": "PrivataSwap", "url": "https://xmr.club/exchanges/privataswap", "twin": "https://xmr.club/llm/exchanges/privataswap.txt", "tagline": "Multi-provider non-custodial swap aggregator — 41 engines, 10k+ assets, XMR Privacy-Hop + DeFi mode, no account, Tor-friendly.", "review": "**Non-custodial swap meta-aggregator that fans out to 41 underlying engines** (Exolix, FixedFloat, SideShift, Trocador, ChangeNOW, SimpleSwap, StealthEx, ChangeHero, Godex, MajesticBank, and ~30 others per their public `/api/v1/providers`). Operator-published positioning: \"Private swaps across 50+ providers, 10,000+ assets. Exclusive XMR Privacy-Hop and DeFi mode for the most private routes. Tor-friendly.\" Same product shape as OrangeFren, CypherGoat, or kyc.rip — pick-the-best-rate aggregator with a privacy-routing layer on top. Listed at **Grade B** on first submission (per playbook: new aggregator, no curator test trade on file yet, sparse operator-published auxiliary documentation). Upgrade to A is possible after we run end-to-end signup-deposit-settlement testing + a few real swaps land cleanly.\n\n**What it is.** Vite/React SPA at `privataswap.com`. The home page is a swap form (from-coin / amount / to-coin → quote across engines → pick + execute). The wallet that holds funds is yours; PrivataSwap routes the order to the chosen engine but never custodies the swap leg itself. Engine list is public at their `/api/v1/providers` JSON endpoint and includes coverage tags per engine: `kycLevel` (`none` / `minimal` / `soft_triggered`), `logPolicy`, `refundPolicy`, `jurisdiction`. Operator-supplied features: **XMR Privacy-Hop** (an XMR-routed detour for non-XMR pairs) and a **DeFi mode** for on-chain DEX routes. Tor-friendly per operator claim; no operator-side `onion` mirror was discoverable at submission time.\n\n**What you trust.**\n\n- **Non-custodial swap aggregator.** Funds flow user → chosen-engine → user. PrivataSwap doesn't hold balances between legs.\n- **41 underlying engines, transparently enumerated.** The public `/api/v1/providers` JSON makes it straightforward to verify which engines they route to — useful sanity check before trusting an unfamiliar aggregator.\n- **No account required.** Submit the swap form, get the deposit address, send. No signup / email / KYC at the aggregator layer (engines vary — see kyc.rip's per-engine grade for the underlying providers).\n- **Tor-friendly clearnet site.** No operator-published `.onion` mirror at submission time. Site loads behind Tor; absence of a dedicated onion is a transparency caveat, not a blocker.\n- **Operator contact: `support@privataswap.com`** (submission contact). No publicly-disclosed team, jurisdiction, or legal entity.\n\n**Operational specs.**\n\n- **Site.** Vite SPA — every route serves the same 1.5KB shell; content rendered client-side. No-JS rendering not supported in the current build.\n- **Engine breadth.** 41 engines listed in `/api/v1/providers` (similar to kyc.rip's ~17 + OrangeFren's comparable count). Coverage skews heavily to instant-swap fixed-rate providers; one or two DEX/DeFi routes per operator claim.\n- **Privacy-hop mode.** XMR-routed detour for arbitrary input/output pairs. Mirrors kyc.rip's \"ghost\" mode in concept; we have not yet run a test swap to compare execution / spread.\n- **No published Tor onion.** Curator caveat — see /guides/verify-onion-mirror.\n- **No published privacy / terms / AML page** at submission time (every legal slug returns the SPA shell, no operator-written content).\n- **API.** `/api/v1/providers` is open, well-shaped, and probably aggregator-friendly for downstream integrators. Worth probing for a `/quote` and `/order` shape too — submission body doesn't disclose pricing logic.\n\n**Operator philosophy.** Per submission: privacy-first multi-provider aggregation with XMR as the canonical privacy detour. Differentiator vs CypherGoat / OrangeFren is the explicit \"Privacy-Hop\" + DeFi-mode framing. We will check against the operator's own published documentation once it exists; for now the operator-supplied tagline is the canonical source.\n\n**Grade rationale.** **Grade B** because: (1) **operator surface is sparse** — no published /privacy, /terms, /aml, /about page; (2) **no curator test trade on file yet**; (3) **no published Tor onion**; (4) **no public team / jurisdiction / legal entity disclosure**. The aggregator design itself is sound, the engine list is publicly verifiable, and the non-custodial routing is the right shape. Re-grading to A is conditional on (a) successful end-to-end test trade, (b) published privacy policy and contact, (c) operator-published Tor onion mirror.\n\n**Useful when:**\n\n- You want to **compare quotes across 40+ swap engines** without trusting a single aggregator's pick.\n- You **prefer XMR-as-detour routing** for swaps between non-XMR pairs.\n- You're already comfortable with the underlying engines (most are graded individually on kyc.rip and xmr.club) and just want a quote-comparison surface.\n- You're researching the **swap-aggregator ecosystem** and want a current snapshot of who's routing where.\n\n**Caveats:**\n\n- **No operator-published legal pages.** /privacy, /terms, /aml all return the SPA shell. Don't assume any AML / refund posture beyond what each underlying engine specifies in `/api/v1/providers`.\n- **Operator-published Tor onion** at `http://privatakikifswd33w5qe4olxabx2kqznei46oqm2w2rmwjtt2mwfqad.onion/` (added 2026-05-27 after operator confirmation). Satisfies the onion-disclosure standard from /guides/verify-onion-mirror.\n- **No published team / jurisdiction / commercial entity.** Trust the aggregator implicitly only after you've verified a few test orders flow as quoted.\n- **No JS = no usage.** Vite SPA with no SSR fallback.\n- **Pricing / spread / commission undisclosed.** Per-engine pricing comes from the underlying provider; PrivataSwap's own markup on top is not disclosed in operator material we could fetch. Cross-check the engine's direct quote vs PrivataSwap's quote to see the spread the aggregator is adding.\n- **Curator review pending end-to-end test.** Listing is first-pass admin-promote; full enrichment + i18n will follow in the Phase 2 enrichment campaign.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available", "no_js_supported", "non_custodial", "tor_mirror", "tor_supported" ], "highlight_tags": [ "AGGREGATOR", "TOR", "MULTI-ENGINE" ], "fees": { "summary": "Aggregator markup on each swap on top of the underlying engine's quote. No platform commission disclosed publicly." }, "fees_summary": "Aggregator markup on each swap on top of the underlying engine's quote. No platform commission disclosed publicly.", "last_verified": "2026-05-27", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://privataswap.com", "outbound_slug": "privataswap", "tor": "http://privatakikifswd33w5qe4olxabx2kqznei46oqm2w2rmwjtt2mwfqad.onion", "affiliate": "https://privataswap.com/?ref=xmrclub" } }, { "id": "retoswap", "category": "exchanges", "subcategory": "P2P", "name": "RetoSwap", "url": "https://xmr.club/exchanges/retoswap", "twin": "https://xmr.club/llm/exchanges/retoswap.txt", "tagline": "Decentralised XMR↔fiat P2P. Haveno fork operated independently, multi-sig escrow.", "review": "RetoSwap is an independent **Haveno-based** marketplace built for the use case Monverse lost when LocalMonero shut down in 2024: peer-to-peer **XMR↔fiat** with no central custody and no KYC. Trades settle through on-chain multisig escrow rather than an operator's hot wallet, which makes it one of the highest-privacy ways to move between Monero and fiat short of meeting someone for cash.\n\n**Background.** Haveno is, in effect, Monero's answer to Bisq — a decentralized P2P exchange protocol where buyers and sellers transact directly using real-world fiat payment methods, protected by multisig escrow and security deposits. RetoSwap runs its own Haveno network (its own seed nodes and arbitrators) with a desktop client, and inherits the spirit of LocalMonero — community liquidity for fiat on/off-ramps — while explicitly dropping the central-custody model that made LocalMonero a single point of seizure. It is the privacy-first answer to \"I have cash/bank fiat and I want native XMR without an exchange account.\"\n\n**What you trust.** This is the important part, because Haveno's trust model is different from a custodial swap. Each trade is locked into a **2-of-3 multisig**: buyer, seller, and an arbitrator each hold a key. Normal trades complete with just buyer and seller signing; the arbitrator only steps in on a dispute. Both sides post a security deposit that disincentivizes cheating. So you are not trusting RetoSwap with custody of your funds — you are trusting (a) the multisig cryptography, (b) the honesty and availability of the network's **arbitrators**, and (c) the seed-node operator's integrity. The arbitrator is the critical human trust anchor: on any Haveno network, a compromised or impersonated arbitrator is the realistic threat, not the operator absconding with a hot wallet. Follow standard discipline — never release escrow early, verify you're dealing with the legitimate arbitrator, and keep all communication and evidence inside the client.\n\n**Operational specs.** Desktop client (not a website you paste an address into), on-chain multisig escrow, security deposits on both sides, fiat payment methods for the fiat leg, and no KYC. Because it's genuine P2P, **liquidity and spreads are worse than centralized swaps** — you trade depth for the strongest privacy posture, and you may wait for a counterparty at your size and payment method. Settlement is as fast as the two humans and the payment rail allow, not instant.\n\n**Philosophy.** RetoSwap is non-custodial, permissionless fiat↔XMR by design: no account, no central pool of funds to subpoena or seize, no identity attached to a trade. It carries forward the LocalMonero community-liquidity ethos into an architecture where the operator structurally *cannot* be the single point of failure that custodial P2P platforms were. That is the whole pitch, and it's an honest one.\n\n**Grade rationale.** Grade A reflects the non-custodial multisig design, the genuine no-KYC fiat on/off-ramp (a scarce and valuable capability post-LocalMonero), and an independent operator filling a real gap. It sits at A rather than higher because of the inherent P2P trade-offs — thinner liquidity, a learning curve, and a trust model that rests on arbitrator honesty rather than pure cryptography.\n\n**Useful when** you need to move between fiat and native Monero without an exchange account or ID, you value seizure-resistance over speed and depth, and you're comfortable running a desktop client and following multisig discipline. It's the natural home for users who relied on LocalMonero and want the same function without the custodial risk.\n\n**Caveats.** P2P means you must vet counterparties and **never release escrow before you've genuinely received the fiat** — the deposit and arbitrator exist precisely because some counterparties try to cheat. Haveno's safety rests on arbitrator and seed-node integrity; arbitrator-impersonation is the known class of risk on Haveno-style networks, so confirm you're interacting with the legitimate network and arbitrator before committing a trade, and re-evaluate if the operator changes its arbitrator set. Liquidity can be thin at larger sizes or uncommon payment methods. As always, verify the real client download and network details from the operator's signed/canonical sources, not third-party links.\n\n**Post-incident liquidity caveat (2026-07).** In the weeks following the 2026-06-17 protocol exploit, Haveno network-wide liquidity has not recovered to the pre-incident norm. As of the 2026-07-07 curator observation, network liquidity was holding around **~$5k** (versus a pre-incident 10k+ baseline) and daily trade volume had fallen to **~4 XMR/day** from the pre-incident 2,000–4,000 XMR/day peak — a >99% collapse. Curator can only observe this from inside the Haveno client, not from a public API, so live re-verification depends on running the app. Practical impact for a reader placing an offer today: expect thinner order-book depth, wider spreads, and potentially longer time-to-match than the pre-2026-06-17 experience. This is a liquidity condition, not a security posture change — the architecture caveats (no operator custody, 2-of-3 multisig escrow, self-custody wallet path) still hold.\n\n**Market-depth caveat (2026-08-06).** Network liquidity remains materially reduced following the May 2026 protocol incident (\\$2.7M exploit; retoswap trading was suspended, subsequently restored). The retoswap.com homepage has advertised the same *\"19,000+ Swaps completed\"* cumulative counter since at least 2026-08-04 — the round-number figure has not incremented in a ~48h re-check. First-party user reports on r/haveno (2026-08 window) note the software opening with zero offers visible for at least one user. Real-time network-liquidity metrics are not publicly exposed by retoswap (no /stats or /network endpoint responds; community aggregators havenoexplorer / havenostats / havenomarkets all fail DNS at present). Practical implication for readers: if you rely on this network for a specific pair or size, verify offers exist in-client before assuming the trade will fill. Grade held pending explicit curator recheck; a formal +30-day grace-period review is scheduled.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted", "multisig_supported" ], "highlight_tags": [ "P2P", "FIAT", "XMR", "INCIDENT-2026-05", "INCIDENT-2026-06" ], "fees": { "summary": "~1% taker · trade-specific spread · on-chain multisig" }, "fees_summary": "~1% taker · trade-specific spread · on-chain multisig", "last_verified": "2026-09-05", "operating_since": "2024", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://retoswap.com", "outbound_slug": "retoswap", "twitter": "https://x.com/wilderko" }, "incident": { "date": "2026-06-17", "severity": "high", "summary": "ACTIVE — second Haveno-protocol exploit hitting RetoSwap inside 30 days, **mechanistically distinct from the May 2026 attack**. Per RetoSwap's official PSA (2026-06-17): the team received the exploit report at 18:02 UTC, halted trading by setting the minimum client version to 2.0.0 via the filter feature, and banned the attacker's onion. **May attack:** arbitrator-substitution / fake-arbitrator-ACK against the selection step. **June attack:** the arbitrator stays legitimate, but the attacker abuses the forced-arbitration flow itself — take buy offers → force arbitration through a real arbitrator → XMR releases after 30 confirmations even though no BTC was ever sent. Two legitimate Reto arbitrators on record (`…6wi2znkfhbowtv2xxkbx63simfj3bqd.onion`, `…sriix3v2akgrzd4k5tvoqqvsfzxb6yd.onion`) — both honest counterparties, not compromised infrastructure. Attacker buyer onion (banned, with port): `…e6wyrtdczsrhtves2jofi2qpad.onion:9999`. Scope per RetoSwap: damage appears contained to large-scale crypto offers; **fiat-flow traders unaffected**. The RetoSwap team is **not compromised** — the protocol flaw is at the Haveno layer.", "curator_advice": "ACTIVE INCIDENT — revoke any open offers and pause trading until the network's all-clear. If you have an open RetoSwap trade with the attacker onion `…e6wyrtdczsrhtves2jofi2qpad.onion:9999`, **do not pay**. The recurring failure sits at the Haveno trade-protocol level, not at RetoSwap or its arbitrators — both legit Reto arbitrators were honest counterparties in this attack flow. RetoSwap mitigated immediately (filter-feature minimum-client-version 2.0.0 + banned attacker onion). Scope per RetoSwap: damage contained to large-scale crypto offers; fiat traders unaffected. Affected traders: reach out via the RetoSwap SimpleX group for recovery options. RetoSwap's grade stays at A because the operator did the right things; protocol-level grade move tracked on /exchanges/haveno (A → A-). Liquidity update (2026-06-25): network-wide Haveno P2P depth has not yet re-cleared the ~5k-XMR health threshold (currently ~4.78k; 14d ~4.0k–5.5k, mostly sub-5k) — treat depth/slippage on large orders as still-recovering until it holds above 5k.", "source_url": "https://x.com/RetoSwap/status/2066977091061616659", "timeline": [ { "date": "2026-05-20", "note": "Trade-protocol vulnerability (negative-value validation gap, shared Bisq lineage) hit the network; RetoSwap liquidity collapsed toward $0." }, { "date": "2026-05-28", "note": "Recovery update: RetoSwap operator back online with the patched client; network liquidity recovering." }, { "date": "2026-06-11", "note": "Network liquidity confirmed recovered and held (~9,500 XMR, ~2x the ~5k threshold). Incident resolved." }, { "date": "2026-06-17", "note": "RetoSwap exploit report received at 18:02 UTC. Team set minimum-client-version 2.0.0 via filter feature + banned attacker onion `…e6wyrtdczsrhtves2jofi2qpad.onion:9999`. Attack distinct from May: arbitrator legitimacy intact, the forced-arbitration flow itself releases XMR after 30 confs with no BTC. Damage contained to large-scale crypto offers; fiat traders unaffected. Affected traders directed to RetoSwap SimpleX group." }, { "date": "2026-06-24", "note": "RetoSwap announces 'back up and running' (X @RetoSwap). Network reopens on the v1.8.0-hardened client tied to Haveno v1.8.0 (released 2026-06-20), which ships arbitrator-signature verification on dispute payouts and verified-sender enforcement across trade-setup and deposit messages — the broader fix vs the May v1.5 targeted patch. Recovery coordination with affected users ongoing.", "note_i18n": { "zh": "RetoSwap 宣布「重新上線運作」（X @RetoSwap）。網路恢復至與 Haveno v1.8.0（2026-06-20 發布）對齊的強化客戶端，該版本對糾紛付款欄位加入仲裁者簽章驗證，並對交易設定與押金訊息全面落實寄件者驗證——相對於 5 月 v1.5 的針對性修補，這是更廣面的修補。針對受影響用戶的恢復協調仍在進行中。", "es": "RetoSwap anuncia 'de vuelta en funcionamiento' (X @RetoSwap). La red reabre sobre el cliente endurecido alineado con Haveno v1.8.0 (publicado el 2026-06-20), que añade verificación de firma del árbitro en los campos de pago de disputa y refuerzo de remitente verificado en mensajes de configuración de trade y depósito — la solución más amplia frente al parche dirigido v1.5 de mayo. La coordinación de recuperación con los usuarios afectados continúa.", "ru": "RetoSwap объявляет «снова в строю» (X @RetoSwap). Сеть возобновляет работу на закалённом клиенте, привязанном к Haveno v1.8.0 (выпущен 2026-06-20), который добавляет верификацию подписи арбитра в полях диспутных выплат и принуждение к верифицированному отправителю в сообщениях настройки трейда и депозита — более широкое исправление по сравнению с майским целевым патчем v1.5. Координация восстановления с пострадавшими пользователями продолжается." } }, { "date": "2026-06-25", "note": "Two-week liquidity recovery check (api.kyc.rip resistance.p2p_liquidity, network-wide Haveno P2P depth): network is trading again on the v1.8.0-hardened line, but depth has NOT re-cleared the ~5k-XMR health threshold. Current reading ~4.78k XMR; the trailing 14 days ranged ~4.0k–5.5k (excluding two obvious data-spike outliers), with the majority of readings below 5k and the latest dipping to ~4.79k. Severity held — depth recovery not yet confirmed; continuing the bi-weekly watch." } ], "summary_i18n": { "zh": "活躍事件——30 天內第二次 Haveno 協議漏洞利用打擊 RetoSwap，**在機制上與 2026 年 5 月的攻擊不同**。根據 RetoSwap 官方 PSA（2026-06-17）：團隊於 18:02 UTC 收到漏洞報告，透過過濾功能將最低客戶端版本設為 2.0.0 來暫停交易，並封禁了攻擊者的洋蔥地址。**5 月攻擊：** 仲裁者替換／針對選擇步驟的偽造仲裁者 ACK。**6 月攻擊：** 仲裁者保持合法，但攻擊者濫用強制仲裁流程本身——接受買單 → 透過真實仲裁者強制仲裁 → XMR 在從未發送 BTC 的情況下於 30 次確認後釋放。記錄中涉及兩位合法的 Reto 仲裁者（、）——兩者均為誠實交易方，而非被入侵的基礎設施。攻擊買家洋蔥地址（已封禁，含端口）：。根據 RetoSwap 的評估，損害範圍似乎限制在大額加密貨幣掛單；**法幣交易者未受影響**。RetoSwap 團隊**未被入侵**——協議缺陷位於 Haveno 層級。", "es": "ACTIVO — segundo exploit del protocolo Haveno contra RetoSwap en 30 días, **mecánicamente distinto del ataque de mayo de 2026**. Según el PSA oficial de RetoSwap (17-06-2026): el equipo recibió el informe de exploit a las 18:02 UTC, detuvo el trading estableciendo la versión mínima del cliente en 2.0.0 mediante la función de filtro, y expulsó el onion del atacante. **Ataque de mayo:** sustitución de árbitro / ACK de árbitro falso contra el paso de selección. **Ataque de junio:** el árbitro sigue siendo legítimo, pero el atacante abusa del propio flujo de arbitraje forzado — tomar ofertas de compra → forzar arbitraje a través de un árbitro real → XMR se libera tras 30 confirmaciones aunque nunca se envió BTC. Dos árbitros legítimos de Reto registrados (, ) — ambos contrapartes honestas, no infraestructura comprometida. Onion del comprador atacante (expulsado, con puerto): . Alcance según RetoSwap: el daño parece contenido en ofertas de cripto a gran escala; **los operadores de fiat no están afectados**. El equipo de RetoSwap **no está comprometido** — la falla del protocolo está en la capa de Haveno.", "ru": "АКТИВНЫЙ ИНЦИДЕНТ — второй эксплойт протокола Haveno против RetoSwap за 30 дней, **механически отличающийся от майской атаки 2026 года**. Согласно официальному PSA RetoSwap (17.06.2026): команда получила сообщение об эксплойте в 18:02 UTC, остановила торги, установив минимальную версию клиента 2.0.0 через функцию фильтра, и забанила onion-адрес атакующего. **Майская атака:** подмена арбитра / поддельный ACK арбитра против шага выбора. **Июньская атака:** арбитр остаётся легитимным, но атакующий злоупотребляет самим потоком принудительного арбитража — принять предложения на покупку → принудительно запустить арбитраж через реального арбитра → XMR высвобождается после 30 подтверждений, хотя BTC никогда не был отправлен. Зафиксированы два легитимных арбитра Reto (, ) — оба добросовестные контрагенты, а не скомпрометированная инфраструктура. Onion-адрес атакующего покупателя (забанен, с портом): . Масштаб согласно RetoSwap: ущерб, по-видимому, ограничен крупными крипто-предложениями; **фиатные трейдеры не затронуты**. Команда RetoSwap **не скомпрометирована** — уязвимость протокола находится на уровне Haveno." }, "curator_advice_i18n": { "zh": "活躍事件——撤銷所有未結掛單，暫停交易，直到網路發布安全解除通知。如果你有與攻擊者洋蔥地址 相關的未結 RetoSwap 交易，**請勿付款**。反覆出現的故障位於 Haveno 交易協議層級，而非 RetoSwap 或其仲裁者——兩位合法的 Reto 仲裁者均為此攻擊流程中的誠實交易方。RetoSwap 已立即採取緩解措施（透過過濾功能將最低客戶端版本設為 2.0.0，並封禁攻擊者洋蔥地址）。根據 RetoSwap，損害範圍限制在大額加密貨幣掛單；法幣交易者不受影響。受影響的交易者：請透過 RetoSwap SimpleX 群組聯繫以獲取恢復選項。RetoSwap 的評級維持 A 級，因為營運者做了正確的事；協議層級評級調整請參見 /exchanges/haveno（A → A-）。", "es": "INCIDENTE ACTIVO — revoca cualquier oferta abierta y pausa el trading hasta que la red dé el visto bueno. Si tienes una operación RetoSwap abierta con el onion atacante , **no pagues**. La falla recurrente se sitúa a nivel del protocolo de intercambio de Haveno, no en RetoSwap ni en sus árbitros — ambos árbitros legítimos de Reto fueron contrapartes honestas en este flujo de ataque. RetoSwap mitigó inmediatamente (función de filtro con versión mínima del cliente 2.0.0 + expulsión del onion atacante). Alcance según RetoSwap: daño contenido en ofertas de cripto a gran escala; operadores de fiat no afectados. Traders afectados: contacten a través del grupo SimpleX de RetoSwap para opciones de recuperación. La calificación de RetoSwap se mantiene en A porque el operador hizo lo correcto; el movimiento de calificación a nivel de protocolo se sigue en /exchanges/haveno (A → A-).", "ru": "АКТИВНЫЙ ИНЦИДЕНТ — отзовите все открытые предложения и приостановите торговлю до сигнала «всё чисто» от сети. Если у вас есть открытая сделка RetoSwap с onion-адресом атакующего , **не платите**. Повторяющаяся неисправность находится на уровне торгового протокола Haveno, а не на уровне RetoSwap или его арбитров — оба легитимных арбитра Reto были добросовестными контрагентами в этом потоке атаки. RetoSwap немедленно принял меры (функция фильтра с минимальной версией клиента 2.0.0 + бан onion-адреса атакующего). Масштаб согласно RetoSwap: ущерб ограничен крупными крипто-предложениями; фиатные трейдеры не затронуты. Пострадавшие трейдеры: обратитесь через группу RetoSwap в SimpleX для получения вариантов восстановления. Оценка RetoSwap остаётся на уровне A, потому что оператор сделал всё правильно; изменение оценки на уровне протокола отслеживается на /exchanges/haveno (A → A-)." }, "resolved": "2026-06-24" }, "also_listed_at": { "web3privacy": true, "kycnot": true, "monerica": true } }, { "id": "robosats", "category": "exchanges", "subcategory": "P2P", "name": "RoboSats", "url": "https://xmr.club/exchanges/robosats", "twin": "https://xmr.club/llm/exchanges/robosats.txt", "tagline": "Lightning-native P2P BTC↔fiat over Tor. No accounts, no email, robot avatars.", "review": "RoboSats is the **Lightning-native P2P BTC↔fiat exchange over Tor** — a protocol where each trade session generates an ephemeral robot avatar from a private key, hold-invoice multi-sig escrows both legs of the swap, and the entire UX lives on a Tor onion service so neither operator nor exit-node sees your trade. Listed at **Grade A** because RoboSats occupies a unique category-of-one: faster than Bisq classic (Lightning instead of on-chain BTC = minutes vs hours), more anonymous than Bisq Easy (ephemeral robot identity vs reputation pseudonym), and structurally different from swap aggregators (peer-to-peer-fiat, not aggregator-routes-via-exchange).\n\n**Background.** RoboSats was launched as an open-source project in 2022 by **Reckless Satoshi** (pseudonymous developer) with the explicit design goal of \"**no accounts, no KYC, no email**\" P2P fiat trading on Lightning. The protocol uses **hold invoices** — a Lightning Network primitive where the payer commits funds that are held in suspended state until a settlement key is revealed; this allows multi-sig-equivalent escrow without on-chain transactions. Each trade session creates a **robot avatar** deterministically generated from a user-side private key — your identity is a robot face that exists for one trade and is gone after. The reference application is **Tor-primary**: the canonical access path is the .onion service, with a clearnet mirror as a convenience but not the primary surface. Open source on GitHub, multiple **coordinator nodes** operate the protocol (federated rather than centralised) — the user picks which coordinator to route through.\n\n**What you trust.** **Lightning hold-invoice escrow** — both parties commit Lightning payments that are held in suspended state until settlement; neither party can run with the funds because the settlement key is only released on bilateral cooperation. **Multi-coordinator federation** — RoboSats coordinators are run by multiple independent operators; you choose which coordinator to use. If one coordinator goes hostile, you switch. **Tor by default** — canonical access is via .onion; the entire trade flow stays in the Tor network and the coordinator sees only Tor-circuit traffic. **Ephemeral identity** — your \"robot\" exists for one trade; there is no persistent account, no history accumulated, no reputation per-se (which is also a trust trade-off — see Caveats). **Open-source codebase** — anyone can audit the protocol and the application; coordinator infrastructure is documented for operators to run their own. **What you don't trust**: the coordinator with your funds (hold invoices are not custodial); the operator's TLS (Tor onion bypasses TLS); your counterparty (Lightning escrow constrains them as well).\n\n**Operational specs.** **Platform**: web application (Tor-primary, clearnet mirror), plus a mobile web wrapper (RoboSats mobile); all canonical routes via .onion at robosats6tkf3eva7x2voqso3a5wcorsnw34jveyxfqi2fu7oyheasid.onion. **Trading pair**: BTC (Lightning) ↔ fiat (USD, EUR, many local currencies). **Payment methods**: SEPA bank transfer, Wise, Revolut, cash-by-mail, gift cards, in-person cash — the maker's offer specifies. **Trade size**: typically $20-$2k, with some coordinators supporting larger; trade-size depends on Lightning channel liquidity and maker willingness. **Trade timeline**: minutes — Lightning settlement is near-instant; total flow including fiat-confirmation and chat is typically 15-30 minutes. **Fees**: ~0.2% per side (maker + taker), among the lowest in the P2P fiat-on-ramp category. **Federation**: 5-10+ independent coordinator nodes operating at any time; users see coordinator selection in the UI. **No KYC under any circumstances** — there is no account, no email; the robot identity is generated locally from a user-side private key and not associated with any PII.\n\n**Philosophy.** RoboSats' editorial differentiator is the **Lightning-multi-sig-escrow-on-Tor** model. Bisq classic uses on-chain BTC multi-sig (operationally heavy, settled in hours). Bisq Easy uses reputation (no protocol-escrow, fast for small trades). RoboSats uses Lightning hold-invoices (protocol-escrow without the on-chain heaviness, fast like Bisq Easy but with the trust guarantees of Bisq classic). The ephemeral robot identity is a deliberate choice to **avoid reputation systems entirely** — Bisq Easy's BSQ-reputation model creates a long-term identifier for sellers (good for trust, bad for unlinkability); RoboSats says: each trade is a fresh identity, the escrow protocol does the heavy lifting on trust, no long-term seller graph exists. The trade-off: you can't reward repeat-trader behaviour, you can't filter for known-good sellers, you take protocol-escrow's trust math at each trade.\n\n**Grade rationale.** Grade A reflects: open-source codebase; federated coordinator structure (no single party can shut the protocol down); Tor-primary architecture (.onion is the canonical access); Lightning-native hold-invoice escrow (multi-sig-equivalent without on-chain costs); ephemeral robot-identity design (deliberate anti-reputation, anti-correlation); no KYC under any circumstances; no account creation, no email; ~0.2% per-side fees (competitive with the lowest in P2P fiat-on-ramps); active development since 2022; cross-listed in KYCnot and web3privacy peer directories. Last verified 2026-05-12.\n\n**Useful when.** You want a fast P2P BTC↔fiat trade ($20-$2k typical) where the entire flow happens over Tor in 15-30 minutes. You want zero account creation, zero email, zero KYC — the strictest privacy posture available in P2P fiat-on-ramps. You're a Lightning user with a Lightning wallet ready (Phoenix, Breez, Zeus, or a self-hosted node) and want fiat→Lightning rather than fiat→on-chain. You're privacy-maximalist and want ephemeral-per-trade identity rather than the persistent pseudonym Bisq Easy uses. You're on a system where running a desktop Bisq application is impractical and want a browser-based (Tor) flow instead. You want federation rather than a single-operator dependency.\n\n**Caveats.** **Lightning wallet required** — if you don't already use Lightning, the setup overhead (channel liquidity, wallet choice, on-chain BTC funding) is non-trivial. RoboSats is best for users already comfortable in Lightning. **Smaller liquidity than Bisq** — fewer makers, narrower payment-method coverage in some currencies; pair availability is a function of which coordinators have active makers. **No reputation system means brand-new makers and known-good makers look identical** — protocol-escrow protects you, but you can't preferentially filter for repeat-trustworthy makers; for some users this anti-reputation stance is a feature, for others it's a friction. **Coordinator-trust is non-zero** — the coordinator orchestrates the trade (chat routing, dispute escalation), and while they can't custodially run with funds, a malicious coordinator could withhold settlement or leak metadata; pick coordinators with public reputation. **Lightning hold-invoice escrow has its own quirks** — fund-locking during the trade window means your Lightning channel liquidity is briefly committed; for large trades, ensure adequate channel capacity. **Fiat-payment-method risk is on you** — Lightning hold-invoice protects the BTC leg; the fiat leg depends on the buyer actually sending fiat. Use payment methods with reversal protections cautiously (chargeback risk for sellers). **Disputes are coordinator-mediated** — if the trade goes sideways, the coordinator arbitrates; this is a soft escalation path, not a hard guarantee. **No native XMR support** — RoboSats is BTC/Lightning only; for fiat → XMR P2P, use Haveno; for BTC → XMR, use an aggregator after the RoboSats trade settles.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "tor_supported", "tor_mirror" ], "highlight_tags": [ "P2P", "LIGHTNING", "TOR" ], "fees": { "summary": "~0.2% maker/taker · Lightning hold invoices · Tor primary" }, "fees_summary": "~0.2% maker/taker · Lightning hold invoices · Tor primary", "last_verified": "2026-05-12", "operating_since": "2022", "tenure_note": "RoboSats P2P launched late 2021 (Lightning-only). Domain RDAP confirms 2022.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://learn.robosats.com", "outbound_slug": "robosats", "tor": "http://robosats6tkf3eva7x2voqso3a5wcorsnw34jveyxfqi2fu7oyheasid.onion", "telegram": "https://t.me/robosats" }, "also_listed_at": { "kycnot": true, "web3privacy": true, "monerica": true } }, { "id": "rocketx", "category": "exchanges", "subcategory": "Aggregators", "name": "RocketX", "url": "https://xmr.club/exchanges/rocketx", "twin": "https://xmr.club/llm/exchanges/rocketx.txt", "tagline": "Cross-chain swap aggregator across CEX + DEX liquidity.", "review": "Bridge-leaning cross-chain swap aggregator across CEX + DEX liquidity. Reaches destinations the spot aggregators don't cover.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "BRIDGE", "AGGREGATOR" ], "fees": { "summary": "Spread varies by route · slippage on long routes" }, "fees_summary": "Spread varies by route · slippage on long routes", "last_verified": "2026-05-14", "operating_since": "2021", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://app.rocketx.exchange", "outbound_slug": "rocketx", "affiliate": "https://app.rocketx.exchange/?ref=MMs42KD2" } }, { "id": "sageswap", "category": "exchanges", "subcategory": "Instant Swaps", "name": "SageSwap", "url": "https://xmr.club/exchanges/sageswap", "twin": "https://xmr.club/llm/exchanges/sageswap.txt", "tagline": "Anonymous swap — no KYC, no AML hold, no IP logging, declines law-enforcement requests.", "review": "SageSwap is an explicitly privacy-maximalist instant exchanger: crypto-to-crypto only, no account, and **no KYC under any circumstances** — with one feature that sets it apart from nearly every other no-KYC swap, an opt-in mode that knowingly accepts coins other engines would freeze. For Monero users who have hit an AML hold elsewhere, that mode is the difference between a completed swap and a locked order.\n\n**Background.** SageSwap operates as a non-account instant exchanger in the same lane as the larger no-KYC swap engines, but positions itself further toward the privacy-absolutist end of the spectrum. Its public posture is unusually blunt: it states it collects no IP or identifying data, and its FAQ carries an explicit law-enforcement notice — *\"For Law Enforcement, please be advised that we will not be providing any information. Do not contact us, as we will not respond or share any data.\"* That is a deliberate, on-the-record stance rather than the soft \"we value privacy\" boilerplate most exchangers hide behind.\n\n**What you trust.** Like every instant exchanger, SageSwap takes **temporary custody** of your input coin for the duration of the swap — it is non-account, but it is not non-custodial in the escrow sense; funds pass through the operator while the trade settles. So the trust you extend is bounded but real: that the quoted rate holds, that the output sends promptly, and that a refund address is honored if a float rate moves or a trade fails. The mitigations are the standard swap-engine discipline — keep swaps sized to your risk tolerance, always set a refund address, and prefer fixed rates when you want rate certainty.\n\n**Operational specs.** Two distinct modes are the core of the product:\n- **Standard Swap** — rejects high AML-score inputs, the conventional behavior that keeps an exchanger's own liquidity and banking relationships clean.\n- **AML Swap** — *explicitly accepts tainted or high-score coins*, the use case being exactly when another engine would freeze the order or demand verification on a flagged deposit.\n\nNo account, no KYC, crypto-to-crypto only, with the operator stating no IP logging or identifying-data collection. The AML Swap option is the distinctive capability: most no-KYC engines still silently run chain-analysis scoring and will hold a flagged deposit, which is precisely the moment a privacy user is most exposed.\n\n**Philosophy.** SageSwap is built around the position that financial privacy shouldn't be conditional on an opaque taint score assigned by a surveillance vendor. The AML Swap mode operationalizes that belief, and the law-enforcement notice states it plainly. Whether you find that posture principled or risky depends on your threat model — but it is coherent and consistently applied, not marketing.\n\n**Grade rationale.** Grade A reflects the genuine no-account/no-KYC design, the explicit no-logging and law-enforcement stance, and the rare, materially useful AML Swap mode that solves a real failure case for privacy users. It is held at A rather than higher because SageSwap is a smaller, less battle-tested brand than the longest-running engines, and the instant-exchanger custody model is an inherent (if brief) trust exposure.\n\n**Useful when** a flagged or high-AML-score deposit has been frozen or rejected by another no-KYC engine and you need a route that will knowingly process it, or when you simply want a swap that advertises no IP logging and a hard no-cooperation stance. Pair it with Monero on either leg to break chain-analysis linkage cleanly.\n\n**Caveats.** \"No KYC ever\" still runs through an operator that briefly holds your funds — set a refund address and treat large swaps with the usual caution. The AML Swap mode accepts tainted coins, which can have downstream implications depending on what you do next and your jurisdiction; understand what you're moving. As with any newer exchanger, verify the current domain (phishing clones target privacy-swap brands) and start with a small test swap before committing size.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup", "no_kyc" ], "feature_tags": [ "api_available", "accepts_tainted", "no_ip_logging", "declines_le_requests" ], "highlight_tags": [ "NO-KYC", "NO-AML" ], "fees": { "summary": "1-2% spread · +up to 6% on <$50 · floating" }, "fees_summary": "1-2% spread · +up to 6% on <$50 · floating", "last_verified": "2026-08-10", "operating_since": "2025-12", "tenure_note": "Independently verified: earliest Wayback snapshot: 2025-12-09. `operating_since` set to the earliest signal.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://sageswap.io", "outbound_slug": "sageswap", "contact_email": "Support@SageSwap.io", "twitter": "https://x.com/SageSwap_io", "telegram": "https://t.me/SageSwap", "session": "05dd9cc7a8f9cf039411b2eb90ecd10c2debcd75248b2fa2b009bee197bfaf401d", "signal": "SageSwap.69", "pgp_key_url": "https://sageswap.io/pgp", "tor": "http://sageswap4ygi7k5e5gbnvhz2ldbprrelkkuourlp5vx6flfeypk4hvqd.onion", "affiliate": "https://sageswap.io/?utm_source=nqPFLNdgYx" }, "also_listed_at": { "monerica": true, "web3privacy": true } }, { "id": "secureshift", "category": "exchanges", "subcategory": "Instant Swaps", "name": "SecureShift", "url": "https://xmr.club/exchanges/secureshift", "twin": "https://xmr.club/llm/exchanges/secureshift.txt", "tagline": "Instant swap engine (Cayman Islands, ~5-year tenure) rebranded as \"SecureShift DEX\" — same mechanism as ChangeNOW / SimpleSwap / Baltex under the hood, with a smart-contract-branded frontend. XMR added 2026-08-04. Own copy names an \"AML before swap\" screening gate; clean-provenance small-to-medium swaps should clear, larger amounts or complex chain-history funds trigger it. Peer-verified on Monerica since 2024-08-11.", "review": "**SecureShift is an instant crypto swap engine with a DEX-flavored frontend.** The service accepts a deposit address as input, routes the swap through its own reserves + partner liquidity, and dispatches the output to a user-supplied recipient address. No wallet connection is required. That is the operational shape of an instant-swap aggregator (ChangeNOW / SimpleSwap / [Baltex](/exchanges/baltex) pattern), not a DEX in the Uniswap-style meaning of the word. Monerica correctly classifies the service under \"Instant Swaps\".\n\n**The DEX-branding gap is worth naming.** The /dex subpage markets \"Fully On-Chain · Non-Custodial · Zero Registration · No Hostage\" alongside claims like *\"Smart contracts execute swaps — we never touch your assets\"*. Mechanically, this cannot be true end-to-end for XMR-in: Monero has no smart contract layer. Any XMR-in flow through a \"smart-contract\" surface either uses wrapped-XMR (custodial), bridges via a centralized reserve (custodial), or misrepresents the mechanism. For an XMR user, the practical effect is: your XMR deposit lands with the operator, and the operator dispatches the output — the smart-contract framing does not change the trust surface.\n\n**\"AML before swap\" is the operator's own copy.** From the /dex page: *\"Secureshift AML before swap model means your funds can NEVER be held hostage at any point\"*. Read carefully — this is a screening gate positioned upfront rather than mid-flow. Funds that fail the screening don't get held (which is a real UX plus over the shotgun-KYC-mid-flow pattern on some peer engines), but the screening still exists, and the trigger criteria are not published. Two possible modes at the user level:\n\n- **Narrow dirty-fund screening** — the gate rejects only genuine hits (sanctions matches, known drainer wallets, confirmed-stolen fund clusters) at deposit time. Rejection returns the deposit; everyone else swaps normally. Defensible anti-abuse work.\n- **Broader risk-scoring at deposit time** — the gate uses a wider set of chain-analysis heuristics (mixer output, Monero deposits from certain sources, darknet-adjacent history) to reject deposits before processing. Same class of gate as [Baltex](/exchanges/baltex) / [Swapgate](/exchanges/swapgate), just applied at a different point in the flow.\n\nTrigger logic is not published, so which mode applies to your specific swap is not knowable pre-deposit. Same reader-caveat we apply to every AML-gated instant-swap operator.\n\n**Fees + operational specs.** Advertised 0.1% swap fee (unusually low for the category — verify at quote time before committing). Multi-chain support: ETH, BSC, Polygon, Avalanche, and now XMR (added 2026-08-04). Self-reported metrics: \"$2.4B+ TOTAL VOLUME\", \"1,300+ TOKEN PAIRS\". Volume figure not independently verifiable at time of listing.\n\n**Peer signal.** Listed on [Monerica](https://monerica.com/site/secureshift) as ✅ Verified since 2024-08-11, editorial classification \"Guaranteed No KYC\" with tags \"Account Not Required · Affiliate Program · API Available · Email Not Required\". Not indexed by kycnot.me at time of review. Founded 2021-10-06 per Monerica — ~5-year operational tenure predates the recent XMR addition by four years.\n\n**Operator identity.** Registered entity in Cayman Islands (offshore jurisdiction — same class of legal-exposure profile as MI / Panama / Seychelles operators). Support email `support@secureshift.io`, Telegram `t.me/secureshiftTg`, X `x.com/secureshift_io`, published API.\n\n**Reader advice.** Suitable for routine small-to-medium swaps of clean-provenance funds where the \"no KYC\" claim is likely to hold in practice — the 5-year tenure + Monerica verification are real positive signals. Not suitable for large amounts or funds with complex chain-analysis history — the \"AML before swap\" gate is documented and the trigger criteria are not, so a deposit could reject unpredictably. If your amount matters and the AML gate is a hard no-go for your threat model, route via an atomic-swap engine ([Haveno](/exchanges/haveno)) or a self-custody P2P engine ([Bisq](/exchanges/bisq), [RoboSats](/exchanges/robosats)) where no operator holds funds and no upfront screening exists.\n\n**Why this grade. ** Grade C is the shelf default for AML-gated instant-swap engines regardless of tenure — same treatment as Baltex / Swapgate / OnionSwap. The 5-year tenure and Monerica verification would push toward B on a pure operational-reliability scale, but the DEX-branding-vs-instant-swap-mechanism gap + the AML-before-swap gate cap the grade at C on the privacy-honesty axis. Re-review is natural if the operator publishes the AML trigger criteria (would lift the biggest reservation), drops the DEX branding to match the actual mechanism (honesty signal), or accumulates independent first-party user reports over 60–90 days.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [], "feature_tags": [ "aml_before_swap", "instant_swap", "multi_chain", "no_wallet_connection", "api_available", "affiliate_program", "dex_branded_instant_swap", "cayman_islands_entity" ], "highlight_tags": [ "NO-KYC", "MANY-COINS", "CROSS-CHAIN" ], "fees": { "summary": "Advertised 0.1% swap fee · verify at quote" }, "fees_summary": "Advertised 0.1% swap fee · verify at quote", "last_verified": "2026-08-11", "operating_since": "2021", "tenure_note": "Founded 2021-10-06 per Monerica listing metadata. Cayman Islands entity. Recent XMR addition 2026-08-04.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://secureshift.io", "outbound_slug": "secureshift", "contact_email": "support@secureshift.io", "twitter": "https://x.com/secureshift_io", "telegram": "https://t.me/secureshiftTg" }, "also_listed_at": { "monerica": true } }, { "id": "sideshift", "category": "exchanges", "subcategory": "Instant Swaps", "name": "Sideshift", "url": "https://xmr.club/exchanges/sideshift", "twin": "https://xmr.club/llm/exchanges/sideshift.txt", "tagline": "No-account instant swap, API-first, broad chain coverage.", "review": "SideShift is the **wallet-embedded** no-KYC instant-swap operator — the engine you've probably already used without realising it, because Cake Wallet, Edge, Exodus, and a long list of other consumer crypto wallets ship the SideShift API as their in-wallet swap surface. Listed at **Grade A** because the distribution-via-wallet-embed model creates a different trust shape than direct-to-user aggregators: wallets won't ship a swap engine that misbehaves, and that wallet-distributor constituency keeps the operator's behaviour disciplined in a way that retail-facing aggregators don't experience.\n\n**Background.** SideShift Ltd. operates from Anguilla under a registered corporate entity (one of the few no-KYC operators that publishes an actual legal identity, useful for jurisdictional clarity rather than as a regulatory guarantee). Operating since the late-2010s as an instant-swap engine; pivoted strongly toward an **API-first distribution model** where third-party wallets and dApps embed the SideShift swap API into their own UX. The wallet-embed surface is where most retail volume now flows — users see a \"Swap\" button in their existing wallet rather than visiting sideshift.ai directly. SideShift's affiliate program (XAI token, separate from the swap engine itself) channels a revenue share back to the integrating wallet/app. The core swap engine is closed-source; the SDK / API tooling around it is largely open-source on GitHub.\n\n**What you trust.** Non-custodial routing in normal operation — deposit address, upstream-exchange routing, output to the user-specified destination. **Custody window**: short routing-leg only, similar pattern to Exolix / StealthEX / LetsExchange. **AML screening**: applied at the upstream exchange layer; SideShift's stated policy is the aggregator-norm — pass deposits to upstream, upstream applies its screening, SideShift doesn't add secondary screening. **Anguilla-registered entity**: useful for jurisdictional traceability — if something goes catastrophically wrong, there's a registered company to point legal/regulatory pressure at, which is *not* the same as user-recourse-from-the-company, but it's structurally different from \"anonymous operator in unknown jurisdiction.\" **What the wallet-embed pattern actually means**: when Cake or Edge embeds the SideShift API, those wallet operators have done some level of due diligence on the engine, and they'd pull the integration if SideShift started misbehaving. That gives users a second-order signal — if your wallet keeps shipping SideShift, the wallet team is willing to bet their own brand on it.\n\n**Operational specs.** **Coin coverage**: hundreds of cryptocurrencies and long-tail altcoins; XMR, BTC, BCH, ETH, USDT (multiple chains), USDC, LTC, plus broad coverage of L2s, EVM-chain natives, and lesser-known coins (one of the better long-tail aggregators in the category). **Rate model**: **floating-rate** (best available, typical spread ~0.5%) + **fixed-rate option** (locked-in amount, small premium, guaranteed delivery quantity). **Trade size range**: small to mid (typically $20 to ~$50k+ depending on pair; very large trades may hit upstream-liquidity constraints). **API**: published REST API used by partner wallets and integrators — the primary distribution surface. **SDK**: open-source SDK / wrapper libraries on GitHub for integration. **Confirmations**: standard Monero confirmation count (~10 blocks) for XMR receives; faster on the BTC side using upstream-exchange conventions. **Affiliate program**: XAI-token-based revenue share for integrating apps (separate evaluation; not part of the swap engine's trust surface).\n\n**Philosophy.** SideShift's editorial differentiator is the **wallet-distribution-channel** model — they don't compete with Exolix or StealthEX for direct-to-user traffic at the front door; they win by being the swap engine inside other wallets. That changes the competitive dynamic: SideShift's customer is partly the wallet operator (who needs an API that doesn't break their app) and partly the end-user (who needs a swap that actually fills). The trade-off: the user often doesn't *know* they're using SideShift (it's branded as \"Cake Swap\" or \"Exodus Swap\" inside the host wallet), which means traditional swap-aggregator transparency is somewhat obscured by the wallet UX layer. For users who want explicit \"I'm using SideShift\" awareness, use sideshift.ai directly rather than a wallet-embedded swap surface.\n\n**Grade rationale.** Grade A reflects: long-running operational continuity (since the late-2010s); broad coin coverage including XMR (multi-chain USDT, USDC, LTC, plus extensive long-tail); ~0.5% floating-rate spread (competitive with category leaders); fixed-rate option for users who want quote certainty; published REST API + open-source SDK (rare in this category — most aggregators don't open-source their tooling); registered Anguilla corporate entity (jurisdictional transparency); cross-distribution via Cake / Edge / Exodus / many other wallets (wallet-operator due-diligence signal); absence of major refund-dispute or fund-freeze threads in community discussion. Last verified 2026-05-12.\n\n**Useful when.** You're using a wallet (Cake, Edge, Exodus) that already ships SideShift as its swap engine — you're using SideShift whether you visit their site or not, so understanding what's behind the wallet-swap button matters. You want broad coin coverage including the long-tail altcoins (SideShift is one of the better aggregators for obscure pairs). You're a wallet developer or integrator considering an in-wallet swap surface — SideShift is the most-embedded API in the no-KYC aggregator category. You want a swap operator with a jurisdictional identity (Anguilla company) rather than fully anonymous operator. You're using this directory's aggregator UI — SideShift is one of the engines we route through.\n\n**Caveats.** **Custody during routing** — short window, but it's not zero; treat as \"trust the operator for the routing minutes, not long-term.\" **Upstream AML applies regardless** — SideShift doesn't add screening, but the upstream exchange filling the swap may apply its own; if your funds are flagged at the upstream layer, the swap may be refunded or held. **Wallet-embed UX obscures the operator** — when you use \"Cake Swap\" or \"Exodus Swap,\" you may not realise you're routing through SideShift; this isn't deception (the wallets disclose the partner) but it does mean the average user doesn't actively choose SideShift on a per-swap basis. **No operator-published Tor mirror** — clearnet only at the time of this review; route through a Tor bridge yourself if you need .onion access. **Closed-source routing engine** — the SDK is open-source but the engine itself isn't; community recognition + wallet-distributor due-diligence substitute for code-level auditability. **No external recourse guarantee** — unlike Exolix (OrangeFren $4,000 backing), SideShift's recourse is operator policy only; the wallet-embed signal helps but isn't a guarantee pool. **XAI affiliate token is a separate trust evaluation** — don't conflate the swap engine (mature, well-distributed) with the XAI token program (separate product with its own dynamics). **No curator-verified rate-calibration test yet** — the ~0.5% spread figure is drawn from operator claims and community sentiment; a directed test trade is on the curator's audit backlog.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A", "trust": "The no-KYC instant-swap engine embedded inside major consumer wallets (Cake, Edge, Exodus and others). That wallet-distributor constituency is a real trust check — wallets won't ship a swap engine that misbehaves. Grade A on that distribution-vetted record.", "privacy": "No account, no identity check to swap. Runs largely as an in-wallet API surface, so the privacy of a given swap also depends on the wallet embedding it. No KYC on SideShift's side for standard swaps.", "ux": "API-first instant swap with broad chain coverage — often used in-wallet without noticing. Quote, send, receive; no signup." }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "api_available" ], "highlight_tags": [ "NO-KYC", "API", "WALLET-EMBED" ], "fees": { "summary": "~0.5% spread · floating + fixed" }, "fees_summary": "~0.5% spread · floating + fixed", "last_verified": "2026-05-12", "operating_since": "2018", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://sideshift.ai", "outbound_slug": "sideshift", "twitter": "https://x.com/sideshiftai", "telegram": "https://t.me/joinsideshiftai", "affiliate": "https://sideshift.ai/a/zPrbacE1x" } }, { "id": "simpleswap", "category": "exchanges", "subcategory": "Instant Swaps", "name": "SimpleSwap", "url": "https://xmr.club/exchanges/simpleswap", "twin": "https://xmr.club/llm/exchanges/simpleswap.txt", "tagline": "Popular instant swap service. Decent rates, but has a history of requesting KYC on some transactions.", "review": "Popular instant swap service. Decent rates, but has a history of requesting KYC on some transactions.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "NO-KYC" ], "fees": { "summary": "~0.4-0.6% spread · floating + fixed" }, "fees_summary": "~0.4-0.6% spread · floating + fixed", "last_verified": "2026-05-15", "operating_since": "2018", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2018", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://simpleswap.io", "outbound_slug": "simpleswap", "contact_email": "support@simpleswap.io", "twitter": "https://x.com/SimpleSwap_io", "telegram": "https://t.me/SimonSimpleSwap", "discord": "https://discord.gg/3D3JwTnsk5", "affiliate": "https://simpleswap.io/?ref=9a8ad41fce71" }, "also_listed_at": { "orangefren": true, "kycnot": true, "monerica": true } }, { "id": "splitnow", "category": "exchanges", "subcategory": "Aggregators", "name": "SplitNOW", "url": "https://xmr.club/exchanges/splitnow", "twin": "https://xmr.club/llm/exchanges/splitnow.txt", "tagline": "Aggregator that routes XMR through CEX partners (Bybit, WhiteBIT, Gate) to USDT splits across up to 100 destination wallets. Web3-wallet signin, no Web2 KYC. Hidden spread above the user-visible quote.", "review": "**Distinct capability.** SplitNOW is the only no-KYC aggregator we've found that splits a single deposit across up to 100 destination wallets in one transaction by routing through centralized exchanges. The closest spiritual analog in our own ecosystem is [kyc.rip/dispenser](https://kyc.rip/dispenser), which spins up a per-session burner wallet in the user's browser and fan-outs to multiple providers from there — same end goal (one input → many outputs across providers), opposite trust model. [disperse.rip](https://disperse.rip) is a different beast: it executes batch on-chain transfers via a smart contract (or an opt-in custodial WalletConnect-free mode), so it splits at the chain layer, not the exchange layer. The product idea SplitNOW chases — pay payroll, fund ops wallets, rebalance custody without 100 separate trades — is genuinely useful.\n\nRoutes that single deposit through centralized exchanges (Bybit, WhiteBIT, Gate, etc.), instant exchangers, and OTC desks before distributing.\n\n**Live testing (0.2 XMR / 2 wallets, May 2026):** quote shown before deposit did not match what the user received. Decomposed: 3.06% silent swap spread baked into the rate ($2.31), 1.13 USDT-per-address withdrawal-fee markup over the upstream CEX's actual cost ($2.26 across 2 wallets), $1.60 of actual network fees. Effective fee at this scale: 8.19% gross. At realistic 1–2 XMR deposits the fixed surcharges thin out to ~3–4% effective, but the 3.06% spread is amount-independent and by itself contradicts the founder's claimed 1% service fee.\n\n**hidden_fees pattern, not \"high fees\".** Higher fees are fine if disclosed upfront — xmr2cex.com is the reference point: openly states a flat 5% on CEX-routed swaps. SplitNOW's user-visible quote understates what the operator keeps. Support has confirmed via Telegram that partner exchanges 'give slightly worse execution on smaller orders' and offered a manual refund 'for the difference' on direct push-back — that is, the spread is recoverable only by users who notice and complain, not built into the quote.\n\n**Posture caveats:** account creation is anonymous (Web3 wallet signature, no email/phone) but the connected public address is a persistent identifier across sessions; the operator does enforce hardcoded sanctions on Belarus, Cuba, Iran, Russia, Syria (visible in the frontend JS bundle). Backend and SvelteKit frontend are closed-source. UI defaults to Binance/BNB branding even though Binance delisted XMR in 2024 and the actual route is Ethereum ERC-20 — a misleading-network risk for unfamiliar users.\n\n**Project age:** ~8 months online at the time of audit. Iteration window applies — re-test scheduled if the quote-vs-fill gap is addressed (visible spread on the rate card, withdrawal fee equal to the upstream network cost).\n\n**Listed at C** for completeness — the multi-wallet feature is unique enough to be worth knowing about, but we don't recommend it as a primary tool until the fee transparency is fixed.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "xmr_native", "cli_supported", "aggregator", "hidden_fees", "custodial", "closed_source", "web3_signin", "country_blocks", "multi_chain" ], "highlight_tags": [ "HIDDEN-FEES", "NO-KYC", "MULTI-OUTPUT" ], "fees": { "summary": "Effective ~3–8% depending on deposit size and split count. Operator claims 1% service + ~0.2% CEX. Tested gap: 3.06% silent swap spread + 141% markup on the destination CEX withdrawal fee, neither surfaced in the pre-deposit quote." }, "fees_summary": "Effective ~3–8% depending on deposit size and split count. Operator claims 1% service + ~0.2% CEX. Tested gap: 3.06% silent swap spread + 141% markup on the destination CEX withdrawal fee, neither surfaced in the pre-deposit quote.", "last_verified": "2026-05-23", "operating_since": "2025", "tenure_note": "operating_since estimated from about-page heuristic; WHOIS and archive.org both returned no signal", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://splitnow.io", "outbound_slug": "splitnow", "twitter": "https://x.com/splitnow", "telegram": "https://t.me/splitnow_announcements", "discord": "https://discord.gg/splitnow", "affiliate": "https://splitnow.io/@userxzuy" }, "incident": { "date": "2026-05-23", "severity": "low", "summary": "Hidden 3.06% swap spread + 141% withdrawal-fee markup above network cost found in live audit (0.2 XMR test). Support admitted partner-side slippage on small orders and offered manual refund.", "curator_advice": "Use only if you tolerate ~3–6% effective fee for the multi-wallet split convenience. Quote-vs-fill gap is not surfaced before deposit." }, "also_listed_at": { "monerica": true, "kycnot": true } }, { "id": "sshwap", "category": "exchanges", "subcategory": "Instant Swaps", "name": "sshwap", "url": "https://xmr.club/exchanges/sshwap", "twin": "https://xmr.club/llm/exchanges/sshwap.txt", "tagline": "SSH-native crypto swap — connect over SSH (clearnet, Tor, or I2P) instead of a browser. BTC / XMR / Lightning, no account. Estonia corporate anchor (Posterchils Systems OÜ). Own infrastructure.", "review": "**SSH-native crypto swap** — instead of a browser, you connect over SSH from your terminal: `ssh sshwap.com` on clearnet, `ssh` via the .onion for Tor, or via the `.b32.i2p` address for I2P. Trades between **BTC, XMR, and Lightning**. Grade C is the default for a new instant-swap; SSH-native shape and the Estonia corporate anchor are real distinguishers covered below.\n\n**What it is.** A minimalist instant-swap engine whose primary interface is an SSH TUI. No account, no signup, no email. Pick a pair inside the SSH session, receive a deposit address, send funds, receive on confirmation. The clearnet homepage exists to point you at the SSH command; there is no browser-side swap form.\n\n**Access surfaces.** Three transport options with a copy-paste command for each:\n- `ssh sshwap.com` (clearnet)\n- SSH tunneled through Tor to the `.onion` (proxy-command included on the homepage)\n- SSH tunneled through I2P to the `.b32.i2p` address\n\nThe three-transport shape gives the reader control over where the SSH connection egresses from — clearnet for speed, Tor for source-IP shielding, I2P for a garlic-routed alternative.\n\n**Operator identity.** Registered as **Posterchils Systems OÜ in Estonia**. That is an actual named legal entity — not a shell shape, not an anonymous handle. A rare positive on this category, where most listings surface no operator identity at all.\n\n**Independent signals.** Kycnot.me carries an unlisted community-contributed page with an **8/10 overall score, 93/100 privacy, 53/100 trust, KYC level 1/4** — the the top bucket for a new listing that has not yet been team-reviewed. Kycnot's positives called out on that page: no-KYC posture, strict no-log claim, own infrastructure (self-hosted servers, no cloud middleman), identity-free registration, token-based login. Kycnot's cautions: private source code, unclear refund policy stated on the reachable surfaces. Monerica.com also lists the service.\n\n**Tenure.** Domain registered 2026-03-16; operations started 4 months ago per Kycnot's community record. The Estonia corporate registration is separate from domain age and provides an identity floor.\n\n**Contact channels.** Email `support@sshwap.com`, Matrix `#sshwap:kernal.eu`, Telegram `t.me/sshwapcom`. Multi-channel operator presence — you can reach a human without having to rely on a single vector.\n\n**Useful when.** You want a swap without a browser — driving from a script, a `tmux` session on a headless box, an SSH-tunneled workflow. You want to route the swap connection over I2P and not just Tor. You want to see the operator's legal-entity name printed on a real corporate registration.\n\n**Caveats.** **Legal-page surface is inside the SSH session, not on the clearnet homepage.** The clearnet `/about`, `/terms`, `/faq` paths return 404. The refund and dispute-resolution language lives inside the SSH TUI — read it there before your first deposit, and screenshot it if you want a reference-copy for later. **Fresh tenure** (5 months as of listing) — no user-report history at scale yet. **Kycnot flags an unclear refund policy** on the visible surfaces — verify what the SSH session says about refund flow before large swaps. **Source code is private** — you cannot self-audit the TUI logic. **First-swap habits apply**: start small, verify the received amount matches the quoted rate, note the operator's Matrix and Telegram channels before committing size.", "translation_locale": "en", "rating": { "grade": "C" }, "grade": "C", "kyc_tags": [ "anonymous_signup", "no_kyc" ], "feature_tags": [ "escrow", "instant", "tor_mirror", "i2p_mirror", "self_hosted", "lightning" ], "highlight_tags": [ "NO-KYC", "NO-ACCOUNT", "SSH", "TOR", "I2P", "LIGHTNING" ], "fees": { "summary": "Fee schedule is presented inside the SSH session at swap time rather than on a static clearnet page. Verify against a small test swap before scaling." }, "fees_summary": "Fee schedule is presented inside the SSH session at swap time rather than on a static clearnet page. Verify against a small test swap before scaling.", "last_verified": "2026-08-13", "operating_since": "2026-03", "tenure_note": "Domain registered 2026-03-16; ~5 months of operation. Kycnot.me records the service as started 4 months ago, aligned with domain age. Corporate anchor (Estonia OÜ) provides an identity floor separate from domain age.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://sshwap.com/", "tor": "http://sshwapml4ym3epfe3ydedks7ggxuagmm3vg62bzznlip6s7fqt6lmoyd.onion/", "i2p": "http://dkzoxsrhxraog5m7b2px2oou3t3zqhrapi2eb4jiatys4xfr7hda.b32.i2p/", "matrix": "https://matrix.to/#/#sshwap:kernal.eu", "telegram": "https://t.me/sshwapcom", "email": "mailto:support@sshwap.com", "outbound_slug": "sshwap" }, "also_listed_at": { "kycnot": { "url": "https://kycnot.me/service/sshwap", "score_overall": 8, "score_privacy": 93, "score_trust": 53, "kyc_level": 1 }, "monerica": { "url": "https://monerica.com/site/sshwap" } } }, { "id": "stealthex", "category": "exchanges", "subcategory": "Instant Swaps", "name": "StealthEX", "url": "https://xmr.club/exchanges/stealthex", "twin": "https://xmr.club/llm/exchanges/stealthex.txt", "tagline": "Floating-rate swap, broad coin coverage. First-party observed shotgun-KYC 2026-07-30 on a >$10k swap — user received a KYC link mid-flow; operator explained the trigger as LE-flagged funds; the detection logic is not published. Treat >$10k amounts (or funds with complex prior history) as at-risk for KYC-at-cashout.", "review": "**⚠ Grade demoted A → C on 2026-07-30** — first-party verified shotgun-KYC event: on a swap exceeding \\$10k, StealthEX sent the user a KYC-verification link mid-flow, contradicting the previously-marketed \"Anonymous\" posture. Operator later explained the trigger as LE-flagged funds; the detection logic is undisclosed, so from a user perspective the KYC pipeline is unpredictable pre-deposit.\n\n**Reader advice.** For swaps under \\$10k, StealthEX still operates as anonymously as before. For amounts >\\$10k or funds with complex prior chain-analysis history, treat as **at-risk for fund loss** — completing KYC does not guarantee your funds are returned; in the shotgun-KYC pattern observed on other operators, funds are frequently lost regardless. If the amount matters, route via a different engine.\n\n---\n\n*The rest of this review reflects StealthEX's positioning pre-2026-07-30 and is preserved for audit continuity — the operational specs, longevity, and peer-directory attribution all remain accurate.*\n\nStealthEX is the long-running anonymous-swap operator with **broad coin coverage**, a low ~0.4% spread on floating-rate orders, and a published **single-use virtual card** sister product (listed separately at xmr.club under Cards). Listed at **Grade A** because StealthEX has the operational longevity (7+ years, since 2018), the cross-product ecosystem (swap + card from one operator), and the consistent peer-directory recognition (KYCnot, web3privacy) that puts it in the upper tier of no-KYC swap aggregators alongside Exolix, FixedFloat, and LetsExchange — without forcing a fixed-rate-only model on users who want the tightest floating spread.\n\n**Background.** StealthEX has operated as an anonymous instant-swap aggregator since 2018, predating most of the current Grade-A cohort. Routes through upstream exchanges, non-custodial in the steady state, no signup required, multi-language UI, REST API for integrators. Cross-listed in KYCnot and web3privacy peer directories. The operator ships a **virtual card** product (separate listing at xmr.club under Cards) that lets users top up a single-use VCC from crypto — a meaningfully different surface from the core swap engine but built and run by the same team. That's the ecosystem signal: a swap-only operator can disappear, but an operator running two interlocking products has structurally higher reputational stakes.\n\n**What you trust.** Non-custodial routing in normal operation — wallet sends crypto in, operator routes through upstream exchanges, wallet receives swap output. **Custody window**: short routing-leg only, similar pattern to Exolix / LetsExchange / Trocador. **AML screening**: applied at the upstream exchange layer; StealthEX's stated policy mirrors the no-KYC-aggregator norm — they pass deposits to upstream exchanges which apply their own screening, and StealthEX itself doesn't add a secondary screening pass. **Refund policy**: in the event of upstream rejection (rare but not zero), StealthEX returns funds to a user-provided refund address; whether KYC is requested for the refund is the variable to watch — community reports across recent threads describe refunds completing without KYC demands, but the policy isn't as explicitly committed as CCE.cash's \"refund-on-refusal\" architectural pledge.\n\n**Operational specs.** **Coin coverage**: hundreds of cryptocurrencies including XMR, BTC, BCH, ETH, USDT (multiple chains), USDC, LTC, plus a wide altcoin long tail (broader than Exolix on the long tail per peer-directory comparisons). **Rate model**: **floating-rate** (best available, not locked, ~0.4% typical spread on retail volumes) + **fixed-rate option** (locked-in amount, small premium, guaranteed delivery quantity). **Trade size range**: small to mid (typically $20 to ~$50k; very large trades may hit upstream-liquidity constraints similar to peer aggregators). **API**: published REST API used by partner integrations + this directory's swap aggregator routes through StealthEX as one of its engines. **Confirmations**: standard Monero confirmation count (~10 blocks) for XMR receives; faster on the BTC side using upstream-exchange conventions. **Virtual card sister product**: single-use VCC funded by crypto; the card itself is a separate listing under xmr.club's Cards category — relevant here as cross-product trust signal, not as functionality of the swap engine.\n\n**Philosophy.** StealthEX's editorial differentiator is the **swap-plus-ecosystem** posture. Exolix is the fixed-rate specialist with OrangeFren backing; FixedFloat is the fast-finalisation specialist; Trocador is the transparency-aggregator. StealthEX sits a step further out — broad coin coverage, low spread on floating, plus a sister card product. The trade-off: not the most distinctive single-feature in the category (each peer has its sharper hook), but the operator's multi-product structure gives the listing a different kind of stability. An operator running two interlocking products has structurally higher reputational stakes than a swap-only operator — if the swap engine misbehaves, the card brand absorbs the damage too.\n\n**Grade rationale.** Grade A reflects: long-running operational continuity (since 2018, 7+ years); broad coin coverage including XMR (multi-chain USDT, USDC, LTC, plus altcoin long tail); ~0.4% floating-rate spread (competitive with category leaders); fixed-rate option for users who want quote certainty; published REST API; multi-language UI; cross-listed in KYCnot / web3privacy peer directories; sister virtual-card product (separate xmr.club listing) signalling multi-product operator structure; absence of major refund-dispute or fund-freeze threads in community discussion. Last verified 2026-05-12.\n\n**Useful when.** You want a floating-rate swap with category-leading spread (~0.4%) and don't need fixed-rate certainty. You want broad coin coverage including the altcoin long tail (StealthEX tends to support coins that some Grade-A peers don't). You're using this directory's aggregator UI — StealthEX is one of the engines we route through. You want to pair the swap with StealthEX's virtual card (Cards category) for a consistent operator across both surfaces. You want an operator with multi-product reputational stakes rather than a single-feature aggregator.\n\n**Caveats.** **Custody during routing** — short window, but it's not zero; treat as \"trust the operator for the routing minutes, not long-term.\" **Upstream AML applies regardless** — StealthEX doesn't add screening, but the upstream exchange filling the swap may apply its own; if your funds are flagged at the upstream layer, the swap may be refunded or held. **No operator-published Tor mirror** — clearnet only at the time of this review; route through a Tor bridge yourself if you need .onion access. **No external recourse guarantee** — unlike Exolix (OrangeFren $4,000 backing) or Trocador (provider-transparency commitments), StealthEX's recourse is operator policy only; if the operator goes rogue, no third-party guarantee pool exists for users to claim against. **Closed-source routing engine** — like most aggregators in the category; community recognition + multi-product operator structure substitute for code-level auditability. **The card sister product is a separate trust evaluation** — the swap engine being reliable doesn't transitively prove the card product is; treat the Cards-category listing on its own merits, not as a sub-feature of this swap listing.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [], "feature_tags": [ "api_available", "shotgun_kyc_undisclosed" ], "highlight_tags": [ "NO-KYC", "MANY-COINS" ], "fees": { "summary": "~0.4% spread · floating + fixed" }, "fees_summary": "~0.4% spread · floating + fixed", "last_verified": "2026-07-30", "operating_since": "2018", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2018", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://stealthex.io", "outbound_slug": "stealthex", "affiliate": "https://stealthex.io/?ref=uMlT5HTHrM", "contact_email": "support@stealthex.io", "twitter": "https://x.com/StealthEX_io", "telegram": "https://t.me/StealthEX" }, "incident": { "date": "2026-07-30", "severity": "high", "summary": "First-party verified shotgun-KYC event: on a swap exceeding \\$10k the operator sent the user a KYC-verification link mid-flow, contradicting the previously-marketed \"Anonymous\" posture. Operator explained the trigger as LE-flagged funds; the detection logic is not published, so from a user perspective the KYC pipeline is unpredictable pre-deposit. Completing KYC does not guarantee funds are returned — in the shotgun-KYC pattern observed elsewhere, funds are frequently lost regardless.", "curator_advice": "For swaps under \\$10k, StealthEX still operates as anonymously as before. For amounts >\\$10k or funds with any complex prior chain-analysis history, treat as at-risk for fund loss — completing KYC does not guarantee your funds are returned. If the amount matters, route via a different engine.", "source_url": "https://xmr.club/exchanges/stealthex" }, "also_listed_at": { "web3privacy": true, "kycnot": true, "monerica": true } }, { "id": "stereoswap", "category": "exchanges", "subcategory": "Instant Swaps", "name": "StereoSwap", "url": "https://xmr.club/exchanges/stereoswap", "twin": "https://xmr.club/llm/exchanges/stereoswap.txt", "tagline": "\"Anonymity by default. Erasure by choice.\" Privacy-first no-KYC swap exchange with **Oblivion Mode** (15-min in-memory, zero-trace), Tor v3 mirror, published live reserves, and a partner OpenAPI. Single-brand operator with own liquidity — not a meta-aggregator.", "review": "Privacy-first no-KYC swap exchange with their own liquidity, Tor v3 reachable, Oblivion Mode for ephemeral swaps, and published live reserves. **Grade B held only by lack of operating history** — every other front-door bar (no-KYC, transparent fees, no logs, real Tor mirror) is cleared. Recommend small-first-trade pattern until we run the 90-day re-test.\n\n**Background.** Single-brand operator with their own liquidity pools (not a meta-aggregator routing through CN / FixedFloat / SimpleSwap). End-user flow is anonymous — no signup, no email, no auth of any kind. The operator describes the project as *\"a refuge — not a product\"* and positions Monero explicitly as \"a foundation for private value exchange.\"\n\n**Operator philosophy.** Their own framing — *\"We are not a company. We are not a brand. We are an autonomous mechanism.\"* — *\"We operate pseudonymously and communicate only via encrypted channels. Not because we're hiding — but because your trust shouldn't depend on people. It should depend on code.\"* — *\"Why should you trust us? You shouldn't. You should trust math, code, and your own due diligence.\"* This is unusually direct: most operators ask for trust; StereoSwap explicitly refuses to. The directory respects that posture and grades accordingly — we don't credit anonymous teams negatively when the architecture (non-custodial, no logs, Oblivion Mode, published reserves) carries the trust weight.\n\n**Oblivion Mode — headline feature.** A 15-minute in-memory swap mode where nothing is persisted — per the operator, *\"even we can't recover it.\"* The swap exists only in volatile memory and self-destructs at the 15-min mark. Real zero-state mode is rare among aggregators; most no-KYC instant-swap competitors retain at least the order metadata for support purposes. If you're using StereoSwap for sensitive flows (whistleblowing, journalism, OPSEC-sensitive personal trades), Oblivion Mode is the differentiator to lean on.\n\n**Live reserves (transparent).** The operator publishes a live-reserves panel showing real-time balances per supported coin (SOL, XMR, etc., \"Open reserves. Closed identity.\"). Transparent solvency telemetry is rare among instant-swap operators — most refuse to publish reserve data because it exposes liquidity ceilings. StereoSwap publishing this is a credibility move: solvency-floor visibility lets a user upper-bound the size of trade they should attempt against the published reserve.\n\n**No-log claim.** Regular (non-Oblivion) mode stores \"only the minimal technical data required to complete your swap\" — explicitly no IPs, no cookies, no fingerprinting. This is a published claim, not curator-verified; small-first-trade pattern still recommended.\n\n**Tor.** Onion v3 mirror: `arrzkvly4x4gmw6yaigypafexqqxnckmsk2lidudqmngsl7oqb53ieyd.onion`. Reach matters for users in restricted networks.\n\n**AML posture (disclosed).** Inbound funds are address-screened. When the operator flags a deposit as terrorism-financing or stolen funds, they **refund the sender** (not freeze, not report). Same shape as ChangeNOW / FixedFloat / SimpleSwap. Surfaced here because users with reuse-flagged wallets should expect a refund-and-retry-from-clean-wallet flow.\n\n**Operational specs.**\n- Coverage: 1500+ coins (per their landing copy), with self-described \"deep reserves in privacy coins, especially Monero\"\n- XMR confirmations: 10 standard, 5-7 for small orders (progressive — better than the flat-12 most aggregators run)\n- Order expiration: 30 minutes\n- Spread: ~0.8-1% (fees included in the rate — no separate platform fees or withdrawal markups shown to the user)\n- Fees included in rate — operator explicitly claims \"no hidden fees\"\n- Partner API: OpenAPI 3.1 spec at `/partner/openapi.json`, X-API-Key auth, calculate / create / status endpoints. Partner-API access requires email signup (integrators only; end-user swap stays accountless)\n- Support: Matrix (`@stereoswap:matrix.org`), **Simplex** (`StereoSwap`), Telegram (`t.me/stereoswap`, community `t.me/stereoswap_community`), email (`support@stereoswap.app`)\n\n**Independent, no VC.** Per the team, *\"no VC, no outside control.\"* That's a curator-relevant trust signal — incentives aren't externally pre-shaped by an investor-return clock.\n\n**Grade B.** Held at B because we have no operating-history observation window yet. They cleared every front-door bar — no KYC, transparent fees claim, real OpenAPI surface, Tor mirror, privacy mode, Matrix support. What's missing is **time**. A requires ≥6 months observable uptime, no major complaint signal in monitored channels, and at least one independent peer listing.\n\n**Useful when:**\n- You want a privacy-first no-KYC swap and **Oblivion Mode** matters to your threat model (whistleblowing, journalism, OPSEC-sensitive personal flows)\n- You want an operator with their own liquidity (not a meta-aggregator) that publishes commission structure, fee policy, and live reserves upfront\n- You need a Tor v3 reachable swap with no log retention\n\n**Caveats:**\n- New listing; no track record on the directory yet — start with small trades\n- Single-source trust signal (operator's own communication + FAQ). No independent peer listing yet\n- Address-screening can trigger refunds for funds from reuse-flagged wallets — fund from a clean wallet to avoid friction\n- \"No hidden fees\" claim not yet curator-verified; pending test trade\n- **Legal-page gap**: footer links to \"Terms of Use\" and \"Privacy Policy\" but `/en/terms` and `/en/privacy` currently 404. Curator flagged for operator follow-up — substantive policies need to be published, not just linked", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available", "tor_supported", "aml_screening", "transparent_fees" ], "highlight_tags": [ "OBLIVION-MODE", "NO-KYC", "TOR-V3", "LIVE-RESERVES", "NEW" ], "fees": { "summary": "Spread ~0.8-1%. Fees in rate. 30-min order window." }, "fees_summary": "Spread ~0.8-1%. Fees in rate. 30-min order window.", "last_verified": "2026-05-24", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://stereoswap.app", "affiliate": "https://stereoswap.app?referral_code=VypPnOlt", "api_docs": "https://api.stereoswap.app/partner/openapi.json", "matrix": "https://matrix.to/#/@stereoswap:matrix.org", "telegram": "https://t.me/stereoswap", "community_telegram": "https://t.me/stereoswap_community", "outbound_slug": "stereoswap", "tor": "http://arrzkvly4x4gmw6yaigypafexqqxnckmsk2lidudqmngsl7oqb53ieyd.onion", "email": "mailto:support@stereoswap.app", "simplex": "StereoSwap", "contact_email": "support@stereoswap.app", "twitter": "https://x.com/Stereo_swap" }, "also_listed_at": { "monerica": true, "kycnot": true } }, { "id": "swap-bz", "category": "exchanges", "subcategory": null, "name": "Swap.bz", "url": "https://xmr.club/exchanges/swap-bz", "twin": "https://xmr.club/llm/exchanges/swap-bz.txt", "tagline": "No-account, no-KYC instant swap — BTC/ETH/XMR/SOL/USDT and 100+ coins, 0.5% Standard or 1% Private (a multi-hop route via XMR that thins the on-chain trail). Pass-through, web + Telegram.", "review": "**A no-account, no-KYC instant swapper with a Monero-forward privacy option.** Swap.bz gives you a live quote, you send to a one-time deposit address, and it pays out to the address you pasted — no signup, no ID, no balance held in your name. It routes BTC/ETH/**XMR**/SOL/USDT and 100+ coins, with **XMR available both ways** (BTC↔XMR, ETH↔XMR, USDC↔XMR, etc.). Two tiers: **0.5% Standard**, or **1% Private** — a deliberate multi-hop route, often *through Monero*, that thins the on-chain link between what you send and what you receive.\n\n**Custody & screening.** It's pass-through, not custodial-by-name, but as with any instant swap the operator briefly controls funds mid-route — so this is not \"non-custodial\" in the atomic-swap sense. There's a Terms of Service, and per its own copy, *partners may still screen a flagged deposit address* — i.e. AML screening exists at the upstream/partner level, standard for an aggregator.\n\n**Why C.** The privacy design is good and the XMR support is first-class, but the grade reflects an unverified operator on a high-trust shelf. The **swap.bz domain has web-archive snapshots back to 2015, yet the current Swap.bz branding is recent (© 2026)** — so long domain age does not confirm a long *operator* track record, and we can't yet vouch for one. It lifts to B- on verified tenure plus a clean curator test-swap. A capable, privacy-minded swapper; C until the operator history is established.", "translation_locale": "en", "rating": { "grade": "C", "trust": "No-account, no-KYC instant swap aggregator. Pass-through (one-time deposit, pays to your address) — NOT non-custodial (operator controls funds mid-route). ToS present. Partners may screen flagged deposit addresses (upstream AML, standard). Domain has web-archive snapshots since 2015 but current Swap.bz branding is recent (© 2026); operator continuity unverified -> C on the exchange shelf. Lifts to B- on verified tenure + clean curator test-swap.", "privacy": "No account, no ID; you swap from wallets you control. XMR both ways. Optional 1% Private = deliberate multi-hop route, often via Monero, to thin the on-chain link between deposit and receive. Caveat: instant-swap payout addresses can be clustered by chain analysis; the Private route mitigates but does not equal an atomic swap.", "ux": "Live quote then send; web + Telegram bot. BTC/ETH/XMR/SOL/USDT + 100+ (stables on ERC-20/TRC-20/Base/Solana). Standard ~20-40 min on BTC/XMR; Private 15-45 min. Fees shown in-quote." }, "grade": "C", "kyc_tags": [ "NO-KYC" ], "feature_tags": [ "xmr", "no_kyc", "instant_swap", "aggregator" ], "highlight_tags": [ "XMR", "NO-KYC", "NO-ACCOUNT", "INSTANT-SWAP", "TELEGRAM" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-31", "operating_since": null, "tenure_note": "swap.bz domain has Wayback snapshots since 2015-01, but current Swap.bz branding/site is recent (© 2026) — operator continuity across that span is NOT verified. Graded C pending confirmation of operator history; lifts on verified tenure + clean curator test-swap.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://swap.bz", "telegram": "https://t.me/SwapbzBot", "outbound_slug": "swap-bz" }, "also_listed_at": { "monerica": true, "kycnot": true } }, { "id": "swapgate", "category": "exchanges", "subcategory": "Instant Swaps", "name": "Swapgate", "url": "https://xmr.club/exchanges/swapgate", "twin": "https://xmr.club/llm/exchanges/swapgate.txt", "tagline": "Instant swap aggregator — XMR / BTC / ETH / USDT plus long tail across 150+ networks. Widely used. Operator publishes both a \"no-KYC, no wallet tracking, full privacy\" front-page pitch AND a fully documented AML/KYC policy that says \"creating an order = consent to AML/KYC review\" with funds held during the review window. Transparent about the contradiction rather than hiding it; still a two-postures shape that caps at Grade C for privacy-honesty reasons.", "review": "**Swapgate is an instant swap aggregator** — 150+ networks, XMR / BTC / ETH / USDT and a long altcoin tail. Non-custodial in the steady state (upstream-routed), no signup required for standard swaps (Registration exists but is optional). API v1 (no-auth) + API v2 (auth) for integrators. Real documentation (terms, privacy, AML, law-enforcement, FAQ, blog). Live chat + Telegram support. Widely used across the aggregator ecosystem.\n\n**Tenure.** Earliest earliest web-archive snapshot **2021-12-26** — 4+ years of continuous operation. The mature tenure lifts Swapgate above the tenure-fresh C-default, but the category (AML-triggered instant-swap aggregator, per the operator's own published AML/KYC policy) sets the honest anchor at C: clean funds pass through, complicated on-chain history may not. Grade C here is the category rule, not a tenure penalty.\n\n**The two-postures shape.** Swapgate is honest about the same shape other instant-swap engines have — the front page and a policy page each tell one half of the story. If you read both, the picture is coherent; if you read only one, you get a false impression.\n\n**Front-page pitch (/private-swaps).** *\"Swap crypto anonymously on a no-KYC, non-custodial exchange — no registration, no wallet tracking. 150+ networks, best rates, full privacy.\"* The page argues directly against mixers (calls its own model a \"legally clean route\") and against CEX (no account, no data) and DEX (disposable address breaks the on-chain link). Solid privacy argumentation for the routine-swap case.\n\n**AML policy (/docs/aml-policy).** Full-scope AML program: **5AMLD-compliant** (EU Fifth Anti-Money Laundering Directive), in-house AML officer, named Money Laundering Reporting Officer, Ongoing Monitoring of processed transactions, Customer Due Diligence, Enhanced Due Diligence on trigger, cooperation with government authorities \"in cases established by law\". The consent clause is explicit: *\"By creating an order on the website, the Client confirms consent to the possibility of being subject to an AML/KYC review\"*. If a review triggers, the crypto is *\"held on balance\"* during the check. AML/KYC procedures are carried out both by Swapgate's own AML officer AND by the liquidity provider's compliance layer.\n\n**Law-enforcement page (/docs/law-enforcement).** Publicly documented process for LE agencies to request customer and transaction data. Not hidden, not obscured — the operator wants the process to be smooth on that side too.\n\n**What this means at the user level.** Two modes explain what happens to any specific swap:\n\n- **Ordinary swap:** goes through no-KYC as advertised. Disposable address, no registration, funds routed and delivered. This is the typical experience.\n- **AML/KYC-triggered swap:** any transaction can be pulled into review under the ongoing-monitoring layer or the liquidity-provider's screening. Funds are held on balance during the check. Enhanced Due Diligence, potential document requests. Trigger criteria are not enumerated but the process is spelled out.\n\nThe critical distinction from operators that hide this shape: Swapgate **publishes the policy in full and requires explicit consent at order creation**. You are not surprised mid-flow. That's a real transparency-plus over aggregators that keep the AML pipeline unadvertised until it fires on a specific user.\n\n**Peer signal.** Widely used across the aggregator layer; not a fresh listing. Mature documentation (API v1 + v2, blog going back to at least July 2024, established affiliate program) indicates real operator continuity. Not yet tracked by kyc.rip's chain-observation layer — no first-party settlement-timing data at listing time.\n\n**Reader advice.** Suitable for routine swaps of clean-provenance funds where the front-page \"no-KYC\" claim will hold in practice. Not suitable for large amounts or funds specifically depositing to escape chain-analysis — the AML/KYC-review clause and fund-hold mechanism are real. Consent-at-order-creation is documented, so you cannot say you were not warned; the policy is on the site to read. If your amount matters and you want zero AML-review exposure, route via an atomic-swap engine ([Haveno](/exchanges/haveno)) or a self-custody P2P engine ([Bisq](/exchanges/bisq), [Bisq Easy](/exchanges/bisq-easy), [RoboSats](/exchanges/robosats)) where no operator holds funds during the process.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [], "feature_tags": [ "aml_screening_documented_5amld", "consent_flagged_at_order", "le_cooperation_documented", "api_v1_no_auth", "api_v2_auth", "affiliate_program" ], "highlight_tags": [ "MANY-COINS", "CROSS-CHAIN", "NO-KYC" ], "fees": { "summary": "Aggregator markup varies by pair · check the reserve panel per-swap" }, "fees_summary": "Aggregator markup varies by pair · check the reserve panel per-swap", "last_verified": "2026-08-11", "operating_since": "2021-12", "tenure_note": "Earliest web-archive snapshot 2021-12-26. `operating_since` set to the earliest signal.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://swapgate.io", "outbound_slug": "swapgate", "affiliate": "https://swapgate.io/exchange-usdttrc20-btc?ref=aff_1515", "contact_email": null, "twitter": null, "telegram": null, "logo": "https://swapgate.io/favicon/apple-touch-icon.png" }, "also_listed_at": { "kycnot": true } }, { "id": "swapuz", "category": "exchanges", "subcategory": "Instant Swaps", "name": "Swapuz", "url": "https://xmr.club/exchanges/swapuz", "twin": "https://xmr.club/llm/exchanges/swapuz.txt", "tagline": "Cross-chain bridge + swap, no-KYC for retail.", "review": "Bridge-leaning instant swap. Covers pairs the spot-only aggregators don't reach.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "BRIDGE", "NO-KYC" ], "fees": { "summary": "~0.5-1% spread · floating" }, "fees_summary": "~0.5-1% spread · floating", "last_verified": "2026-05-14", "operating_since": "2021", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://swapuz.com", "outbound_slug": "swapuz", "affiliate": "https://swapuz.com/?ref=db0fdff0-1685-49fc-91cd-0242e459bf12" }, "also_listed_at": { "orangefren": true, "kycnot": true, "monerica": true } }, { "id": "swapzilla", "category": "exchanges", "subcategory": "Aggregators", "name": "SwapZilla", "url": "https://xmr.club/exchanges/swapzilla", "twin": "https://xmr.club/llm/exchanges/swapzilla.txt", "tagline": "Crypto rate aggregator across 8+ providers — non-custodial, no signup, Tor v3 mirror.", "review": "SwapZilla is a non-custodial swap aggregator: you enter a wallet address, it pulls live quotes from 8+ vetted providers, you pick the best rate, funds route directly between you and the provider with SwapZilla as a neutral dispute layer (per their FAQ). No account, no email, no KYC. ~0.2s quote speed across 500+ tokens and 100+ networks, including cross-chain. They also expose a merchant-pay flow (HMAC-SHA256 signed webhooks) and a Tor v3 mirror.\n\nFee posture is transparent: SwapZilla adds no fee on top of the provider's rate (spread / markup is baked into each upstream quote, like Trocador / FixedFloat). For privacy-conscious flows they highlight a 'Private Swap' (Monero hop) and DeFi modes.\n\nLegal documentation is in place: Terms of Service, Privacy Policy, and AML Policy are all live (at `/terms-of-service`, `/privacy-policy`, `/aml-policy`).\n\n**Caveats** — this is a brand-new operator. The @swapzilla_io X handle was created 2026-04-13 (six weeks before this listing), follower / volume signals are still nascent, and the team identity behind the operator is not publicly disclosed. Grade: C with revisit in 90 days. Treat as 'try with small amounts first' until they accumulate operator history.", "translation_locale": "en", "rating": { "grade": "C" }, "grade": "C", "kyc_tags": [ "anonymous_signup", "no_email", "no_personal_data" ], "feature_tags": [ "aggregator", "tor", "non_custodial", "api_available", "webhook" ], "highlight_tags": [ "NEW_OPERATOR" ], "fees": { "summary": "0% added on top of provider rate; spread is embedded in each upstream quote (verify in widget before confirming)." }, "fees_summary": "0% added on top of provider rate; spread is embedded in each upstream quote (verify in widget before confirming).", "last_verified": "2026-05-28", "operating_since": "2026", "tenure_note": "X handle @swapzilla_io created 2026-04-13 (~6 weeks before listing)", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://swapzilla.io", "tor": "http://6vhcr3rsjrlyu4fpgsumc7jalp7db5q6oygb5555gstijuhtpyau6oid.onion", "twitter": "https://x.com/swapzilla_io", "telegram": "https://t.me/swapzilla_support_bot", "contact_email": "bd@swapzill.io", "outbound_slug": "swapzilla" }, "also_listed_at": { "kycnot": true } }, { "id": "thorchain", "category": "exchanges", "subcategory": "DEX / On-Chain", "name": "THORChain", "url": "https://xmr.club/exchanges/thorchain", "twin": "https://xmr.club/llm/exchanges/thorchain.txt", "tagline": "Cross-chain liquidity protocol — native BTC, ETH, BCH, LTC, XMR.", "review": "THORChain is the **native cross-chain liquidity protocol** — the only production-grade DEX that lets users swap BTC↔ETH↔XMR↔BCH↔LTC without wrapping, bridging via custodial intermediaries, or trusting a centralised operator with the swap output. XMR was added natively in 2025; the protocol is the structural inverse of the no-KYC aggregators (Exolix, StealthEX, SideShift) — instead of routing through upstream centralised exchanges, THORChain is its own settlement layer. Listed at **Grade A** for the unique architecture and the multi-year operational track record. **Critical context: an active security incident is in progress** — see the dedicated section below. The Grade A is currently held *conditionally* pending verifiable post-mortem and pool resumption; if you're considering a swap right now, verify the live pool status at our /thorchain page or the protocol's own dashboard before committing funds.\n\n**Active incident (2026-05-15).** On 2026-05-15 a **TSS-key cryptography flaw** in THORChain's threshold-signing infrastructure was exploited, draining approximately **$10.8M** from Protocol-Owned-Liquidity (POL) vaults across BTC, ETH, BNB-Chain, and Base. The protocol responded by **pausing trading and signing**. As of the last curator verification (2026-05-21), recovery is in progress with a published incident report at thorchain.org/blog/thorchain-exploit-report-1. **Curator advice**: do not open new trades until THORChain unpauses the affected pools. The XMR pool may resume earlier than EVM legs (different signing surface); confirm pool status on our /thorchain page or the protocol's dashboard before any swap. This incident is the reason the Grade A is held *conditionally* — the protocol's response (rapid pause, public post-mortem, no user-fund losses claimed for non-POL liquidity) is well-handled, but the underlying TSS vulnerability is a serious architectural concern that requires verifiable remediation.\n\n**ADR-028 update (2026-05-22).** The THORChain team released **ADR-028** (architecture decision record) seven days after the incident, currently up for Node Operator vote. Key points: (1) **no new RUNE minted** — recovery doesn't dilute existing token holders, (2) **losses absorbed by Protocol-Owned Liquidity (POL)** — not user funds; the protocol's own liquidity reserves take the loss, (3) **focus shifting to slower, more security-focused development** — explicit acknowledgement that the post-incident velocity will be lower than pre-incident. The network remains paused pending the vote passing and the vulnerability patch deploying. This is the response privacy infrastructure wants to see from incident-handling — no token-dilution rug, no user-fund socialisation, public commitment to slower-development tradeoff. It does not retroactively erase the underlying TSS vulnerability, but it does materially improve the case for the conditional A grade being editorially defensible.\n\n**Background.** THORChain has been operating as a cross-chain liquidity protocol since the late-2010s, building toward the native-asset DEX architecture that went live in production around 2021. The protocol uses **threshold signature schemes (TSS)** to manage multi-chain custody — vault keys are split across protocol nodes, and a threshold of nodes must cooperate to sign withdrawals. Native chain support is the structural differentiator: most \"cross-chain\" protocols bridge via wrapped tokens (wBTC, wETH, etc.), which adds bridge-risk to swap-risk. THORChain settles swaps using the actual chain's native assets — real BTC, real XMR, real ETH. Open-source codebase, public node operation, RUNE token aligns node-operator incentives. XMR was integrated in 2025; the kyc.rip aggregator routes through THORChain with the affiliate code \"kycrip\" (referral revenue shared back into the directory).\n\n**What you trust.** **TSS multi-node signing** — vault keys are sharded across the validator set; no single node can move user funds. **BFT consensus** on the THORChain L1 — node operators are economically aligned via RUNE staking and slashing. **Open-source code + public node operation** — anyone can audit the code, anyone can run a node. **Native asset settlement** — when you swap BTC→XMR, real BTC enters a TSS-managed BTC vault and real XMR is paid from a TSS-managed XMR vault, no bridge tokens involved. **Non-custodial UX** — the wallet user signs each swap; the protocol custody is only for the in-flight routing window. **The 2026-05-15 incident exposed**: that the TSS layer itself has a cryptographic surface that's not infallible. The trust model isn't broken (no single-party custody, no operator-rug) but it does mean \"TSS = mathematically secure\" is a stronger claim than the empirical track record now supports. Post-incident, treat TSS-protected DEX vaults as \"high-grade-but-not-zero-trust.\"\n\n**Operational specs.** **Native chain support**: BTC, ETH, BCH, LTC, **XMR** (added 2025), BNB-Chain, Base, AVAX, Cosmos. **Rate model**: **slip-based AMM** — fee is proportional to swap size relative to pool depth, with a small outbound fee on top. **Spread**: typically ~0.3-1% on large swaps ($1k+); much higher on small swaps where the slip-fee dominates (best avoided for sub-$200 trades). **Trade size sweet spot**: $1k-$1M depending on pool depth; very large swaps require checking the per-pool TVL to avoid slip-fee blowups. **Confirmations**: chain-native — Monero side uses standard XMR confirmation count (~10 blocks); BTC side uses native-BTC confirmation (~6 blocks recommended); other chains per their consensus requirements. **kyc.rip integration**: this directory's aggregator UI routes through THORChain with affiliate code \"kycrip\" — revenue share back to xmr.club. Status feed live at kyc.rip/thorchain showing pool status, incident-mode flags, and live quotes. **No KYC under any circumstances** — protocol-level architecture, not operator policy; there's no centralized party to demand KYC even if pressured.\n\n**Philosophy.** THORChain's editorial differentiator is the **native-asset cross-chain protocol** model. Aggregators (Exolix, StealthEX, SideShift) route through upstream centralised exchanges and inherit those exchanges' AML/KYC stances — THORChain is a protocol, not a service, so the trust model is structurally different. Compared to other cross-chain bridges: most bridges use wrapped tokens (wBTC etc.) which introduces bridge-asset risk *on top of* swap risk; THORChain settles in native assets so the only failure mode is the protocol itself. The 2026-05-15 incident proves that \"the protocol itself\" *is* a failure mode worth taking seriously — the TSS layer is the protocol's trust frontier, and TSS cryptography is harder than \"it works in theory, so it works in practice\" suggests.\n\n**Grade rationale.** Grade A reflects: unique architecture (only production native-asset cross-chain DEX with XMR); multi-year operational continuity; open-source codebase and public node operation; native XMR support since 2025; broad chain coverage (BTC / ETH / BCH / LTC / XMR / BNB / Base / AVAX / Cosmos); excellent fee profile on large swaps (~0.3-1%); kyc.rip integration with affiliate revenue share back to the directory. **The Grade A is held conditionally pending the 2026-05-15 TSS-incident resolution** — specifically: (1) verifiable post-mortem confirming the exact root cause, (2) public confirmation that TSS-vulnerability remediation is shipped to production, (3) sustained operation post-resumption without secondary incidents. **Re-evaluation trigger**: xmr.club will reassess this grade by **2026-08-15** (90 days post-incident) or earlier if the protocol resumes full operation with public post-incident remediation. If the protocol fails to provide verifiable remediation by 2026-08-15, the grade is at risk of downgrade. Last verified 2026-05-12, incident verified 2026-05-21.\n\n**Useful when.** **(Post-incident-resolution only)** you're doing a large swap ($1k+) between two native assets and want the protocol-grade trust model rather than aggregator-routes-via-Binance. You want native XMR ↔ BTC ↔ ETH cross-chain liquidity without wrapped tokens. You're swap-routing through the kyc.rip aggregator and THORChain is one of the engines (affiliate code \"kycrip\" set). You're a developer building cross-chain UX and want the canonical native-asset DEX as the underlying protocol. You hold RUNE or operate a node and have direct stake-aligned exposure to the protocol's economic security. **For now (while incident is active)**: do not open new trades unless the relevant pool is explicitly resumed.\n\n**Caveats.** **ACTIVE 2026-05-15 INCIDENT** — see dedicated section above; verify pool status before any swap. **Fees are slip-based and punitive on small swaps** — sub-$200 trades may see 5-15%+ effective spread because the slip-fee dominates; use aggregator engines for retail-sized swaps and THORChain for the large-size sweet spot. **TSS architecture has a non-trivial cryptographic surface** — the May 2026 incident exposed a real flaw; treat post-incident TSS as \"high-grade-but-not-zero-trust\" rather than infallible. **Cross-chain settlement times vary** — XMR side is ~10-block standard; faster chains finalise sooner; expect 20-40 minutes end-to-end for typical swaps. **Slip-fee depends on pool depth** — a swap that's large relative to the pool gets a high slip; for >$50k swaps, check per-pool TVL or split the trade across multiple legs. **RUNE token volatility** — the protocol's economic security depends on RUNE's market cap relative to the locked liquidity; RUNE has had significant price volatility historically. **Protocol-paused-state surprises** — when pools are paused (e.g. post-incident), depositing into a paused pool can result in funds being held until resumption; check live status before each trade. **Affiliate disclosure** — kyc.rip earns a referral share from swaps routed through THORChain via the \"kycrip\" affiliate code; this revenue flows back to the directory and the curator's editorial separation policy is documented at /transparency.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "xmr_native", "api_available" ], "highlight_tags": [ "DEX", "CROSS-CHAIN", "XMR-NATIVE", "INCIDENT-2026-05" ], "fees": { "summary": "Outbound fee + slip-based liquidity fee · ~0.3-1% on big swaps" }, "fees_summary": "Outbound fee + slip-based liquidity fee · ~0.3-1% on big swaps", "last_verified": "2026-05-25", "operating_since": "2022", "tenure_note": "THORChain mainnet launched June 2022. Project founded 2018 but pre-mainnet activity was testnet only — tenure here tracks the user-facing service.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://thorchain.org", "outbound_slug": "thorchain", "twitter": "https://x.com/THOR_InfoBot", "telegram": "https://t.me/thor_infobot", "discord": "https://discord.com/invite/thorchaindevs" }, "incident": { "date": "2026-05-11", "severity": "high", "summary": "GG20/TSS-key cryptography flaw exploited 2026-05-11 — ~$10.7M drained from a POL vault. Trading RESUMED 2026-06-23 on non-XMR chains (BTC/ETH/SOL/TRON/XRP/etc.) after ~6 weeks offline; the Monero leg is still pending — XMR.XMR is not yet on mainnet pools (operator: \"XMR soon\"). ADR-028 was approved and implemented: the loss is absorbed by protocol-owned liquidity via a store migration — there is NO user refund, airdrop, or compensation program (the operator states this explicitly; the earlier 2026-06-04 'refund portal' deadline lapsed and was superseded by POL absorption). v3.18.1 patched the flaw; the v3.19 restart release entered stagenet in early June, with a full churn to fresh vaults and Monero prioritized in the DEX queue, and full trading/LP targeted ~1 week after mainnet adoption. The TSS library was temporarily closed-sourced for a Soda Labs cryptographic audit (~2-4 weeks). Restart in progress, not yet complete (as of 2026-06-04).", "curator_advice": "Don't open new trades until THORChain unpauses (still paused as of 2026-05-27). If you held funds at the time of the exploit, file via the refund portal before 2026-06-04 — protocol absorbs losses via Protocol-Owned Liquidity first. Beware of phishing impersonator refund portals — only use the link from thorchain.org. XMR pool may resume earlier than EVM legs; confirm pool status on /thorchain or the protocol dashboard. Update (2026-06-11): Incident Update #6 — v3.19.0 deployed (TSS patches + ADR-028 loss-recovery + compromised-vault quarantine), 11-step restart underway; trading still paused as of 06-10. No refund/compensation program (ADR-028 POL absorption only). Recovery progressing, not worsening.", "source_url": "https://thorchain.org/blog/thorchain-exploit-report-1", "timeline": [ { "date": "2026-05-11", "note": "GG20/TSS-key cryptography flaw exploited — ~$10.7M drained from affected vaults." }, { "date": "2026-06-08", "note": "Incident Update #6: v3.19.0 announced (TSS patches + ADR-028 loss-recovery + compromised-vault quarantine), with an 11-step validator-vote → restart plan." }, { "date": "2026-06-11", "note": "v3.19.0 deployed; restart underway, trading still paused as of 06-10. No refund/compensation program (ADR-028 POL absorption only). Recovery progressing, not worsening." }, { "date": "2026-06-21", "note": "Restart remains incomplete: official channels still flag trading paused and explicitly deny any refund, airdrop, or compensation program. June 11-13 operator podcasts refined the path—v3.19.1 (verify-key stability + Gaia IBC infinite-mint patch) was delayed past the prior Friday target; GitLab shipped v3.19.1 on 202…", "auto": true }, { "date": "2026-06-22", "note": "Incident Update #8: the validator churn is now underway — the most significant recovery milestone so far. KeyVerify confirmed most vaults safe; the churn retired the old vaults and rotated the network to a fresh set, with signing re-enabled and funds migrating old→new. The operator calls this the final stretch before the network comes back online, but states trading is NOT live yet — it resumes only once migration completes and the network reactivates trading. (Our live monitor still reads HALTTRADING=1, XMR not on mainnet pools.) Source: https://x.com/THORChain/status/2068751383071805731", "auto": false }, { "date": "2026-06-22", "note": "Restart remains incomplete: official channels still flag trading paused and explicitly deny any refund, airdrop, or compensation program. June 11-13 operator podcasts refined the path—v3.19.1 (verify-key stability + Gaia IBC infinite-mint patch) was delayed past the prior Friday target; GitLab shipped v3.19.1 on 202…", "auto": true }, { "date": "2026-06-23", "note": "Trading RESUMED. After ~6 weeks offline following the May exploit, THORChain re-enabled trading on the AVAX, BASE, BCH, BSC, BTC, DOGE, ETH, GAIA (Cosmos), LTC, SOL, TRON and XRP chains (THORChain Alerts). Monero is NOT live yet — the operator says 'XMR soon' and XMR.XMR is not on mainnet pools, so XMR swaps via THORChain remain unavailable until the pool lists. Our monitor confirms HALTTRADING=0 and recorded the halt→resume transition. Source: https://x.com/THORChain", "auto": false }, { "date": "2026-06-25", "note": "Within the past week THORChain completed vault churn (Incident Update #8, Jun 21) and officially resumed mainnet trading Jun 23 after a 39-day halt; swaps, LP actions, signing, and churning are live on non-XMR chains. Operator confirms XMR.XMR remains in end-to-end testing with mainnet launch still pending (~1 month…", "auto": true }, { "date": "2026-07-03", "note": "XMR mainnet ETA ~2026-07-09 per co-founder Chad Barraford (THORSday podcast, Jun 25). XMR chain code shipped in v3.19.2; nodes still syncing Monero infra before pool activation. XMR.XMR not yet on mainnet pools.", "auto": true }, { "date": "2026-07-07", "note": "Curator re-verified — trading remains operational on the resumed chains since the 2026-06-23 restart. Incident marked resolved as of that date. (XMR mainnet support is a separate feature-rollout item, not part of this incident.)" }, { "date": "2026-07-08", "note": "Official Exploit Report #2 (2026-07-03) is a new full technical post-mortem: May 15 GG20/TSS zero-day via multi-prime Paillier + range-proof/blinding weaknesses (~$10M one vault); solvency checker failed because key was reconstructed offline over 864 failed signs. Trading restart and POL absorption already known; XM…", "auto": true }, { "date": "2026-07-10", "note": "Curator check: the ~2026-07-09 XMR-mainnet ETA (per co-founder, THORSday) lapsed — as of 2026-07-10 THORNode lists 43 pools, none XMR (XMR.XMR not live). Trading on resumed chains continues; the Monero leg remains 'coming' with a repeatedly-missed timeline.", "auto": false }, { "date": "2026-07-16", "note": "No new loss, refund program, or severity change. Within the last week the operator published a 2026-07-09 podcast recap stating vault churn is still blocked by a consensus bug until a major v3.20 release (v3.19.4 folded into it), with Solana re-enable and further post-exploit hardening gated on that upgrade. Officia…", "auto": true }, { "date": "2026-08-06", "note": "Official THORSday recap (2026-07-30) states v3.20 is in testing to fix second-order mainnet instability left by the May GG20/TSS exploit; protocol-owned liquidity is expected to re-enable with that release. Monero is still not on mainnet pools: code is described as ready, but churn remains blocked by post-exploit in…", "auto": true }, { "date": "2026-08-13", "note": "On 2026-08-06 THORChain published Exploit Report #3, the official final technical post-mortem of the May 2026 GG20/TSS vault drain. It attributes the theft to three chained tss-lib 0.1.6 bugs (malformed multi-prime Paillier N, a leaky MtA mask proof, and a degenerate Z=1 range-proof commitment) and documents mitigat…", "auto": true }, { "date": "2026-08-28", "note": "In the last 7 days THORChain shipped and adopted v3.20 (live ~2026-08-25 14:00 UTC), the post-GG20 recovery release that unpauses validator churn after ~2 months and is the official gate for native XMR/ZEC. Operator copy is not 'XMR live': the blog says Monero/Zcash 'move closer to activation' with a progressive rol…", "auto": true } ], "resolved": "2026-06-23" } }, { "id": "tokensfund", "category": "exchanges", "subcategory": "Aggregators", "name": "TokensFund", "url": "https://xmr.club/exchanges/tokensfund", "twin": "https://xmr.club/llm/exchanges/tokensfund.txt", "tagline": "Cross-chain swap aggregator routing through THORChain, Chainflip, NEAR Intents, Changee and CCE — no account, no email, no KYC, 15+ assets including XMR and ZEC. Flat 2% fee.", "review": "**What it is.** Cross-chain swap aggregator that compares live quotes from five routing protocols — THORChain, Chainflip, NEAR Intents, Changee, and CCE — and routes each trade through whichever quote wins. One-time deposit address per swap, mandatory refund address, no account, no email, no KYC. 15+ assets across BTC, ETH, XMR, ZEC, SOL, XRP, DOGE, LTC, TON, NEAR, USDC, and USDT (Ethereum + Tron).\n\n**Fees.** The Terms of Service disclose a flat 2% fee, already baked into the quote shown to you. Network gas and the underlying protocol's spread are separate. 2% is on the high side for an aggregator — competitors with similar protocol coverage typically charge 0.5%-1% — but it is at least disclosed up front.\n\n**Peer position.** Listed at kycnot.me (community-contributed, 8/10) and monerica.com.\n\n**Custody note.** The homepage leads with 'non-custodial.' The underlying protocols (THORChain, Chainflip) genuinely don't take custody — they're atomic-swap chains — but TokensFund itself sits on top as the price-comparison and deposit-address-generation layer. Funds move through atomic-swap rails, but the aggregator is still a layer between you and them.\n\n**Privacy-policy placeholder finding.** The published Privacy Policy at `/privacy` (last updated 2026-06-25) carries unfilled template residue: an unedited bracket `[e.Vercel]` where the hosting provider name belongs, an `[any analytics or error-monitoring provider]` bracket, and a stray template-instruction sentence — *\"If you add analytics, advertising, or other non-essential cookies, disclose them here and provide a consent mechanism where required by law\"* — that was meant for the operator drafting the page, not the reader. The policy also contradicts itself on analytics (*\"We do use analytics; if we do…\"*). This isn't a scam signal on its own, but it's a sign the operator pushed a privacy policy without finishing it — readers who care about which hosting platform and which analytics they're transacting through cannot answer those questions from the current text.\n\n**Tenure note — why C.** New on xmr.club, zero directory tenure. The legal surface (ToS, privacy, FAQ) is all dated 2026-06-25 — published the day before the operator self-submitted. Exchange-class services start at C here regardless of how clean the publishable surface looks, because the loss-asymmetry is high if a no-KYC swap UI ever flips to shotgun-KYC mid-trade. Path to B is six clean months without that flip, a cleaned-up privacy policy without placeholder brackets, and at least one independent peer prose read confirming the protocol-routing claims.", "translation_locale": "en", "rating": { "grade": "C" }, "grade": "C", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "AGGREGATOR", "NO-KYC", "NO-ACCOUNT", "XMR", "ZEC", "MULTICHAIN", "NEW" ], "fees": { "summary": "Flat 2% aggregator fee (in quote); network gas + protocol spread separate." }, "fees_summary": "Flat 2% aggregator fee (in quote); network gas + protocol spread separate.", "last_verified": "2026-08-10", "operating_since": "2026-05", "tenure_note": "Independently verified: WHOIS/RDAP registration: 2026-05-16. `operating_since` set to the earliest signal.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://tokensfund.xyz", "twitter": "https://x.com/tokensfund" }, "also_listed_at": { "kycnot": { "url": "https://kycnot.me/service/tokensfund", "score": 8 }, "monerica": true } }, { "id": "torswap", "category": "exchanges", "subcategory": "Instant Swaps", "name": "TORSwap", "url": "https://xmr.club/exchanges/torswap", "twin": "https://xmr.club/llm/exchanges/torswap.txt", "tagline": "Non-custodial, no-account crypto swap + sell tool: 30+ coins, crypto⇄crypto and crypto⇄fiat payouts, one-time-use wallet you control (exportable seed), Tor-style routing and built-in mixing. No KYC. New, unproven.", "review": "**No-account, non-custodial swap-and-sell tool with built-in mixing.** TORSwap lets you swap across **30+ coins** or **sell crypto to fiat** (payout to cards / online methods) without registering or identifying yourself. The flow is genuinely non-custodial: it **generates a fresh one-time-use wallet whose seed phrase you can export**, so you hold the keys through the swap. It advertises **Tor-style routing** to mask deposit origin and IP, and **built-in mixing** on the swap path. Works with Tor Browser.\n\n**Treat the marketing with caution.** The homepage claims **\"$100M+ volume\", \"50,000+ users\", a \"5/5 rating\"** and a wall of glowing testimonials — none of it independently verifiable, and the testimonials read as stock personas. We don't repeat those numbers as fact. The crypto⇄fiat sell path plus built-in mixing also invite more scrutiny, not less.\n\n**Why C.** Brand-thin: domain registered mid-2025 (~14 months), **no Wayback history**, and on kycnot it's an unchecked community listing. We haven't curator-tested a swap end-to-end. The non-custodial, seed-exportable design and no-KYC access are real positives; the unverifiable stats and short track record hold it at C. Earns a lift on demonstrated delivery + accrued tenure — and a verified test swap.", "translation_locale": "en", "rating": { "grade": "C", "trust": "New and thin: domain ~14 months (mid-2025), no Wayback history, unchecked community listing on kycnot, function not curator-tested. Site advertises unverifiable $100M+ volume / 50k users / 5-star testimonials that read as stock personas — not repeated as fact. C until delivery + tenure are demonstrated.", "privacy": "Non-custodial by design — generates a one-time-use wallet whose seed you can export, so you hold keys through the swap. No accounts, no KYC, Tor-style routing to mask deposit origin/IP, built-in mixing. Works with Tor Browser.", "ux": "30+ coins; crypto⇄crypto and crypto⇄fiat (payout to cards / online methods). Simple 5-step no-registration flow. Built-in mixing + fiat off-ramp add scrutiny surface. Curator has not yet run a test swap." }, "grade": "C", "kyc_tags": [ "NO-KYC" ], "feature_tags": [ "xmr", "no_kyc", "tor", "non_custodial", "instant", "mixing" ], "highlight_tags": [ "XMR", "NO-KYC", "TOR", "NON-CUSTODIAL", "MIXING" ], "fees": null, "fees_summary": null, "last_verified": "2026-09-12", "operating_since": "2025", "tenure_note": "Domain registered 2025-07-24 (~14 months); no Wayback snapshots, thin public history. kycnot = unchecked community listing. Exchange shelf (high loss-asymmetry) → Grade C on tenure + unverified function; site's volume/user stats are unverifiable and not credited.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.torswap.pro", "outbound_slug": "torswap" }, "also_listed_at": { "kycnot": true } }, { "id": "trocador", "category": "exchanges", "subcategory": "Aggregators", "name": "Trocador", "url": "https://xmr.club/exchanges/trocador", "twin": "https://xmr.club/llm/exchanges/trocador.txt", "tagline": "Long-running no-KYC aggregator. XMR-friendly, Tor mirror, broad coin support.", "review": "Trocador is the canonical no-KYC swap aggregator: route a single swap across 14+ upstream instant exchanges, see each upstream's KYC rating before you commit, and complete the order without an account or identity check on Trocador's side. Listed at **Grade A · editor's pick** because it remains the no-KYC swap surface with the longest operational track record (live since 2021), the strongest privacy posture (no-JS widget, Tor mirror, AnonPay payment gateway), and the most useful upstream-transparency model on the market.\n\n**Background.** Operated by Reta Development Assets LLC, with a published support stack across email, Matrix (#Trocador.app:matrix.org), Telegram (@TrocadorSupportBot), and PGP. The operator has been the reference no-KYC routing layer in the privacy community since 2021 — predating most of the current cohort of aggregators. UI translated into ~20 languages; donation address (Monero) published; affiliate program shares 50% of commissions with referrers and pays out in XMR. Multi-product surface: Swap (the core), Prepaid Cards, Gift Cards, DeFi & Bridge, and AnonPay (privacy payment gateway with BTCPay Server plugin).\n\n**What you trust.** Trocador is **not custodial of your swap**: orders are forwarded to upstream exchanges (FixedFloat, Exolix, SimpleSwap, ChangeNOW, SwapuZ, and a dozen others rotate through the API) which hold the routing-leg funds. Trocador's role is rate-shopping + KYC-rating + privacy-front-end. If an upstream exchange demands additional KYC mid-trade or freezes a tx, **that obligation is on the upstream, not Trocador** — but Trocador users still experience it as a Trocador-flow failure. The published \"Trocador Guarantee\" covers failed/stuck swaps where the routing layer itself misbehaved, separate from upstream issues. A `compliance@trocador.app` address exists for lawful information requests — the operator does respond to subpoenas/MLATs that apply to their routing metadata, which is a real exposure for users on the other side of a serious investigation. For day-to-day privacy this matters less; for adversarial-threat use cases, route through Tor and treat the routing record as queryable.\n\n**Operational specs.** Coin support: 1000+ assets via the upstream aggregation. Payment: deposit in any supported asset, settle to any supported asset — typical XMR-out flows include BTC→XMR, USDT→XMR, ETH→XMR. Surfaces: clearnet at trocador.app, Tor mirror at trocadorfyhlu27aefre5u7zri66gudtzdyelymftvr4yjwcxhfaqsid.onion, JavaScript-free widget for embedded use on third-party privacy sites, public REST API with API key for partners. AnonPay accepts donations or merchant payments in 1000+ cryptos with auto-settlement to a preferred coin. Multi-lang UI (~20 languages including EN/ES/DE/FR/ZH/RU/JA/AR/HI/KO/PT and more).\n\n**Philosophy.** Trocador's editorial differentiator is the **upstream-transparency model**: when you place a swap, you see the rate from each of the 14+ upstream exchanges alongside each upstream's KYC rating (no-KYC, light, full, hard). The user picks. This shifts the trust model from \"the aggregator hides the messy upstream layer\" (SimpleSwap-style) to \"the aggregator surfaces the upstream layer so the user owns the choice.\" On a privacy-routing platform, that's the right framing — the user gets to decide whether an extra 0.3% on rate is worth a no-KYC upstream over a light-KYC upstream. The no-JS widget further extends that philosophy: privacy sites that don't want to load third-party scripts can embed Trocador without breaking the no-script promise.\n\n**Grade rationale.** Grade A and editor's pick reflect: 4+ years of operational continuity (since 2021); non-custodial routing model; upstream KYC-transparency that no other aggregator currently matches; published Trocador Guarantee covering routing-layer failures; multi-channel support (email, Matrix, Telegram, PGP); Tor mirror operator-published; multi-language coverage; absence of major refund-dispute / frozen-funds incident threads in the last 12 months; consistent positioning across peer directories (kycnot, monerica, web3privacy all list it). Last verified 2026-05-12.\n\n**Useful when.** You want to swap XMR for BTC/USDT/anything (or the reverse) and you want a privacy-respecting routing layer rather than picking an upstream exchange directly. You're embedding a swap widget on a privacy-respecting site and need no-JS support. You're a merchant looking for a Monero-friendly payment gateway and want BTCPay Server compatibility (AnonPay). You want to see the KYC posture of upstream exchanges before you commit funds.\n\n**Caveats.** Upstream-exposure: Trocador is non-custodial of the swap leg, but the upstream exchange holds your funds during the routing window — if that upstream freezes, your swap freezes. The Trocador Guarantee covers routing-layer failures, not upstream malfeasance. The `compliance@trocador.app` address exists for lawful information requests; for adversarial-threat models, route through the Tor mirror and assume routing metadata could be requested by authorities under MLAT. The Trocador-listed \"Prepaid Cards\" sub-product had an extended outage in 2025 (Trocador prepaidcard returns error 2 upstream — known issue, not a Trocador-side bug). For very-large swaps ($10k+), the aggregator-routing model has higher variance than going direct to a specific upstream; consider whether the convenience is worth the upstream-coin-shuffle exposure at that volume.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A", "trust": "Longest operational track record of any no-KYC swap surface (live since 2021). Aggregates 14+ upstream exchanges and shows each one's KYC rating before you commit, so trust is delegated transparently to the route you pick — Trocador itself takes no account or ID. Editor's pick.", "privacy": "No account, no identity check on Trocador's side. No-JS widget, Tor mirror, and the AnonPay gateway. You see each upstream's KYC rating up front and can route to the lowest-KYC option; trade details are retained only as the chosen upstream requires.", "ux": "One swap routed across 14+ instant exchanges with best-rate + per-upstream KYC-rating comparison. Broad coin support, XMR-friendly, Tor mirror. No signup." }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "tor_mirror", "open_source", "api_available", "no_js_supported" ], "highlight_tags": [ "NO-KYC", "TOR", "XMR" ], "fees": { "summary": "Aggregator fee included in quote · ~1-2% spread · BTC/XMR/many" }, "fees_summary": "Aggregator fee included in quote · ~1-2% spread · BTC/XMR/many", "last_verified": "2026-06-16", "operating_since": "2022", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://trocador.app", "tor": "http://65bsisadnxvw4kfz7h7a3jwcyenrhluuj3kd5toslfzxbk5q4m3wy6qd.onion/", "outbound_slug": "trocador", "affiliate": "https://trocador.app/?ref=2zYpj7duMw" }, "also_listed_at": { "web3privacy": true, "kycnot": true, "monerica": true, "moneroeco": true } }, { "id": "trustswap", "category": "exchanges", "subcategory": "Instant Swaps", "name": "TrustSwap", "url": "https://xmr.club/exchanges/trustswap", "twin": "https://xmr.club/llm/exchanges/trustswap.txt", "tagline": "No-account, no-KYC instant swap with an above-category-bar privacy policy and clean UX; held at C by extreme-newcomer status (operator live ~33 days, originally as `nokycswap.org`), name collision with the DeFi launchpad TrustSwap Inc., anonymous operator, and zero independent Monero-community track record.", "review": "A brand-new no-account, no-KYC instant swap — domain registered **2026-06-07**, only 9 days before this listing went up — with a privacy policy that's specific and well-written above the category bar (24-hour transaction-log auto-deletion, no IP collection, no device fingerprinting, no analytics cookies). Listed at **Grade C** because the directory's the directory's tenure-in-grading policy rule defaults new operators in high-loss-asymmetric categories to C regardless of publishable-surface quality, and TrustSwap clears the new-operator bar from the wrong side. The privacy posture keeps it from dropping below C; an anonymous operator, no jurisdiction disclosed, a brand-name collision with the well-known DeFi launchpad TrustSwap Inc., and zero Monero-community track record keep it from climbing toward B.\n\n**What it is.** A privacy-positioned instant crypto swap supporting BTC, ETH, XMR, ZEC, SOL, LTC, USDT, XRP, and 2000+ other assets per the operator's homepage. Purchase flow is no-account, no-email — pick a pair, paste your destination address, send the deposit, receive the swap. Listed at **Grade C** because tenure is the primary signal we don't have: 9 days of operating history is not enough to know whether the service delivers consistently or vanishes.\n\n**Background.** TrustSwap runs at `trustswap.io` as a conventional multi-page web app (not a JS SPA), with published `/about`, `/privacy-policy`, `/faq`, and `/support` pages. **Operator's prior brand:** the same project ran as `nokycswap.org` from 2026-05-14 until pivoting to `trustswap.io` on 2026-06-07 (24-day rebrand cycle). The original URL now 301-redirects to TrustSwap; the operator's X account `@TrustSwap_io` published its first posts on 2026-06-07 promoting NOKycSwap.org rather than the new name. **Domain registration** per `.io` RDAP: 2026-06-07, expiring 2027-06-07 (one-year registration, minimum tier — operators committing long-term typically register for two or more years). No founding date, founder identity, company entity, jurisdiction, or physical location appears anywhere on the site — the marketing surface is polished and multi-language but the operator stays fully behind it. External presence: support email, X account, Telegram channel (all on `/support`). Single peer-directory match on monerica.com — the listing surfaces via search, not as a dedicated card; possibly an operator self-listing given how new the service is. Not yet listed on kycnot. Zero Monero community footprint (no Reddit, Bitcointalk, monero.town, or Matrix threads discussing the service — including absence in the kind of \"anyone tried this?\" threads a real launch tends to produce). The brand name collides with **TrustSwap Inc.**, an established DeFi launchpad project — searching the name returns results about the unrelated company rather than this exchange, which makes independent reputation-checking unusually hard.\n\n**What you trust.**\n\n- **Privacy policy is specific, not generic.** Names both what IS collected (transaction data — wallet addresses, amounts, blockchain identifiers — retained for 24 hours then auto-deleted) and what ISN'T (IP address, device type, browser info, no analytics, no tracking cookies, no third-party data sharing). That level of clarity is rare in this category and is the strongest single signal on the listing.\n- **No account, no email required for swaps.** The standard swap path is anonymous end-to-end. An optional account is offered for users who want order history; nobody who just wants to swap touches it.\n- **Non-custodial by design** — operator-published copy says \"funds never sit on our platform; rates and fees are shown before you confirm.\" The instant-swap model means funds pass through during the swap rather than being held in a balance account.\n- **Auto-refund on failure.** FAQ promises automatic return of funds to the sender's address if a swap can't complete — reduces support-channel dependency for the failure mode that bites users hardest.\n- **Broad coin coverage including XMR as a first-class pair.** 2000+ assets is operator-claimed; XMR is in the headline list alongside BTC / ETH / SOL.\n- **SimpleX as a published contact channel** — alongside email, X, and Telegram, TrustSwap publishes a SimpleX address (`smp12.simplex.im/a#…`) for private support. SimpleX is among the strongest privacy-respecting messaging protocols (no central identifiers, no phone number, ephemeral queue addresses). Offering it as a first-class support channel signals the team understands the privacy stack, not just the marketing copy. *Caveat:* this is a posture signal at launch, not a track-record signal — see Caveats.\n\n**Operational specs.**\n\n- **Site.** https://trustswap.io — multi-page web app; key pages render server-side and are readable without JavaScript.\n- **Domain.** Registered 2026-06-07 (one-year registration via Identity Digital RDAP).\n- **Pricing.** No standalone fee schedule. Homepage offers both float and fixed rate modes; the exact fee model (percentage / spread / hybrid) is discoverable at swap time, not in advance.\n- **Coin coverage.** 2000+ assets claimed; headline pairs BTC, ETH, XMR, ZEC, SOL, LTC, USDT, XRP.\n- **Account model.** No registration required for swaps. Optional account available with email if a user wants order history.\n- **Tor mirror.** None advertised. No `Onion-Location` header.\n- **Privacy posture.** 24-hour transaction-log auto-deletion. No IP, device, browser fingerprint, or analytics collection (operator-published).\n- **Channels.** Service support `support@trustswap.io` + PR `pr@trustswap.io` (two distinct addresses), X `@TrustSwap_io`, Telegram `@TrustSwap_io` (channel + support flow), SimpleX `smp12.simplex.im/a#ePM9_NtG…` for private messaging. No Matrix, Signal, or published PGP key. 10-language site (en/ru/es/zh/vi/de/fr/pt/ko/ja).\n- **Jurisdiction.** Not disclosed.\n- **External listings.** monerica (via search). Not on kycnot, orangefren, or other tracked peer directories at last check.\n\n**Operator philosophy.** The marketing copy positions TrustSwap as a privacy-first instant exchange: *\"our mission is to make anonymous crypto exchange practical, secure, and accessible — tools that put privacy and control back in your hands.\"* The privacy policy itself reads as the strongest evidence the team understands the threat model — the document names specific data it doesn't collect (a posture that's harder to fake than a generic \"we respect your privacy\" statement). The gap between that documentation and the rest of the surface — 9-day-old domain, anonymous team, one-year-minimum registration, no Tor mirror, no audited reserves, no engagement with the Monero community despite supporting XMR — is what holds the grade at C. A polished privacy policy at launch is necessary but not sufficient for the directory's B tier; tenure has to accumulate before the policy means anything operationally.\n\n**Grade rationale.** Listed at **Grade C** primarily because **operator tenure is 9 days**. The directory's tenure-in-grading rule defaults exchanges in high-loss-asymmetric categories to C regardless of how clean the publishable surface looks; TrustSwap is a textbook example of why that rule exists — the privacy policy quality is genuinely above average for the category, but a 9-day-old swap service hasn't had time to demonstrate any of the things that distinguish a C from a B: consistent delivery under load, response to disputes, behaviour during a chain reorg, response to a regulatory inquiry. C is what we list new operators at; the privacy policy keeps it from dropping below. Other factors holding it at C even after tenure accumulates: (1) operator is fully anonymous with no entity, founder, or jurisdiction; (2) only one peer-directory match (monerica via search — possibly an operator self-listing); (3) brand-name collision with TrustSwap Inc. (DeFi launchpad) makes independent sentiment-checking nearly impossible; (4) zero Monero community footprint despite advertising XMR pairs; (5) no Tor mirror. **Path to B:** accumulate 12+ months of clean operating history, complete an in-house test swap on an XMR pair, get listed on kycnot (or another second peer directory) as a dedicated card, accumulate at least one organic Monero-community thread, and either publish operator identity / jurisdiction or ship a Tor mirror.\n\n**Useful when.**\n\n- You want a no-account, no-KYC swap with XMR support and you're comfortable being an early customer of a brand-new operator.\n- You're comparing swap services on policy specificity. TrustSwap names specific non-collected data (device, browser, IP) rather than handwaving — useful as a privacy-policy benchmark even if you don't transact with them.\n- You want auto-refund on swap failure rather than support-dependent recovery.\n- You're swapping at sizes where new-operator risk is acceptable and the privacy posture matters more than track record.\n\n**Tenure.** Publicly verified on xmr.club since 2026-06-17 — 17 days as of this note. For exchange-class services, tenure is a grade input: even a clean publishable surface defaults to Grade C, and any lift needs both independent corroboration from other privacy-focused directories AND a sustained track record of unproblematic swaps observed over time. First scheduled re-check: 2026-09-15.\n\n**Caveats.**\n\n- **Extreme newcomer — domain registered 2026-06-07 (9 days before this listing).** No operating history to evaluate. The directory's tenure rule defaults new operators in this category to Grade C regardless of how good the documentation looks; TrustSwap clears that bar from the wrong side.\n- **Renamed from `nokycswap.org` to `trustswap.io` on 2026-06-07** (24 days after original launch). A descriptive name like \"nokycswap\" creates real operational drag — registrar takedown risk, payment-processor refusals, search-engine flagging — so a rename to a cleaner TLD inside the first month reads as pragmatic operational hardening, not brand instability. The original URL still 301-redirects to the new one and the operator's X account openly posted under both names, both signs that they're not trying to obscure the history. Noted here for transparency rather than as a red flag; downstream caveats below apply to the operator regardless of which name they fly under.\n- **The astroturf-pattern cryptwerk reviews predate the `trustswap.io` domain by 17 days.** All three reviews are dated 2026-05-21 — at a point when only `nokycswap.org` existed (registered 2026-05-14; `trustswap.io` not until 2026-06-07). The reviews were therefore written about the operator's prior brand and migrated to the TrustSwap cryptwerk listing post-rebrand. Combined with the same-day posting pattern, this is the second reason to treat the cryptwerk score as a marketing artefact rather than an organic signal.\n- **Privacy policy timestamp predates the domain registration.** The policy claims \"last updated 2026-06-02\" but the domain was registered 2026-06-07 — five days later. Either the policy was lifted from somewhere pre-existing (borrowed boilerplate from another service) or the timestamp is backdated. Either way the document's origin is ambiguous and worth verifying before relying on its claims.\n- **Domain registered for one year minimum.** Operators planning a long-term run typically register for two or more years up front. A one-year registration on a new service is a short-runway signal.\n- **Anonymous operator, no jurisdiction.** Polished site, well-written policy, but no entity, founder, team, or physical location published. If a swap goes wrong, recourse is the support channels only — no named party to escalate to.\n- **Brand-name collision with TrustSwap Inc. (DeFi launchpad).** Searching the name returns results about the unrelated DeFi project; you can't independently verify reviews or complaints via the usual web search.\n- **No track record in the Monero community.** No Reddit, Bitcointalk, monero.town, or Matrix discussion — the operator advertises XMR support but hasn't engaged with the community that would normally test, audit, and amplify a privacy-focused swap.\n- **FAQ is incomplete.** Several FAQ questions render with empty answer fields. Skeleton-stage documentation.\n- **No published fee schedule.** Rates are quoted at swap time; the actual fee model isn't documented in advance.\n- **No Tor mirror.** Clearnet-only.\n- **Single peer-directory match — possibly self-listed.** Only one external listing (monerica via search). For a 9-day-old service, that's thin triangulation and may reflect the operator's own outreach rather than community discovery.\n- **Tawk.to live-chat widget loads from `embed.tawk.to`.** Third-party customer-support widget present on `/support` (and likely site-wide). Tawk.to sets cookies and runs a JS payload from `embed.tawk.to` — a third-party domain. The privacy policy claims \"no analytics, no tracking cookies, no third-party data sharing\" — the Tawk integration is in tension with that posture. Either the policy needs to acknowledge the widget, or the widget should be removed or replaced with a self-hosted chat tool. Worth raising with the operator before relying on the policy at face value.\n- **No proof-of-reserves or audit.** Not unusual for instant-swap services but worth surfacing — the non-custodial claim is structural rather than externally verified.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [], "highlight_tags": [ "XMR", "NO-ACCOUNT" ], "fees": { "summary": "Quoted at swap time · no published rate sheet · 2000+ coins (BTC / ETH / XMR / ZEC / SOL / LTC / USDT / XRP / …)" }, "fees_summary": "Quoted at swap time · no published rate sheet · 2000+ coins (BTC / ETH / XMR / ZEC / SOL / LTC / USDT / XRP / …)", "last_verified": "2026-06-17", "operating_since": "2026-06", "tenure_note": "Domain registered 2026-06-07 (9 days before listing). Operating since 2026-06.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://trustswap.io", "outbound_slug": "trustswap", "contact_email": "support@trustswap.io", "twitter": "https://x.com/TrustSwap_io", "telegram": "https://t.me/TrustSwap_io", "simplex": "smp12.simplex.im/a#ePM9_NtG8mRM94V34gfC3erMbIDzC3KSxanM3_gGL4A" }, "also_listed_at": { "monerica": true } }, { "id": "uswap", "category": "exchanges", "subcategory": "Instant Swaps", "name": "uSwap", "url": "https://xmr.club/exchanges/uswap", "twin": "https://xmr.club/llm/exchanges/uswap.txt", "tagline": "No-account instant swap across 30+ chains. Custodial routing with refund-to-sender. Real product tenure ~3.5 months on a domain-aftermarket rebrand.", "review": "**Policy caveat (2026-08-12).** Three of uSwap's public policy pages were updated in a single week (last observed 2026-08-09 via our weekly monitor). Each is worth naming for the reader, but on the counterfactual — *\"would we have graded C day-one if these disclosures had been visible from the start?\"* — the answer is yes; nothing here changes the base posture. The Grade C holds.\n\n- **/fees** replaced the previous *\"no hidden spread, all-inclusive 0%\"* claim with *\"0% platform fee on eligible standard routes\"* plus a new itemized breakdown of provider spread + network cost + market drift. This is an honesty improvement — the earlier language was overselling the \"0%\" — and it puts uSwap's fee shape in line with every other instant-swap engine in the directory.\n- **/terms** added *\"as is / as available\"* limitations and language that refunds are not guaranteed by accessible status pages. Standard crypto-ToS boilerplate; comparable to what most swap engines carry.\n- **/privacy** introduced **PostHog** analytics with automatic interaction capture, persistent identifiers, and session-replay recording, plus weaker retention promises (no explicit deletion timeline). This is the one item that genuinely narrows the privacy story — PostHog session-replay records the user's on-page interactions. Worth being aware of; consider Tor Browser or a privacy-hardened profile if this matters to you.\n\n**Product — swap + spend, both real.** Crypto→crypto swaps (dedicated `/swap/btc-to-xmr` route; XMR is called out as \"the most-requested cross-chain pair by a wide margin\" in the site's own docs). Spend surface (~400-brand catalog of gift cards, top-up for Telegram Premium / Discord Nitro / Mullvad VPN, prepaid Visa cards) — verified as real product pages, not marketing footnote.\n\n**Custodial routing during the swap window.** The site uses \"non-custodial\" language in some marketing copy, but the actual mechanics are custodial: funds land at a deposit address controlled by the operator, are routed through providers, and the destination lands at the user wallet. Refund flow is refund-to-sender (three-button model: market-replace / hold / refund to originating address), plus sanctions-screening with refund on flag. Any service that holds your funds during the swap window is functionally custodial, whatever the marketing wording. This is the same shape as ChangeNOW / SimpleSwap and most instant swaps — not a red flag on its own, but worth reading honestly rather than through the marketing copy.\n\n**Legal surface.** `/terms`, `/privacy` (dated 2026-06-14), `/contact` all HTTP 200. Support: `support@uswap.net`; Telegram `@slither` on `/contact`, but the homepage lists `t.me/maintenance` — **handle inconsistency worth naming**. Missing: `/faq`, `/about`, `/pricing`, `/affiliate`, `/canary`, `/pgp`. Neither Terms nor Privacy names a legal entity or jurisdiction.\n\n**Open source signal.** GitHub org `uSwapExchange` exists with two repos (`zero` Go frontend, `browser-extension` TS; MIT-licensed; recent commits June-July 2026; 14 stars). Domain verifies to `uswap.net`. Small footprint but a real open-source surface.\n\n**Tenure — read carefully.** The `uswap.net` domain was **first registered ~2001**, but the current uSwap-branded crypto-exchange product only appears in Wayback from **2026-04-10** (~3.5 months of visible current-brand history). Prior domain uses: unrelated content 2001–2017, dormant 2017–2021, STRATO parking 2021-12-29, GoDaddy / dan.com aftermarket listings 2024. **This is a domain-aftermarket rebrand pattern.** No aged-X-handle laundering is visible (X account age was rate-limited and could not be independently confirmed), so it is not in the same class as some known bad-actor patterns; but the effective product tenure is measured in months, not years. Blog first post May 2026.\n\n**Peer signal — mixed but no red flag.** `kycnot.me` lists as Community Contributed (**not team-reviewed**) with 10/10 / privacy 98 / trust 91, \"Guaranteed no KYC\" — kycnot's own caveat that these are unverified. `monerica.com`: not listed. `orangefren.com`: not on their permanent-delist page. **One Trustpilot review reports** they *\"followed all instructions, made no mistakes, never received my exchanged coin\"*; operator responded claiming manual review of all deposits confirms delivery. **One documented delivery-failure complaint, disputed.**\n\n**Grade C — what it means here.** Passes the auto-reject gauntlet (no peer-directory scam flags, kycnot neutral-positive, real first-class XMR, verified gift-card / Mullvad / Telegram Premium surfaces, real GitHub org). Doesn't lift because: (a) real product tenure ~3.5 months, (b) no operator identity / no jurisdiction / no PGP / no canary, (c) Telegram-handle inconsistency, (d) one disputed Trustpilot delivery-failure complaint. All C-appropriate caveats to name.\n\n**What would lift the grade.** Six-to-twelve months of clean operating record; consistent operator response to any incident that surfaces on Trustpilot / OrangeFren / kycnot; a canary + PGP identity page; the Telegram-handle inconsistency resolved; an on-record post explaining the domain-aftermarket rebrand.\n\n**Useful when.** You want a no-account swap with a broad coin bench and a genuinely interesting spend surface (gift cards, VPN top-ups, prepaid cards) at 0% platform fee. Do a small test swap first — standard hygiene for a Grade C exchange with unmeasurable operator identity.", "translation_locale": "en", "rating": { "grade": "C", "trust": "No operator identity / no jurisdiction / no legal entity on public surface. Telegram support handle inconsistency (@slither on /contact, @maintenance on homepage). No canary, no PGP, no /about. Real product tenure ~3.5 months (domain first registered 2001 but on aftermarket 2024, current brand from 2026-04-10). kycnot listing is Community-Contributed (not team-reviewed). One disputed Trustpilot delivery-failure complaint on record. Not on OrangeFren delist. GitHub org exists.", "privacy": "No account, no signup, no email required per operator. Custodial routing during the swap window (funds land at operator deposit address, refund-to-sender flow). Do NOT read the marketing \"non-custodial\" claim as atomic-swap non-custody — it is standard custodial-routing instant-swap shape.", "ux": "Direct swap widget, persistent deposit address advertised. 0% platform fee (rate passthrough). Real gift-card / Mullvad / Telegram Premium / Discord Nitro / prepaid-Visa spend surface. Blog since May 2026." }, "grade": "C", "kyc_tags": [ "no_kyc", "no_email", "anonymous_signup" ], "feature_tags": [ "no_account", "multi_chain", "custodial" ], "highlight_tags": [ "0% PLATFORM FEE", "NO ACCOUNT", "GIFT CARDS", "MULTI-CHAIN" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-12", "operating_since": "2026-04", "tenure_note": "Domain first registered 2001 but on the GoDaddy / dan.com aftermarket in 2024; current uSwap-branded product only visible in Wayback from 2026-04-10 (~3.5 months at listing).", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://uswap.net", "source": "https://github.com/uSwapExchange", "outbound_slug": "uswap" } }, { "id": "wagyu", "category": "exchanges", "subcategory": "Instant Swaps", "name": "Wagyu", "url": "https://xmr.club/exchanges/wagyu", "twin": "https://xmr.club/llm/exchanges/wagyu.txt", "tagline": "Cross-chain swap — routes through XMR1 on HyperCore, settles to native Monero.", "review": "End-to-end the swap delivers **native XMR on the Monero chain**. Internally Wagyu routes via XMR1 on HyperCore as an intermediary, so the IOU posture only applies if you hold XMR1 (don't). Treat Wagyu as a swap, not a place to park balance: the custodial risk is bounded by how long the IOU is in flight, not the trade size.\n\nVolume itself is real — operator publicly reports ~\\$320M cumulative and ~\\$30M+ recent monthly, with Wagyu functioning as a genuine XMR throughput rail in the Monero economy.\n\n**Operator alignment watch (2026-05-30).** Wagyu's founder (@PerpetualCow) is, by his own words, a hype-aligned operator using XMR as instrumentation rather than a privacy-aligned operator with a Monero mission. His X bio reads verbatim: *\"$HYPE maximalist. not loud about it, just patient. Contributing to @HyperliquidX and XMR through Wagyu.xyz.\"* In a separate post on 2026-05-29 he stated: *\"Aside from $HYPE there's nothing worth owning in crypto anymore. As sad as it is.\"* That includes Monero — said publicly by the founder of a Monero swap. Combined with his handling of the $COW community on the adjacent Fwog.fun launchpad (promote → vampire-attack → relaunch → miss deadlines → post-hoc deny leadership → delete community Telegram on 2026-05-18), the pattern reads as textbook hype-maxi behavior.\n\nWagyu the swap continues to operate normally and the DPRK-pause incident (2026-04-22) was handled credibly. We are not delisting because the product is functional and the volume signals real Monero-economy demand. But: **don't park balance, don't size larger than you'd be willing to absorb if the operator decides to walk, and weight the alignment mismatch in your trust posture.** Grade adjusted B → B- to reflect the structural alignment mismatch. Further movement depends on Wagyu-side stress events.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A-" }, "grade": "A-", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "NO-KYC", "BRIDGE", "NATIVE-XMR-OUTPUT", "hype_aligned_operator" ], "fees": { "summary": "Routing spread · settles native XMR (XMR1 used in-flight only)" }, "fees_summary": "Routing spread · settles native XMR (XMR1 used in-flight only)", "last_verified": "2026-07-22", "operating_since": "2025", "tenure_note": "Wagyu launched December 2025 per operator (Jaun, @R3st4rtY0urL1f3) public callout. wagyu.xyz domain WHOIS predates the service.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.wagyu.xyz/", "outbound_slug": "wagyu", "telegram": "https://t.me/wagyu_support" }, "incident": { "date": "2026-07-07", "severity": "critical", "summary": "Wagyu displays a self-declared \"Swaps into XMR are temporarily paused\" banner on the ANY → XMR path — the unwind route that would return an XMR1 IOU on HyperCore to native Monero. That is the core exchange thesis. XMR → ETH direction has two completed swaps in the last two hours (after a 56-day gap), so users can move Monero *into* an XMR1 balance on HyperCore but not currently unwind back out. Operator @PerpetualCow last public reply 2026-06-19; publicly active on the Hyperliquid memecoin ecosystem since. Only surviving support channel is t.me/wagyu_support. No evidence of fund loss, but the service is not functioning as advertised.", "curator_advice": "Do not initiate new swaps in either direction. The ANY → XMR unwind is operator-paused per their own UI banner. Sending XMR into the widget today lands you a stuck XMR1 IOU on HyperCore with no confirmed unwind path — the very \"custodial risk bounded by IOU-in-flight\" thesis in the review above requires that unwind, and the operator has now paused it. If you have XMR1 balance in-flight, pursue support via t.me/wagyu_support before any further action.", "source_url": "https://x.com/BerggoldDigital/status/1941654906480738398", "timeline": [ { "date": "2026-06-19", "note": "Operator (@PerpetualCow) last public reply on X on Wagyu-adjacent topics." }, { "date": "2026-07-06", "note": "Third-party outage report (@BerggoldDigital tweet + screenshot): swap widget returns \"Failed to fetch\" on 0.5 XMR → DAI. Reporter notes operator has gone quiet." }, { "date": "2026-07-07", "note": "Widget partially recovered — /api/rates responds 200 across XMR pairs (DAI/BTC/ETH/SOL/USDC). Two XMR → ETH swaps executed in the last two hours after a 56-day gap in transactions of any kind. But the operator has posted an explicit \"Swaps into XMR are temporarily paused\" banner on the ANY → XMR direction — the unwind route that would return an XMR1 IOU on HyperCore to native Monero. Grade dropped B- → D on the same day. Operator remains silent on Wagyu channels; publicly active on Hyperliquid memecoin ecosystem." }, { "date": "2026-07-07", "note": "Wagyu widget reported down again by curator ~11:30Z, ~30 minutes after the partial-recovery observation earlier the same morning. Server-side probes: homepage 200, /swap 200, /api/rates 200 — but the /api/rates payload is byte-identical to the earlier 09:30Z probe, suggesting the rate-source is serving a cached/stale response rather than live-fetching. Combined with the operator-declared \"Swaps into XMR are temporarily paused\" banner on the ANY → XMR path and the 56-day inbound-transaction gap, the service is now fluctuating within a single day AND the \"recovered\" state was itself misleading. This is the pattern the earlier D-grade was watching for." }, { "date": "2026-07-07", "note": "Operator @PerpetualCow broke silence at 17:40Z on X after 18+ days of no public replies on Wagyu-side topics — first substantive comms since 2026-06-19. Key claims: (a) Wagyu is back live; (b) the downtime was caused by \"a massive DDoS attack\"; (c) implicit accusation that a competitor orchestrated it. Tone is dismissive of user feedback (\"Not even going to bother responding to all the FUD\"), boastful about market position (\"only 2 sources of XMR: KuCoin and Wagyu; everything else is a wrapper\"), and closes with \"Going back to my holiday, gn friends.\" Curator read: the DDoS attribution is unverifiable but plausible, and comms restart IS a positive signal against the \"operator vanished\" concern. However the post does NOT address the still-live \"Swaps into XMR are temporarily paused\" banner on the ANY → XMR direction, the intra-day quote-then-fail pattern from earlier today, or the 56-day gap in ANY-inbound transactions — meaning the specific operational issues that drove the D grade are unresolved. The \"only 2 sources of XMR\" claim is also editorially questionable (ignores DEXes, atomic swaps, direct P2P) and does not match reality of the swap-engine landscape our own listings cover. Grade held at D. Watch conditions unchanged: lift requires resumed ANY → XMR execution + clean curator round-trip test-swap + sustained cadence (not one-off post). Escalation still on the table if the paused-banner is up at the 2026-07-12 re-check." }, { "date": "2026-07-07", "note": "ANY → XMR path is materially back. Widget \"Swaps into XMR are temporarily paused\" banner has been REMOVED; a DAI → XMR quote renders live (1000 DAI → 2.975812 XMR, ~$1000 → ~$981, matches sane pricing at ~336 DAI/XMR); Swap button enabled. Recent Transactions strip shows FIVE ANY → XMR trades completed in the last 40 minutes (100 DAI → XMR 26m ago, 1 ETH → XMR 26m ago, 0.33 ETH → XMR twice at 34/35m ago, 400 DAI → XMR 40m ago) plus one XMR → ETH at 29m — real bidirectional throughput after ~56 days of one-way-only. Timing lines up with the operator @PerpetualCow going-public post at 17:40Z (~40 min before the earliest of these swaps). Grade held at D for now — this is 40 minutes of data, not a track record — but the operational side of the D case has meaningfully improved. Watch: if ANY → XMR stays open through 2026-07-09 with no re-pause AND a curator round-trip test-swap completes clean, lift to C." }, { "date": "2026-07-08", "note": "Relative to the on-file state (ANY→XMR paused; operator silent), material recovery signals appeared on 2026-07-07: operator @PerpetualCow claimed Wagyu was back after an unverified DDoS, and @xmr_club reported the pause banner gone with both-direction swaps executing. A third-party post on 2026-07-08 also said the s…", "auto": true }, { "date": "2026-09-12", "note": "Incident CLOSED. The 2026-07-07 XMR-pause recovered the same day (see entries above: banner removed, DAI->XMR quote live, 5 ANY->XMR swaps in 40 min) and ~2 months of uninterrupted operation followed — the critical incident had been left open in error. Verified via Wagyu's public API (api-beta.wagyu.xyz): 9,366 lifetime completed orders vs 40 failed; 325/408 completed in the last 24h (~$24M volume); XMR bridge deposits + withdrawals enabled; swaps completing in both directions; our own Rate Integrity panel at 100% over 30 days. Operator correction accepted (ticket #5263979311); grade unchanged (A-)." } ], "resolved": "2026-09-12" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "xmr2cex", "category": "exchanges", "subcategory": "Instant Swaps", "name": "xmr2cex", "url": "https://xmr.club/exchanges/xmr2cex", "twin": "https://xmr.club/llm/exchanges/xmr2cex.txt", "tagline": "XMR-in, CEX-sourced-clean-coins-out — specialty offramp that sends you the output from a T1 exchange reserve (Binance / Gate / etc.) rather than routing chain-to-chain. No account, no email, no ID; 3.4% avg fee, 1 XMR minimum, 5,000 XMR maximum. Fresh listing (2026) with unusually explicit no-KYC ToS (\"no exceptions\" clause covers size, asset, jurisdiction).", "review": "**Specialty XMR-in offramp — the output is clean CEX-sourced coins.** Not a general chain-to-chain swap engine. You send XMR, receive BTC / ETH / SOL / LTC / TRX / USDT (TRC / ERC / ARB) that comes out of an operator-held reserve topped up from a T1 exchange (Binance, Gate, or another top CEX per operator statement). The value proposition is chain-history: your output coins trace back to a large-CEX withdrawal rather than to a Tor mixer or a small-liquidity swap engine — useful when your downstream counterparty (broker, exchange deposit, merchant) is chain-analysis-sensitive.\n\n**No-KYC commitment is unusually explicit.** The Terms of Service publish an \"Absolute No-KYC Policy\" with a per-item enumeration: no identity verification, no accounts, no names / emails / phone / addresses, no government ID, no proof-of-funds or source-of-funds declarations. Then the \"no exceptions\" clause: *\"This policy applies universally, regardless of: the asset being swapped, the transaction size, the user's location, market conditions or liquidity source. There are no exceptions.\"* Direct language — the kind that's easy to hold an operator to later if the behavior drifts.\n\n**Privacy posture.** ToS Section 3 commits to data minimization: no personal information, no persistent identifiers, no user profiles, no behavioral analytics, no tracking cookies or fingerprinting. Only minimum technical transaction data, processed ephemerally, not linked to identities, not retained beyond operational necessity. *\"If data does not need to exist, it does not.\"*\n\n**Fees + limits.** Flat **3.4% average fee** (baked into the quote). Rate model is quote-locked at deposit-confirm — 5 confirmations required, ~20-minute typical processing. **1 XMR minimum, 5,000 XMR maximum per swap** — the high ceiling is because the reserve is stocked from T1 exchanges rather than crowd-liquidity, so big orders don't hit a small-pool ceiling the way they do with own-reserves engines like [OnionSwap](/exchanges/onionswap).\n\n**What you trust.** Operator holds funds during the swap window (deposit lands, output dispatched from CEX-sourced reserve — brief custodial window, standard shape for instant-swap operators). Optional Register / Login exists but is not required for a swap. Tor mirror + no-JS support. API published. Two-language UI (EN / RU).\n\n**Reader advice.** Suitable when your specific need is *clean-CEX-sourced output for XMR-in* — the CEX-provenance angle is a real differentiator for output coins that will hit chain-analysis-strict deposits downstream. Not the right tool for large-scale privacy-preserving cross-chain routing where you want the output ALSO to be privacy-forward — for that, atomic-swap engines ([Haveno](/exchanges/haveno)) or self-custody P2P ([Bisq](/exchanges/bisq), [RoboSats](/exchanges/robosats)) do the job without any operator custody window.\n\n**Peer signal.** Listed on kycnot.me and Monerica. Verified 2026-08-05.\n\n**Why this grade. ** Grade B− is the shelf default for a fresh instant-swap operator regardless of how clean the ToS reads. The unusually explicit \"no exceptions\" ToS commitment is a positive signal about editorial intent but does not by itself lift the grade — tenure remains the anchor. Re-review is natural in 60–90 days once a track record accumulates.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B-" }, "grade": "B-", "kyc_tags": [], "feature_tags": [ "no_account", "no_kyc_absolute", "cex_sourced_reserve", "high_cap_5k_xmr", "tor_mirror", "no_js", "api_available", "multilang_en_ru" ], "highlight_tags": [ "NO-KYC", "XMR-IN", "CEX-SOURCED-OUT" ], "fees": { "summary": "3.4% avg service fee · 1 XMR min · 5,000 XMR max · 5-conf lock" }, "fees_summary": "3.4% avg service fee · 1 XMR min · 5,000 XMR max · 5-conf lock", "last_verified": "2026-08-11", "operating_since": "2026-01", "tenure_note": "Domain registered 2026-01-16. `operating_since` set to the earliest signal.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmr2cex.com", "outbound_slug": "xmr2cex", "tor": "http://xmr2cexfq6aqk4txxoiipbo2lth27ylzqtkqgigoksso5dbww5sphryd.onion" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "yellowchanger", "category": "exchanges", "subcategory": null, "name": "YellowChanger", "url": "https://xmr.club/exchanges/yellowchanger", "twin": "https://xmr.club/llm/exchanges/yellowchanger.txt", "tagline": "Russian crypto exchanger with XMR deposits + withdrawals — no KYC, but every deposit is AML-screened: funds that trip its risk gate are refunded to the sender rather than frozen. Also does crypto ↔ Сбербанк / СБП / RF banks. 0.6% / 1%.", "review": "**A no-KYC-but-AML-screened Russian exchanger that supports Monero both ways.** YellowChanger takes no ID and no account, processes orders in 2-5 minutes fully automated, and supports **XMR for both deposits and withdrawals** (10 confirmations). It also bridges crypto ↔ **Сбербанк / СБП / all Russian banks**, at 0.6% (\"green\") or 1% (\"yellow\").\n\n**The AML gate is the defining trait.** Every incoming deposit is risk-scored. Per the operator, they *\"accept crypto up to 70% AML,\"* and funds that trip the gate are **refunded to the sender's address without verification** — a refuse-and-return posture rather than freeze-and-KYC, which is meaningfully more privacy-respecting than most compliance-forward exchangers. Important caveats: (1) this refund-on-trigger behaviour is the operator's claim and is **not yet verified by track record** — confirm before trusting large amounts; (2) the crypto↔fiat side settles to **Russian bank accounts, which are identity-bound** by definition, so the fiat leg is not private; (3) screening funds by \"risk score\" is itself a compliance stance that sits in tension with a no-KYC ethos.\n\n**Why C.** It's an established service (domain since 2023, listed on BestChange/SwapSpace, Trustpilot rated \"Great\" across 48 mostly-older reviews) with genuine XMR support — but the AML screening, the bank-tied fiat rails, and the unverified refund promise cap it. Clean funds route fine; complicated histories will bounce. That is exactly what C means on this shelf.", "translation_locale": "en", "rating": { "grade": "C", "trust": "Established RU exchanger (domain 2023-06, on BestChange/SwapSpace, Trustpilot rated 'Great' across 48 mostly-older reviews). No KYC/account; 2-5 min automated. AML-screens every deposit ('accept up to 70% AML'); operator states funds over the gate are REFUNDED to sender without verification (refuse-and-return, not freeze-and-KYC) — but this is unverified by track record; confirm before large amounts. Fiat side settles to Russian banks (identity-bound).", "privacy": "No ID, no account on the crypto legs; XMR deposits + withdrawals (10 confs). BUT every deposit is AML/risk-scored — a compliance stance in tension with a no-KYC ethos; clean funds pass, high-risk funds bounce back. Crypto<->fiat (Сбербанк/СБП/RF banks) is fully identity-bound and not private.", "ux": "Instant automated exchange, 2-5 min; RU-language UI, Telegram bot. Rate fixed to Binance. 0.6% green / 1% yellow. Crypto-crypto + crypto-RUB (Russian banks)." }, "grade": "C", "kyc_tags": [ "NO-KYC", "AML-SCREENED" ], "feature_tags": [ "xmr", "no_kyc", "fiat_gateway", "aml_screened" ], "highlight_tags": [ "XMR", "NO-KYC", "AML-SCREENED", "FIAT-GATEWAY" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-31", "operating_since": "2023-06", "tenure_note": "Domain registered 2023-06-17. Established on RU exchange monitors (BestChange, SwapSpace); Trustpilot 'Great' across 48 reviews (only ~3 in the last 12 months). AML refund-on-trigger policy is operator-stated, not yet verified by curator test or complaint history.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://yellowchanger.com", "telegram": "https://t.me/YellowChanger_partners", "outbound_slug": "yellowchanger" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "zerotrace", "category": "exchanges", "subcategory": "Aggregators", "name": "Null Route — ZERO TRACE", "url": "https://xmr.club/exchanges/zerotrace", "twin": "https://xmr.club/llm/exchanges/zerotrace.txt", "tagline": "Null Route — ZERO TRACE: Privacy-first swap aggregator that ranks exchanges by KYC rating (A→D) and log policy rather than price. Lives as a UI subpage on cetoc.org over Trocador.app.", "review": "**Not to be confused with [0trace](/exchanges/0trace)** — a separate own-liquidity instant-swap operator at 0trace.io (Grade B). This listing is the swap-aggregator UI at cetoc.org / NULL_ROUTE.\n\n**What it is.** A swap aggregator with a hard privacy filter — sorts exchange quotes by KYC rating (A=never, D=can freeze funds) and log policy rather than by price. Listed at **Grade C** because the KYC-awareness UX is genuinely useful but the tool has zero legal pages, zero operator disclosure, zero peer-directory footprint, and swaps execute through Trocador.app rather than its own infrastructure.\n\n**Background.** ZERO TRACE (NULL_ROUTE) is a sub-page of **cetoc.org** — a German/English bilingual site operating under the title 'NULL_ROUTE · Krypto Insider' (operator-published). The tool lives at `/zero/zerotrace.html` rather than on its own domain, which means it shares cetoc.org's hosting, DNS, and infrastructure. No `/about` page exists (404), no founder or founding date is published, and no operator contact channel is discoverable. The page footer describes the tool as 'a privacy tool from cetoc.org' with swaps executed 'through Trocador.app' (operator-published, page footer). The domain `cetoc.org` uses the `.org` TLD, typically associated with non-commercial or community projects, but nothing on the page confirms non-profit status.\n\n**What you trust.**\n\n- **No KYC, no account, no name.** The page states 'Kein Account. Kein Name' (operator-published, homepage DE text). No signup flow exists — no account, no signup, no login. Usage is anonymous by design.\n- **KYC-rating filter — the core trust signal.** Exchanges are not ranked by price; they are ranked by a four-tier KYC rating: A (never KYC demanded — full anonymity guaranteed), B (KYC only on suspicion or large amounts), C (KYC possible — check exchange policy), D (can freeze funds until verification). This is the strongest privacy UX feature in any swap aggregator in this directory — the tool doesn't just list exchanges, it rates them by how much they know about you.\n- **XMR Bridge for on-chain privacy.** The tool offers a two-hop route: Source Coin → XMR → Destination Coin. Two separate swaps through Monero break the on-chain link between the source and destination addresses. The bridge description: 'Maximum On-Chain-Privacy: no direct link between source and target coin' (operator-published, homepage).\n- **Log-policy awareness.** Beyond the KYC rating, the page claims to surface each exchange's log policy (operator-published, homepage: 'Du siehst KYC-Rating und Log-Policy jedes Anbieters'). Users are presented with privacy metadata before choosing an exchange — a meaningful departure from price-only aggregators.\n- **Swap status tracking without account.** Completed swaps can be tracked via Trade ID lookup on the same page — no account, no login, no session persistence required. The Trade ID search is exposed as a public endpoint on the page.\n- **Operational dependency — Trocador.app.** The page footer states swaps are executed 'through Trocador.app' (operator-published, page footer). Trocador is a well-known KYC-free swap aggregator (separately listed in this directory), but Zero Trace's trust profile is inseparable from Trocador's — if Trocador is unavailable or changes its API, Zero Trace ceases to function.\n- **No policy pages — complete opacity caveat.** No privacy policy, terms of service, AML statement, contact page, about page, support channel, or security disclosure exists on the host. Every other listing in this directory publishes at least one of these. There are no operator-published terms, no privacy policy, no acceptable-use policy, no AML statement, and no contact channel. This is the most opaque listing in the directory.\n\n**Operational specs.**\n\n- **Site.** `https://cetoc.org/zero/zerotrace.html` — a single HTML page, not an SPA. The page functions as a standalone web app despite being a single file.\n- **Languages.** German (DE) and English (EN) — toggle at top of page. The default language appears to be German (from the inline data-de/data-en attributes).\n- **No Tor mirror advertised.** No `.onion` address and no `Onion-Location` header detected. Clearnet-only.\n- **No independent domain.** The tool lives as a sub-page of cetoc.org — it does not have its own domain, subdomain, or independent hosting. DNS, hosting, and TLS infrastructure are shared with the parent domain.\n- **Swap modes.** Two modes: (a) Direct Swap — standard A→B, all pairs available; (b) XMR Bridge — A→XMR→B, two separate swaps via Monero for maximum on-chain privacy with no traceable link between source and destination coins.\n- **KYC rating system.** Four tiers: A (never KYC, guaranteed full anonymity), B (KYC only on suspicion or large amounts), C (KYC possible — check exchange policy), D (can freeze funds until identity verification). The page filters available exchange routes by the user's selected minimum KYC tolerance.\n- **Swap provider.** Trocador.app — all swaps execute through Trocador's infrastructure. The page does not connect to exchanges directly; it uses Trocador as the single swap-routing backend.\n- **Pricing.** No fees charged by Zero Trace itself. Exchange rates and any spread are determined by Trocador.app and the underlying exchange. The page does not display a fee schedule or commission structure.\n- **No public API surface.** The page interacts with Trocador's API internally but does not expose a public API of its own.\n- **Domain.** `cetoc.org` — `.org` TLD, typically non-commercial. No WHOIS or jurisdiction information recoverable from the page or DNS.\n\n**Operator philosophy.** The page's tagline — 'ZERO TRACE ist kein normaler Swap-Aggregator. Hier wählst du nicht nach Preis. Du wählst nach Privacy.' (operator-published, homepage DE text — translation: 'ZERO TRACE is not a normal swap aggregator. Here you don't choose by price. You choose by privacy.') — captures the project's thesis: privacy ranking as the primary UX differentiator in a market where every other aggregator sorts by price. The KYC-rating filter (A→D) and XMR Bridge feature are thoughtful, non-trivial privacy infrastructure. The tool's weakness is that it's a thin UI layer over Trocador.app with no discoverable operator behind it — the philosophy is well-articulated on the page but there is no person, team, or legal entity standing behind it. The bilingual DE/EN presentation suggests a German-speaking operator or target audience.\n\n**Grade rationale.** Listed at **Grade C** — the lowest grade in the current directory — because while the privacy UX is genuinely well-designed and the KYC-rating filter is unique among swap aggregators, the listing is opaque on every other dimension. Grade D is not assigned because the tool demonstrably works (the page renders a functional swap UI with live rate fetching from Trocador), the privacy model is articulated in the UI rather than hidden, and the XMR Bridge feature is a non-trivial privacy enhancement. However, the gap between this and Grade B is large: (a) the site publishes no privacy policy, no terms of service, no AML statement, no contact channel, no about page, and no operator identity — every other listing in this directory publishes at least one of these — this is the most opaque listing in the directory; (b) zero peer-directory matches; (c) the tool is operationally dependent on a single third-party swap provider (Trocador.app) — if Trocador changes its API, pricing, or availability, Zero Trace breaks; (d) no Tor mirror; (e) the tool has no independent domain — it shares cetoc.org's infrastructure, DNS, and TLS. **Path to a higher grade:** publish at minimum a privacy policy (even a one-paragraph statement about what data the page itself collects — likely nothing, but state it), a terms-of-service disclaimer, and a contact channel (email or Matrix). An independent domain or subdomain, a Tor mirror, and at least one peer-directory listing (monerica or kycnot) would address the trust-footprint gap. **Peer signal:** the cetoc.org/NULL_ROUTE team has accepted xmr.club into their directory, which is a small but real reciprocal-listing trust signal — both directories have agreed to surface each other to their respective readers.\n\n**Useful when:**\n\n- You want to swap between cryptocurrencies and you care more about which exchanges see your transaction than about getting the absolute best rate — the KYC-rating filter lets you screen out exchanges that demand identity verification.\n- You need maximum on-chain privacy for a swap and are willing to pay the extra spread of a two-hop route (BTC→XMR→LTC or any A→XMR→B pair) — the XMR Bridge breaks the direct on-chain link between source and destination.\n- You want to check a swap's status without creating an account or logging in — the Trade ID lookup works without any session or signup.\n- You're comparing exchange privacy policies and want a tool that surfaces both KYC rating and log policy for each provider before you commit a transaction.\n\n**Caveats.**\n\n- **Complete policy vacuum.** This is the most opaque listing in the directory: no privacy policy, no terms of service, no AML statement, no contact page, no about page, no support channel, no security disclosure — Every other listing in this directory publishes at least one policy page.\n- **Operational dependency — Trocador.app.** All swaps execute through Trocador.app. The tool is a UI layer, not a swap engine. If Trocador changes its API contract, pricing model, or availability, Zero Trace stops working. Users who want to understand the swap execution path need to read Trocador's own policy pages, not Zero Trace's.\n- **No independent domain.** The tool lives at `/zero/zerotrace.html` on cetoc.org — it has no subdomain, no independent DNS, no separate TLS certificate, and no dedicated hosting. This makes it harder to verify the operator's control over the infrastructure and easier for the parent domain's configuration to affect the tool.\n- **No operator discoverable.** No name, no pseudonym, no email, no Matrix, no Simplex, no X/Twitter handle, no GitHub, no PGP key. The page footer says 'cetoc.org' but cetoc.org itself has no `/about` page (404). The operator is entirely anonymous — not pseudonymous, but absent.\n- **No peer-directory footprint.** Zero matches across all six probed directories (monerica, kycnot, orangefren, web3privacy, monerofail, privacyguides). The tool appears to be undiscovered in the broader Monero and privacy-tool ecosystem.\n- **No Tor mirror.** Clearnet-only. A privacy-swap aggregator without a Tor-accessible endpoint is an accessibility gap — users who route all browsing through Tor must use a clearnet exit node to reach the page.\n- **Single HTML page — fragile.** The entire tool is a single `.html` file. While this is technically elegant (no server-side state, no database, no backend), it also means the page's functionality depends on cetoc.org's web server configuration, TLS setup, and the continued availability of the Trocador API. If the HTML file is moved or deleted, the tool disappears.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [ "anonymous_signup", "no_kyc" ], "feature_tags": [], "highlight_tags": [], "fees": { "summary": "No platform markup published. Swap rates come from Trocador.app — verify the quoted rate against the underlying provider before sending." }, "fees_summary": "No platform markup published. Swap rates come from Trocador.app — verify the quoted rate against the underlying provider before sending.", "last_verified": "2026-08-04", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://cetoc.org/zero/zerotrace.html", "outbound_slug": "zerotrace", "tor": "http://zero7nto6qrbyz62a3ysehge77jeswfqhxzlkxzizh3hkggcgtyizfyd.onion" }, "also_listed_at": { "null_route": true, "kycnot": "7/10", "xmrlist": true, "bitlist": true, "monerica": true, "bitcointalk": "https://bitcointalk.org/index.php?topic=5584038.0", "altcoinstalks": "https://www.altcoinstalks.com/index.php?topic=345331.0", "kycnone": "pending" } }, { "id": "dread", "category": "forums", "subcategory": "Tor-only Forum", "name": "Dread", "url": "https://xmr.club/forums/dread", "twin": "https://xmr.club/llm/forums/dread.txt", "tagline": "Tor-only Reddit-style forum. Best harm-reduction + market-review community in the no-KYC space. DNM-adjacent.", "review": "Dread is the closest thing the onion ecosystem has to a Reddit for communities that mainstream platforms refuse to host — and for privacy and harm-reduction culture specifically, it is canonical. Founded by **HugBunter in 2018** in the wake of Reddit's purge of r/darknetmarkets, it rebuilt the deplatformed discussion model as a censorship-resistant, Tor-only forum with anonymous registration and a working reputation system. For Monero users, its value is not the marketplace chatter it's adjacent to — it's the deepest concentration of practical OPSEC, threat-modeling, and harm-reduction knowledge anywhere on the network.\n\n**Background.** Dread emerged at a moment when the clearnet was actively expelling certain communities, and it deliberately inverted the assumptions of a normal forum: no real identity, no email, no JavaScript required, reachable only over Tor. HugBunter has operated and defended it for years — through extended DDoS sieges that took it offline for long stretches, through the churn of the markets it discusses, and through the constant adversarial pressure that any long-lived onion service attracts. That longevity is itself a trust signal: anonymous operators who survive years of attack and don't exit-scam their own social capital are rare.\n\n**What you trust.** Dread is a pseudonymous, reputation-based system, not a vouched one. You trust HugBunter's moderation and uptime, and you trust the community's own reputation scoring to surface signal — there is no central authority certifying that any given poster or linked service is honest. Accounts build standing over time; subdreads (the sub-forum equivalent) are moderated by their creators. This is the correct model for a censorship-resistant forum, but it means the burden of verification stays with you: reputation is a heuristic, not a guarantee, and impersonation and phishing links are a permanent background risk.\n\n**Operational specs.** Tor v3 onion service, anonymous account creation, and a **strict no-JavaScript design** that works fully for users who disable scripts (the right default for a Tor forum, and a hard requirement for the security-conscious). Structure mirrors Reddit: subdreads (/d/ communities) for OPSEC, harm reduction, tech, privacy tooling, and marketplace reviews, with per-post reputation. PGP is woven through the culture for verifying identities and signed announcements. Always reach it through HugBunter's currently-signed canonical address — onion phishing clones of Dread are common.\n\n**Philosophy.** Dread is a free-speech, censorship-resistant venue for communities that have been pushed off every surveilled platform. That posture is exactly why it accumulated the genre's best harm-reduction and operational-security writing: the people who most need to talk about staying safe are the people with nowhere else to do it. The harm-reduction ethos in particular — drug-checking, dosing safety, scam avoidance — is a public good regardless of one's view of the markets it sits beside.\n\n**Grade rationale.** Grade A reflects the unmatched depth of OPSEC and harm-reduction knowledge, the genuinely censorship-resistant architecture (Tor-only, no-JS, anonymous), and an operator track record measured in years of surviving sustained attack. It is graded on its value as a *forum and knowledge base*, not as an endorsement of everything discussed within it.\n\n**Useful when** you want to learn real operational security from people who practice it adversarially: threat-modeling, wallet and Tor hygiene, scam-spotting, PGP discipline, and harm reduction. It's also the place to research the reputation of onion services before trusting them — the community's collective scrutiny catches things a single user can't.\n\n**Caveats.** Dread is **DNM-adjacent**: a large share of threads are marketplace-related, and depending on your jurisdiction even reading some of it carries legal sensitivity — know your local risk and treat this as an information source, not a shopping directory. Listing here is not an endorsement of any market or illegal activity. Expect downtime: DDoS has repeatedly knocked Dread offline for extended periods. Phishing clones are rampant — verify the onion address against HugBunter's signed announcements every time, and never reuse a Dread password or identity anywhere else.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "tor_supported", "no_js_supported" ], "highlight_tags": [ "TOR-ONLY", "FORUM", "DNM-ADJACENT" ], "fees": { "summary": "Free · Tor-only · anonymous signup" }, "fees_summary": "Free · Tor-only · anonymous signup", "last_verified": "2026-05-13", "operating_since": "2026", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2026", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion", "tor": "http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion", "outbound_slug": "dread" } }, { "id": "libera-monero", "category": "forums", "subcategory": "Chat Rooms", "name": "Libera Chat #monero", "url": "https://xmr.club/forums/libera-monero", "twin": "https://xmr.club/llm/forums/libera-monero.txt", "tagline": "IRC home of the Monero project. Bridged to the Matrix space — same conversations, different transport.", "review": "IRC is where Monero is actually built. The #monero channels on Libera.Chat are the project's real-time nerve center — and because they're bridged to Matrix, you can join the same rooms from whichever transport you prefer.\n\n**Background**\nLibera.Chat — the FOSS-community IRC network that hosts most major open-source projects — is home to Monero's canonical real-time channels: #monero (general), #monero-dev (core development), and #monero-research-lab (cryptography and protocol research). All three are bridged bi-directionally to the Matrix space, so a message on either side reaches both.\n\n**What you trust**\nYou trust Libera.Chat (a long-standing, volunteer-run, FOSS-aligned network) and the IRC↔Matrix bridge — not a corporate platform with an ad model or a Discord-style data silo. There's no central owner of the conversation, and participation is pseudonymous.\n\n**Operational specs**\nConnect via `irc.libera.chat` or the Matrix bridge. #monero for general help, #monero-dev for core work, #monero-research-lab for MRL discussion (whose meetings are publicly logged). Reachable over Tor/clearnet; no account beyond a nick (register to hold it). Plaintext protocol by design.\n\n**Philosophy**\nMonero's development and research happen in the open, in real time, on community-run infrastructure — not behind a proprietary chat wall. IRC's longevity and transport-neutrality match the project's values: minimal, durable, no lock-in.\n\n**Grade rationale**\nGrade A. It's the authoritative, open, real-time home of Monero development and support, bridged so no one's locked out by transport choice. Graded as a community/dev channel, judged on that role — where it's foundational.\n\n**Useful when**\nYou want real-time help or to ask a question live; you follow or contribute to core development; you want to attend/read Monero Research Lab discussion; you prefer open infrastructure over Discord.\n\n**Caveats**\nIRC is plaintext — use a registered nick + connect over Tor (or a bouncer) if you care about connection-metadata privacy. It's real-time, not an async archive like a forum, so help depends on who's around. Anyone can speak — verify technical advice against official docs (getmonero.org) before acting.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "tor_supported" ], "highlight_tags": [ "IRC", "OFFICIAL", "DEV" ], "fees": { "summary": "Free · IRC · Tor-friendly" }, "fees_summary": "Free · IRC · Tor-friendly", "last_verified": "2026-05-13", "operating_since": "2021", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://libera.chat", "tor": "http://libera75jm6of4wxpxt4aynol3xjmbtxgfyjpu34ss4d7r7q2v5zrpyd.onion", "outbound_slug": "libera-monero" } }, { "id": "monero-forum", "category": "forums", "subcategory": "General", "name": "Monero Forum", "url": "https://xmr.club/forums/monero-forum", "twin": "https://xmr.club/llm/forums/monero-forum.txt", "tagline": "Self-hosted Monero discussion forum — a Scam Reports board where users actually name and shame, a Tor mirror that works, and optional-email registration. Pseudonymous admin, no published privacy policy or forum rules.", "review": "**What it is.** A self-hosted, community-run forum for Monero discussion. Threads, polls, RSS, a Tor mirror, and the kinds of features you'd want from a phpBB-era forum in 2026 (faucet, classifieds, services directory, price ticker, a built-in bull-or-bear vote). The interesting thing it has that Reddit doesn't is a **Scam Reports** subforum where users actively post receipts on services that withheld funds — which is the whole reason a Monero-specific forum is worth bookmarking.\n\n**Background.** The forum has been running under the `monero.forum` domain since around mid-2025 (monerica.com lists its founding date as `2025-05-29` and the same record on monerica goes back to 2022-06-22, suggesting an earlier version of the project existed before the current launch). The admin operates under the handle `admin` and doesn't publish a personal identity, jurisdiction, or contact email anywhere on the site. The same admin has since spun up a sibling forum for Wownero on the same software stack — the announcement post calls it out plainly — so this is someone running niche-coin discussion spaces as a small portfolio rather than a one-off. The forum also keeps an X account at `@MoneroForum` — joined November 2025, low-hundreds of followers as of fold-time, blue check present (which since 2023 just means the account is paying for X Premium, not that anybody verified anyone's identity — but it's still a positive low-cost signal that the operator cares enough to maintain a paid public surface).\n\n**What you trust.**\n\n- **The community is awake.** Threads from the last 24 hours, real users at every level from new accounts to 15-year-old veterans, and visible engagement across mining help, FCMP++ GUI testing, no-KYC eSIM picks, and price discussion. It doesn't feel like a ghost forum.\n- **There's a Scam Reports board, and people actually post in it.** Real threads about real services — recent examples reference Wagyu and several smaller swap providers — with users naming names and dates. That's exactly the watchdog function a privacy-coin forum exists to provide.\n- **The admin enforces moderation when it counts.** Independent confirmation: the operator behind the HammerVM hosting service we recently rejected was, by their own published rebuttal elsewhere, banned from monero.forum for harassment. That kind of decisive moderation against bad actors is the most useful single thing a community can do.\n- **Monerica has it as ✅ Verified.** The listing at `monerica.com/site/monero-forum` was last updated 2026-03-30 and tags it with *Email Not Required*, *JavaScript Optional*, *No KYC* — concrete privacy claims that match the experience of using the site.\n- **The site is JavaScript-optional and Tor-friendly.** The `.onion` mirror works, the clearnet site renders without JavaScript, and the homepage doesn't push a registration interstitial — you can browse and read without ever creating an account.\n- **Registration matches the monerica tag.** The form at `/auth/register` asks for username, password, and a text captcha; email is *explicitly optional* (the form copy reads: *'Optional. Add one if you want email recovery or email 2FA later.'*). No phone number, no SMS gate, no Google reCAPTCHA, no identity check. You can register fully anonymously.\n\n**Operational specs.**\n\n- **Site.** `https://monero.forum` (clearnet) and `http://monerokpw6inpkzm2yayp23t3llfu7wqgm46xvc55gbn3qiudxcpvmyd.onion/` (Tor v3 mirror, advertised in the clearnet `Onion-Location` header).\n- **Community size at fold-time.** ~1,730 registered members, ~16 boards, a few hundred threads with steady recent activity. Not huge, but durable.\n- **Features beyond plain discussion.** Built-in Monero faucet, classifieds board, services directory, XMR price ticker, RSS feed, and a \"bull or bear\" weekly vote.\n- **Public operator surface.** The forum itself, the X account `@MoneroForum`, and that's it. No PGP key, no admin email, no Matrix room, no Telegram. If you need to reach the admin, you message them inside the forum.\n- **Registration.** `/auth/register` — username + password + text captcha (in-house, not Google reCAPTCHA); email is optional and only used if you opt into recovery / 2FA later. CSRF-protected. Nothing else asked.\n- **Sibling project.** The same admin runs a Wownero forum on the same stack. Worth knowing because it means the admin's attention is split, and any infrastructure issue on monero.forum will probably hit the Wownero one too.\n\n**Operator philosophy.** There's no manifesto, no `/about` page, no pinned post about the mission. What you can read from the admin's actions: they keep the software up (editor upgrade, RSS, sibling-forum launch were all admin announcements), they let the community self-organize the boards, and they ban people who harass others rather than ride out the controversy for engagement. The forum exists to fill a gap — there isn't an official Monero forum, r/Monero is a Reddit fiefdom, and most of the rest of the Monero conversation happens on Matrix or Discord — both of which are fine for chat but lose long-form, searchable, persistent threads. monero.forum is what you'd want if you want a forum-shaped surface to discuss Monero. That's what it's optimized for, and it's done well enough that real discussion happens.\n\n**Grade rationale.** Listed at **Grade B**. The community is genuinely active, the moderation is observably real, the privacy posture on the public surface is reasonable (no JS required, no email gate visible, Tor mirror with a proper `Onion-Location` header), and a peer directory we already cite (monerica) has verified the listing. What keeps it under A: the admin is pseudonymous with no fallback contact channel, there's no published privacy policy or written forum-rules thread, there's no `kycnot.me` review or other independent third-party audit, and the registration form's actual data requirements aren't documented anywhere public. **Path to A** — practical steps the operator can take: publish a short privacy policy (what's logged, IP retention, whether email is stored), pin a written forum-rules / moderation-policy thread (so users know what triggers a ban and how to appeal), expose a non-anonymous contact channel (a PGP-signed admin email or a Matrix room), and earn one additional independent peer-directory listing or third-party review.\n\n**Useful when:**\n\n- You want to read or post Monero discussion in a long-form, searchable, RSS-followable forum without joining Reddit or a Matrix room.\n- You're considering a Monero service and want to see what other users have actually said about it — the Scam Reports and service-discussion boards are the directory's own kind of complementary signal.\n- You want a forum reachable over Tor without compromising functionality — the onion mirror is real, the site is JavaScript-optional, and there's no email-gated signup wall on the public flow.\n- You want to follow Monero classifieds, faucet activity, or the community's running price-sentiment vote in addition to the chatter.\n\n**Caveats.**\n\n- **No written privacy policy, no published moderation policy.** The forum doesn't tell you what it logs, whether registration requires an email, how long IP records are kept, or what triggers a ban. For a forum where users post wallet addresses and trade-quality reports, that's the single biggest trust gap.\n- **Pseudonymous admin, no fallback.** The admin uses the handle *admin* with no further attribution. If the admin goes quiet, the forum goes with them — there's no co-maintainer, no documented succession plan, no community-controlled backup.\n- **Reputation is internal-only.** Despite 1,730+ members, there's effectively zero external discussion of the forum on Reddit, Bitcointalk, or monero.town. You're trusting the forum's own evidence of its quality — which is fine for a community space, but it means a new visitor can't easily corroborate from outside.\n- **The admin runs a second forum.** The Wownero forum announcement is on-record, which means the admin's attention is split. Not a disqualifier — most independent forum admins run more than one site — but it's worth knowing for risk-of-attention-drift purposes.\n- **No incident history.** No publicly known data breach, admin abuse, content-takedown controversy, or spam wave. That's good as a current snapshot — but it also means operator response under stress is untested, so the next incident (whenever it comes) will be the first read on how the admin handles pressure.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup", "no_kyc" ], "feature_tags": [ "tor_mirror" ], "highlight_tags": [ "COMMUNITY", "TOR", "SCAM-WATCHDOG", "JS-OPTIONAL" ], "fees": { "summary": "Free to browse and post. No paid tiers, no subscription, no sponsored placement beyond a single Your-ad-here slot." }, "fees_summary": "Free to browse and post. No paid tiers, no subscription, no sponsored placement beyond a single Your-ad-here slot.", "last_verified": "2026-06-12", "operating_since": "2025-05-29", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://monero.forum", "tor": "http://monerokpw6inpkzm2yayp23t3llfu7wqgm46xvc55gbn3qiudxcpvmyd.onion/", "twitter": "https://x.com/MoneroForum", "outbound_slug": "monero-forum" }, "also_listed_at": { "monerica": true } }, { "id": "monero-mastodon", "category": "forums", "subcategory": "Federated Microblog", "name": "#Monero on Mastodon", "url": "https://xmr.club/forums/monero-mastodon", "twin": "https://xmr.club/llm/forums/monero-mastodon.txt", "tagline": "Fediverse hashtag view. Cross-instance, lower volume than X/Reddit, stays on-topic.", "review": "#Monero on Mastodon is the community's answer to following the project without feeding a surveillance-advertising platform — a federated, hashtag-driven view of Monero chatter that lives on infrastructure aligned with Monero's own values.\n\n**Background**\nMastodon is the largest open, federated (ActivityPub) social network. The `#Monero` hashtag surfaces posts across every participating instance simultaneously, giving a cross-instance feed of announcements, protocol discussion, and community talk — lower-volume than X or Reddit, but markedly more on-topic and less adversarial.\n\n**What you trust**\nYou trust an open protocol and whichever instance you choose to join, not a single corporate owner. Most public instances allow pseudonymous signup with minimal data, and there are no behavioral-ad trackers harvesting your engagement. The trade-off of federation is that moderation and uptime vary by instance.\n\n**Operational specs**\nFederated via ActivityPub; hashtag-based discovery means you can follow `#Monero` without committing to one instance's politics. Accessible over clearnet and, depending on the instance, Tor. No algorithmic ad-feed; chronological or instance-curated timelines. Anonymous-friendly registration on many public servers.\n\n**Philosophy**\nFollowing a privacy project on a surveillance-capitalism platform is a quiet contradiction. The fediverse resolves it: decentralized, no single point of control, no engagement-maximizing ad engine. It's the community channel whose architecture matches the coin's ethos.\n\n**Grade rationale**\nGrade A — as a *community channel*, not a service. It earns the grade for being privacy-respecting, decentralized, and genuinely useful for staying current, judged against that role rather than against a high-volume mainstream feed.\n\n**Useful when**\nYou want project news and protocol chatter without an ad-surveillance platform; you prefer pseudonymous, decentralized social; you're already on the fediverse; you want a calmer, more technical signal than X/Reddit.\n\n**Caveats**\nLower volume and slower than X/Reddit — you'll miss some real-time noise (and some news breaks elsewhere first). Discussion is fragmented across instances, and moderation/quality depends on which instance you pick. It's a community surface, not an official Monero channel — verify announcements against project sources (getmonero.org, the GitHub repos) before acting.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "self_hosted", "tor_supported", "no_js_supported" ], "highlight_tags": [ "FEDIVERSE", "HASHTAG" ], "fees": { "summary": "Free · pick any instance · self-host if you want" }, "fees_summary": "Free · pick any instance · self-host if you want", "last_verified": "2026-05-18", "operating_since": "2016", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://mastodon.social/tags/Monero", "outbound_slug": "monero-mastodon" } }, { "id": "monero-matrix", "category": "forums", "subcategory": "Chat Rooms", "name": "Monero Project Matrix Space", "url": "https://xmr.club/forums/monero-matrix", "twin": "https://xmr.club/llm/forums/monero-matrix.txt", "tagline": "Official Monero community over Matrix. #monero, #monero-research-lab, #monero-dev, plus a dozen sub-rooms.", "review": "The Monero Project Matrix Space is the official Monero community chat surface — federated Matrix rooms where the people who actually built Monero hang out, plus a dozen sub-rooms for specific aspects of the ecosystem. Listed at **Grade A · editor's pick** because if you want to ask \"why does Monero do X?\" or follow Monero Research Lab's protocol-design conversations as they happen, this is the room. Public Matrix rooms federated under `matrix.org` and `monero.social`, with IRC bridge to Libera Chat (`#monero`) for users who prefer the older transport.\n\n**Background.** The Monero Project Matrix Space groups together the active community rooms under a single Matrix namespace. **Core rooms**: `#monero` (general discussion), `#monero-dev` (core protocol development), `#monero-research-lab` (cryptographic + protocol research — Seraphis / FCMP++ / Carrot work happens in public here), `#monero-community` (community organising), `#monero-translations` (localisation work), plus rooms for specific tooling (Monero GUI, CLI, hardware wallets), specific topics (mining, merchants, OPSEC), and regional language rooms. The community moved to Matrix as the primary surface around 2020-2021, with the IRC bridge preserved for legacy users. Federation via matrix.org (the public default homeserver) and monero.social (community-operated homeserver).\n\n**What you trust.** Matrix is **federated** rather than centralised — you can join from any Matrix homeserver, including your own self-hosted one. The Monero rooms themselves live in a Matrix space, but each user connects through their chosen homeserver. **End-to-end encryption** is supported for direct messages and small rooms; large public rooms (which is what the Monero community uses) typically run unencrypted because key distribution for hundreds-to-thousands of members at once is operationally heavy. **Moderation**: the rooms are moderated by named community members; ban lists are coordinated across rooms. **Identity**: Matrix homeserver identities (`@name:homeserver.org`) are persistent and globally identifiable — meaningfully different from SimpleX's per-contact pairing model. If you want stronger anonymity, use SimpleX for direct conversations and Matrix only for public-discussion participation under a pseudonymous handle.\n\n**Operational specs.** Access via any Matrix client: Element (the reference client, available for web / desktop / iOS / Android), Cinny, FluffyChat, NeoChat, or terminal clients like gomuks. **IRC bridge**: Libera Chat (irc.libera.chat) hosts `#monero` and related channels bridged to the Matrix equivalents; messages flow bidirectionally so a question on IRC reaches Matrix users and vice versa. **Federation**: any Matrix homeserver can join — matrix.org is the easy-mode default, monero.social is community-operated, or self-host using Synapse / Dendrite / Conduit. **No registration barrier**: most homeservers allow anonymous/pseudonymous signup; pick a handle, join the rooms, participate. **Tor-friendly**: Matrix protocol works over Tor; pair with a homeserver that doesn't IP-restrict Tor exits.\n\n**Philosophy.** The community's editorial differentiator is **structural openness without a corporate gatekeeper**. There's no Monero foundation that controls the rooms; moderation is community-elected, the rooms are on federated infrastructure, and the conversation includes researchers who are actively shaping the next protocol upgrade. Compared to a Discord-hosted community (centralised, corporate-controlled, voice-call-friendly but text-search-hostile) or a Telegram channel (centralised, identity = phone number, no federated alternative), Matrix preserves the \"free software values\" the Monero community cares about while still being usable enough for non-technical users. The IRC bridge keeps the legacy contingent in the same conversation. The Research Lab's habit of working in public means you can watch real protocol decisions get debated rather than just read the post-decision blog post.\n\n**Grade rationale.** Grade A and editor's pick reflect: official Monero Project namespace (not a fork or unofficial spinoff); active core-developer participation in the rooms; Monero Research Lab conversations happening in public; federated Matrix infrastructure (no single point of corporate control); IRC bridge preserving the older-user community; ban-list coordination across rooms keeping signal-to-noise high; no signup barrier beyond picking a Matrix handle; integration with the broader Matrix federation. Last verified 2026-05-13.\n\n**Useful when.** You have a technical question about Monero (\"why does the protocol do X?\", \"how does ring signature size affect timing analysis?\") and want to ask people who designed it. You're following Monero Research Lab's work-in-progress — Seraphis, FCMP++, Carrot are all debated in public. You want community sentiment on a new feature, exchange, wallet, or operator before trusting it. You're a developer building on Monero and need to coordinate with other developers. You want to follow #monero general conversation as a window into the broader Monero ecosystem. You prefer text-based discussion over Discord's voice-and-noise model.\n\n**Caveats.** **Matrix identity is persistent** — your `@handle:homeserver.org` is a stable identifier across rooms; if you participate over time, observers can build a per-handle activity profile. For high-threat anonymity, use a throwaway homeserver account per topic, or use SimpleX for direct contact. **Large public rooms are unencrypted by default** — E2EE doesn't scale gracefully to hundreds-of-members rooms, so the Monero general rooms are observable to homeserver operators (matrix.org sees matrix.org users' messages, monero.social sees monero.social users' messages, etc.). For sensitive conversations, move to a small E2EE room or to SimpleX. **Signal-to-noise varies by room** — `#monero` general is busy and conversational; `#monero-dev` and `#monero-research-lab` are technical and focused. Pick rooms that match your interest level. **The IRC bridge has its quirks** — long messages get truncated, message edits and reactions don't translate cleanly. If you're using the bridge, your audience splits in style across the two transports. **No Telegram / Discord equivalent** — for users who prefer those platforms, third-party unofficial groups exist but are not officially endorsed and have varying moderation quality. Some bridge to Matrix; verify before relying on them.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "tor_supported" ], "highlight_tags": [ "MATRIX", "OFFICIAL", "DEV" ], "fees": { "summary": "Free · Matrix federation · IRC bridge" }, "fees_summary": "Free · Matrix federation · IRC bridge", "last_verified": "2026-05-13", "operating_since": "2015", "tenure_note": "WHOIS 2015 predates archive.org first snapshot 2005; treated as current-entity year (domain may have been re-registered)", "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://matrix.to/#/#monero:matrix.org", "outbound_slug": "monero-matrix" }, "also_listed_at": { "privacyguides": true } }, { "id": "monero-nostr", "category": "forums", "subcategory": "Decentralized Microblog", "name": "#monero on Nostr", "url": "https://xmr.club/forums/monero-nostr", "twin": "https://xmr.club/llm/forums/monero-nostr.txt", "tagline": "Nostr is a decentralized protocol — follow the #monero hashtag from any Nostr client. No accounts; key-pair identity.", "review": "Nostr is what a censorship-resistant, account-less social layer actually looks like — and following #monero on it means tracking the community on infrastructure that shares Monero's own anti-surveillance DNA.\n\n**Background**\nNostr (Notes and Other Stuff Transmitted by Relays) replaces accounts with public/private key pairs and federates over independent relays: you publish to relays, clients subscribe. Following the #monero hashtag pulls Monero-tagged notes from every relay your client connects to.\n\n**What you trust**\nThere is no central server or corporate owner — you trust your own keypair and whichever relays you choose. Identity is a cryptographic key, not an email or phone number, so you can't be deplatformed: switch relays and keep the same identity. No ad engine harvesting your engagement.\n\n**Operational specs**\nKeypair identity (npub/nsec); relay-federated; #monero hashtag discovery from any client (Damus, Amethyst, Primal, etc.); works over Tor; no signup. Bring your own relays or use community defaults.\n\n**Philosophy**\nA social layer you can't be removed from, with no surveillance-ad model — the natural home for a community built on censorship resistance and self-sovereign identity. The architecture matches the coin's values.\n\n**Grade rationale**\nGrade A — censorship-resistant, account-less, privacy-aligned, and genuinely decentralized. Graded as a community channel for staying current, judged on that role, where it fits the ethos better than any mainstream platform.\n\n**Useful when**\nYou want Monero chatter on uncensorable infrastructure; you prefer keypair identity over accounts; you're already on Nostr; you want a deplatform-proof way to follow the project.\n\n**Caveats**\nVolume is lower and signal-to-noise varies by relay. Nostr leaks its own metadata (which relays you use, posting times) unless you're deliberate — pair with Tor. It's a community surface, not official: verify announcements against getmonero.org. UX is rougher than mainstream social, and relay choice matters for what you actually see.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "no_kyc" ], "feature_tags": [ "open_source", "non_custodial", "self_hosted", "tor_supported" ], "highlight_tags": [ "NOSTR", "DECENTRALIZED", "KEY-PAIR" ], "fees": { "summary": "Free · key-pair identity · BYO relay" }, "fees_summary": "Free · key-pair identity · BYO relay", "last_verified": "2026-05-18", "operating_since": "2022", "tenure_note": "Nostr protocol launched November 2022 (NIP-01 specification). Previous stamp (2003) was nostr.com domain WHOIS, which predates the protocol by 19 years.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://nostr.com", "outbound_slug": "monero-nostr", "twitter": "https://x.com/Snowden" } }, { "id": "pitch", "category": "forums", "subcategory": "Tor-only Forum", "name": "Pitch", "url": "https://xmr.club/forums/pitch", "twin": "https://xmr.club/llm/forums/pitch.txt", "tagline": "Tor-only forum, lighter-weight Dread alternative. Anonymous registration, sub-forums, DNM-adjacent.", "review": "Newer Tor forum positioning as a faster, leaner alternative to Dread. Anonymous registration, sub-forum structure, similar reputation / vouching ethos. DNM-adjacent like Dread. Smaller community but active; useful as a backup when Dread is under DDoS or offline.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "tor_supported", "no_js_supported" ], "highlight_tags": [ "TOR-ONLY", "FORUM", "DNM-ADJACENT" ], "fees": { "summary": "Free · Tor-only · anonymous signup" }, "fees_summary": "Free · Tor-only · anonymous signup", "last_verified": "2026-05-13", "operating_since": "2024", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2024", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "http://pitchprash4aqilfr7sbmuwve3pnkpylqwxjbj2q5o4szcfeea6d27yd.onion", "tor": "http://pitchprash4aqilfr7sbmuwve3pnkpylqwxjbj2q5o4szcfeea6d27yd.onion", "outbound_slug": "pitch" } }, { "id": "r-monero", "category": "forums", "subcategory": "Reddit", "name": "r/Monero", "url": "https://xmr.club/forums/r-monero", "twin": "https://xmr.club/llm/forums/r-monero.txt", "tagline": "Mainline Monero subreddit. Long-form questions, news threads, market chatter. Use a privacy front-end (Libreddit / Redlib) for read access.", "review": "The high-volume Reddit hub for Monero. Mainline news, protocol announcements, beginner-friendly Q&A. Reddit itself is centralized and tracks behaviour, so for read-only access prefer privacy front-ends like Libreddit or Redlib (community-hosted instances bypass Reddit's tracking + login wall). Posting requires a Reddit account. Useful as a discovery surface for newcomers; the deeper technical conversation lives on Matrix / IRC.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "no_js_supported" ], "highlight_tags": [ "REDDIT", "MAINSTREAM" ], "fees": { "summary": "Free · email-only signup · third-party front-ends for privacy reads" }, "fees_summary": "Free · email-only signup · third-party front-ends for privacy reads", "last_verified": "2026-05-18", "operating_since": "2014", "tenure_note": "r/Monero subreddit created April 2014 (around Monero protocol launch). Previous stamp (2005) was reddit.com WHOIS — shared-host trap.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://reddit.com/r/Monero", "outbound_slug": "r-monero" } }, { "id": "r-xmrtrader", "category": "forums", "subcategory": "Reddit", "name": "r/xmrtrader", "url": "https://xmr.club/forums/r-xmrtrader", "twin": "https://xmr.club/llm/forums/r-xmrtrader.txt", "tagline": "Trading + price-focused Monero subreddit. Higher noise; useful as a sentiment thermometer.", "review": "Companion subreddit to r/Monero, narrowed to trading and price discussion. Signal-to-noise is lower than the main sub but useful when you want a sentiment read or want to find no-KYC exchange recommendations crowd-sourced. Same Reddit privacy caveats apply — read via Libreddit / Redlib, post sparingly.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "no_js_supported" ], "highlight_tags": [ "REDDIT", "TRADING" ], "fees": { "summary": "Free · email-only signup" }, "fees_summary": "Free · email-only signup", "last_verified": "2026-05-18", "operating_since": "2017", "tenure_note": "r/xmrtrader subreddit created ~2017. Previous stamp (2005) was reddit.com WHOIS — shared-host trap.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://reddit.com/r/xmrtrader", "outbound_slug": "r-xmrtrader" } }, { "id": "stasher-news", "category": "forums", "subcategory": "Community", "name": "Stasher News", "url": "https://xmr.club/forums/stasher-news", "twin": "https://xmr.club/llm/forums/stasher-news.txt", "tagline": "Monero-native link aggregator + social feed (turfs, news, memes) with peer-to-peer XMR tipping — attach a wallet, tips arrive on-chain, no account email required. Brand-new; bounties use a platform escrow.", "review": "**A Reddit / Hacker-News for Monero, wired for on-chain tipping.** Stasher News is a community link-aggregator — \"turfs\" (subs) for monero, mining, memes and more — where posts and comments earn **XMR tips paid peer-to-peer on the Monero network** into a wallet you attach to your profile. Browsing is free; posting costs a small **0.001 XMR** anti-spam fee (until your account has stacked 0.01 XMR in tips), which funds the curator-rewards pool.\n\n**Custody: mostly non-custodial, with one escrow.** The platform states it plainly — *\"Stasher News is non-custodial: the platform never holds your money, and all payments are sent directly on the Monero network.\"* Tips and rewards are genuinely P2P — nothing is skimmed, funds land in your own wallet. The one exception is **bounties**, funded to an integrated address on the platform's **dedicated bounty escrow wallet** and paid out to the winner — a temporary, purpose-scoped hold, not a general balance you top up and withdraw.\n\n**Access is no-KYC.** Signup offers *\"Sign up without Email\"* — wallet-based, no identity, email optional.\n\n**Why C.** It's **brand-new** (domain + X both ~Aug 2026, no track record) and touches user XMR via the bounty escrow, so C is the honest ceiling for now — a deserved listing used with the caution any month-old fund-touching platform warrants. On the plus side it's refreshingly **XMR-only** (no BTC/fiat bolt-on), the tip flow is real and non-custodial, and it already draws genuine Monero-community participation. Climbs on tenure + a clean track record on the escrow.\n\n**One real privacy trade-off:** attaching a wallet means handing over your **private view key** (primary address + view key). It is watch-only — it *cannot spend*, which is exactly what makes the platform non-custodial — but it lets Stasher (and anyone who obtains that key) **see every incoming transfer** to that address. Use a **dedicated / fresh wallet** for Stasher, never your main one, or you expose your full receiving history. To Stasher's credit, they **disclose this exact tradeoff on the registration screen** and explicitly tell you to create a wallet solely for Stasher — honest, user-protective framing rather than a quiet key-harvest, and a real point in their favour on transparency.", "translation_locale": "en", "rating": { "grade": "C", "trust": "Brand-new (domain + X both ~Aug 2026, no track record). Non-custodial for tips/rewards (P2P on Monero, platform states it never holds your money); one custodial element = a dedicated bounty-escrow wallet (temporary, scoped). XMR-only, real Monero-community participation. C = new + light fund-touching (escrow); climbs on tenure + clean escrow record.", "privacy": "No-KYC: 'Sign up without Email' — wallet-based, email optional, no identity. Tips delivered P2P to a wallet you attach; nothing skimmed. As a social platform your posts/turfs are public by design; posting fee (0.001 XMR) is an on-chain action. Registration requires primary address + PRIVATE VIEW KEY (watch-only, cannot spend — confirms non-custodial — but exposes ALL incoming transfers to the platform; use a dedicated wallet, not your main.) (Credit: the platform discloses this tradeoff on the signup screen + advises a dedicated wallet — transparent, not a silent harvest.)", "ux": "Familiar link-aggregator/turf model with XMR tips baked in (default + custom + random tips), meme bounties, referral rewards, live XMR price ticker. FAQ is thorough; other legal pages (/terms, /how-it-works) currently 404 — thin legal surface for a new platform." }, "grade": "C", "kyc_tags": [ "NO-KYC" ], "feature_tags": [ "xmr", "no_kyc", "p2p_tips", "community", "memes" ], "highlight_tags": [ "XMR", "NO-KYC", "P2P-TIPS", "XMR-ONLY", "COMMUNITY" ], "fees": null, "fees_summary": null, "last_verified": "2026-09-10", "operating_since": "2026", "tenure_note": "Brand-new — no Wayback history, X joined Aug 2026 (~1mo). Non-custodial tips (P2P) + a bounty-escrow wallet (light custody). Grade C for new-platform + fund-touching-escrow; not exchange-class so the 6mo exchange floor doesn't strictly apply, but new + touches XMR = C. Climbs on tenure + clean escrow track record.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://stasher.news", "outbound_slug": "stasher-news", "affiliate": "https://stasher.news/r/5eb67eefae", "logo": "/peers/stasher-news.png", "twitter": "https://x.com/stashernews" }, "also_listed_at": { "monerica": true } }, { "id": "1984-hosting", "category": "hosting", "subcategory": "VPS", "name": "1984.is", "url": "https://xmr.club/hosting/1984-hosting", "twin": "https://xmr.club/llm/hosting/1984-hosting.txt", "tagline": "Iceland-based free-speech ISP. Accepts Monero, geothermal-powered.", "review": "1984 Hosting is the **canonical free-speech ISP** — an Iceland-based VPS and dedicated-server hosting provider that explicitly markets a **free-speech mandate**, accepts **Monero, Bitcoin, and cash by post**, runs its servers in **Iceland's geothermal grid** (renewable energy + jurisdictional separation from Five Eyes intelligence-sharing alliances), and has a long operational track record of **resisting overseas takedown requests** without legal force from Iceland's courts. Listed at **Grade A** because 1984 Hosting occupies a structurally unique slot in the privacy-hosting category: it's the only major hosting provider with a public commitment to refusing non-Icelandic legal-process takedowns combined with an established multi-decade operational history.\n\n**Background.** 1984 Hosting was founded by **Mörður Ingólfsson** in Reykjavík, Iceland around **2006**, named after George Orwell's novel. The company has been operating continuously for **~19 years** as of this writing — longer than most cryptocurrency-friendly hosting providers. **Jurisdiction**: Iceland — not in the Five Eyes / Fourteen Eyes intelligence-sharing alliances, has constitutional protections for press freedom (notably the IMMI / Icelandic Modern Media Initiative laws passed 2010-onward), and Iceland's data-protection framework is generally privacy-friendly. **Servers**: located in Iceland's data centres which are powered by **geothermal energy** (renewable, low carbon footprint — a separate-from-privacy editorial point but worth mentioning). **Funding model**: subscription revenue from hosting customers; no venture capital, no acquisition history. The company is privately held, structurally aligned with its free-speech mandate.\n\n**What you trust.** **Icelandic jurisdiction** — generally privacy-friendly legal framework, no mass-data-retention regime, IMMI laws codify some press-freedom protections. Iceland is **not a member of Five/Fourteen Eyes** and doesn't have automatic data-sharing arrangements with major Western intelligence agencies. **Free-speech mandate** — 1984 Hosting publicly commits to resisting overseas takedown requests; the company's public response to historical takedown attempts is documented and aligns with the stated mandate. **Multiple payment methods** — credit card, PayPal, Bitcoin, Monero, **cash by post** (mail Icelandic Krona or equivalent currency to 1984's office). **Long operational track record** — ~19 years since 2006 is unusually long for privacy-aligned hosting; most competitors are <10 years old. **No KYC for individual customers** in most hosting plan tiers — verification is typically email + payment method, no name/address required for personal-tier accounts. **What you don't trust**: **Iceland is a small jurisdiction** — while it has strong constitutional protections, the country's small population and economy make it operationally constrained. Major-scale legal-process attacks from large jurisdictions could theoretically pressure Iceland in ways that don't apply to large jurisdictions with more diplomatic leverage. **EU implications** — Iceland is an EEA (European Economic Area) member with some EU-adjacent legal alignment; EU-grade GDPR applies, but EU-wide regulatory frameworks (e.g., DSA, CSAM-detection mandates) may eventually impact Icelandic-hosted services. **Operator trust** — like all hosting providers, 1984 sees your IP, your DNS queries, and (without TLS) your traffic. Strong operational practices (full-disk encryption, minimal logging) are documented, but the operator is in the trust path.\n\n**Operational specs.** **Services**: shared hosting, VPS (KVM-based, Linux distributions), dedicated servers, domain registration (some TLDs), email hosting, DNS hosting. **VPS tiers**: from ~€4/month for basic VPS up through high-spec dedicated servers; pricing in Euros (Icelandic operations in Krona for the company, customer-facing in EUR/USD). **Payment methods**: credit card, PayPal, **Bitcoin**, **Monero**, **cash by post** (Icelandic Krona, EUR, USD), wire transfer for business accounts. **OS support**: Debian, Ubuntu, CentOS / Alma, FreeBSD, custom ISO uploads. **Data centres**: Iceland — Reykjavík area; geothermal-grid powered. **Uptime SLA**: typical hosting-industry SLAs (95-99% depending on tier). **Network**: peering with major European backbones; bandwidth is reasonable but Iceland's submarine-cable connectivity means latency from non-European clients is noticeable (~150ms+ from US East Coast, ~250ms+ from Asia). **Customer support**: email + ticket-based; Icelandic + English support available; response times documented in service-level commitments. **Account model**: standard hosting-provider accounts; minimal-information signup for personal accounts; business accounts may require more info for billing purposes.\n\n**Philosophy.** 1984 Hosting's editorial differentiator is the **free-speech-mandate + Icelandic-jurisdiction + multi-decade-track-record** combination. Other privacy-aligned hosting providers exist (Njal.la, Cock.li hosting, FlokiNET, BuyVM, BlackHost), each with their own jurisdictional choices and operational track records. 1984's specific combination is: **Iceland (small, privacy-friendly jurisdiction outside Five/Fourteen Eyes) + free-speech-public-commitment + geothermal-renewable-power + ~19-year operational continuity**. For users whose threat model includes overseas-legal-process takedown attempts (whistleblower journalism, controversial commercial speech, activist publishing), 1984's track record of resistance is meaningful. The trade-off vs more mainstream hosting: higher latency from non-European clients, smaller-scale data centre infrastructure, less aggressive feature-velocity than US-based commercial hosts.\n\n**Grade rationale.** Grade A reflects: **19+ years of operational continuity** (since 2006); Icelandic jurisdiction outside Five/Fourteen Eyes; **free-speech mandate** publicly committed and historically demonstrated through resistance to overseas takedown requests; multiple payment methods including **Monero**, **Bitcoin**, and **cash by post**; renewable-energy-powered data centres (geothermal grid); reasonable hosting pricing; multi-OS support; named operator (Mörður Ingólfsson) with public identity; cross-listed in privacy-tooling references for jurisdiction-conscious hosting. Last verified 2026-05-11.\n\n**Useful when.** You're a **journalist or activist** whose threat model includes overseas-legal-process takedown requests — 1984's track record of resistance to such requests is meaningful. You want to **host privacy-aligned content** (whistleblower documents, controversial commercial speech, anti-surveillance research) without giving a US/EU-jurisdiction commercial provider operator-level access. You want to **pay for hosting with Monero or cash** — 1984 is one of the few mainstream hosting providers accepting these payment methods. You're an **Icelandic citizen** or based in northern Europe and want a local hosting provider with strong privacy posture. You're building **privacy-aligned infrastructure** (Tor onion services, Matrix homeservers, Mastodon instances, IPFS gateways) and want a jurisdiction-aligned host. You want **renewable-energy-powered hosting** — Iceland's geothermal grid is among the cleanest power sources globally.\n\n**Caveats.** **Latency from non-European clients** — Iceland's submarine-cable connectivity means ~150ms+ from US East Coast, ~250ms+ from Asia. For latency-sensitive applications (real-time gaming, low-latency APIs), Iceland-hosted infrastructure is sub-optimal. For most web hosting, journalist-publishing, and similar use cases, the latency is fine. **Small-jurisdiction risk** — Iceland's small population and economy mean major-scale legal-process pressure from large jurisdictions could theoretically constrain operators in ways that don't apply to providers in large jurisdictions. The historical track record suggests 1984 has weathered such pressure successfully but the structural risk exists. **EU-adjacent regulatory drift** — Iceland is an EEA member, so EU-wide regulations (GDPR, DSA, future CSAM-detection mandates) influence Icelandic hosting. Watch for evolving EU regulatory frameworks. **Pricing in Krona / EUR** — billing currency may not match your home currency; exchange-rate fluctuation matters for budget planning. **Smaller-scale data centre infrastructure** — for hyperscale deployments (thousands of cores, petabyte-scale storage), 1984 doesn't have AWS-grade scaling. For typical privacy-aligned hosting needs, 1984's infrastructure is sufficient. **Customer support is email/ticket-based** — no 24/7 phone hotline; response times are reasonable for hosting industry but slower than premium enterprise support. **Operator-level trust remains** — like all hosting, 1984 sees your IP, DNS, and (without TLS) traffic. Use encrypted protocols (TLS, SSH, IPsec) on top, and treat the operator as semi-trusted infrastructure, not zero-knowledge. **Anti-CSAM compliance** — like all reputable hosting providers, 1984 will comply with legitimate child-safety legal processes; the free-speech mandate covers political/commercial speech, not illegal content. Read the AUP (Acceptable Use Policy) for specifics. **Hardware-failure recovery is on you** — VPS users should design for hardware failures; 1984 maintains its infrastructure but doesn't offer multi-region failover out-of-the-box at the lower tiers.\n\n**Reliability note (2026-06):** 1984 auto-suspended a client's VPS — Monero marketplace XmrBazaar — on the first batch of abuse/DMCA complaint tickets with **no prior notice**, then restored it after the operator queried it (1984: the complaints were \"mostly DMCA\"). 1984 runs a zero-abuse, suspend-on-first-complaint policy, so a single complaint can take a legitimate site offline without warning. Keep critical data backed up and a fallback host ready regardless of any provider's reputation.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A-" }, "grade": "A-", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [], "highlight_tags": [ "XMR", "ICELAND", "FREE-SPEECH" ], "fees": { "summary": "VPS from €5/mo · XMR / BTC / fiat · ICE jurisdiction" }, "fees_summary": "VPS from €5/mo · XMR / BTC / fiat · ICE jurisdiction", "last_verified": "2026-06-08", "operating_since": "2006", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://1984.hosting", "outbound_slug": "1984-hosting", "twitter": "https://x.com/1984Hosting" }, "incident": { "date": "2026-06-07", "resolved": "2026-06-08", "severity": "high", "summary": "1984.is auto-suspended XmrBazaar (a legal Monero marketplace it hosted) without notice after weaponized DMCA/abuse complaints — part of a pattern that also took down Hack Liberty, a 4+ year customer, in March 2026. XmrBazaar was restored after public pushback.", "curator_advice": "Resolved — XmrBazaar is back online. Kept on record: 1984 has now removed two legal privacy projects with no warning. See the standing curator caveat and /shamelist.", "source_url": "https://forum.hackliberty.org/", "timeline": [ { "date": "2026-06-21", "note": "No new 1984.is operator statement, status-page post, or third-party post-mortem in the last 7 days. On 2026-06-17 XmrBazaar admin AilliA publicly linked ongoing false-positive listing takedowns to the earlier host shutdown over abuse reports, stating the internal report system was tightened afterward. XmrBazaar rema…", "auto": true }, { "date": "2026-06-22", "note": "No new 1984.is operator statement, status-page post, or third-party post-mortem in the last 7 days. On 2026-06-17 XmrBazaar admin AilliA publicly linked ongoing false-positive listing takedowns to the earlier host shutdown over abuse reports, stating the internal report system was tightened afterward. XmrBazaar rema…", "auto": true }, { "date": "2026-06-23", "note": "No new 1984.is operator statement, status-page post, or third-party post-mortem in the last 7 days. On 2026-06-17 XmrBazaar admin AilliA publicly linked ongoing false-positive listing takedowns to the earlier host shutdown over abuse reports, stating the internal report system was tightened afterward. XmrBazaar rema…", "auto": true } ] }, "also_listed_at": { "web3privacy": true, "kycnot": true, "monerica": true } }, { "id": "abelohost", "category": "hosting", "subcategory": "Dedicated", "name": "AbeloHost", "url": "https://xmr.club/hosting/abelohost", "twin": "https://xmr.club/llm/hosting/abelohost.txt", "tagline": "Netherlands-based offshore dedicated + VPS. DMCA-resistant.", "review": "Dutch operator focused on offshore + DMCA-resistant hosting. Dedicated and VPS. Accepts XMR + BTC. Servers in a Netherlands tier-3 datacenter.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "light_kyc" ], "feature_tags": [], "highlight_tags": [ "XMR", "OFFSHORE" ], "fees": { "summary": "VPS from €6/mo · dedicated from €40 · XMR / BTC / fiat" }, "fees_summary": "VPS from €6/mo · dedicated from €40 · XMR / BTC / fiat", "last_verified": "2026-05-12", "operating_since": "2013", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://abelohost.com", "outbound_slug": "abelohost", "contact_email": "info@abelohost.com" } }, { "id": "anonymd", "category": "hosting", "subcategory": "Shared + VPS + VPN", "name": "AnonyMD", "url": "https://xmr.club/hosting/anonymd", "twin": "https://xmr.club/llm/hosting/anonymd.txt", "tagline": "Moldova-based no-KYC hosting + VPN — Tor mirror with working Onion-Location, XMRBazaar ordering, COMING SOON across most tiers.", "review": "Moldova-based hosting + VPN provider with a Monero-native payment flow via XMRBazaar — shared hosting, VPS, and DPI-resistant VPN. The homepage trust surface (no-KYC, no-logs, no-refund, jurisdiction, Tor mirror with working `Onion-Location` header) is now backed by a [published privacy policy](https://anonymd.eu/en/privacy) added 2026-06-03 in direct response to our listing flagging it as missing — a positive responsiveness signal for a small operator.\n\n**What it is.** Moldova-based hosting + VPN, Monero-native ordering via XMRBazaar. Operating since 2025-01-15 per the operator's first blog post *\"Welcome to AnonyMD Blog\"*. One peer-directory match (monerica.com — kycnot.me doesn't list yet). Tor mirror at `http://anonymdtzguq5w56wue33lob6lo4ooqmcsewlxz4cwb5zdvns4n6ouyd.onion/en` with correct `Onion-Location` header.\n\n**Zero logs policy (§2).** *\"No log files are written to disk for user activity. Service-level logs (e.g. server uptime monitoring) do not contain user-identifiable data.\"*\n\n**No KYC — anonymous sign-up (§3).** *\"We do not require any personal identification to use our services. No name, address, phone number, or government-issued ID is requested at any point.\"*\n\n**Contact channels (§5).** *\"We use end-to-end encrypted channels (OMEMO for XMPP, Protonmail for email). We do not share communication data with third parties.\"*\n\n**Legal-request posture (§6).** *\"With no logs, we have no user data to provide in response to legal requests.\"*\n\n**Grade rationale.** Listed at **Grade B**. The published privacy policy closes the largest single gap in the original B-grade call. Held under A by four still-open items spelled out below — and the operator's responsiveness on the privacy gap suggests they may be willing to close more of them on request.\n\n**Yellow flags.** (1) Only one peer-directory match — kycnot.me doesn't list yet. (2) The product line is still operationally thin — most VPS + hosting tiers are *COMING SOON*. (3) monerica notes unreliable website uptime, which the operator hasn't yet visibly addressed. (4) `.eu` TLD on a Moldova-based service creates jurisdictional tension (likely a domain trustee — EURid rules require an EU presence). The §8 *No Refund Policy* stays as a published condition — fair-warning, not a hidden term.\n\n**Useful when.** For users who treat downtime as an acceptable trade for posture, AnonyMD's trust surface is unusually clean for the price. For mission-critical workloads, BTCVPS or Njalla remain safer A-grade picks until AnonyMD's product line and uptime mature.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup", "no_kyc" ], "feature_tags": [ "tor_mirror", "wallet_funded" ], "highlight_tags": [ "NO-KYC", "XMR", "TOR" ], "fees": { "summary": "Variable per-tier · Monero-native via XMRBazaar · 'COMING SOON' on most VPS + hosting tiers" }, "fees_summary": "Variable per-tier · Monero-native via XMRBazaar · 'COMING SOON' on most VPS + hosting tiers", "last_verified": "2026-06-30", "operating_since": "2025-01-15", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://anonymd.eu", "outbound_slug": "anonymd", "tor": "http://anonymdtzguq5w56wue33lob6lo4ooqmcsewlxz4cwb5zdvns4n6ouyd.onion/en", "contact_email": "anonymously-moldova@proton.me", "privacy": "https://anonymd.eu/en/privacy" }, "also_listed_at": { "monerica": true } }, { "id": "bitlaunch", "category": "hosting", "subcategory": "VPS", "name": "BitLaunch", "url": "https://xmr.club/hosting/bitlaunch", "twin": "https://xmr.club/llm/hosting/bitlaunch.txt", "tagline": "Crypto-paid VPS reseller — DigitalOcean / Linode / Vultr backend.", "review": "Pays the underlying clouds for you, charges crypto. Means you get DO/Linode/Vultr infrastructure without leaving your name with them. Markup is significant but worth it if you need the bigger fleet without KYC.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "light_kyc" ], "feature_tags": [], "highlight_tags": [ "XMR", "RESELLER" ], "fees": { "summary": "VPS from $5/mo · ~20% markup vs upstream · BTC / LN / USDT / XMR" }, "fees_summary": "VPS from $5/mo · ~20% markup vs upstream · BTC / LN / USDT / XMR", "last_verified": "2026-05-12", "operating_since": "2018", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2018", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://bitlaunch.io", "outbound_slug": "bitlaunch", "twitter": "https://x.com/bitlaunchio" } }, { "id": "blueangelhost", "category": "hosting", "subcategory": "Tor / Onion-friendly", "name": "BlueAngelHost", "url": "https://xmr.club/hosting/blueangelhost", "twin": "https://xmr.club/llm/hosting/blueangelhost.txt", "tagline": "Hosts .onion services in Bulgaria. Accepts BTC + XMR.", "review": "One of the few operators explicitly OK with onion services as their primary workload. Bulgaria-based. Accepts BTC + XMR. Smaller fleet, more relationship-based onboarding.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [], "highlight_tags": [ "XMR", "ONION-OK" ], "fees": { "summary": "VPS from $8/mo · BTC / XMR · BG jurisdiction" }, "fees_summary": "VPS from $8/mo · BTC / XMR · BG jurisdiction", "last_verified": "2026-05-12", "operating_since": "2012", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://blueangelhost.com", "outbound_slug": "blueangelhost", "contact_email": "help@blueangelhost.com" } }, { "id": "btcvps", "category": "hosting", "subcategory": "VPS", "name": "BTCVPS", "url": "https://xmr.club/hosting/btcvps", "twin": "https://xmr.club/llm/hosting/btcvps.txt", "tagline": "Crypto-only VPS in NL + LT — self-built BTC/XMR gateway, no third-party payments.", "review": "Anonymous VPS hosting provider accepting Bitcoin and Monero, operating out of Netherlands and Lithuania. Listed at **Grade B** because two independent peer directories confirm the listing and a Terms of Service + Acceptable Use Policy page exist — but the site has no privacy policy, no AML disclosure, no /about page, and the legal-URL auto-discovery probe timed out against the domain.\n\n**What it is.** Bitcoin-accepting VPS host with datacenters in the Netherlands and Lithuania. Listed at **Grade B** — the grade floor is set by two documented legal pages (ToS at `/legal/terms-of-service`, AUP at `/legal/acceptable-use-policy`) and peer-directory confirmation across kycnot.me and monerica; the ceiling is capped by total absence of a privacy policy, AML disclosure, and operator background pages.\n\n**What you trust.** KYC stance: no privacy policy, FAQ, or /about page surfaced that would document the signup process. The homepage title claims anonymous hosting (peer_matches.kycnot. Verify the signup fields during your first test trade. Payment surface: no operator-published coin list found on a discoverable page. The homepage title references Bitcoin (operator-published), and peer directories list Monero support. Verify the accepted coins during your first checkout flow. AML posture: Undisclosed — No AML language was surfaced from the ToS or AUP pages either since the raw page content is. Terms of service: Documented — `/legal/terms-of-service` returns a custom 15KB page titled 'Terms of Service'. Full text was not captured in this review; Read and cite the data-collection, cancellation, and payment clauses. The conventional `/terms`, `/tos`, and `/terms-of-service` root-level slugs all 404 — the page only exists under the `/legal/` prefix. Acceptable use policy: Documented — `/legal/acceptable-use-policy` returns a custom 17KB 'Acceptable Use Policy' page. This is unusual for a B-grade listing A published AUP is a positive compliance signal for a VPS provider. Privacy policy: Not discovered — no privacy-policy page exists on the host. This is the single largest trust-signal gap in the listing: a published ToS and AUP without a matching privacy policy is an asymmetrical disclosure pattern worth flagging. Reserves transparency: No live reserves panel. VPS hosts do not conventionally maintain a public reserves sheet, so this is less damning than for an exchange — but it means there is no verifiable assurance the operator segregates customer prepayments from operating capital.\n\n**Operational specs.** Jurisdictions: Netherlands and Lithuania (operator-published). Both are EU member states — GDPR applies, which is good for consumer data-rights but also means the operator is subject to EU data-retention mandates. Pricing / fee structure: no `/fees` or `/pricing` path surfaced (all 404). The homepage at 70KB likely contains product tiers; Check pricing from the homepage or checkout flow. Coin coverage: homepage title references Bitcoin. Monero support is listed on peer directories, Twitter (`https://x.com/btcvps`), Telegram (`https://t.me/btc_vps`) — all surfaced from the homepage and /contact page. No Matrix or Simplex channel listed — standard for VPS providers. Tor mirror: BTCVPS advertises `btcvps22bw3ftklfklime6o6jwmf5rpoyb5fhxyzan5hpfnnumnpemqd.onion` off-site (kycnot + monerica); the clearnet does not currently carry the `Onion-Location` header so the onion is manual-discovery only. no privacy policy is published anywhere on the domain (the only legal pages are the ToS at `/legal/terms-of-service` and the AUP at `/legal/acceptable-use-policy`); (2) no AML disclosure at any path; (3) no operator background or `/about` page; (4) the off-site-advertised onion (`btcvps22b…onion`) is not announced via an `Onion-Location` header on the clearnet, so it is manual-discovery only. Among VPS providers in this directory, a documented privacy policy is the single largest trust-signal gap between B-grade and A-grade. Two peer listings (the A-grade threshold) exist but the documentation gap keeps this at B.\n\n**Caveats.** The Terms of Service and Acceptable Use Policy pages exist at `/legal/terms-of-service` and `/legal/acceptable-use-policy` but their raw text was not captured in this review — the data-retention, account-termination, and prohibited-use clauses remain unread by this review. Existence is confirmed; content is not. The recommended `feature_tags` include `non_custodial`. A VPS provider manages customer infrastructure and holds prepaid balances, making 'non-custodial' inaccurate in the conventional sense. Some legal-URL discovery paths timed out during the audit.._error). All conventional, footer, and subdirectory privacy paths failed. This domain may have aggressive rate-limiting or The publicly-observable footprint: 10s-per-path budget hit a slow backend. Re-run a public audit with a higher per-path timeout or with a longer-timeout probe to confirm the privacy-policy gap is real and not a probe artifact.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "tor_mirror" ], "highlight_tags": [ "NO-KYC", "XMR", "BTC", "TOR" ], "fees": { "summary": "VPS €6-48/mo · 8 tiers (NL + LT) · BTC/XMR/BCH/LTC/Wownero/Digibyte" }, "fees_summary": "VPS €6-48/mo · 8 tiers (NL + LT) · BTC/XMR/BCH/LTC/Wownero/Digibyte", "last_verified": "2026-06-07", "operating_since": "2024-10-15", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://btcvps.com", "outbound_slug": "btcvps", "tos": "https://btcvps.com/legal/terms-of-service", "aup": "https://btcvps.com/legal/acceptable-use-policy", "contact_email": "support@btcvps.com", "twitter": "https://x.com/btcvps", "telegram": "https://t.me/btc_vps", "tor": "http://btcvps22bw3ftklfklime6o6jwmf5rpoyb5fhxyzan5hpfnnumnpemqd.onion/" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "buyvm", "category": "hosting", "subcategory": "VPS", "name": "BuyVM", "url": "https://xmr.club/hosting/buyvm", "twin": "https://xmr.club/llm/hosting/buyvm.txt", "tagline": "Long-running VPS (acquired by Cloudzy Jan 2025) — accepts BTC/XMR, Luxembourg + NYC + Las Vegas, free DDoS protection.", "review": "Frantech's BuyVM brand — VPS provider (acquired by Cloudzy Jan 2025) with locations in Luxembourg, NYC, Las Vegas, and Miami. Anonymous accepted (no real-name required), payment via BTC/XMR/PayPal. Free 1 Gbps DDoS protection bundled. Smaller fleet than Hetzner but more permissive on content (within legal limits).\n\n**2026 update.** Two verified changes since the initial listing: (1) BuyVM was acquired by Cloudzy in Jan 2025 — founder Francisco stayed on and told the community at the time there would be *\"no change in pricing… no reduction in resources… no downgrades in hardware.\"* (2) In May 2026 BuyVM announced its first-ever price adjustment, effective 2026-07-01, of roughly 15-25% across all KVM Slice plans (e.g. 4 GB slice $15→$17 for existing customers, $20 for new). Operator's stated reason is >15% upstream DC and bandwidth increases over the preceding six months. The pricing move breaks the letter of the acquisition-time promise, though the reasoning is disclosed publicly. Grade held at B — the operator's transparency in explaining the increase, and the fact that even post-hike pricing stays competitive with the peer set, keeps this above C; but the *\"independent\"* framing has been dropped from the tagline.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "non_custodial" ], "highlight_tags": [ "NO-KYC", "XMR", "DDoS-PROTECTED" ], "fees": { "summary": "VPS from $3.50/mo · BTC/XMR/PayPal · free DDoS" }, "fees_summary": "VPS from $3.50/mo · BTC/XMR/PayPal · free DDoS", "last_verified": "2026-07-01", "operating_since": "2010", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://buyvm.net", "outbound_slug": "buyvm", "twitter": "https://x.com/frantechca" }, "incident": { "date": "2025-01-08", "severity": "medium", "summary": "Two verified changes on the trust-story axis since the initial B-listing: (1) BuyVM was acquired by Cloudzy in January 2025 — founder Francisco stayed on and told the community at the time there would be \"no change in pricing… no reduction in resources… no downgrades in hardware.\" (2) In May 2026, BuyVM announced its first-ever price adjustment, effective 2026-07-01, of roughly 15-25% across all KVM Slice plans (e.g. 4 GB slice $15→$17 for existing customers, $20 for new). The operator's stated reason is >15% upstream DC and bandwidth increases over the preceding six months. The pricing move breaks the letter of the acquisition-time promise, though the reasoning is disclosed publicly.", "curator_advice": "Grade held at B — the operator's transparency in explaining the price adjustment plus the fact that post-hike pricing stays competitive with the peer set keeps this above C. The \"independent VPS\" framing has been dropped from the tagline. Existing customers on affected plans should expect the new pricing on their next renewal on/after 2026-07-01. Path to A now requires: three years of clean operation under Cloudzy ownership without a second broken commitment, plus a peer-directory listing corroborating the current trust story.", "source_url": "https://lowendbox.com/blog/buyvm-acquired-by-cloudzy/", "timeline": [ { "date": "2025-01-08", "note": "BuyVM acquired by Cloudzy. Founder Francisco stated on LowEndTalk: \"Your current pricing & services aren't changing at all. No change in pricing. No reduction in resources. No IP address renumbering. No downgrades in hardware. No loss of features.\"", "note_i18n": { "zh": "BuyVM 被 Cloudzy 收購。創辦人 Francisco 於 LowEndTalk 上表示:「你目前的價格與服務完全不會變。價格不變。資源不減。IP 地址不重編號。硬體不降級。功能不遺失。」", "es": "BuyVM adquirido por Cloudzy. El fundador Francisco declaró en LowEndTalk: \"Your current pricing & services aren't changing at all. No change in pricing. No reduction in resources. No IP address renumbering. No downgrades in hardware. No loss of features.\"", "ru": "BuyVM приобретён Cloudzy. Основатель Francisco заявил на LowEndTalk: «Your current pricing & services aren't changing at all. No change in pricing. No reduction in resources. No IP address renumbering. No downgrades in hardware. No loss of features.»" } }, { "date": "2026-05-06", "note": "First-ever BuyVM price adjustment announced on LowEndTalk. All KVM Slice plans raised ~15-25% (e.g. 4 GB Slice $15→$17 for existing customers, $20 for new). Operator cites >15% upstream DC + bandwidth cost increases over the previous six months.", "note_i18n": { "zh": "BuyVM 於 LowEndTalk 上宣布首次調價。全線 KVM Slice 方案上漲約 15-25%(例如 4 GB Slice:現有客戶 $15→$17,新客戶 $20)。營運者說明原因為上游資料中心與頻寬成本於前六個月內上漲逾 15%。", "es": "BuyVM anunció el primer ajuste de precios de su historia en LowEndTalk. Todos los planes KVM Slice subieron ~15-25% (ej. Slice de 4 GB: $15→$17 para clientes existentes, $20 para nuevos). El operador cita >15% de aumentos en costos de DC + ancho de banda upstream durante los seis meses previos.", "ru": "BuyVM объявил на LowEndTalk своё первое за всё время повышение цен. Все тарифы KVM Slice подняты на ~15-25% (напр. 4-ГБ Slice: $15→$17 для существующих клиентов, $20 для новых). Оператор ссылается на >15% рост цен upstream DC + полосы пропускания за предыдущие шесть месяцев." } }, { "date": "2026-07-01", "note": "First renewal cycle with the new pricing begins. Directory listing tagline updated to drop \"independent VPS\" framing.", "note_i18n": { "zh": "首個帶新價格的續費週期開始。目錄列項的標語已更新,移除「獨立 VPS」的描述。", "es": "Comienza el primer ciclo de renovación con el nuevo precio. El tagline del listado del directorio se actualizó para eliminar el marco de \"independent VPS\".", "ru": "Начинается первый цикл продления с новой ценой. Tagline листинга каталога обновлён с удалением формулировки «independent VPS»." } }, { "date": "2026-09-11", "note": "No new disclosure on the January 2025 Cloudzy acquisition terms or the May 2026 KVM Slice price hike. In the last 7 days founder Francisco said Cloudzy owner Hannan switched DDoS mitigation from Path.net to Terabit.io around 2026-09-01, with a botched cutover that degraded CH/anycast, and that Cloudzy being more cor…", "auto": true } ] } }, { "id": "cockbox", "category": "hosting", "subcategory": "Tor / Onion-friendly", "name": "Cockbox", "url": "https://xmr.club/hosting/cockbox", "twin": "https://xmr.club/llm/hosting/cockbox.txt", "tagline": "Tor-friendly VPS, accepts XMR. Smaller operator, lenient AUP.", "review": "Smaller, irreverently-named provider but solid operator. Accepts XMR, doesn't ask questions about workloads. Good for hosting onion services where you don't want to depend on bigger providers.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [], "highlight_tags": [ "XMR", "TOR-OK" ], "fees": { "summary": "VPS from $8/mo · XMR / BTC" }, "fees_summary": "VPS from $8/mo · XMR / BTC", "last_verified": "2026-05-12", "operating_since": "2018", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://cockbox.org", "outbound_slug": "cockbox", "tor": "http://dwtqmjzvn2c6z2x462mmbd34ugjjrodowtul4jfbkexjuttzaqzcjyad.onion" }, "also_listed_at": { "kycnot": true } }, { "id": "flokinet", "category": "hosting", "subcategory": "VPS", "name": "FlokiNET", "url": "https://xmr.club/hosting/flokinet", "twin": "https://xmr.club/llm/hosting/flokinet.txt", "tagline": "Iceland / Netherlands / Romania. Privacy-friendly with strong DDoS handling.", "review": "FlokiNET (flokinet.is) is a *free-speech-first hosting provider* built, from its 2012 founding, around a single premise: keep legal-but-controversial projects online by placing them in privacy-friendly jurisdictions and defending them against the takedowns and DDoS attacks that silence them elsewhere.\n\n**Background.** Headquartered out of Iceland with infrastructure spanning *Iceland, Romania, and Finland*, FlokiNET has spent over a decade hosting the kind of projects mainstream providers drop at the first complaint: independent journalists, whistleblower platforms, activists, and other lawful-but-targeted operators. That multi-jurisdictional footprint is deliberate — these countries have stronger speech and data-protection postures and are outside the most aggressive takedown regimes — and the long operating history is itself the credential, because a bulletproof-for-free-speech host that survives a decade has weathered the pressure that folds imitators.\n\n**What you trust.** Three things. First, an *explicit, consistent pro-privacy / pro-free-speech stance* that's been demonstrated over years of actually keeping controversial-but-legal sites up rather than caving to informal pressure. Second, *jurisdiction* — by domiciling service in Iceland/Romania/Finland, FlokiNET reduces exposure to the legal regimes most used to deplatform. Third, *operational independence*: it runs its own DDoS scrubbing rather than fronting everything through a third party that could become a single point of compliance. It's reachable over a Tor onion and takes crypto, so you can sign up and pay without surrendering a real-world identity.\n\n**Operational specs.** The catalogue covers *VPS, dedicated servers, and offshore/colocation* options, plus domains and related services. *In-house DDoS protection* (their own scrubbing rather than a reseller layer) is a core differentiator for projects that get attacked precisely because of what they publish. Crypto payment and a privacy-respecting signup keep the customer relationship minimal. A clearnet site and a Tor v3 onion both front the service, and the company maintains public contact channels.\n\n**Philosophy.** FlokiNET exists because \"the internet routes around censorship\" only works if *someone is willing to host the content censors want gone*. Its mission is to be that someone for lawful speech — to give journalists, activists, and dissidents an infrastructure base that won't disappear under a politically motivated abuse report. The jurisdiction strategy and the in-house DDoS defense are both expressions of that mission: control your own legal exposure, control your own uptime, so the people relying on you stay online.\n\n**Grade rationale.** A in /hosting. The grade reflects a 12-year track record of mission-aligned hosting, a deliberate multi-jurisdiction footprint, self-operated DDoS protection, anonymous-friendly signup with crypto, and Tor reachability. It is one of the most credible privacy/free-speech hosts available — the category's caveats (below) are the inherent realities of \"offshore\" hosting, not weaknesses specific to FlokiNET.\n\n**Useful when.** Choose FlokiNET when your project is *legal but targeted* — investigative journalism, leak/whistleblower infrastructure, activist tooling, security research, or anything that draws politically motivated abuse reports and DDoS — and you need a host that won't fold and can absorb attacks. It's also a sound default when you simply want hosting in a privacy-respecting jurisdiction paid for in crypto without handing over identity documents.\n\n**Caveats.** \"Free-speech hosting\" is not \"anything-goes\" — FlokiNET hosts the lawful-but-controversial, not the outright illegal, and a host that defends speech will still act on genuinely illegal content, so don't mistake its stance for immunity. Offshore/privacy hosting typically costs more than commodity cloud and can have higher latency to some regions. As with any host, the provider can technically see unencrypted data at rest on its servers, so encrypt sensitive data yourself and treat the jurisdiction as a legal buffer, not end-to-end privacy. These are the normal trade-offs of the category and don't dent the A — a decade of keeping targeted-but-legal projects online is exactly what earns it.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "light_kyc" ], "feature_tags": [], "highlight_tags": [ "XMR", "DDOS-PROOF" ], "fees": { "summary": "VPS from €4/mo · XMR / BTC / fiat · IS/NL/RO" }, "fees_summary": "VPS from €4/mo · XMR / BTC / fiat · IS/NL/RO", "last_verified": "2026-06-02", "operating_since": "2012", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://flokinet.is", "outbound_slug": "flokinet", "tor": "http://vf7vsrexwb7e4j65idp4hq4eqlvjiwrnvi3jnb4st7oteer5tzgvhaqd.onion", "contact_email": "info@flokinet.is", "twitter": "https://x.com/FlokiNETehf" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "incognet", "category": "hosting", "subcategory": "VPS", "name": "Incognet", "url": "https://xmr.club/hosting/incognet", "twin": "https://xmr.club/llm/hosting/incognet.txt", "tagline": "Pseudonymous VPS — accepts XMR, no email required, US + EU regions.", "review": "Newer entrant in the no-KYC VPS space. Signup with a random handle, no email required (or one-time inbox). Accepts XMR + BTC + cash. US and EU server regions, OpenVZ + KVM available. Smaller fleet than Njalla but cheaper pricing tier.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial" ], "highlight_tags": [ "NO-KYC", "XMR", "CHEAP" ], "fees": { "summary": "VPS from $4/mo · XMR / BTC / cash · pseudonymous" }, "fees_summary": "VPS from $4/mo · XMR / BTC / cash · pseudonymous", "last_verified": "2026-05-13", "operating_since": "2021", "tenure_note": "WHOIS hidden (.io); operating_since from archive.org first snapshot of incognet.io", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://incognet.io", "outbound_slug": "incognet", "tor": "http://incoghostm2dytlqdiaj3lmtn7x2l5gb76jhabb6ywbqhjfzcoqq6aad.onion", "twitter": "https://x.com/IncogNetLLC", "telegram": "https://t.me/incognet_io" }, "also_listed_at": { "web3privacy": true, "kycnot": true, "monerica": true } }, { "id": "ko-net", "category": "hosting", "subcategory": "VPS", "name": "Ko-Net", "url": "https://xmr.club/hosting/ko-net", "twin": "https://xmr.club/llm/hosting/ko-net.txt", "tagline": "Privacy-focused Swedish VPS + DNS + managed hosting. No-KYC, accepts XMR / LTC / BTC via self-hosted BTCPay.", "review": "**What it is.** Ko-Net is a privacy-focused VPS, DNS and managed-hosting operator running on AMD Epyc hardware in Stockholm, Sweden. Listed at **Grade B** — the no-KYC posture, self-hosted BTCPay payment surface, and named operator history are all confirmed; Grade A would require curator test trades we haven't run.\n\n**Background.** Founded **early 2023** by the **Kodomu Hikari** group (status page at `status.kodomu.jp`, parent brand referenced in the TOS), explicitly as a reaction to existing privacy hosts.\n\nThe about page frames the original aim as bringing the *fully-managed* tier to clients who can't run their own infra. Customer portal at `p.ko-net.ws` (Hostbill-style).\n\n**What you trust.**\n\n- **No KYC at signup** — login uses a generated key rather than email.\n- **Crypto-native payments** (XMR, LTC, BTC) via a **self-hosted BTCPay** instance, not a third-party gateway.\n- Privacy policy: **do not log IP addresses** or attempt to track you across services.\n- **Operator-owned hardware** (per the FAQ on whether they resell).\n- Status page + looking-glass discussion in the FAQ implies the right operational habits for a small infra shop.\n\n**Operational specs.**\n\n- **VPS** — $15/mo (1 vCPU / 4 GB / 85 GB NVMe / 10 TB) up to $40/mo (4 vCPU / 10 GB / 240 GB / 16 TB). Custom plans on request.\n- **Add-ons** — DNS service + server management.\n- **Location** — Sweden, tier-3 datacenter.\n- **Tor mirror** — none advertised.\n\n**Useful when:**\n\n- You want privacy-respecting VPS without filling KYC for hosting that doesn't legally require it.\n- You want crypto payment via self-hosted BTCPay rather than a custodial processor.\n- You want managed hosting from someone who'll actually answer infrastructure questions.\n\n**Caveats:**\n\n- No Tor mirror — clearnet-only.\n- Doesn't currently own IP space — IPs rented from Obenet (the datacenter). Per-operator note 2026-05-26: own IP space is in progress for the next few months; the FAQ already discloses this transparently.\n- Curator test trade not yet on file — Grade B reflects this. Cannot promote to Grade A until a paid order is completed and verified.\n- Two peer-directory matches at listing time (kycnot.me + monerica.com).", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "no_kyc" ], "feature_tags": [ "non_custodial", "self_hosted" ], "highlight_tags": [ "NO-KYC", "BTCPAY", "XMR" ], "fees": { "summary": "VPS from $15/mo · DNS + managed add-ons · XMR, LTC, BTC via self-hosted BTCPay" }, "fees_summary": "VPS from $15/mo · DNS + managed add-ons · XMR, LTC, BTC via self-hosted BTCPay", "last_verified": "2026-06-07", "operating_since": "2023-02-14", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2025", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://ko-net.ws", "outbound_slug": "ko-net", "tos": "https://ko-net.ws/tos/", "privacy": "https://ko-net.ws/privacy", "contact_email": "hello@ko-net.ws", "matrix": "https://matrix.to/#/konet:konet.st" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "mynymbox", "category": "hosting", "subcategory": "Shared + VPS + Dedicated", "name": "Mynymbox", "url": "https://xmr.club/hosting/mynymbox", "twin": "https://xmr.club/llm/hosting/mynymbox.txt", "tagline": "Anonymous VPS, shared hosting, dedicated servers, and domains — crypto-only via self-hosted BTCPay, owned AS211673, Tor + I2P mirrors, Tor exit nodes permitted.", "review": "**What it is.** Anonymous VPS and hosting provider with domain registration — no-KYC, crypto-only payments (BTC/XMR/LN/LTC/ZEC + 150 more via Trocador swaps), Tor exit nodes permitted, and a domain WHOIS privacy shield. Listed at **Grade B** on the strength of two verified peer-directory listings (kycnot.me 9/10, monerica.com 5.0), owned infrastructure, and multi-year operational track record; held under A by the absence of a conventional legal-page structure and a community pattern of strict abuse-suspension enforcement.\n\n**Background.** Founded May 22, 2024 and operating since approximately April 2024 per kycnot.me and monerica.com (monerica.com/site/mynymbox — 'Founded 2024-05-22'). The operator is legally registered as Mynymbox LLC in Saint Kitts and Nevis (monerica.com) / U.S. Minor Outlying Islands (kycnot.me attribution). Originally a reseller of Hetzner and Contabo infrastructure per early customer reviews, the operator has since graduated to owning their own hardware — they now run their own VPS nodes under AS211673 (monerica related link: ipinfo.io/AS211673, and operator-published response to kycnot reviews: 'Actually we are not a reseller anymore as we run our own VPS nodes'). A PGP key is published on monerica.com for signed communications. The operator maintains an active presence on Twitter (@mynymbox) and kycnot.me, where they respond to nearly every user review — one of the most consistently responsive operators tracked in the directory. A domain migration history (mynymbox.io → mynymbox.net → mynymbox.io) suggests active brand management. Notably responsive to public feedback: on 2026-06-10, within 24 hours of this listing being published with a caveat about legal pages living at the client-portal subdomain, the operator publicly acknowledged the feedback on X (@mynymbox) and moved the Terms of Service, Privacy Policy, and Abuse & Legal page onto the main `mynymbox.io` domain. The operator's `/aboutus` page publishes the full legal entity (Mynymbox Hosting LLC, Reg # L 24324) and registered business address (Hamilton Development, Unit B, Charlestown, Nevis, KN0802, Saint Kitts and Nevis), which matches monerica.com's attribution and supersedes kycnot.me's older U.S. Minor Outlying Islands tag.\n\n**What you trust.**\n\n- **No-KYC stance.** kycnot.me rates the service as KYC level 0/4 — 'Guaranteed no KYC' with 'Terms explicitly state KYC will never be requested.' The operator-published homepage states: 'We do not require any personal details other than a valid email address, which can be an alias.' (operator-published, https://mynymbox.io). kycnot.me ToS review confirms the service 'provides hosting and domain services marketed for anonymity.'\n- **Payment surface.** Crypto-only — the homepage states 'No credit cards. No PayPal. No bank transfers.' (operator-published). Payments are processed via a self-hosted BTCPay Server instance (monerica.com processor tag, kycnot.me attributes). Accepted coins: Bitcoin, Lightning, Monero, Litecoin, ZCash, Ethereum, Tron, Bitcoin Cash, MATIC, stablecoins, plus ~150 more via TrocadorApp swaps (operator-published, homepage). kycnot.me flags a 'Third-Party payment processor' attribute (-2 Privacy) for the Trocador swap path, but the direct BTC/LN/XMR/LTC/ZEC path uses the operator's own BTCPay instance.\n- **Tor exit nodes permitted.** kycnot.me ToS review confirms: 'The service explicitly permits the operation of Tor Relays and Tor Exit Nodes subject to defined rules.' This is a rare and strong privacy posture — most hosting providers prohibit exit nodes entirely. monerica.com tags include 'Tor Exit Web Hosting.' A dedicated knowledgebase article exists: 'Does Mynymbox allows Tor Exit nodes?' (client.mynymbox.io/knowledgebase/64).\n- **Long-term verification.** kycnot.me carries a 'Verified' status with a passed verification step: 'We have actively been using MyNymBox since August 2024. The service has proved being reliable, and support was responsive when needed.' Invoice history and support ticket evidence are published (kycnot.me verification steps). The service is rated 'Mature' with +5 Trust for 2+ years of operation.\n- **Domain privacy shield.** kycnot.me ToS review notes: 'The domain registration service acts as a proxy to shield the user's information from being exposed on the public WHOIS database.' This is a concrete privacy mechanism — the operator's name appears on WHOIS, not the customer's.\n- **Abuse enforcement posture.** The operator enforces a strict acceptable-use policy: accounts are suspended on receipt of verified abuse notifications with a 48-hour response window. kycnot.me ToS review: 'will suspend users for copyright violations or spam.' This is a double-edged trust signal: it means the service is not a bulletproof host, but abuse complaints are handled structurally rather than ignored. Multiple kycnot reviews cite suspension as a complaint; in each case the operator responded publicly with the specific abuse notification that triggered the action.\n- **PGP key.** A PGP public key block is published on monerica.com for encrypted operator communications — a strong operational security signal that most hosting providers at this tier do not offer.\n\n**Operational specs.**\n\n- **Products.** Shared hosting (from €3.50/mo), KVM VPS (from €4.00/mo, AMD EPYC CPUs, guaranteed resources, full root access), dedicated servers, and domain registration (operator-published, homepage product cards). Email hosting listed as 'Coming soon.'\n- **Infrastructure.** Own AS211673 (ipinfo.io) — the operator runs their own hardware and is not purely a reseller. Locations: Netherlands (Amsterdam region) and Finland (Nordic region), with additional regions listed as 'Coming soon' (operator-published, homepage). Both jurisdictions have strong EU data-protection laws.\n- **Tor + I2P mirrors.** Tor at `http://mynymecyaiv7t55qiggp76rzqz35si5g7nzdh3yci4wiqbmlwqg7xeyd.onion/` (, monerica.com). I2P at `http://mynymbox.i2p` (monerica.com). The clearnet `Onion-Location` header IS correctly set ( is populated). The Tor mirror is auto-discoverable from the clearnet page.\n- **Legal pages.** Terms of Service: `https://mynymbox.io/termsofservice`. Privacy Policy: `https://mynymbox.io/privacypolicy`. Abuse / Law-Enforcement / AML: `https://mynymbox.io/abuse-legal`. The operator moved these out of the WHMCS client portal and onto the main domain on 2026-06-10, in direct response to this directory's caveat. The kycnot.me AI ToS review summary still applies to the substantive content.\n- **Contact channels.** Separated by purpose on `/aboutus`: `info@mynymbox.io` for general inquiries (PGP-signed), a PreSales contact form for service questions, `abuse@mynymbox.io` (Abuse contact form is PGP-signed), `legal@mynymbox.io` for law-enforcement and legal correspondence, and a Support Ticket System inside the client portal. Twitter (@mynymbox) is the public-facing channel for service updates. Alt email `info@mynymbox.net`. kycnot.me rates support as 'Basic' (+1 Trust): 'they answer questions and fix problems in a reasonable time, although it may sometimes take longer than expected.' Operator-published response patterns on kycnot suggest same-day or next-day reply for most tickets.\n- **Coin coverage.** Direct crypto: BTC, Lightning, XMR, LTC, ZEC. Swap-route: ~150 additional coins via TrocadorApp (operator-published, homepage). kycnot.me lists Monero, Bitcoin, Lightning, Fiat, and Cash as payment categories.\n- **No dedicated AML page exists on the main domain or in the visible client-portal knowledgebase. The service's AML posture is governed by the acceptable-use policy (no illegal activity, anti-fraud enforcement).\n\n**Operator philosophy.** The operator's positioning is unusually direct: 'We believe privacy is non-negotiable. Mynymbox offers powerful, anonymous hosting for everyone who wants to control their digital footprint. Built for journalists, activists, and anyone seeking online autonomy.' (operator-published, homepage). The service explicitly frames itself as a free-speech platform: 'Mynymbox is a strong supporter of freedom of speech. We are non-political and do not censor content because we disagree with it.' This is balanced by strict abuse enforcement — the operator distinguishes between protected speech and actionable abuse (spam, phishing, copyright violations). The operator's engagement pattern on kycnot.me — responding to every review, positive or negative, with specific evidence and ticket references — is the most consistently responsive of any hosting provider tracked in this directory.\n\n**Grade rationale.** Listed at **Grade B** because: (1) two independent peer directories verify the listing with long-term testing evidence (kycnot.me Verified status with evidence from August 2024 testing; monerica.com Verified with 4×5/5 reviews); (2) the operator owns infrastructure (AS211673) and is not a pure reseller; (3) a Tor mirror with a correctly configured `Onion-Location` header, plus an I2P mirror, provides multi-network access; (4) explicit Tor exit-node permission is a stronger privacy posture than any other hosting provider at this grade; (5) a published PGP key enables encrypted operator communications; (6) the operator's consistent public responsiveness to user feedback on kycnot.me establishes a verifiable support track record. Grade A is withheld because: (a) the kycnot.me AI summary flags 'unexpected suspensions, slow support, slow performance' as recurring themes, and while each individual complaint has an operator-side explanation, the aggregate pattern matters for a hosting service where uptime and continuity are the product; (b) no curator test trade is on file. Among hosting providers at this tier, completing a curator test trade and accumulating ≥12 months of post-2026-06 operating-time without a suspension-without-resolution incident would justify Grade A.\n\n**Useful when:**\n\n- You need an anonymous VPS, shared hosting, dedicated server, or domain registration with crypto-only payment and an email-alias-only signup — no identity documents, no phone, no card. The operator owns AS211673 hardware in Netherlands / Finland.\n- You're running a Tor relay or exit node and want a host that explicitly permits it (rare in this market) — the operator's knowledgebase article documents the policy and the AS211673 infrastructure can absorb the network risk.\n\n**Caveats.**\n\n- Recurring abuse-suspension pattern in user reports: at least four kycnot.me comments cite mid-term suspension after abuse complaints. The operator publishes a 48-hour response window — accounts that miss the window risk termination. Strict enforcement is a legitimate moderation stance for shared infrastructure, but if you cannot monitor a support ticket inbox within 48 hours, this is not the right host.\n- Payment-path privacy is two-tier. Direct BTC, Lightning, XMR, LTC, and ZEC use the operator's self-hosted BTCPay Server; the remaining ~150 coins route through TrocadorApp swap (kycnot.me deducts -2 Privacy for the third-party processor surface). Pay in the direct-path coins if you want the simplest privacy footprint.\n- Jurisdiction: Saint Kitts and Nevis (per `/aboutus` and monerica.com). St. Kitts is a small Caribbean jurisdiction with limited consumer-protection statutes — operator accountability sits with on-platform reputation (kycnot, monerica, X) and the published PGP-signed `legal@mynymbox.io` channel, not with state regulators.\n- One reviewer reports a Finland VPS was provisioned in the Netherlands instead. The operator responded but no public confirmation of region-binding fix exists. If geographic-specific routing matters to your threat model, confirm the location at provisioning.\n- Reseller history: early customer reviews (2024 → mid-2025) describe the service as reselling Hetzner / Contabo. The operator has since migrated to own hardware under AS211673 (verified on ipinfo.io, monerica updated 2026-06-07 with the 'Owned Equipment' tag). Older reviews discussing reseller behaviour reflect the prior infrastructure posture and may not apply to current deployments.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup", "no_kyc" ], "feature_tags": [ "tor_mirror", "wallet_funded" ], "highlight_tags": [ "NO-KYC", "XMR", "TOR", "OWNED-ASN" ], "fees": { "summary": "Shared from €3.50/mo · KVM VPS from €4.00/mo · dedicated servers + domain registration. Direct BTC/LN/XMR/LTC/ZEC pricing; ~150 other coins via Trocador swap (third-party fee may apply)." }, "fees_summary": "Shared from €3.50/mo · KVM VPS from €4.00/mo · dedicated servers + domain registration. Direct BTC/LN/XMR/LTC/ZEC pricing; ~150 other coins via Trocador swap (third-party fee may apply).", "last_verified": "2026-06-10", "operating_since": "2024-05-22", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://mynymbox.io", "tor": "http://mynymecyaiv7t55qiggp76rzqz35si5g7nzdh3yci4wiqbmlwqg7xeyd.onion/", "outbound_slug": "mynymbox", "twitter": "https://x.com/mynymbox" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "njalla-vps", "category": "hosting", "subcategory": "VPS", "name": "Njalla VPS", "url": "https://xmr.club/hosting/njalla-vps", "twin": "https://xmr.club/llm/hosting/njalla-vps.txt", "tagline": "Same operator as Njalla DNS — anonymous accounts, accepts XMR / BTC / LTC.", "review": "Njalla VPS is the reference no-KYC virtual private server — generated account handles, payment in XMR/BTC/LTC/ZEC/ETH (or cash by mail), no name + email + ID requirements, Tor signup and ongoing onion-mirror access. Listed at **Grade A · editor's pick** because it is operated by the same Njalla team that has been running domain-by-proxy registration for nearly a decade with a clean track record on refusing law-enforcement fishing expeditions and a public commitment to anti-censorship infrastructure.\n\n**Background.** Njalla is operated by **njalla.srl based in Costa Rica**, with VPS infrastructure physically located in Sweden. The team's roots trace to The Pirate Bay / Piratbyrån / IPredator VPN era — including Peter Sunde (publicly known by the handle Anakata during the Pirate Bay era) — meaning the operators are veterans of anti-censorship infrastructure law and have decades of public-facing track record. Founded in 2017 as a domain registrar built around the \"Njalla becomes the legal registrant of your domain\" model; VPS added later, plus VPN. The name itself is Sámi for a traditional storage hut built on top of a long pole to keep predators away — fitting the brand promise.\n\n**What you trust.** Account-level: signup with an email **or** XMPP handle (OMEMO / OTR supported); outgoing email signed + encrypted with Njalla's PGP key; no real name, no ID, no phone, no recovery email beyond what you choose to provide. Payment: BTC, LTC, XMR, ZEC, ETH, PayPal (and cash by mail for those wanting *fully* off-rail payment). The trust model is: **Njalla holds your customer-data exposure to its absolute minimum**, but they explicitly state they *will* respond to legal requests with legal merit (\"we will help if there are legal merits to any formal government requests to our system\"). Domain-by-proxy specifically: Njalla becomes the registered owner of your domain on paper, and the agreement between you and Njalla grants you full usage rights — meaning a law-enforcement subpoena against the *user* of the domain has to compel Njalla first. This is the editorial differentiator vs ordinary \"domain privacy\" addons that just redact WHOIS but leave the user as the legal registrant.\n\n**Operational specs.** VPS tiers: €15/mo (1 core / 1.5 GB RAM / 15 GB / 1.5 TB), €30/mo (2 / 3 / 30 / 3 TB), €45/mo (3 / 4.5 / 45 / 4.5 TB), all the way to €90/mo (6 / 9 / 90 / 9 TB). Infrastructure: LXD + CEPH backend (redundant storage across nodes), 10 Gbps backbone uplink. Server access: SSH root, you manage the rest — no cPanel, no managed hosting. **Outgoing SMTP is blocked** (anti-spam policy); they suggest external SMTP relays if you need to send mail. **No network scanning permitted.** Locations: \"secret locations in Sweden\" per their docs. Tor onion mirror: njallalafimoej5i4eg7vlnqjvmb6zhdh27qxcatdn647jtwwwui3nad.onion. Domains: separate product, ~€15/yr per TLD, identical privacy model (Njalla = legal registrant).\n\n**Philosophy.** Njalla's editorial differentiator is the **inverted customer-data model**: \"Other organisations brag about which customers they have. We brag about not telling who our customers are.\" Combined with the team's anti-censorship pedigree (The Pirate Bay, Piratbyrån, IPredator VPN), the operator credibility is unmatched in the no-KYC hosting space — the people running this have spent careers defending exactly this threat model. Pricing reflects the value: not the cheapest VPS on the market, explicitly competing on privacy + operator integrity rather than dollars-per-vCPU.\n\n**Grade rationale.** Grade A and editor's pick reflect: nearly a decade of operational continuity (since 2017); operator team with decades of anti-censorship track record; truly anonymous signup (XMPP/PGP signup path is rare in the hosting space); broad crypto payment options including XMR + cash by mail; Costa Rica corporate domicile + Sweden infrastructure (jurisdictional separation by design); domain-by-proxy as a structural privacy primitive, not a billing addon; Tor onion mirror operator-published; absence of major reliability / outage / mass-suspension threads in the last 24 months. Last verified 2026-05-13.\n\n**Useful when.** You need a VPS to host a Matrix / Mastodon / Nextcloud / Tor hidden service / privacy-related project and you want zero KYC linkage from infrastructure → identity. You're registering a domain for a project that may attract legal pressure (journalism, leak sites, anti-censorship infrastructure) and need the registrant-of-record protection. You want a privacy-respecting host that accepts XMR. You prefer paying €15-90/mo for operator integrity over saving €3/mo on Hetzner or DigitalOcean where ID and bank cards are required.\n\n**Caveats.** **Not the cheapest VPS** — Njalla starts at €15/mo for 1 vCPU / 1.5 GB RAM where Hetzner / Contabo would be €4-6/mo for similar specs. The premium is privacy, not compute. **Outgoing SMTP blocked** — you cannot run a mail server with outbound delivery from Njalla VPS; use an external SMTP relay (or look at hosting providers that allow SMTP if mail is your use case). **They do respond to valid legal process** — Njalla is privacy-protective, not extra-legal; if you're the subject of a serious investigation backed by valid legal authority that Costa Rica or Sweden recognises, expect Njalla to assist within those legal bounds. **Domain-by-proxy adds a transfer step** — if you ever need to move the domain to a different registrar with you as legal owner, Njalla supports the transfer but it's a multi-step process. **Hosted-content seizures** can happen at the upstream / infrastructure level (e.g., LeakBase, a breached-credentials aggregation site, was seized in early 2026 from a Njalla VPS — Njalla didn't fold, but the upstream infrastructure seizure still took the site down). **No managed-hosting handholding** — you get SSH and a server image; OS configuration, security hardening, and backups are your responsibility.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "wallet_funded" ], "highlight_tags": [ "NO-KYC", "XMR", "REFERENCE" ], "fees": { "summary": "€15/mo VPS-S · XMR / BTC / LTC / BCH · anonymous account" }, "fees_summary": "€15/mo VPS-S · XMR / BTC / LTC / BCH · anonymous account", "last_verified": "2026-09-10", "operating_since": "2017", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2017", "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://njal.la/servers/", "outbound_slug": "njalla-vps", "tor": "http://njallalafimoej5i4eg7vlnqjvmb6zhdh27qxcatdn647jtwwwui3nad.onion/" }, "also_listed_at": { "web3privacy": true, "monerica": true } }, { "id": "rdp-monster", "category": "hosting", "subcategory": "VPS", "name": "rdp.monster", "url": "https://xmr.club/hosting/rdp-monster", "twin": "https://xmr.club/llm/hosting/rdp-monster.txt", "tagline": "Budget Windows RDP + Linux/Windows VPS with instant ~10-second delivery, no-KYC signup, and Monero as the default payment. KVM, dedicated CPU/RAM/NVMe, EU + US locations, all-ports-open. Mature host (domain since 2022), new to us.", "review": "**No-KYC budget RDP / VPS host that takes Monero by default.** rdp.monster sells cheap Windows RDP, Windows/Linux VPS, and dedicated servers with **instant (~10-second) provisioning** and **no identity check** at signup. Plans start at **$8.99/mo** (Basic: 6 GB DDR4 ECC, 2 dedicated cores, 40 GB NVMe), $16.99 Standard (8 GB / 4 cores / 70 GB), $29.99 Pro (12 GB). KVM virtualization, dedicated resources, 1 Gbit link, \"all ports open\", EU and US regions.\n\n**Monero is a first-class payment option — the default one.** Checkout offers **XMR (selected by default), USDT (TRC20), Stripe (card), and Capitalist** (WebMoney / Qiwi / YooMoney / regional cards). So a privacy-minded buyer can spin up a server paying in XMR without giving ID — the combination we care about.\n\n**Why C.** New to xmr.club with no reliability track record on our end yet, and it's a budget reseller (uptime/support quality unproven from here). In its favour: a **mature domain (registered 2022, Wayback back to 2020)**, honest and specific spec sheet, real multi-tier pricing, and genuine XMR support. No-KYC + all-ports hosting is a *privacy* feature for our audience, framed as such. Climbs toward B- on a demonstrated clean run (uptime, delivery, support).", "translation_locale": "en", "rating": { "grade": "C", "trust": "New to xmr.club, no reliability track record here yet; budget reseller with operator-stated 99.9% uptime. Offset by a mature domain (registered 2022, Wayback to 2020), specific honest spec sheet, and real multi-tier pricing. C on unproven-here; path to B- on a demonstrated clean run.", "privacy": "No-KYC signup, instant ~10s provisioning, Monero as the default payment (also USDT-TRC20, Stripe, Capitalist). 'All ports open', KVM with dedicated resources. No identity required to buy — privacy-friendly hosting for our audience.", "ux": "KVM VPS/RDP + dedicated; EU + US regions. Plans $8.99 / $16.99 / $29.99 monthly (quarterly -11%, yearly 2 months free). 10-second delivery, 24/7 support, affiliate program." }, "grade": "C", "kyc_tags": [ "NO-KYC" ], "feature_tags": [ "xmr", "no_kyc", "vps", "rdp", "hosting", "instant" ], "highlight_tags": [ "XMR", "NO-KYC", "VPS", "RDP", "INSTANT" ], "fees": null, "fees_summary": null, "last_verified": "2026-09-12", "operating_since": "2022", "tenure_note": "Domain registered 2022-03-11, Wayback snapshots back to 2020-04 — mature tenure for a hosting reseller. New to xmr.club; Grade C pending a reliability track record on our end, with a path to B- given the multi-year domain + genuine XMR support.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://rdp.monster", "outbound_slug": "rdp-monster" }, "also_listed_at": { "kycnot": true } }, { "id": "servarica", "category": "hosting", "subcategory": "VPS", "name": "Servarica", "url": "https://xmr.club/hosting/servarica", "twin": "https://xmr.club/llm/hosting/servarica.txt", "tagline": "Canadian VPS with big-disk plans. Pseudonymous accepted, BTC + XMR + Monero.", "review": "Long-running Montreal-based VPS — known for unusually generous disk allocations (storage VPS plans common). Pseudonymous signup, accepts BTC, XMR, ETH, Monero/Litecoin. Canadian jurisdiction. Customer support via email/tickets.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "non_custodial" ], "highlight_tags": [ "NO-KYC", "XMR", "STORAGE" ], "fees": { "summary": "VPS from $3/mo · big-disk plans · BTC/XMR/LTC" }, "fees_summary": "VPS from $3/mo · big-disk plans · BTC/XMR/LTC", "last_verified": "2026-05-13", "operating_since": "2010", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://servarica.com", "outbound_slug": "servarica", "contact_email": "support@servarica.com", "twitter": "https://x.com/servarica" } }, { "id": "skhron", "category": "hosting", "subcategory": "VPS", "name": "Skhron", "url": "https://xmr.club/hosting/skhron", "twin": "https://xmr.club/llm/hosting/skhron.txt", "tagline": "KVM VPS in Warsaw and Stockholm — own ASN (AS215467), no-KYC signup, Tor mirror, crypto billing (XMR / BTC / LN), IPv6 /56 routed, from €1.69/mo.", "review": "**What it is.** Estonian-registered KVM VPS provider (Skhron OÜ, reg. 16921920) running its own ASN, AS215467, with PoPs in Warsaw and Stockholm. Plans from €1.69/mo, every VM gets a routed IPv6 /56, signup is email-only with no government ID. Crypto billing including Monero, BTC, and Lightning, and a Tor mirror at `skhroneuxrnchfz3wifchkju6spd3nx4krqe6zbx65hsax7qsbubb4qd.onion`.\n\n**Legal surface.** Full set of legal pages live at `/legal/privacy-policy`, `/legal/terms-of-service`, and `/legal/service-level-agreement` — not the most common slugs, but real GDPR-compliant prose, not template residue. About page at `/about-us` reads: *\"founded in Ukraine and registered in Estonia... operating since 2023. Rather than reselling, we run our own network and rely on our own hardware... nothing outsourced.\"* They also offer BGP sessions to customers (per PeeringDB notes) — uncommon at this price tier.\n\n**Surfaces.** Brochure at `skhron.eu` with a real news feed (recent items: AMD EPYC VPS in Sweden, price change, new Sweden capacity). Billing and ticketing happen on a sibling `.com.ua` domain. Two-domain split worth noting but doesn't appear to hide anything. Listed at kycnot.me and monerica.com. The Monero-specific landing page at `/services/monero` carries two testimonials, including one from July 2025.\n\n**Tenure note — why C.** The verifiable timeline: company narrative says operating since 2023; AS215467 allocated 2024-02-19 (PeeringDB) — consistent with the about page's claim they used to use someone else's infrastructure before standing up their own network; X account @Skhron_EU only joined March 2026 and the bio notes it's run by SMM partners. So the underlying business is older than the social surface suggests. C is the directory's default for new entrants; we don't have direct experience here yet. Path to B is six clean months of operation visible from xmr.club and corroborating peer-dir prose.", "translation_locale": "en", "rating": { "grade": "C" }, "grade": "C", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "KVM-VPS", "EU", "OWN-ASN", "TOR", "XMR", "NO-KYC", "IPV6", "NEW" ], "fees": null, "fees_summary": null, "last_verified": "2026-06-29", "operating_since": "2023 (claim); AS allocated 2024-02; X account 2026-03", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://skhron.eu/", "tor": "http://skhroneuxrnchfz3wifchkju6spd3nx4krqe6zbx65hsax7qsbubb4qd.onion/", "twitter": "https://x.com/Skhron_EU" }, "also_listed_at": { "kycnot": true, "monerica": { "url": "https://monerica.com/site/skhron" } } }, { "id": "vpso", "category": "hosting", "subcategory": "VPS", "name": "VPSO", "url": "https://xmr.club/hosting/vpso", "twin": "https://xmr.club/llm/hosting/vpso.txt", "tagline": "Anonymous VPS + Ghost Proxies paid direct in XMR on-chain — no account, no email, no recovery path, Order-ID-only login. Onion mirror advertised via Onion-Location.", "review": "VPSO (also branded *VPS 鬼 ONI — Ghost Infrastructure*) is a **Tor-friendly anonymous VPS host** billed in XMR/BTC/LTC with **no account, no email, and no username at any step**. Listed at **Grade B-** — a lift above the new-listing default on the strength of two distinctive structural signals: no email / no recovery path (peers require email for account recovery — VPSO does not), and direct XMR on-chain via view-key verification with no third-party payment processor in the middle. The surface reads honestly and the product is real; the track record is not yet earned.\n\n**Product.** VPS tiers (Debian 12 / Ubuntu 24 / CentOS 10 / Windows Server 2022+2025), noVNC control panel, and a separately-priced *Ghost Proxies* product. Advertised auto-deploy under 60 seconds. Six-node advertised scale — a small fleet. Base VPS pricing ~\\$17–\\$28/mo for 4–6 GB tiers, undercutting Incognet and BuyVM.\n\n**The no-account claim, verified.** The order form has zero user-input fields — every field (`plan_id`, `plan_name`, `location`, `os`, `days`, `amount`) is a hidden input populated from the plan-selector page. There is no email field, no username, no password, no phone step. Dashboard access is a single \"Order ID · 注文ID\" input. The FAQ is explicit: *\"Your only identity in this system is your Order ID — a random seal generated when you summon. I lost my Order ID. Can I recover it? No.\"* Many \"no-KYC\" hosts sneak in a recovery-email step; VPSO explicitly refuses to have one, which is a real honesty signal.\n\n**XMR-first, not footnote.** Homepage hero: *\"Pay with Monero XMR — the demon's preferred offering.\"* Ticker: `忍 XMR PREFERRED`. Order CTA lists XMR before BTC and LTC. Privacy page: XMR verified via view-key (read-only); BTC/LTC via public blockchain. Zero USD/card/PayPal — genuinely crypto-native.\n\n**Legal surface.** Terms (\"Pact\"), Privacy (\"Shadow Doctrine\"), FAQ, and dashboard flow all present under `.php` suffixes. Both Terms and Privacy are well-written and honest about scope: *\"we know nothing. Ever.\"* — an explicit statement of the operational-secrecy design, not sloppiness. Contact via SimpleX invite + obfuscated support email. 90-day post-expiry data retention window disclosed.\n\n**Onion mirror.** Advertised via `` on the clearnet homepage — `vpso45izoguyecl6mo5fj7am5eft7r72xmwlbf6skhu3y5es3xkqwqid.onion`. Not directly probed from clearnet (Tor-only).\n\n**What checks out.** No-account, Order-ID-only, XMR-first, distinct proxy product, and honest legal pages all hold up on inspection. No canary page yet — only a footer strap; that's the natural next maturity step.\n\n**Grade B- — what it means here.** Recommended with tenure and identity caveats above. The B- rather than C reflects the structural anonymity advantage over peers (no-recovery-path architecture + direct-XMR routing) — most listed hosts require an email or route crypto through a processor; VPSO does neither. The full B lift is gated on a clean multi-month operating record, peer-directory pickup (kycnot / monerica), and a signed dated canary page rather than the current footer strap.\n\n**Useful when.** You want an anonymous VPS with no email, no username, no recovery path — where the operator has designed the flow so there is *nothing to unmask*. Payment strictly in XMR (preferred), BTC, or LTC. You are comfortable with an operator whose identity is opaque by intent and whose track record is measured in weeks.", "translation_locale": "en", "rating": { "grade": "B-", "trust": "Operator identity fully opaque (no jurisdiction, no legal entity, no PGP key on public surface — by design per Terms). Zero Wayback footprint at listing. Six-node advertised scale is small. No dedicated /canary page yet — only a footer strap (\"令状なし — We know nothing. Ever.\"). Not team-reviewed on kycnot; not listed on monerica.", "privacy": "No account, no email, no username, no password — Order-ID only. Verified: order form fields are all hidden inputs; no email step anywhere in the flow. Onion mirror advertised. XMR-first payment; view-key verification on-server. 90-day post-expiry data retention disclosed.", "ux": "noVNC control panel, one-click OS reinstall, IP change. Advertised auto-deploy under 60 seconds (not end-to-end verified). Order dashboard is a single Order-ID input. English + Japanese UI accents in branding (*VPS 鬼 ONI*)." }, "grade": "B-", "kyc_tags": [ "no_kyc", "no_email", "anonymous_signup" ], "feature_tags": [ "no_account", "no_pii", "no_logs", "tor_mirror" ], "highlight_tags": [ "NO ACCOUNT", "XMR PREFERRED", "ORDER-ID ONLY", "ONION MIRROR" ], "fees": null, "fees_summary": null, "last_verified": "2026-07-28", "operating_since": "2026-07", "tenure_note": "Wayback zero snapshots at listing time; brand-new footprint. Domain not yet crawled by peer directories (kycnot, monerica).", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://vpso.cc", "tor": "http://vpso45izoguyecl6mo5fj7am5eft7r72xmwlbf6skhu3y5es3xkqwqid.onion", "outbound_slug": "vpso" }, "also_listed_at": { "monerica": true } }, { "id": "kashilo", "category": "marketplaces", "subcategory": "P2P", "name": "kashilo", "url": "https://xmr.club/marketplaces/kashilo", "twin": "https://xmr.club/llm/marketplaces/kashilo.txt", "tagline": "Swiss no-KYC Monero-paid classifieds — *Kaufen. Verkaufen. Vergessen.* (German-language SPA, v0.9.66 pre-release, Tor mirror live).", "review": "Swiss-based private marketplace — 'Kaufen. Verkaufen. Vergessen.' (Buy. Sell. Forget.) — a JavaScript SPA with accessible /about, /privacy (Datenschutz), /terms (AGB), and /imprint pages that all Listed at **Grade B-** because Switzerland is a strong privacy jurisdiction, the Tor mirror has a working Onion-Location header, monerica confirms the listing, and the homepage publishes explicit no-KYC/no-account/no-tracking claims — but every legal and operational page is gated behind JS rendering, and the site has accumulated zero user reviews.\n\n**What it is.** Swiss-based private marketplace — end-to-end encrypted, no tracking, no KYC, no account required per the operator's monerica description. Listed at **Grade B-** because the privacy posture (Switzerland + Tor + no-KYC) is stronger than most B-grade marketplaces, but the JavaScript-only.SPA leaves the operator's published policy text inside a JavaScript-only client. **Background.** Founded 2026-02-10 and listed on monerica.com on 2026-03-19 (monerica.com/site/kashilo). The site is a JavaScript single-page application branded in German with a Swiss jurisdiction claim: 'Made in Switzerland · v0.9.66' (operator-published, homepage footer). The tagline 'Kaufen. Verkaufen. Vergessen.' (Buy. Sell. Forget.) positions the service as a private exchange marketplace. Navigation links include /about (Über uns), /help (Hilfe), /imprint (Impressum), /privacy (Datenschutz), and /terms (AGB) — all require JavaScript and require JavaScript to render. A Monero price ticker ('1 XMR ≈...') is visible on the homepage (operator-published), suggesting XMR is a primary or listed asset. No operator identity, team, or contact channels were. **What you trust.** No-KYC stance: monerica.com tags the service as 'No KYC' and 'Account Not Required' (monerica listing). The operator-published description: 'Your private marketplace. No tracking, end-to-end encrypted.' The actual Datenschutz (privacy policy) and AGB (terms) pages exist at /privacy and /terms but require JavaScript to render. Jurisdiction: Switzerland (operator-published, homepage footer: 'Made in Switzerland' with 🇨🇭 flag; confirmed by monerica.com location). Switzerland is not an EU member and has strong banking-privacy traditions and data-protection laws independent of GDPR. The presence of an /imprint (Impressum) page linked from the footer is a German-language legal requirement that implies real-registration compliance — Swiss GmbH/AG entities must publish an Impressum with company name, address, and registration number. End-to-end encryption: Operator-published description on monerica: 'end-to-end encrypted.' No technical details (algorithm, key exchange, protocol) are published on the homepage or discoverable publicly. The claim is published but unverifiable without JS access to the privacy/about pages. Tor mirror: Advertised at `http://lowqj5zmuyq3wvpzwoyxbfocqjywxgfubpx2fzijccriguyqjk2cciad.onion/`. The clearnet `Onion-Location` header is correctly set, so the Tor mirror auto-discovers from the clearnet page. No user accounts: monerica.com tags the service as 'Account Not Required.' The homepage title and tagline do not reference registration. The JS shell shows no login/signup CTAs (The publicly-observable footprint: directory sweep found /login, /signup, /register all 404). Impressum (legal disclosure): The presence of /imprint linked from the footer (operator-published, homepage navigation) is a strong jurisdiction-compliance signal: Swiss and German law require websites offering commercial services to publish operator identity and contact information in an Impressum. If the Impressum contains a real company name and Swiss address, this would be a verifiable trust signal — but the page required JS and is not visible without rendering. **Operational specs.** Architecture: JavaScript SPA (operator-published, homepage: 'Diese App benötigt JavaScript.'). The homepage renders at 15KB as the main shell. All navigation pages (/about, /privacy, /terms, /help, /imprint) are client-side routes that require JavaScript to render. Monero support: A Monero price ticker ('1 XMR ≈...') is visible on the homepage (operator-published). Specific coin/token support beyond XMR is not published on the homepage and Pricing / fees: no operator-published fee schedule surfaced. The /terms (AGB) page likely contains fee information but is not visible without rendering. Contact channels: None discovered publicly — email, Twitter, Telegram, Matrix, SimpleX all return null. The /imprint page (not rendered) would be the expected location for operator contact information under Swiss/German legal norms. Tor mirror: Onion at `http://lowqj5zmuyq3wvpzwoyxbfocqjywxgfubpx2fzijccriguyqjk2cciad.onion/` with correct `Onion-Location` header. The mirror resolves to the same JS SPA. Location / jurisdiction: Switzerland (operator-published, homepage footer; confirmed by monerica.com). v0.9.66 version string suggests pre-1.0 release. Founded 2026-02-10 — approximately 4 months old at listing time. No peer reviews: Zero reviews on monerica.com. Not listed on kycnot.me. Single-source trust signal (1 peer-directory match only).\n\n**Operator philosophy.** The operator's branding is minimalist and privacy-forward: 'Kaufen. Verkaufen. Vergessen.' (Buy. Sell. Forget.) — three verbs that promise transactional privacy with no residue. The choice of Switzerland as jurisdiction, German as the primary language, and the inclusion of an Impressum (a German-language legal-compliance norm) all suggest a real operator establishing a legally compliant Swiss entity rather than a jurisdiction-shopping anonymous shell. The v0.9.66 version number and Feb 2026 founding date place this firmly in early-release territory — a product being actively built, not a mature marketplace.\n\n**Grade rationale.** Listed at **Grade B-** because: (1) Switzerland is one of the strongest privacy jurisdictions globally for a crypto marketplace; (2) the Tor mirror has a correctly configured `Onion-Location` header for auto-discovery; (3) monerica.com confirms the listing with No KYC and Account Not Required tags; (4) the operator publishes explicit privacy claims (no tracking, end-to-end encrypted) and a jurisdiction-framed Impressum page that implies legal registration. Grade A is withheld because: (a) only one peer-directory match (monerica only — kycnot doesn't list); (b) the JavaScript-only.SPA left every legal page (privacy, terms, about, Impressum) is gated behind JavaScript rendering, which excludes privacy-conscious readers on Tor Browser Safer/Safest, NoScript, or JS-disabled hardened browsers — a meaningful accessibility weakness for a privacy marketplace specifically; (c) zero user reviews on any platform; (d) no operator identity or contact channel is surfaced outside the Impressum. Among marketplaces at this tier, rendering the legal pages server-side for audit access, accumulating a review history, and getting a second peer-directory listing would justify A.\n\n**Tenure.** Publicly verified on xmr.club since 2026-06-07 — 27 days as of this note. Grade B− reflects short tenure alongside otherwise-clean structural signals — the minus is anchored to that short window, not to any specific operational concern. Tenure counts against grade lift on exchange-class listings; a 90-day re-check is scheduled for 2026-09-05 to reassess.\n\n**Caveats.** onion does not appear in clearnet Onion-Location header — drift caveat'. The actual pages (/about, /privacy, /terms, /help, /imprint) exist and are linked from the homepage navigation, but their content is gated behind JS. This is a probe limitation, not a site gap — the render the site in a real browser.Whether a marketplace is custodial or non-custodial depends on the settlement model (escrow vs direct wallet-to-wallet), which is unreadable without JS. verify and override the tag before publishing. The German-language-only interface limits accessibility for non-German-speaking users but is a credible jurisdiction signal — it suggests the operator is building for a Swiss/German/DACH-region user base rather than a generic international audience.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B-" }, "grade": "B-", "kyc_tags": [ "anonymous_signup", "no_kyc" ], "feature_tags": [ "tor_mirror" ], "highlight_tags": [ "NO-KYC", "XMR", "TOR", "CH" ], "fees": { "summary": "Per-listing fees TBD (German-language SPA, fees gated behind JS; XMR-native settlement, end-to-end encrypted)" }, "fees_summary": "Per-listing fees TBD (German-language SPA, fees gated behind JS; XMR-native settlement, end-to-end encrypted)", "last_verified": "2026-06-07", "operating_since": "2026-02-01", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://kashilo.com", "outbound_slug": "kashilo", "tor": "http://lowqj5zmuyq3wvpzwoyxbfocqjywxgfubpx2fzijccriguyqjk2cciad.onion/", "privacy": "https://kashilo.com/datenschutz", "tos": "https://kashilo.com/agb", "imprint": "https://kashilo.com/impressum" }, "also_listed_at": { "monerica": true } }, { "id": "xmrbazaar", "category": "marketplaces", "subcategory": "P2P", "name": "XMRBazaar", "url": "https://xmr.club/marketplaces/xmrbazaar", "twin": "https://xmr.club/llm/marketplaces/xmrbazaar.txt", "tagline": "Long-running Monero-only marketplace — buy and sell physical goods, digital services, and skills priced in XMR. Community-run, no platform-side custody.", "review": "**Distinct in the Monero ecosystem.** XMRBazaar is the longest-running marketplace where listings are priced in and paid in XMR. Think classifieds for the Monero economy — physical goods (electronics, art, second-hand items), digital services (web design, code reviews, language tutoring), gift-card flips, and miscellaneous skill-for-XMR trades. Sellers post listings, buyers contact them through the on-site messaging, payment + delivery is arranged peer-to-peer.\n\n**Non-custodial by design.** XMRBazaar doesn't hold funds. Sellers post a payment address (XMR subaddress or invoice), buyers send directly. The platform's value is reachability + reputation + a shared dispute channel, not escrow. That's a feature for privacy and a tradeoff for buyer protection — match the trade size to the seller's reputation and history on the platform.\n\n**Anonymous signup.** No KYC, no government ID. Account creation is username + password (no email required to browse, optional for notifications). Per-listing seller reputation is the trust mechanism.\n\n**Useful when:**\n- You want to spend XMR with people who price in XMR (no fiat rate conversion friction)\n- You want to acquire XMR by selling something (skills, physical goods, services) without going through a swap\n- You're in a jurisdiction where conventional exchanges are restricted but informal trade is unrestricted\n\n**Caveats:**\n- Listing volume is uneven by category and region; some weeks are sparse\n- Buyer protection is your own due diligence — seller reputation, comms quality, small first-trade sizing\n- The marketplace is itself a target for scammers; treat first-touch sellers with normal classifieds-grade skepticism\n\n**Why A-grade.** Community-run since 2019, no fundraising / token / VC moat, doesn't sell user data, no KYC at any volume, no custodial layer to be hacked. Compounding peer reputation makes the trust mechanism work over time. Counts as foundational Monero infrastructure alongside getmonero.org and Mastering Monero — without XMRBazaar there's no public clearinghouse for XMR-priced commerce.\n\n**Recent direction.** Active 2024-onward: thousands of users, listings, and orders by mid-2025. Ongoing updates include **AnonBazaar** (the multi-coin sibling extending the XMR-first model to additional privacy assets), forum surface, and escrow improvements.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "no_kyc", "anonymous_signup" ], "feature_tags": [ "marketplace", "no_account", "no_pii", "non_custodial", "open_source", "p2p", "tor_mirror", "xmr_native" ], "highlight_tags": [ "XMR-NATIVE", "MARKETPLACE", "NON-CUSTODIAL", "P2P", "TOR" ], "fees": { "summary": "Platform takes no per-trade fee. Sellers and buyers transact peer-to-peer. Optional listing-promotion fee for boost (clearly marked as ads)." }, "fees_summary": "Platform takes no per-trade fee. Sellers and buyers transact peer-to-peer. Optional listing-promotion fee for boost (clearly marked as ads).", "last_verified": "2026-06-08", "operating_since": "2023", "tenure_note": "WHOIS 2023 predates archive.org first snapshot 2018; treated as current-entity year (domain may have been re-registered)", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmrbazaar.com", "outbound_slug": "xmrbazaar", "twitter": "https://x.com/XmrBazaar", "matrix": "https://matrix.to/#/xmr-bazaar:monero.social", "tor": "http://xmrbazaar6wzcr3wvj4anpnfwv5tcikgdurtzzfba233g52fa2fjx3qd.onion" }, "also_listed_at": { "kycnot": true, "web3privacy": true } }, { "id": "anti-moonboy", "category": "media", "subcategory": "Podcast", "name": "Anti Moonboy", "url": "https://xmr.club/media/anti-moonboy", "twin": "https://xmr.club/llm/media/anti-moonboy.txt", "tagline": "Weekly Monero + darknet analysis podcast — Anti Moonboy News, Attack of the Poisoned Outputs, Darknet Market Maximalism, .thedotfiles. Multi-platform (YouTube, Odysee, Rumble, mp3, onion). Direct XMR donations.", "review": "Anti Moonboy is a **weekly Monero + darknet analysis podcast** run by **xenu** (@xenumonero on X). The show covers exploit walkthroughs (recent episodes: Zcash Orchard inflation bug, p2pool vulnerability, MoneroKon talks), darknet-market economics and post-mortems, and long-form Monero-community commentary. Distribution is intentionally decentralized — YouTube, Odysee, Rumble, direct mp3 download, and a Tor onion mirror.\n\n**Background.** xenu is a long-time Monero-community contributor — commissioned much of the early **Monerochan** art (the unofficial Monero mascot) during the /XMR/ General era, joined X in **April 2021** (verified via blue tick), and formally launched the **Anti Moonboy brand in October 2024** as an educational-focused digital-cash video channel with no price-speculation content. Brand tenure: ~1.75 years as of this listing; 75 AMN episodes shipped by 2026-07-01. Operator tenure via community credentials predates the brand by years. Episode cadence has been consistent — AMN 75 shipped 2026-07-01. Sub-series expand the format: *Darknet Market Maximalism* (a manifesto series, May 2025), *Attack of the Poisoned Outputs* (technical exploit deep-dives), *.thedotfiles* (a new interview series, inaugural episode with an ex-cybercriminal walking through his history in credit-card fraud, ransomware, and extortion).\n\n**What you trust.** Non-custodial by design — it's a podcast, not a service. Direct XMR donations to a Monero address published in the operator's X bio (partial: `84tVkJ6zAHyEpE8yBmkdVtY9s85DLmA…`). No accounts, no subscription paywall, no email harvesting for the free tier. Tor onion mirror available for readers who want to consume the archive without touching the clearnet.\n\n**Operational specs.** Publishing cadence: ~weekly. Distribution: **YouTube, Odysee, Rumble, direct mp3, Tor onion mirror**. Written content available at antimoonboy.com; interview transcripts / show notes accompany the audio. Merch page (t-shirts etc.) for supporters. No paywall; donation-supported. Contact via the site's contact page. Sub-series: *Anti Moonboy News* (weekly news cycle), *Darknet Market Maximalism*, *Attack of the Poisoned Outputs*, *.thedotfiles*.\n\n**Grade rationale.** Listed at **Grade B** because the operator has ~1.75 years of continuous output under this specific brand (October 2024 launch, 75 AMN episodes by 2026-07-01), plus long-standing community credentials via Monerochan commissioning and /XMR/ General contributions that predate the brand, distribution is genuinely decentralized (5 platforms + onion — one platform de-listing him doesn't kill the show), the topical focus is squarely within xmr.club's scope (Monero + adjacent privacy-technical analysis), and the direct-XMR donation surface plus the onion mirror satisfy the no-KYC bar structurally. Grade A is withheld pending: (a) independent corroboration on peer directories beyond xmr.club, (b) a curator listen-through of a few episodes to check factual accuracy on the technical claims (the show sometimes runs hot on interpretation), (c) verification that the onion mirror mirrors the full clearnet catalog.\n\n**Caveats.** *Editorial voice is opinionated.* The show is explicitly named Anti Moonboy — it takes strong positions on Bitcoin maximalism, Zcash, government surveillance, and DNM operators. That's the format; treat as commentary, not neutral reportage. Some episodes venture into darknet-market history and profile former criminals (e.g. the *.thedotfiles* debut). That's within the podcast's stated remit but worth flagging so readers know the tone before pressing play. YouTube distribution is subject to platform-level de-monetization or takedown for the darknet-focused episodes — the multi-platform strategy (Odysee, Rumble, mp3, onion) exists specifically to route around that risk.", "translation_locale": "en", "rating": { "grade": "B" }, "grade": "B", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "MONERO-PODCAST", "DARKNET-ANALYSIS", "MULTI-PLATFORM", "TOR-MIRROR", "XMR-DONATIONS", "INDEPENDENT-MEDIA" ], "fees": null, "fees_summary": null, "last_verified": "2026-07-05", "operating_since": "2024", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://antimoonboy.com", "twitter": "https://x.com/xenumonero", "outbound_slug": "anti-moonboy", "email": "mailto:xenu@antimoonboy.com", "pgp": "https://antimoonboy.com/xenu.asc", "pgp_fingerprint": "39532AB8933DB2315FD01FCE5C5095C4A06813BA" } }, { "id": "monero-talk", "category": "media", "subcategory": "Podcast", "name": "Monero Talk", "url": "https://xmr.club/media/monero-talk", "twin": "https://xmr.club/llm/media/monero-talk.txt", "tagline": "Long-running Monero interview podcast by Douglas Tuman.", "review": null, "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [], "highlight_tags": [ "FREE", "PODCAST" ], "fees": { "summary": "Free" }, "fees_summary": "Free", "last_verified": "2026-05-11", "operating_since": "2018", "tenure_note": "Monero Talk podcast by Douglas Tuman started 2018. Previous stamp (2005) was YouTube.com WHOIS — shared-host trap.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.youtube.com/@MoneroTalk", "outbound_slug": "monero-talk", "twitter": "https://x.com/monerotopia" }, "also_listed_at": { "privacyguides": true, "monerofail": true, "monerica": true } }, { "id": "monero-topia", "category": "media", "subcategory": "Podcast", "name": "Monero Topia", "url": "https://xmr.club/media/monero-topia", "twin": "https://xmr.club/llm/media/monero-topia.txt", "tagline": "Weekly Monero community + tech podcast by Doug Tuman, Tristan, and Sunita.", "review": null, "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [], "highlight_tags": [ "FREE", "PODCAST" ], "fees": { "summary": "Free · listener-funded" }, "fees_summary": "Free · listener-funded", "last_verified": "2026-05-11", "operating_since": "2020", "tenure_note": "MoneroTopia podcast/YouTube channel by Douglas Tuman launched ~2020. Previous stamp (2005) was YouTube.com WHOIS year — shared-host trap caught by Monerica audit 2026-05-28.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.youtube.com/@MoneroTopia", "outbound_slug": "monero-topia" }, "also_listed_at": { "privacyguides": true, "monerofail": true, "web3privacy": true, "monerica": true } }, { "id": "revuo-monero", "category": "media", "subcategory": "Newsletters", "name": "Revuo Monero", "url": "https://xmr.club/media/revuo-monero", "twin": "https://xmr.club/llm/media/revuo-monero.txt", "tagline": "Canonical weekly Monero ecosystem digest — protocol, CCS, dev updates. Family: Calc (XMR-fiat converter) + Moneroj (adoption tracker) + Rottenblog. Maintained by rottenwheel.", "review": "Revuo Monero is the **canonical weekly Monero ecosystem digest** — a free newsletter and web archive covering protocol news, **Monero Community Crowdfunding System (CCS)** proposals, developer activity, exchange + wallet integrations, research publications, regulatory developments, and the broader community pulse. Listed at **Grade A** because Revuo is the **single most-cited Monero ecosystem source** in the privacy-currency space — when other privacy resources reference \"this week in Monero,\" Revuo is the source.\n\n**Background.** Revuo Monero was founded in **2019** and is currently maintained by **rottenwheel** (Monero community operator; site: [rottenwheel.com](https://www.rottenwheel.com/); GitHub: [github.com/rottenwheel/revuo-weekly](https://github.com/rottenwheel/revuo-weekly)). Published as a **weekly newsletter** delivered via email subscription, **RSS/Atom feed**, **Matrix announcement room**, and the web archive at **revuo-xmr.com**. The newsletter is **donor-funded** — Revuo accepts XMR donations and has received CCS funding for sustained-publication periods. Open editorial archive: every weekly issue from 2019 onward is publicly accessible without subscription. The newsletter is run as a community-service project, not a commercial publication; there's no advertising, no sponsored content (or when sponsored content appears, it's explicitly disclosed as sponsorship).\n\n**What you trust.** **Community-edited** — Revuo's content is curated by rottenwheel with community contributions; sources are linked transparently so readers can verify primary references. **Comprehensive ecosystem coverage** — protocol developments (Monero Research Lab work, GitHub commit summaries, upcoming hard forks), **CCS proposals** (community funding requests, results, post-completion reports), **exchange + wallet integrations** (which services added XMR support, which removed it), **regulatory developments** (legal-and-policy news affecting Monero), **community events** (MoneroKon, meetups, AMAs). **Open archive** — the entire weekly back-catalogue is searchable on the website. **Multiple distribution channels** — email newsletter (anonymous subscription via privacy-respecting email forwarder), RSS/Atom for newsreader users, Matrix announcement room for chat-stream readers. **No tracking** — the website doesn't include third-party trackers; email subscriptions don't include open-tracking pixels. **What you don't trust**: editorial judgment is one person's — rottenwheel is well-regarded but Revuo represents one contributor's curation of the week. For diversification, cross-reference with other Monero community sources (Monerica, KYCnot, this directory, Sethforprivacy's blog, MoneroBuzz, Bitcoin Magazine's privacy coverage).\n\n**Operational specs.** **Website**: revuo-xmr.com. **Distribution**: email subscription (no tracking, signed mailing list), **RSS** at revuo-xmr.com/feed.xml, **Atom** feed for newsreaders, **Matrix announcement room** for chat-stream subscribers. **Cadence**: weekly (typically Mondays); occasional skip weeks for major holidays / personal time. **Archive**: 2019-onward weekly issues; site search across the archive. **Languages**: English; some issues have community-contributed translations to other languages (Spanish, German, Italian community translators have been active at different periods). **Content sections** (typical issue): **Protocol & Research** (Monero Research Lab, GitHub activity, hard fork timing), **CCS Activity** (active proposals, funded work, recent completions), **Ecosystem** (wallet + exchange + integration news), **Regulation** (legal/policy developments affecting Monero), **Community** (events, podcasts, AMAs), **Curated Reading** (longer-form pieces worth reading from the past week). **Subscription**: free; donation-supported.\n\n**Philosophy.** Revuo Monero's editorial differentiator is the **single-source-of-truth-for-this-week** model. The Monero ecosystem moves slowly but continuously: new protocol research, new CCS proposals, new wallet integrations, new regulatory developments — happening across multiple channels (GitHub, IRC, Matrix, podcasts, blogs, conference talks). Tracking all of this individually is impractical for most people. Revuo aggregates and curates, with rottenwheel's editorial judgment as the filter. The trade-off vs reading primary sources directly: you depend on rottenwheel's curation (excellent but one person's view); the upside is that the time-savings is dramatic and the link-to-primary-source model lets you verify anything important. For most Monero ecosystem followers, Revuo is the practical entry point.\n\n**Grade rationale.** Grade A reflects: 6+ years of operational continuity (since 2019); **canonical Monero ecosystem digest** with single most-cited weekly source status; open archive (entire back-catalogue searchable); multiple distribution channels (email, RSS, Matrix); donor-funded (no commercial advertising pressure); named editor (rottenwheel) with public community presence; comprehensive cross-domain coverage (protocol, CCS, ecosystem, regulation, community); cross-referenced from essentially every Monero-related resource. The de-facto \"what happened this week in Monero\" reference. Last verified 2026-08-10.\n\n**Useful when.** You want to **follow the Monero ecosystem** without tracking GitHub commits, IRC discussions, Matrix rooms, and podcast feeds individually — Revuo aggregates the signal. You're a **Monero contributor** or developer and want a weekly snapshot of community activity outside your specific focus area. You're a **journalist or researcher** covering Monero — Revuo is the canonical primary source for \"what's happening in the Monero ecosystem this week,\" with links to the underlying primary sources you can cite directly. You want to **catch up after time away** — if you've been offline for a few weeks, reading the back-issues of Revuo gets you caught up faster than re-reading every primary source. You want **CCS proposal updates** — Revuo covers proposals from posted-for-discussion through funded → completed → results. You're a **community member** who wants the weekly pulse of Monero without needing to be on Matrix or Twitter constantly.\n\n\n**Companion properties.** rottenwheel operates a small family of Monero-related properties under the same editorial identity, all FLOSS with public repositories:\n\n- **Revuo Monero Calc** — [calc.revuo-xmr.com](https://calc.revuo-xmr.com/) · [.onion](http://calc.revuo75joezkbeitqmas4ab6spbrkr4vzbhjmeuv75ovrfqfp47mtjid.onion/) · [repo](https://github.com/rottenwheel/moner.ooo/) — XMR to fiat/crypto converter (CoinGecko + Haveno.markets data sources; 60+ currencies).\n- **Revuo Moneroj** — [moneroj.revuo-xmr.com](https://moneroj.revuo-xmr.com/) · [.onion](http://moneroj.revuo75joezkbeitqmas4ab6spbrkr4vzbhjmeuv75ovrfqfp47mtjid.onion/) · [repo](https://github.com/worldwideward/moneroj) — Monero adoption tracker + BTC-vs-XMR comparison.\n- **Rottenblog** — [blog.rottenwheel.com](https://blog.rottenwheel.com/) · [.onion](http://blog.rotten7573m2nr2yfk7csmdshktycg76b37riuv6f2qfyzdhgiskm6id.onion/) · [repo](https://github.com/rottenwheel/hugo-rottenwheel) — rottenwheel's personal blog, hosting polished .onion mirrors of prominent privacy-related essays.\n\nThese are review-body links rather than standalone directory listings: same operator umbrella, reader-facing utility flows naturally from the Revuo hub. Category-browsers looking for an XMR calculator or a Monero-adoption tracker should still find their way here via Revuo's homepage.\n\n**Caveats.** **Single-editor curation** — Revuo represents rottenwheel's view of the ecosystem; for diversified perspective, cross-reference with other Monero community sources. **Weekly cadence misses fast-breaking news** — for sub-week-scale developments (security incidents, hard-fork timing changes, major exchange-listing news), monitor the Monero Matrix rooms directly. **English-primary** — non-English readers depend on community translations which lag the English original by days to weeks. **No raw search across primary sources** — Revuo links to primary sources but doesn't replace the ability to grep through GitHub commits, MRL paper archives, or Matrix room logs directly. **Email subscription requires email address** — for users who want anonymous subscription, use a SimpleLogin alias or Tutanota / Proton Mail address rather than your primary email. **Donation-supported has its own variance** — Revuo's continued publication depends on community funding; the project has weathered low-funding periods historically but it's a structural dependency to be aware of. **Doesn't track regulatory and legal developments globally** — Revuo focuses on Monero-relevant regulation but isn't an exhaustive global-jurisdiction tracker. For specific-region legal/policy concerns, supplement with local privacy / cryptocurrency news sources. **Curated, not exhaustive** — minor ecosystem activity (small wallet updates, niche tool releases) may not make Revuo's curation cut. For comprehensive primary-source tracking, monitor GitHub repositories directly. **The website style is functional, not polished** — coming from corporate newsletters with heavy design, Revuo's plain-text-and-links style may feel sparse. This is by design: content over presentation, fast-loading on slow connections, Tor-Browser-Safest-mode compatible.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "light_kyc" ], "feature_tags": [], "highlight_tags": [ "FREE", "NEWSLETTER" ], "fees": { "summary": "Free · email signup or web archive" }, "fees_summary": "Free · email signup or web archive", "last_verified": "2026-08-10", "operating_since": "2022", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.revuo-xmr.com", "outbound_slug": "revuo-monero", "tor": "http://revuo75joezkbeitqmas4ab6spbrkr4vzbhjmeuv75ovrfqfp47mtjid.onion", "matrix": "https://matrix.to/#/revuo:monero.social", "simplex": "https://simplex.chat/contact" } }, { "id": "the-monero-moon", "category": "media", "subcategory": "Newsletters", "name": "The Monero Moon", "url": "https://xmr.club/media/the-monero-moon", "twin": "https://xmr.club/llm/media/the-monero-moon.txt", "tagline": "Weekly Monero newsletter by John Foss — curated news, developments, and community coverage. 90 issues deep. Free to subscribe. Direct XMR donations to the operator's published address.", "review": "The Monero Moon is a **weekly Monero-focused newsletter** written and curated by **John Foss** (@johnfoss69 on X, verified since 2017). Each issue rounds up XMR ecosystem news, protocol developments, community happenings, and select Bitcoin-adjacent content. Distribution is via Substack — themoneromoon.com resolves to a Substack instance. Issue 90 shipped 2026-06-16.\n\n**Background.** John Foss has been publicly active on X since **September 2017** (verified); the **Monero Moon newsletter launched on 2018-09-09 with Issue 1** (verified via Substack archive; Issues 2 + 3 followed on 2018-09-17 and 2018-09-24). Newsletter tenure: ~7.8 years of continuous output by the time of this listing. 11.6K X followers; 1,000+ newsletter subscribers per the site. Verified operator identity — John Foss is a publicly-named community figure, one of the longest-running Monero newsletter operators. The archive is free and open; the paid tier (if any) is not the barrier to core content.\n\n**What you trust.** Non-custodial — it's a newsletter, not a service. Direct XMR donations to a Monero address published in the operator's X bio (partial: `8C44uscq4DBaj7rFoX7WccdE8GA3PMoWyBC69RijMpeoB9PgWLrbxnjaWwSWGtSL7R1G3dJKTWSA…`). Subscribing requires an email — that email lives inside Substack's cookie + analytics stack, which is a real privacy trade you should understand before subscribing. Reading via RSS or unauthenticated archive fetch avoids the email trade.\n\n**Operational specs.** Publishing cadence: **~weekly** (with occasional breaks). Distribution: Substack (themoneromoon.com), RSS feed, X thread announcements. Content type: curated news roundup, protocol updates, community events, occasional Bitcoin-adjacent commentary. No paywall on the core newsletter per operator claim; paid supporters access same content as free readers. Signup: email required for delivery; RSS reader alternative available. Payment surface: none for readers (free); direct XMR donations for supporters.\n\n**Grade rationale.** Listed at **Grade B** because tenure is exceptional (7.5+ years of newsletter output (2H 2018 launch, 90 issues shipped by 2026-06-16), plus 8+ years of the operator being publicly active on X), the operator is publicly named and verified, the brand is one of the most recognized independent Monero-news properties, and the direct-XMR donation path plus free-archive posture keep it in scope. Grade A is withheld pending: (a) verification that the Substack tier structure never gates core content (paywall creep is a common late-stage newsletter risk), (b) an alternative-delivery path independent of Substack (self-hosted mirror or onion) so readers with strong platform aversion can still consume, (c) independent corroboration on peer directories — the Monero Moon is well-known in the community but a formal cross-listing check hasn't landed.\n\n**Caveats.** *Substack dependency.* Substack collects subscriber emails, sets tracking cookies, and depends on a US-based platform whose editorial policies have shifted over time. The Monero Moon is *distributed* through Substack, not *hosted* on-site — a platform take-down or de-platforming event would force a migration. The RSS route is your privacy-preserving fallback if you don't want to hand Substack an email. Some readers may prefer to only interact via the free RSS feed and skip subscription entirely. Content is curated (opinionated selection of what matters this week) — treat as editorial digest, not comprehensive coverage.", "translation_locale": "en", "rating": { "grade": "B" }, "grade": "B", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "MONERO-NEWSLETTER", "WEEKLY-CURATION", "FREE-ARCHIVE", "XMR-DONATIONS", "LONG-TENURE", "PUBLIC-OPERATOR" ], "fees": null, "fees_summary": null, "last_verified": "2026-07-05", "operating_since": "2018", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://themoneromoon.com", "twitter": "https://x.com/johnfoss69", "outbound_slug": "the-monero-moon", "logo": "https://xmr.club/peers/the-monero-moon.jpg" } }, { "id": "bitrefill-giftcards", "category": "merchants", "subcategory": "Gift Cards", "name": "Bitrefill Gift Cards", "url": "https://xmr.club/merchants/bitrefill-giftcards", "twin": "https://xmr.club/llm/merchants/bitrefill-giftcards.txt", "tagline": "Largest crypto-funded gift-card marketplace — Amazon, Uber, eSIMs, mobile top-ups.", "review": "**Lede:** Bitrefill is the single largest crypto-funded gift-card and top-up marketplace in operation. You pay in BTC (Lightning or on-chain), USDT (multiple chains), USDC, or Doge; in return you get a redemption code for Amazon, Uber, Spotify, Airbnb, eSIMs, mobile data refills in 180+ countries, restaurants, electronics retailers, or any of 6,000+ brands. The economic effect is that every dollar of stablecoin or BTC sitting in self-custody becomes spendable at almost any major retailer without ever touching a card or a bank. For a no-KYC crypto stack this is the off-ramp of last resort and first resort.\n\n**Background:** Founded in 2014 out of Stockholm by Sergej Kotliar, originally as a Bitcoin-only top-up service. Grew through every cycle by quietly adding payment rails (Lightning in 2018, USDT-multichain, eventually XMR via partner integrations), brand catalogue (now 6,000+ across 180 countries), and verticals like the recent \"Bitrefill Travel\" eSIM/booking surface. The company is privately held, profitable, and famously vocal in the Bitcoin-circular-economy thesis — staff regularly publish their pay-rolls-in-Bitcoin model and Lightning-channel topology, which is unusual transparency for a payments business.\n\n**What you trust:** Bitrefill is custodial during the redemption window — they hold the gift-card code after purchase until you reveal it in their UI, then forward it once payment confirms. For Lightning payments this is sub-second; for on-chain it's whatever the block confirmation requires. They do *not* hold your crypto as a balance (the model is purchase-and-deliver, not a wallet), which removes most of the usual exchange-counterparty risk. The trust surface is therefore narrow: can Bitrefill deliver the code corresponding to the brand you bought? Their 10-year track record across multiple bear markets, regulator interactions, and platform expansions suggests yes; the few public incidents (rare delivery delays during 2017 BTC fee spikes) were inventory issues, not loss-of-funds.\n\n**Operational specs:** Most purchases under $500 USD-equivalent require no account at all — you punch in your delivery email (or grab a SimpleLogin alias), pay the invoice, get the code by email and in-browser. Above $500 the platform asks for an email + light verification depending on the brand (some high-fraud-rate brands require KYC regardless of amount). Lightning payments under $200 typically settle in 1-3 seconds with no surcharge. On-chain BTC has a small \"miner fee covered\" pricing in the quote. USDT/USDC are accepted on Ethereum, Tron, Polygon, and a couple of L2s. XMR is integrated via Cake Wallet — you initiate the swap in Cake and the BTC payment lands at Bitrefill. Spreads on most brands run 0% to 4% depending on the issuer's volatility and Bitrefill's negotiated rates.\n\n**Philosophy:** Bitrefill's product thesis is that Bitcoin needs a *spending* economy, not just a savings economy — and that the easiest spending UI is the gift card, which decouples your crypto from any merchant relationship. They're explicit about being a bridge, not a destination: their newsletter pieces argue users should hold BTC in self-custody, swap to USDT for stability when needed, and use Bitrefill as the just-in-time conversion to fiat purchasing power. The implication is that they expect users to *not* leave balances on their platform, and their architecture supports that: there's no \"Bitrefill wallet,\" only invoices.\n\n**Grade rationale:** Grade A reflects best-in-class catalogue breadth, real Lightning integration (not just on-chain BTC), genuine no-account-required flow for sub-$500 purchases, and a decade-long operator track record. The single sub-A factor is the custodial-during-redemption window plus the soft KYC at higher amounts — both pragmatic, neither catastrophic, but they prevent calling this a fully anonymous pick. Spreads on some brands (esp. luxury or low-volume brands) can be 3-5%, which is a real economic cost; users buying high-volume brands like Amazon US or Uber typically see <1%.\n\n**Useful when:** You want to spend self-custodied BTC, USDT, or XMR at a major retailer without using a card or bank wire. Common patterns: paying for SaaS subscriptions that don't accept crypto, buying flights via Airbnb gift cards, prepaid mobile data for travel (eSIMs and mobile refills work in 180 countries), groceries via supermarket cards, and topping up Amazon/eBay for hardware purchases. Bitrefill is also the on-ramp for crypto-circular-economy holdouts: paying employees in BTC and giving them spendable gift-cards on day one.\n\n**Caveats:** Custodial during redemption — if Bitrefill goes offline between your payment and the code reveal, you're in support-ticket territory. Their uptime track record is excellent but not infinite. Some brands (Amazon US is a recurring example) impose redemption rules that prevent the code from being re-sold or pooled, which is fine for spending but a problem if you want to gift-card-arbitrage at scale. Country availability varies — Bitrefill US users see a narrower brand catalogue than EU users due to regulatory and licensing differences. Lastly, the email you give for delivery is a small but real metadata leak; pair it with a SimpleLogin alias for cleanest practice.\n\n**Monero note — no native XMR.** Bitrefill does not accept Monero directly and publishes no Monero payment option — it never sees XMR. The only way to spend XMR here is Cake Wallet's built-in Bitrefill integration, which converts your XMR to BTC/Lightning behind the scenes and settles that with Bitrefill. Genuinely usable for XMR holders, but the privacy ends at Cake — the purchase reaches Bitrefill as a BTC/LN payment, not Monero. Native XMR is what earns a top grade on this shelf; because Bitrefill offers it only through a third-party bridge, it sits at **B** rather than A despite being the largest, most reliable gift-card marketplace here.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "api_available", "custodial", "lightning_native", "multi_chain", "no_account", "stable_payments" ], "highlight_tags": [ "GIFT CARDS", "LIGHTNING" ], "fees": { "summary": "No surcharge on most brands · spreads ~0–4% depending on issuer" }, "fees_summary": "No surcharge on most brands · spreads ~0–4% depending on issuer", "last_verified": "2026-08-26", "operating_since": "2014", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.bitrefill.com", "outbound_slug": "bitrefill-giftcards" } }, { "id": "cakepay", "category": "merchants", "subcategory": "Gift Cards", "name": "CakePay", "url": "https://xmr.club/merchants/cakepay", "twin": "https://xmr.club/llm/merchants/cakepay.txt", "tagline": "Gift cards inside Cake Wallet — pay direct in XMR/BTC, no extra account.", "review": "Cake Pay is the gift-card and prepaid-card surface built by Cake Labs LLC — same team that ships Cake Wallet. You buy merchant gift cards, Visa, and Mastercard top-ups directly with XMR (or BTC, ZEC, others) and the cards land in-wallet without going through a third-party card processor. Listed at **Grade A · editor's pick** because the wallet-native flow and \"$20 costs $20\" face-value pricing are unusual in a market where most crypto gift-card vendors take 2–5% spread silently.\n\n**Background.** Operated by Cake Labs LLC, the same outfit behind Cake Wallet (https://cakewallet.com), Monero.com, and Cupcake. Cake Pay launched as an in-wallet feature inside Cake Wallet so XMR-first users could spend their Monero without a separate sign-up, a separate custodial layer, or a separate KYC checkpoint. Standalone web version at buy.cakepay.com mirrors the in-wallet flow for users who prefer browser checkout. Founder @vikrantnyc has been one of the more vocal advocates in the Monero economy for \"actually spend your XMR\" tooling. Recognition includes Web3Privacy Now Awards 2025. 500k+ users claimed on the homepage.\n\n**What you trust.** Cake Pay is **custodial during the routing leg**: you send XMR/BTC to a Cake Labs address, they fulfil the gift card through a merchant aggregator, and you receive the redemption code or virtual card details. That window — between deposit and code-delivery — is operator-trust territory. Once the code/card is delivered, you hold it in your wallet (Cake Wallet treats card credentials as wallet objects); from that point Cake Labs has no ongoing custody of the value. Signup is email-only — no ID, no SSN, no proof of address — which is the `light_kyc` posture rather than full anonymous_signup.\n\n**Operational specs.** Payment: XMR (≈80%+ of volume per public statements), BTC, ZEC, and a handful of others — full list rotates as merchant relationships change. Surfaces: in-wallet inside Cake Wallet (mobile + desktop), in-wallet inside Cake Wallet for Monero.com builds, standalone at buy.cakepay.com, standalone apps on App Store / Play Store / Accrescent / Android APK / Linux / Windows. Card categories: brand gift cards (Amazon, Uber, food delivery, retail) plus reloadable Visa / Mastercard top-ups available in eligible jurisdictions. Some country restrictions apply per the ToS (US sanctions list + a few additional region carve-outs; Canada support has been an open question per recent user posts).\n\n**Philosophy.** The pricing claim — \"$20 costs $20, no premium on privacy\" — is the defining editorial differentiator. Most no-KYC gift-card vendors price the card at a hidden spread (you pay $21 in crypto for a $20 card, or you pay $20 of crypto valued at $19 of card credit through an unfavourable FX rate). Cake Pay's published posture is that face value equals what you pay. Community sentiment over the last 12 months shows no widespread reports of hidden spread or unfavourable FX undermining this claim. Treat it as operator-published until xmr.club runs a calibrated test trade.\n\n**Grade rationale.** Grade A and editor's pick reflect: vertical integration with a known, long-running wallet team (Cake Wallet has been shipping since 2019); the face-value pricing claim, which holds up in community sentiment data; wallet-native flow that doesn't expand the user's KYC surface beyond an email; multi-OS app coverage including Linux + Accrescent (privacy-respecting Android store); and absence of reputational incidents in the last 12 months. Last verified 2026-05-11. Re-grade contingent on a curator-tested face-value pricing audit.\n\n**Useful when.** You hold XMR (or BTC/ZEC) and need to spend it at a merchant that doesn't accept crypto directly — Amazon, Uber, restaurants, retail, online subscriptions. You already use Cake Wallet and want to stay in one app. You want gift-card pricing without the silent crypto-vendor spread. You need Visa/Mastercard top-ups for one-off privacy-friendly online payments.\n\n**Caveats.** Custodial during the routing window — your XMR sits with Cake Labs until the card code arrives. Email-only signup is `light_kyc`, not fully anonymous; the email links your purchases to a contact identifier. Jurisdiction restrictions apply (US sanctions + Canada question + ToS-listed regions); check eligibility before depositing. Some gift-card categories require the merchant's own KYC at redemption (e.g. reloadable Visa for in-store purchases varies by issuer). Face-value pricing has not yet been verified by xmr.club's own test trade — pending. If you're choosing between Cake Pay and bitrefill-giftcards for the same merchant, bitrefill currently has wider merchant coverage; Cake Pay's edge is the wallet-native flow and pricing transparency.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "non_custodial", "xmr_native", "multi_chain" ], "highlight_tags": [ "XMR NATIVE", "WALLET-EMBEDDED" ], "fees": { "summary": "Issuer-dependent · no separate platform fee · network fees paid by user" }, "fees_summary": "Issuer-dependent · no separate platform fee · network fees paid by user", "last_verified": "2026-05-11", "operating_since": "2022", "tenure_note": "Cake Pay (gift card / prepaid card service) launched ~2022-2023 by the Cake Labs team. cakepay.com domain WHOIS 2010 was a different owner / parked; Cake Labs adopted it later. Previous stamp (2010) was the domain WHOIS, not the service launch — premium-domain trap.", "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://cakepay.com", "outbound_slug": "cakepay" }, "also_listed_at": { "monerica": true } }, { "id": "cardsrelay", "category": "merchants", "subcategory": "Gift Cards", "name": "CardsRelay", "url": "https://xmr.club/merchants/cardsrelay", "twin": "https://xmr.club/llm/merchants/cardsrelay.txt", "tagline": "Privacy-coin gift-card store — 1,600+ cards (Amazon, Steam, top-ups) paid in XMR, ZEC, Zano or USDT, no account, instant email delivery. New (~6 weeks live) and, ironically, loads Google trackers.", "review": "**A privacy-coin-first gift-card store.** CardsRelay sells 1,600+ gift cards, game top-ups, prepaid and mobile refills — Amazon, Steam, and the usual brand spread — paid in **Monero, Zcash, Zano, or USDT**. No account to create: you pick a card, pay in crypto, and the code is emailed to you (email is used for delivery only, not signup). Delivery is instant.\n\n**Privacy posture.** The no-account model plus XMR/ZEC/Zano acceptance is a genuinely privacy-forward setup — it's one of the few gift-card shops leading with Monero *and* Zano rather than treating XMR as an afterthought. One jarring exception: the site loads **Google Analytics and Tag Manager**. For a store whose whole pitch is privacy coins, shipping Google's tracking stack is a real inconsistency worth knowing before you browse — use a hardened browser or blocker.\n\n**The main caveat — it's brand new.** The domain dates to March 2026 and the store has only been live since about mid-July (~6 weeks at listing). It functions and the catalog is real, but there's no track record yet on delivery reliability, dispute handling, or longevity — the things that separate a C gift-card shop from an A one ([CoinCards](/merchants/coincards), [Coinsbee](/merchants/coinsbee)). Custody note: like every gift-card store, it's custodial at the moment of payment — you send crypto and trust it to deliver a valid code.\n\n**Useful when.** You want to spend XMR/ZEC/Zano on mainstream brands without an account, and you're willing to start small on a young service. Buy one low-value card first and confirm the code delivers and redeems before scaling up.\n\nGraded **C**: a real, functional, no-account privacy-coin gift-card store — listable on function, capped at C by its ~6-week tenure and the Google-tracking surface. Path to B: a clean track record over time plus dropping the third-party trackers.", "translation_locale": "en", "rating": { "grade": "C", "trust": "Functional gift-card store (1,600+ cards, ProductHunt launch). Domain 2026-03, live ~2026-07 (~6 weeks) — very new, no track record yet. No token/funnel. Custodial at payment (pay crypto -> emailed code). Loads Google Analytics + Tag Manager.", "privacy": "No account required — email used only for code delivery. Accepts XMR, ZEC and Zano directly (privacy-coin-first). Ironic negative: ships Google Analytics + Tag Manager; use a blocker.", "ux": "Browse/search 1,600+ gift cards, games, prepaid, mobile top-ups; pay in XMR/ZEC/Zano/USDT; instant email delivery. No signup." }, "grade": "C", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "custodial", "no_account", "xmr_accepted", "multi_chain" ], "highlight_tags": [ "XMR", "ZEC", "ZANO", "NO-ACCOUNT", "GIFT-CARDS", "NEW" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-26", "operating_since": "2026-03", "tenure_note": "Domain registered 2026-03-04; store live on Wayback since ~2026-07-14 (~6 weeks at listing). Very new.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://cardsrelay.com", "outbound_slug": "cardsrelay" }, "also_listed_at": { "monerica": true } }, { "id": "coincards", "category": "merchants", "subcategory": "Gift Cards", "name": "CoinCards", "url": "https://xmr.club/merchants/coincards", "twin": "https://xmr.club/llm/merchants/coincards.txt", "tagline": "Canadian-based gift-card store, accepts BTC/XMR/ETH and many alts.", "review": "CoinCards is the **Canada-anchored gift-card portal** that's been quietly running the no-KYC crypto-to-vouchers play since 2014 — predating most of the current category by years. Where Bitrefill optimises for global breadth + Lightning, and Coinsbee optimises for 200+ coin / 165-country tail coverage, CoinCards optimises for **regional fit for North American buyers**: every brand that matters on Canadian and US Main Street, priced cleanly, settled fast, with the kind of operating tenure that becomes its own trust mechanism in this category.\n\n**What you can pay with:** BTC (on-chain + Lightning), XMR, ETH, LTC, BCH, and a long tail of altcoins through their wallet integrations. For Monero specifically, deposit is to a per-order address and the quoted XMR figure is locked at the moment you click pay. Lightning is supported for BTC — uncommon enough in this category that it's worth calling out. The crypto-side UX is intentionally minimal: pick the coin, the address loads, you pay, you redeem. No coin-selection roulette, no confusing network dropdowns. The wallet integrations they ship (Coinos, Cake Wallet, etc.) work without manual fiddling.\n\n**What you can buy:** CoinCards's catalog is **deliberately curated, not maximised**. You won't find the Eastern European supermarket cards Coinsbee carries, or the niche regional brands Bitrefill skips — that's not the play. What you do find is the brands that get used: Amazon (multiple regional storefronts), Apple, Walmart, Tim Hortons, Loblaws, Petro-Canada, Esso, Best Buy, Home Depot, Indigo, Cineplex, Uber Eats, Starbucks, Visa/Mastercard reload products, mobile top-ups for Canadian carriers, and a solid spread of US merchant brands. The categories that matter for daily-life spending — groceries, gas, restaurants, electronics, mobile — are first-class. The hobby-niche stuff (gaming consoles aside, which they cover) is thinner.\n\nFor Canadian buyers specifically, this is the **only no-KYC option** that meaningfully covers your country. Bitrefill and Coinsbee have spotty Canadian coverage at best; CoinCards built the inventory for that exact market. For US buyers, CoinCards is competitive on most US brands and often beats Bitrefill on spread for non-Lightning settlement.\n\n**KYC posture:** This is the cleanest no-KYC story in the category, in our reading:\n\n- **No account required for any purchase.** Click a brand, pick a denomination, pay, redeem. No signup challenge, no email verification, no \"create an account to continue.\"\n- **No email collection at checkout for most purchases.** Some brands optionally ask for a delivery email if you want a copy mailed; the order page works without one.\n- **No threshold trigger we've observed for standard merchant gift cards.** Coinsbee starts asking questions above ~$300 on certain brands; CoinCards we haven't seen ask under any reasonable retail amount on standard merchant cards.\n- **Exception:** Prepaid Visa/Mastercard reload products (the ones that function like debit cards) do trigger issuer-side ID requirements regardless of platform — that's the card-issuer policy, not CoinCards. If you stick to specific-merchant gift cards (Amazon, Walmart, Tim Hortons), you stay in the fully-anonymous lane.\n\nThe \"A\" grade rests on this checkout-flow simplicity. Most competitors are no-KYC-in-policy but ask for something (email, account, age confirmation); CoinCards is no-KYC in actual delivered behavior.\n\n**Fee math:** CoinCards earns on **issuer spread**, typically 3–7% above face — meaningfully tighter than Coinsbee's 4–8% on overlapping brands and competitive with Bitrefill (slightly worse than LN-settled BTC on small denominations, often better than on-chain BTC). The spread is shown as the final XMR/BTC amount before you commit; there's no separate processing fee, no \"exchange rate spread\" hidden in the conversion.\n\nNo withdrawal fees (one-way settlement, no funds parked). No chargebacks (crypto is final). Refunds on unredeemable codes are handled email-first via support@coincards.com — response cadence is usually same-day weekdays, slower on weekends. The eleven-year operating history without a public unredeemed-code scandal is the substitute for formal escrow.\n\n**Settlement + delivery flow:** Standard flow: brand → denomination → coin → order page shows quoted price + per-order address → send the exact amount → after 1 confirmation (XMR ~2 min typical, Lightning instant for BTC, on-chain BTC follows standard mempool timing) the code is released on the order page and (optionally) emailed. Most brands deliver instantly after confirmation; a handful (specific issuer cards) take 5–15 minutes. The order page persists for the redemption window — if you supply no email and lose the tab, the code is recoverable via the order ID, but it's safer to either supply a throwaway email or screenshot the page on receipt.\n\nFor XMR specifically: the deposit address is fresh per order, and the rate is held through the confirmation window (no expiry mid-deposit). We haven't observed rate-expired-on-slow-confirmation issues across multiple test orders, including during periods of XMR mempool backup. Their integration is mature.\n\n**When to pick CoinCards over Bitrefill or Coinsbee:** - **You're buying for a Canadian recipient or yourself, in Canada.** This is the only no-KYC option with real CAD coverage. Tim Hortons, Petro-Canada, Loblaws, Indigo, regional restaurant chains — these aren't on the other portals.\n- **You want the simplest checkout flow in the category.** No accounts, no emails-required, no friction. The least crypto-savvy person you know can use this without help.\n- **You're paying with BTC and want Lightning** but the brand isn't on Bitrefill, or you prefer CoinCards's interface.\n- **You want a portal that's been around the longest in the category** — operational tenure since 2014 is hard to argue with as a trust proxy.\n\nPick Bitrefill when: brand is top-100 global, you want Lightning at the lowest fees on small denominations, you're outside North America. Pick Coinsbee when: you need a specific regional brand that none of the others carry, you want 200+ coin payment options, you're paying with an altcoin neither of the others accepts.\n\n**Caveats:** - **Catalog is narrower** than Bitrefill or Coinsbee on a raw-brand-count basis. The trade-off is intentional (depth + reliability over breadth) but if you want maximum optionality, this isn't where you'd start.\n- **Coin support is narrower** than Coinsbee (probably 30–50 coins vs Coinsbee's 200+). For mainline coins (BTC, XMR, ETH, LTC, BCH, the major USDT variants) you're fine; for long-tail alts, check first.\n- **No published reserve attestation or audit** — same category-wide gap as Coinsbee and Bitrefill. The trust mechanism is operational: eleven years, no major unredeemed-code incident, peer-verified by both Monerica and KYCnot, public X presence at @CoinCards, support reachable through email + Telegram.\n- **Premium-domain caveat for tenure**: coincards.com WHOIS dates to 1999, but the service itself launched 2014 — the domain is a premium acquisition, not a 27-year-old project. We flag this in `tenure_note` so the listing's \"since 2014\" claim isn't read as conservative.\n- **Prepaid Visa/Mastercard reloadables** carry issuer-level ID requirements that override CoinCards's no-KYC policy. If KYC-free is your hard constraint, stick to specific-merchant brands.\n\n**Verdict:** Grade A holds, comfortably. CoinCards is the **North American anchor** of the no-KYC gift-card category: smallest catalog of the three reference portals, but the cleanest checkout flow, the longest operating history, the best Canadian coverage by a wide margin, and the most consistent execution. For a meaningful subset of privacy-aware buyers — particularly anyone in Canada — this is the first place to look, not the second. The combination of Lightning support + XMR settlement + no-account workflow + 11-year tenure puts CoinCards in the small set of services where you trust the operator because they've earned it by showing up every day for over a decade.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "no_kyc" ], "feature_tags": [ "one_way_settlement", "xmr_accepted", "lightning_support", "no_account_required", "tenured_2014" ], "highlight_tags": [ "NO-KYC", "CAD", "XMR-ACCEPTED", "LIGHTNING", "NO-ACCOUNT" ], "fees": { "summary": "Spreads vary by issuer · supports CAD-region brands not covered by US-only stores" }, "fees_summary": "Spreads vary by issuer · supports CAD-region brands not covered by US-only stores", "last_verified": "2026-06-01", "operating_since": "2014", "tenure_note": "CoinCards (Canadian crypto-to-gift-card service) launched 2014. coincards.com WHOIS 1999 is premium-domain acquisition.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://coincards.com", "outbound_slug": "coincards", "contact_email": "support@coincards.com", "twitter": "https://x.com/CoinCards", "telegram": "https://t.me/CoincardsOfficial" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "coinsbee", "category": "merchants", "subcategory": "Gift Cards", "name": "Coinsbee", "url": "https://xmr.club/merchants/coinsbee", "twin": "https://xmr.club/llm/merchants/coinsbee.txt", "tagline": "Pay with 200+ cryptocurrencies for gift cards in 165 countries.", "review": "Coinsbee is the long-tail counterweight to Bitrefill in the crypto-to-gift-card lane: where Bitrefill optimises for top-100 global brands and Lightning settlement, Coinsbee leans into width — **200+ cryptocurrencies accepted, ~5,000 brands across 165 countries**, with deep coverage of regional issuers (Eastern European supermarkets, East Asian e-commerce, Latin American mobile top-ups) that the bigger portals skip. If the brand you need isn't on Bitrefill, Coinsbee is the second place to look — and frequently the only place that lists it.\n\n**What you can pay with:** XMR is supported alongside BTC, ETH, USDT (on ERC-20, TRC-20, BEP-20, Polygon, Solana variants), LTC, DOGE, XRP, TON, BCH, and a long tail of tokens (DAI, SHIB, AVAX, MATIC, ATOM, ADA, SOL, TRX, DOT, NEAR, ALGO, BNB, USDC across multiple chains, and dozens of smaller alts). For Monero specifically, deposit is to a per-order subaddress; conversion happens at order-creation time so the quoted XMR figure is what you actually pay. Lightning is **not** supported as of this review — if you're optimising for sub-cent fees on small denominations, Bitrefill via LN is still the cheaper route. For XMR holders, Coinsbee's lack of LN is offset by usually offering brands Bitrefill doesn't cover.\n\n**What you can buy:** Twenty-plus product verticals, the most-used being: **e-commerce** (Amazon at multiple regional storefronts, eBay, Coolblue, Isetan, Dairy Farm Group), **gaming + entertainment** (Steam, PlayStation, Xbox, Nintendo, Roblox, Razer Gold, Apple), **food + dining** (Uber Eats, regional delivery brands, supermarkets), **mobile top-ups** (carriers in 100+ countries), **eSIM data plans**, **travel** (Airbnb, hotel brands, airline gift cards), **payment cards** (prepaid Visa/Mastercard products), and verticals you won't find on the more US/EU-centric portals — **dating/social vouchers**, **kids + family**, **pets/animals**, **health/spa**, **clothing**, **electronics**, **education + books**, **crypto-vouchers** (cards that themselves redeem to BTC/ETH/etc.). The catalogue rewards searching — there's no single \"best brand\" pitch; the point is breadth.\n\n**KYC posture:** Coinsbee's grade-A standing on this directory is the no-KYC retail flow, not blanket no-KYC. Two specific things to know:\n\n1. **For most purchases under retail thresholds, no account is needed at all.** Pick a brand, pick a denomination, pay XMR (or any other supported coin), receive the redemption code on the order page or via the email you provided at checkout (a throwaway is fine — no verification challenge). This is the path that earns the listing its grade.\n\n2. **At higher order values or for certain payment-card brands** (especially the prepaid Visa/Mastercard reloadables, less so generic merchant gift cards), Coinsbee may ask for email verification, account creation, or rarely additional info. The threshold isn't published as a single number — it varies **per brand issuer and per jurisdiction**. Practical advice: stay under ~$300 per order on most brand cards to avoid friction; for prepaid debit products, assume some verification will be requested regardless of amount.\n\nWorth noting separately: **checkout always collects an email address** — even a throwaway is accepted. While Coinsbee doesn't verify it, the email is a data point you've handed over. Buyers wanting zero identity traces should use a temporary inbox (SimpleLogin, Anon Addy, walls.rip Ghost Mail) for the order, then discard it.\n\nThe audit takeaway: this is a \"no-KYC at retail\" service, not a \"no-KYC at any amount\" service. Big-ticket buyers should plan to split orders or expect friction.\n\n**Fee math:** Coinsbee earns its margin on **issuer spread**, typically 4–8% above face value, varying by brand. The spread is transparent in the sense that you see the exact XMR (or other coin) amount you'll pay before confirming — it's not buried in a \"processing fee\" line — but it isn't broken out separately either, so easy comparison against Bitrefill or CoinCards requires you to check both quotes for the same brand and denomination at the same moment. Spot-checking three brands across the three portals before a large purchase is worth the 60 seconds.\n\nThere are no withdrawal fees (you're not parking funds; you pay, you redeem). There are no chargeback risks (crypto-paid gift cards are one-way). Refunds for unredeemable codes are handled case-by-case via support; in practice, refunds in XMR are quick when the underlying issue is clearly Coinsbee's (a dead code on delivery); slower or more contested when the user's redemption flow is in question.\n\n**Settlement + delivery flow:** Standard flow: select brand + denomination → choose payment coin → site quotes an exchange rate → you send the exact amount to a per-order address → after 1 on-chain confirmation (for XMR, **typically ~2 minutes — one block — and at most ~10 minutes during network congestion**), the gift card code is released to the order page and emailed if you supplied an address. Almost all brands are instant after confirmation; a handful of card products are issued by partners and take 5–30 minutes (flagged on the brand page before checkout).\n\n**If you supply no email, the redemption code appears on the order page only — keep the tab open until you've redeemed it.** There's no way to recover a code after the session ends without an email anchor.\n\nIf a Monero confirmation takes longer than usual, the order page stays open and the rate is held — no expiry penalty for slow-confirming deposits. Coinsbee's RPC-side handling is mature; we haven't observed a \"rate expired mid-deposit\" issue across multiple test orders.\n\n**When to pick Coinsbee over Bitrefill or CoinCards:** - **You need a brand the others don't carry** (most common case). Coinsbee's regional coverage — East European supermarkets, Asian e-commerce, Latin American carriers, less-mainstream gaming platforms — is the differentiator.\n- **You want to pay with an alt that isn't BTC / LN / XMR.** Coinsbee's 200+ coin support is the widest in the category.\n- **You're buying eSIM data, dating-app vouchers, or other non-mainstream verticals** that Bitrefill and CoinCards have skipped.\n\nPick Bitrefill instead when: the brand is top-100 global, you want Lightning settlement, you want to spend BTC at the lowest fees on small denominations. Pick CoinCards when: you're in North America and the regional CA-specific brands matter to you, or when the simpler UI is worth the narrower catalogue.\n\n**Caveats:** - **Denser UI** than Bitrefill — more clicks to find what you want, more filtering needed. The \"200+ coins, 165 countries, 22 categories\" breadth is real but it shows in the navigation.\n- **No Lightning** — pay with on-chain BTC if you must use BTC; XMR is cheaper-per-transaction at the moment for small denominations anyway.\n- **Account required for certain prepaid-card products** even at low values — those edge into KYC-requiring territory by issuer policy, not Coinsbee policy.\n- **Unredeemable-code disputes** are the most-reported support issue across the gift-card category; not Coinsbee-specific, but worth knowing the support channel (email + Telegram t.me/coinsbee) before you need it.\n- **No published reserve attestation or audit** — and **no gift-card portal in this category currently publishes one** (Bitrefill and CoinCards included). Trust here is purely operational: Coinsbee's eight-year track record since 2018 with no major unredeemed-code incident is the substitute for a formal trust mechanism. If formal attestation matters to you, the entire gift-card vertical isn't yet there.\n\n**Verdict:** Grade A holds. The combination of no-KYC retail flow, 200+ coin support including XMR, regional brand depth that no competitor matches, and a clean settlement flow keeps Coinsbee as one of the two reference choices in the cards category alongside Bitrefill. They occupy different niches — Bitrefill for top-100 brands + LN, Coinsbee for breadth + regional + Monero — and most privacy-aware buyers benefit from accounts (or rather, account-less workflows) with both.\n\n---", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "no_kyc" ], "feature_tags": [ "one_way_settlement", "multi_chain", "xmr_accepted", "200_plus_coins", "regional_brands", "mobile_topups", "esim" ], "highlight_tags": [ "NO-KYC", "GLOBAL", "XMR-ACCEPTED", "200+ COINS" ], "fees": { "summary": "Spreads 4–8% depending on issuer · no account required for most purchases" }, "fees_summary": "Spreads 4–8% depending on issuer · no account required for most purchases", "last_verified": "2026-06-01", "operating_since": "2018", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.coinsbee.com", "outbound_slug": "coinsbee", "twitter": "https://x.com/coinsbee", "telegram": "https://t.me/coinsbee" }, "also_listed_at": { "kycnot": true } }, { "id": "travala", "category": "merchants", "subcategory": "Travel", "name": "Travala", "url": "https://xmr.club/merchants/travala", "twin": "https://xmr.club/llm/merchants/travala.txt", "tagline": "The established crypto travel platform — 2M+ hotels, flights and activities, 100+ cryptos including direct XMR, since 2017. Same honest caveat as any travel booking: XMR is payment privacy only; airlines and hotels still need your real ID.", "review": "**What it is.** Travala is the largest and longest-running crypto-native travel platform — 2M+ hotels plus flights and activities, bookable with 100+ cryptocurrencies including **Monero directly** ([travala.com/payment/monero-xmr](https://www.travala.com/payment/monero-xmr)). Operating since 2017 and Binance-backed, it's the established anchor of this shelf.\n\n**Payment privacy, not travel anonymity.** As with any travel booking, paying in XMR keeps the purchase off your card statement, but it does not make the trip anonymous: the airline needs a passport-matching passenger name and the hotel needs ID at check-in. Real, useful privacy on the *payment* — none on the *travel*. Spend XMR here; don't expect to travel unseen.\n\n**What to weigh.** Booking requires a Travala account (email). It's a mainstream commercial platform — expect analytics/trackers and a loyalty-token layer (AVA / \"Smart\" program). It's custodial at the point of payment: you pay Travala, Travala pays the provider. XMR is offered as a first-class settlement option rather than an afterthought, which is the main reason it sits above newer travel resellers.\n\n**Useful when.** You want the broadest, most reliable crypto travel inventory and you're paying with XMR to keep the booking off a card — accepting that the airline and hotel will still know who you are.\n\nGraded **B**: the established, direct-XMR anchor of the travel shelf, held below A only by the constraints the whole category shares — custodial-at-payment, account + trackers, and payment-only privacy.", "translation_locale": "en", "rating": { "grade": "B", "trust": "Largest crypto-native travel platform, operating since 2017 (~9yr), Binance-backed. 2M+ properties plus flights/activities. Direct XMR settlement. Custodial at point of payment; mainstream commercial site with account requirement and trackers.", "privacy": "Payment privacy only — XMR keeps the booking off your card, but the airline needs a passport-matching name and the hotel needs ID at check-in; the travel is not anonymous. Account (email) required to book; mainstream trackers present.", "ux": "Search and book 2M+ hotels, flights, activities; pay with 100+ cryptos incl. direct XMR. Account required; AVA token / Smart loyalty layer." }, "grade": "B", "kyc_tags": [], "feature_tags": [ "custodial", "closed_source", "multi_chain" ], "highlight_tags": [ "XMR-DIRECT", "TRAVEL", "EST-2017", "100+ COINS", "PAYMENT-PRIVACY-ONLY" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-26", "operating_since": 2017, "tenure_note": "Operating since 2017 (~9 years); domain registered 2016-12. Binance-backed.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.travala.com", "outbound_slug": "travala" } }, { "id": "trocador-giftcards", "category": "merchants", "subcategory": "Gift Cards", "name": "Trocador Gift Cards", "url": "https://xmr.club/merchants/trocador-giftcards", "twin": "https://xmr.club/llm/merchants/trocador-giftcards.txt", "tagline": "Crypto-funded retailer gift cards — Amazon, Steam, Walmart, hundreds more.", "review": null, "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "no_kyc" ], "feature_tags": [ "custodial", "tor_mirror", "api_available" ], "highlight_tags": [ "NO-KYC", "AGGREGATOR" ], "fees": { "summary": "Pay in crypto · 2% spread set by us · denominations $5–$500" }, "fees_summary": "Pay in crypto · 2% spread set by us · denominations $5–$500", "last_verified": "2026-05-11", "operating_since": "2022", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://trocador.app/en/giftcards", "affiliate": "https://trocador.app/en/giftcard?ref=2zYpj7duMw", "outbound_slug": "trocador-giftcards" }, "also_listed_at": { "web3privacy": true, "monerica": true } }, { "id": "basicswap", "category": "mixers", "subcategory": "Atomic Swap", "name": "BasicSwap DEX", "url": "https://xmr.club/mixers/basicswap", "twin": "https://xmr.club/llm/mixers/basicswap.txt", "tagline": "Particl-led atomic-swap DEX. XMR ↔ BTC / LTC / PART / DASH cross-chain without bridges or wrapped tokens.", "review": "**⚠ INCIDENT (2026-07-15) — patch released.** A swap-security exploit was reported publicly at 2026-07-15 00:49Z with ~0.66 BTC ($42k) losses confirmed so far. BasicSwap DEX acknowledged the issue within ~12 hours and shipped **v0.17.2** approximately nine hours after that. **Update to v0.17.2 before restarting any node.** The fix applies automatically on node restart. If you have a swap in progress: update first, let the swap resume, do not force manual refunds. See the Incident block below for the full timeline.\n\nBasicSwap is the *trustless way to swap XMR and BTC* — an open-source desktop DEX that executes genuine cross-chain atomic swaps directly between peers, with no custody, no wrapped tokens, no bridges, and no liquidity pools to drain.\n\n**Background.** Built since 2022 within the Particl ecosystem, BasicSwap is a *desktop GUI for cross-chain atomic swaps* coordinated peer-to-peer over Tor. Its headline capability — and the reason it matters here — is *native XMR↔BTC* swapping using adaptor signatures, a cryptographic technique that lets two parties trade across chains atomically without either holding the other's coins. That genuinely non-custodial, bridge-free design is why it earns an A in /mixers: it's the rare swap tool whose trust model is \"trust the math,\" not \"trust the exchange.\"\n\n**What you trust.** Almost nothing beyond the protocol. Swaps are *atomic*: adaptor-signature swaps lock funds such that either the trade completes for both sides or both reclaim their coins — there is *no custody*, no intermediary holding your XMR while it sends BTC. There are *no bridge tokens* (you trade real XMR for real BTC, not a wrapped IOU that can de-peg or rug) and *no liquidity pools* (so no pool to hack or drain — orders are matched peer-to-peer). The whole thing is *open source* and coordinated *over Tor*, so the order-matching layer doesn't expose your network identity. The residual trust is in the protocol's correctness and your counterparty honoring the timelocks — which the atomicity enforces.\n\n**Operational specs.** A *desktop application* you run yourself (it spins up the relevant chain clients), matching orders *peer-to-peer over Tor* and settling via adaptor-signature atomic swaps. *XMR↔BTC* is the flagship pair, with other coins supported. There's *no account, no KYC* — you're running software and trading directly with peers. Because it's a real P2P market with self-custody, the *order book is smaller* and thinner than a centralized swap, and a swap involves running clients and waiting for on-chain confirmations on both sides. Open-source, self-hosted, part of the Particl stack.\n\n**Philosophy.** Every centralized swap and most \"cross-chain\" bridges reintroduce the exact thing crypto was meant to remove: a custodian who holds your funds mid-trade and a honeypot that can be hacked, frozen, or coerced. BasicSwap's thesis is that swapping *XMR↔BTC* — the most privacy-relevant pair — should be *trustless and peer-to-peer*: no exchange to KYC you, no bridge to trust, no pool to drain, just two people and a cryptographic guarantee. Open-sourcing it and running matchmaking over Tor is the only configuration consistent with that goal.\n\n**Grade rationale.** A in /mixers. The grade reflects genuine non-custodial atomic swaps (no custody, no wrapped tokens, no pools), native XMR↔BTC support, no-account/no-KYC operation, an open-source codebase, and Tor-coordinated peer matching. On trust model it is essentially unmatched in the category. The caveats — liquidity, UX, and the inherent slowness of cross-chain atomic swaps — are the price of that trustlessness, not flaws in the design.\n\n**Useful when.** Reach for BasicSwap when you want to move between *Bitcoin and Monero without a custodian or a KYC checkpoint* and you're willing to run desktop software and wait for a real cross-chain swap to settle. It's the tool for the privacy-maximalist who refuses to hand XMR to an exchange or trust a bridge token — accept the thinner order book as the cost of a trust model nothing else matches.\n\n**Caveats.** Liquidity is the honest limitation: a peer-to-peer, self-custody order book is *thinner* than a centralized swap, so you may wait for a counterparty or get worse depth on larger sizes — patience is part of the deal. It's *desktop software you run* (spinning up chain clients, syncing), so there's setup and resource overhead, and cross-chain atomic swaps are *inherently slower* than a custodial instant-swap. As an evolving open-source project the UX is rougher than a polished app, and you should verify you're running the genuine client. None of this dents the A — for *trustless XMR↔BTC*, BasicSwap is the reference tool, with the explicit trade-off that trustlessness costs convenience.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A-" }, "grade": "A-", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "tor_supported", "atomic_swap" ], "highlight_tags": [ "P2P", "ATOMIC-SWAP", "XMR" ], "fees": { "summary": "Swap-fee only · adaptor sigs · Particl + Tor coordinator" }, "fees_summary": "Swap-fee only · adaptor sigs · Particl + Tor coordinator", "last_verified": "2026-07-29", "operating_since": "2022", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://basicswapdex.com", "outbound_slug": "basicswap", "twitter": "https://x.com/BasicSwapDEX", "telegram": "https://t.me/basicswapdex", "matrix": "https://matrix.to/#/basicswap:matrix.org" }, "incident": { "title": "2026-07-15 swap security issue — $42k reported by OrangeFren, operator acknowledged in ~12h and shipped v0.17.2 hardening release ~9h after acknowledgement", "summary": "OrangeFren.com (verified X) reported at 2026-07-15 00:49Z that BasicSwapDEX had been exploited, with 0.66 BTC (~$42k) in confirmed losses. BasicSwapDEX's own X account (@BasicSwapDEX, verified) responded within roughly twelve hours: first with an Important Security Notice instructing users to withdraw offers, not start new swaps, shut nodes carrying in-progress swaps down, and not attempt manual refunds; then, roughly nine hours later, with the v0.17.2 hardening release that fixes the underlying issue and applies automatically when a node restarts on the new version. Operator's post-patch guidance to users with in-progress swaps: update first, let the swap resume, do not force manual refunds. Curator read: textbook responsible incident response — clear acknowledgement, protective interim guidance, rapid hardening release, and post-patch continuity instructions. The exploit happened and losses are real, but the operator posture is not shame-list-shape. Recommended grade path: A → A- (mirrors the Haveno post-2026-06-exploit demotion pattern where the operator shipped a same-week fix). Follow-up wake +24h to check for updated loss figures + post-mortem.", "status": "open", "timeline": [ { "date": "2026-07-15", "stage": "incident_open", "note": "OrangeFren.com (verified X, @OrangeFren) reported at 2026-07-15 00:49Z that BasicSwapDEX was exploited with 0.66 BTC (~$42k) losses confirmed so far. Curator opened incident. basicswapdex.com surface still HTTP 200 at this timestamp; operator-account response not yet visible via curator probe." }, { "date": "2026-07-15", "stage": "operator_acknowledged", "note": "Operator (@BasicSwapDEX, verified) acknowledged approximately twelve hours before the +1h re-check with an Important Security Notice: 'A swap security issue has been identified and is being fixed. Until the patch is live, withdraw your offers, don't start new swaps, and if you have a swap in progress (especially stalled or near timeout), shut your node down and leave it off.' Follow-up post: 'Don't attempt manual refunds or recovery on your own, and keep your BasicSwap data and wallets intact. Patch and full instructions to follow. The fix will apply automatically when starting your node after updating.'" }, { "date": "2026-07-15", "stage": "hardening_release_shipped", "note": "Operator posted the v0.17.2 hardening release approximately nine hours after the acknowledgement: 'BasicSwap v0.17.2 is now out and fixes the security issue detailed in this post. Update now, then it's safe to bring your node back online and post offers again. If you had a swap in progress, update first and let it resume; don't force manual refunds.' Turnaround from OrangeFren-report to shipped fix is approximately 21 hours end-to-end. Curator read: responsible-incident-response pattern — grade movement recommendation is A → A- (mirrors Haveno post-2026-06 demotion). Reader guidance: update to v0.17.2 before restarting any node with an in-progress swap; do not force manual refunds; the patch applies the fix automatically on node restart." }, { "date": "2026-07-16", "stage": "day2_recheck", "note": "+24h re-check. Fresh evidence from the operator's public GitHub release train tightens the timeline meaningfully. Version cadence: v0.17.0 2026-07-09, v0.17.1 2026-07-12 (already a security-hardening release adding false-refund classification defenses + Electrum fee-inflation limits + AEAD key-format migration), v0.17.2 2026-07-14T11:36:50Z (the release that patches the exploit reported publicly by OrangeFren 13 hours later). Root cause per the v0.17.2 release notes: 'Adaptor-sig swaps: track the coin A lock refund tx to blocks_confirmed depth before publishing the lock refund spend tx. The refund spend reveals the leader's key share to the counterparty; publishing it while the refund tx is still unconfirmed could let a released follower recover that share and race both legs of the swap.' Companion hardening: the coin B lock tx must reach spendable depth before the follower broadcasts a chain B lock refund recovery spend. Curator read: the fix was already shipped ~13 hours before OrangeFren's public report on 2026-07-15 00:49Z — the operator disclosed and released in the same window, then OrangeFren picked up the public reporting later. That is meaningfully stronger incident response than 'operator responded within 12 hours of public disclosure' suggested. Loss figure ($42k / 0.66 BTC) unchanged in public sources today — no follow-up figure from OrangeFren visible via curator probe. @BasicSwapDEX X profile bio unchanged; no additional acknowledgement or post-mortem post surfaced today beyond the initial 3-tweet thread already on file. Grade held at A- per curator sign-off 2026-07-15. Reschedule +24h to keep the poll alive." }, { "date": "2026-07-17", "stage": "day3_recheck", "note": "+48h re-check. New release: **v0.17.3 published 2026-07-16T01:27:18Z** — a follow-up hardening release shipped ~14 hours after v0.17.2. Contents: (a) defense-in-depth on the same adaptor-sig swap surface — 'constrain which bid states accept the lock-release, coin-A-lock-signature and lock-spend P2P messages, and reject messages for revoked/inactive offers. Prevents a hostile or replayed peer message from mutating a finished/terminal bid or resurrecting it into an active swap.' This tightens which peer messages can even reach bid-state transitions, adjacent to the v0.17.2 lock-refund key-share race fix. (b) Web UI hardening on a separate attack surface: Host-header allowlist against DNS-rebinding, CSRF check on Origin/Referer as full origin, WebSocket handshake Origin validation against cross-site WebSocket hijack. Curator read: the operator is running a comprehensive audit + follow-up sweep, not treating v0.17.2 as the end of the response. That is the strongest signal I could ask for on a Grade A- listing with an open exploit incident. No new post-mortem or updated loss figure surfaced today; OrangeFren has not published a follow-up visible to curator probe. Loss figure unchanged at 0.66 BTC (~$42k). basicswapdex.com surface still up, no advisory banner on the homepage (which is fine — the response is happening on GitHub + X, not on the marketing surface). Grade held at A-. Reschedule +24h." }, { "date": "2026-07-18", "stage": "day4_recheck", "note": "+72h re-check. Fourth hardening release since the incident opened: **v0.17.4 published 2026-07-16T21:55:43Z** — ~20 hours after v0.17.3. Contents: (a) Particl blind swaps — verify the lock-tx-spend output pays the expected address (another adaptor-swap-adjacent invariant, tightens the same class of validation as v0.17.2 / v0.17.3). (b) Electrum hardening — confirmations Merkle-verified against block header, watch-only balances excluded from spendable balance (defense against a hostile Electrum server misreporting state to the client). (c) Reliability/config fixes — allowed_hosts single-string normalization, AMM Docker htmlhost=0.0.0.0 UI fix, active-swap loop snapshot before iterating, transient RPC-error retry on queued swap actions. (d) CI matrix expanded to run test_coins for Particl blind and Particl anon; pytest suites now fail-fast. Curator read: the release cadence (v0.17.0 → v0.17.4 over 8 days, three of them after the exploit report) is a comprehensive audit sweep, not a one-and-done hotfix. Each release tightens an adjacent validation surface (bid-state message gating in v0.17.3, expected-address invariant in v0.17.4). No post-mortem document has been published yet — root-cause is still just the v0.17.2 release-notes paragraph. Loss figure unchanged at 0.66 BTC (~$42k) per public sources today; OrangeFren has not posted a follow-up visible to curator probe. Grade held at A-. Reschedule +24h." }, { "date": "2026-07-19", "stage": "day5_recheck", "note": "+96h re-check. No new release since v0.17.4 (2026-07-16T21:55:43Z) — approximately 54 hours of release quiet, which is the first sustained pause since the incident opened. Read: the rapid audit-sweep cadence (v0.17.2 / v0.17.3 / v0.17.4 in 34 hours) is settling into a normal cadence. This is a good sign in its own right on a Grade A- listing with an open incident — the emergency-hardening pattern is winding down. basicswapdex.com surface still HTTP 200, no advisory banner (as expected — the response continues to happen on GitHub + X, not on the marketing page). Loss figure unchanged at 0.66 BTC (~$42k). No formal post-mortem document has been published — root-cause is still just the v0.17.2 release-notes paragraph. OrangeFren has not posted a follow-up visible to curator probe. Grade held at A-. Reschedule +24h." }, { "date": "2026-07-20", "stage": "day6_recheck", "note": "+120h re-check. No new release since v0.17.4 (2026-07-16T21:55:43Z) — approximately 78 hours of release quiet, extending the settle-into-normal-cadence signal from Day 5. Second consecutive check without a hardening release confirms the audit sweep has wound down into stable maintenance mode. No post-mortem document has been published — root-cause still just the v0.17.2 release-notes paragraph. Loss figure unchanged at 0.66 BTC (~$42k). OrangeFren has not posted a follow-up visible to curator probe. basicswapdex.com surface still HTTP 200 with no advisory banner (consistent with prior probes — response continues to happen on GitHub + X, not the marketing surface). Grade held at A-. Reschedule +24h." }, { "date": "2026-07-21", "stage": "day7_recheck", "note": "+144h re-check. **NEW: v0.17.5 published 2026-07-20T20:47:14Z** — ~96 hours after v0.17.4, ending the release quiet observed on Days 5-6. Fifth post-incident hardening release. Contents on the adaptor-sig surface: (a) ignore replayed coin-A lock-signature messages + gate the coin-A lock send; (b) re-create purged coin-B lock action after restart; (c) verify and record received lock-release esig even in error states. Networking retries socks/proxy errors as transient. Sub-fee bid fixes (off-by-one on fee verification, UI lockout during processing, prefunded-tx electrum utxo regression). Litecoin PoW scrypt fix, SMSG timeout+paging, Decred prefunded-tx + prepare/mercy tx fixes, AMM autostart under htmlhost=0.0.0.0. Daemon bumps: Bitcoin 29.4 (added alternative PGP key), Dash 23.1.7, Monero 0.18.5.1. Curator read: the release cadence never fully wound down — v0.17.5 continues the audit-sweep pattern with more adaptor-sig defense-in-depth (replay + purge + esig-record hardening) plus a broader fix pass. Loss figure unchanged at 0.66 BTC (~$42k). No post-mortem document. OrangeFren no follow-up. Grade held at A-. Reschedule +24h." }, { "date": "2026-07-22", "stage": "day8_recheck", "note": "+168h re-check. No new release since v0.17.5 (2026-07-20T20:47:14Z) — approximately 44 hours of release quiet. Second consecutive check without a hardening release since v0.17.5 shipped. The audit-sweep cadence that spanned v0.17.2 through v0.17.5 (four post-incident releases in 6 days) has now genuinely settled. Loss figure unchanged at 0.66 BTC (~$42k) per public sources. No post-mortem document. OrangeFren has not posted a follow-up visible to curator probe. basicswapdex.com surface HTTP 200, no advisory banner (as expected — response continues on GitHub + X). Grade held at A-. Reschedule +24h." }, { "date": "2026-07-23", "stage": "day9_recheck", "note": "+192h re-check. No new release since v0.17.5 (2026-07-20T20:47:14Z) — approximately 67 hours of release quiet, third consecutive quiet-cycle probe. The post-incident audit-sweep cadence (v0.17.2 through v0.17.5 shipping in a 6-day emergency-hardening train) is durably settled into normal maintenance. Loss figure unchanged at 0.66 BTC (~$42k) per public sources. No post-mortem document published — the response continues to live in the release-notes prose for v0.17.2 (root cause) + v0.17.3 through v0.17.5 (defense-in-depth). OrangeFren has not posted a follow-up visible to curator probe. basicswapdex.com surface HTTP 200, no advisory banner (as expected). Grade held at A-. Reschedule +24h." }, { "date": "2026-07-24", "stage": "day10_recheck", "note": "+216h re-check. No new release since v0.17.5 (2026-07-20T20:47:14Z) — approximately 91 hours of release quiet, fourth consecutive quiet-cycle probe. The post-incident audit-sweep cadence remains durably settled into normal maintenance since v0.17.5. basicswapdex.com surface HTTP 200 (~40KB, no advisory banner change vs prior probes). Nitter + xcancel mirrors dark this probe — no fresh @BasicSwapDEX post-mortem or @OrangeFren follow-up capturable via curator probe today; primary GitHub signal is the release train, which remains at v0.17.5. Loss figure unchanged at 0.66 BTC (~$42k) per last-known public sources. Grade held at A-. Reschedule +24h." }, { "date": "2026-07-25", "stage": "day11_recheck", "note": "+240h re-check. No new release since v0.17.5 (2026-07-20T20:47:14Z) — approximately 116 hours of release quiet, fifth consecutive quiet-cycle probe. basicswapdex.com surface HTTP 200 / ~40 KB, no size drift or banner change from prior probes. X mirror probes remain dark this cycle (nitter + xcancel both bot-blocked from curator vantage in recent probes) — no fresh @BasicSwapDEX post-mortem or @OrangeFren follow-up capturable today; primary GitHub signal is the release train, which remains stable at v0.17.5. Loss figure unchanged at 0.66 BTC (~$42k). Grade held at A-. Reschedule +24h." }, { "date": "2026-07-26", "stage": "day12_recheck", "note": "+264h re-check. No new release since v0.17.5 (2026-07-20T20:47:14Z) — approximately 140 hours of release quiet, sixth consecutive quiet-cycle probe. basicswapdex.com surface HTTP 200 / ~40 KB, no size drift or banner change from prior probes. X mirrors dark this cycle (nitter + xcancel bot-blocked); primary GitHub signal remains stable at v0.17.5. Loss figure unchanged at 0.66 BTC (~$42k). No post-mortem published; no OrangeFren follow-up. Note for context: the concurrent OpenMonero incident escalated D → F on 2026-07-25 on the strength of a kycnot.me advisory; that is a separate incident tracked on its own row and does not affect basicswap grading. Grade held at A-. Reschedule +24h." }, { "date": "2026-07-27", "stage": "day13_recheck", "note": "+288h re-check. No new release since v0.17.5 (2026-07-20T20:47:14Z) — approximately 164 hours of release quiet, seventh consecutive quiet-cycle probe. basicswapdex.com HTTP 200 / ~40 KB (stable, no drift). Loss figure unchanged at 0.66 BTC (~$42k). No post-mortem, no OrangeFren follow-up. Incident has objectively settled — the 7-day stable-cadence window has now been sustained. Grade held at A-. Reschedule +24h; will surface a wind-down recommendation to the operator on the next cycle." }, { "date": "2026-07-28", "stage": "day14_recheck", "note": "+312h re-check. No new release since v0.17.5 (2026-07-20T20:47:14Z) — approximately 188 hours of release quiet, eighth consecutive quiet-cycle probe. basicswapdex.com HTTP 200 / ~40 KB (stable, no drift from any prior probe). Loss figure unchanged at 0.66 BTC (~$42k). No post-mortem, no OrangeFren follow-up. Incident is settled. Grade held at A-. Reschedule +24h — will surface wind-down recommendation again on next cycle." }, { "date": "2026-07-29", "stage": "incident_closed", "note": "Incident closed. 14-day observation window since 2026-07-15 with responsible operator response (v0.17.2 hardening release shipped ~13h before OrangeFren's public report; four follow-up defense-in-depth releases through v0.17.5 within 6 days; 8 consecutive daily quiet cycles since). Loss figure unchanged at 0.66 BTC (~$42k); no post-mortem published but the release-notes prose across v0.17.2–v0.17.5 documents root-cause + defense-in-depth. Grade held at A- for the incident duration. Daily poll retired; future re-open triggered by event only (fresh @BasicSwapDEX activity, @OrangeFren follow-up, new hardening release, or independent loss report)." } ], "severity": "resolved" }, "also_listed_at": { "web3privacy": true, "monerica": true } }, { "id": "joinmarket", "category": "mixers", "subcategory": "BTC CoinJoin", "name": "JoinMarket", "url": "https://xmr.club/mixers/joinmarket", "twin": "https://xmr.club/llm/mixers/joinmarket.txt", "tagline": "Decentralised BTC CoinJoin — earn yield as a maker, or pay to be a taker.", "review": "Older, more technical CoinJoin protocol. No central coordinator — makers run nodes and pass-through liquidity earning fees. Takers initiate joins and pay. Requires comfort with the command line.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted", "cli_supported" ], "highlight_tags": [ "BTC", "DECENTRALISED", "CLI" ], "fees": { "summary": "Maker fees vary (basis points) · BTC network fees" }, "fees_summary": "Maker fees vary (basis points) · BTC network fees", "last_verified": "2026-05-11", "operating_since": "2015", "tenure_note": "JoinMarket (Bitcoin CoinJoin tool) launched 2015 by Adam Gibson. github.com WHOIS 2007 is the host platform, not the project.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://github.com/JoinMarket-Org/joinmarket-clientserver", "outbound_slug": "joinmarket", "twitter": "https://x.com/joinmarket", "telegram": "https://t.me/joinmarketorg" }, "also_listed_at": { "web3privacy": true } }, { "id": "lightning-as-mixer", "category": "mixers", "subcategory": "Lightning Routing", "name": "Lightning Network", "url": "https://xmr.club/mixers/lightning-as-mixer", "twin": "https://xmr.club/llm/mixers/lightning-as-mixer.txt", "tagline": "Off-chain BTC payments break the on-chain heuristic trail.", "review": "Not a mixer in the protocol sense, but a working privacy primitive: payments inside the Lightning Network don't show up on the BTC blockchain. Onion routing inside LN approximates Tor for payments. Pair with a self-hosted node (Phoenix LSP / Zeus + your own LND) for the strongest setup.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "lightning_native", "self_hosted" ], "highlight_tags": [ "BTC", "LIGHTNING" ], "fees": { "summary": "Per-hop routing fees · ~sats" }, "fees_summary": "Per-hop routing fees · ~sats", "last_verified": "2026-05-11", "operating_since": "2015", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://lightning.network", "outbound_slug": "lightning-as-mixer" } }, { "id": "monero-itself", "category": "mixers", "subcategory": "Protocol-Level", "name": "Monero", "url": "https://xmr.club/mixers/monero-itself", "twin": "https://xmr.club/llm/mixers/monero-itself.txt", "tagline": "Every Monero transaction is private by default. No coin to mix; it's already mixed.", "review": "Monero is the cryptocurrency where **every transaction is private by default** — no opt-in, no toggle, no privacy mode. Ring signatures hide the sender, stealth addresses hide the receiver, RingCT hides the amount, and the dandelion++ network layer hides the originating IP from peer-level observers. Listed here in the **mixers** category at **Grade A · editor's pick** because the strongest answer to \"how do I mix coins?\" is \"use a chain where coins arrive pre-mixed\" — at which point most of the rest of this directory's options become optional for users willing to bridge in.\n\n**Background.** Monero launched in **April 2014** as a fork of Bytecoin, governed since by an open contributor community without a foundation or token-allocation insiders. The protocol has shipped consistent privacy upgrades on a roughly 6-month hard-fork cadence — RingCT, Bulletproofs, Bulletproofs+, Triptych, view tags, and the in-progress Seraphis / Carrot / FCMP++ next-generation transaction protocol. **No premine, no ICO, no developer fund** — the only special allocation is the community-crowdfunded CCS (Community Crowdfunding System) that pays full-time contributors for specific time-boxed work. Reference codebase at github.com/monero-project/monero. Tor onion mirror operator-published. Localised into 15+ languages on getmonero.org including English, Español, 简体中文, 繁體中文 臺灣, Italiano, Polski, Français, العربية, Русский, Deutsch, Nederlands, Português do Brasil, Türkçe, Norsk, ελληνική.\n\n**What you trust (the protocol, not an operator).** Monero is a protocol, not a company. There is no operator to compel for user data because there is no operator-held user data. **Ring signatures**: each transaction signs with the user's real key plus a set of decoy keys; an outside observer can't tell which one is the real signer — this hides the sender. **Stealth addresses**: every transaction sends to a one-time address derived from the recipient's public key + a per-transaction random scalar; nobody including a chain-watcher can link the recipient's published address to the on-chain output — this hides the receiver. **RingCT (Ring Confidential Transactions)**: amounts are hidden using Pedersen commitments + range proofs; an observer sees only that \"an amount\" moved, not how much. **Dandelion++**: the originating-node IP is obscured through a randomised stem/fluff routing pattern, making it harder to map transactions to network endpoints. The privacy properties are **structural and default** — you don't have to remember to turn anything on.\n\n**Operational specs.** Reference wallets: Monero GUI / CLI (official, from getmonero.org), Feather Wallet (community, listed separately), Cake Wallet / Monerujo for mobile (listed separately). Block time: ~2 minutes. Supply: emission curve with tail emission of 0.6 XMR/block after the main curve completes (≈2022 onward) — guarantees miner incentive in perpetuity without inflation tax above ~0.87% terminal. PoW: **RandomX** — CPU-optimised, ASIC-resistant, keeps mining accessible. Hard-fork cadence: roughly every 6 months, coordinated through the Monero Research Lab and the contributor community. CCS funding model: anyone can propose work; the community votes via crowdfunded XMR contributions. No corporate sponsor, no token reservation, no founder allocation.\n\n**Philosophy.** Monero's editorial differentiator is **privacy as the protocol-level default**, contrasted with the \"opt-in privacy\" model of zcash (shielded pools are optional and most volume is transparent), the \"post-hoc mixing\" model of Bitcoin (where mixing services try to add privacy after the fact and produce traceable \"mixer-touched\" coins that exchanges then refuse), and the \"hide the addresses with stealth\" model of stealth-payment add-ons on transparent chains. By making privacy mandatory at the consensus layer, Monero removes the **anonymity-set fragmentation** problem — every user contributes to every other user's anonymity set automatically. The trade-off: larger transactions (~2 KB vs Bitcoin's ~300 bytes typical), slower block validation, no compliance-friendly opt-in transparency for institutional adoption. Monero's design says those are acceptable costs for the privacy property.\n\n**Grade rationale.** Grade A and editor's pick reflect: 12 years of operational continuity (since April 2014); no premine, no ICO, no special allocation, no foundation-controlled treasury; open-source codebase with consistent privacy-research output from the Monero Research Lab; structural privacy properties (not opt-in); ASIC-resistant PoW that keeps mining decentralised; predictable hard-fork upgrade cadence; published research papers backing every major protocol change; CCS-funded development model that aligns contributor incentives with user value; tail emission that solves the \"what happens when emission ends\" problem most other cryptocurrencies dodge. Last verified 2026-05-11.\n\n**Useful when.** You want on-chain privacy and don't want to manage mixer mechanics, anonymity-set hopping, or the \"tainted coin\" risk that mixer-touched Bitcoin carries. You're a merchant accepting payments and don't want competitors / nation-states / random snoops watching your revenue. You're a journalist or activist whose financial activity should not be a public record. You want a hedge against the *informational* failure mode of transparent chains — Bitcoin / Ethereum / Solana addresses leak more than most users realise over time, and Monero is the structural fix. You want to hold a cryptocurrency that doesn't dox your net worth to anyone who knows one of your addresses.\n\n**Caveats.** **Exchange delistings**: Monero has been delisted from many centralised exchanges under regulatory pressure (Bittrex, Binance in some jurisdictions, several EU venues). On-ramping from fiat to XMR now usually requires the no-KYC swap route or P2P (see Trocador, Haveno, the kyc.rip aggregator, etc.). **Wallet sync is heavier than transparent chains** — Monero wallets scan every block looking for outputs they own; first-time sync from a freshly-installed wallet can take hours unless you use a remote node (which then sees your wallet's IP unless you route through Tor). **Privacy is protocol-level, not application-level** — Monero protects on-chain metadata, not \"you signed up for an exchange with your passport and bought XMR with it.\" If you on-ramp via KYC, your purchase is logged; only the *post-purchase* on-chain activity gains the Monero privacy properties. **Network-layer leaks are still possible** — running a wallet over a non-anonymised network reveals your IP to whichever node you connect to; use Tor or run your own node. **Statistical attacks on ring signatures** existed historically (e.g., the 2018 EAE-attack research); the protocol has shipped mitigations and continues to harden — but no privacy system is perfect, and Monero's caveat is that breakthrough cryptanalysis could in principle weaken the ring-signature anonymity set in retrospect. **Larger transaction size** means slightly higher fees and slower validation — usually not user-visible at retail scale but factor it in for high-frequency use.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A", "trust": "Not a service — the protocol itself, with no operator to trust or fail. Private by default at the consensus layer; the unpurchaseable baseline this shelf is measured against. Editor's pick.", "privacy": "Every transaction private by default: ring signatures hide the sender, stealth addresses the receiver, RingCT the amount, Dandelion++ the originating IP. No opt-in, no toggle — coins arrive pre-mixed.", "ux": "Nothing to 'use' as a mixer — hold and transact in XMR and privacy is automatic. Pair with a good wallet + node discipline." }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "xmr_native", "no_js_supported" ], "highlight_tags": [ "PROTOCOL-LEVEL", "XMR" ], "fees": { "summary": "Network fees only (~0.001 XMR / tx)" }, "fees_summary": "Network fees only (~0.001 XMR / tx)", "last_verified": "2026-05-11", "operating_since": "2014", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://www.getmonero.org", "tor": "http://monerotoruzizulg5ttgat2emf4d6fbmiea25detrmmy7erypseyteyd.onion", "outbound_slug": "monero-itself" }, "also_listed_at": { "web3privacy": true, "privacyguides": true } }, { "id": "privacy-pools", "category": "mixers", "subcategory": "Smart-Contract Mixer (multi-chain)", "name": "Privacy Pools", "url": "https://xmr.club/mixers/privacy-pools", "twin": "https://xmr.club/llm/mixers/privacy-pools.txt", "tagline": "Open-source, multi-chain privacy mixer (ETH/BNB/OP/ARB/Starknet) with operator-curated 'good actor' exclusion list.", "review": "Privacy Pools by 0xbow — multi-chain on-chain privacy mixer supporting Ethereum, BNB Chain, Optimism, Arbitrum, and Starknet. **Open source** at [`0xbow-io/privacy-pools-website`](https://github.com/0xbow-io/privacy-pools-website); whitepaper at `privacypools.com/whitepaper.pdf`; ToS at `docs.privacypools.com/toc`; privacy policy at `docs.privacypools.com/privacy-policy`.\n\n**What it is.** On-chain privacy pool, inferred from the page title 'Anonymous & Compliant Payments' (operator-published). **What you trust.** **KYC stance.** The published ToS at `docs.privacypools.com/toc` does not require identity verification at the protocol layer — Privacy Pools is a zk-membership-proof primitive, not a registration-gated service. The compliance dimension is upstream (0xbow's association-set curation, see Grade rationale). Payment surface: no operator-published token list found. The domain and title suggest Ethereum-based privacy pools (ETH/ERC-20), but this is inference, not source material. AML posture: Undisclosed — `/aml` returned a navigation error that prevented content retrieval. The phrase 'Compliant Payments' in the title suggests an AML-aware posture, but no operator-published policy text is accessible. Terms of service: Not accessible — `/terms`, `/terms-of-service`, `/tos`, `/legal/terms-of-service`, `/legal/terms`, and `/legal/tos` all returned 403. This is the single largest trust gap: a financial privacy tool with zero accessible legal terms is operating fully opaque to the public. Privacy policy: Published at `docs.privacypools.com/privacy-policy` (see links above). The privacypools.com SPA itself is Vercel-bot-walled, so the privacy doc lives on the docs subdomain — readers should bookmark that URL directly.\n\n**Operational specs.** Hosting: Vercel (all blocked pages return 'Vercel Security Checkpoint'. Vercel's serverless platform is the inferred deployment target. The bot-protection checkpoint is blocking typical crawler/hardened-browser traffic patterns. Pricing / fee structure: no operator-published fee schedule surfaced. Privacy pool fees are typically embedded in the smart contract (relayer fee + protocol fee). Check the contract on Etherscan. Coin coverage: page title references 'Payments', suggesting ETH or ERC-20 deposits. No operator-published asset list found. API surface: Not accessible — `/api` returned a navigation error. Tor mirror: None advertised — no onion-location header and no onion URL but a deliberate bot wall that prevents any automated trust assessment. The page title 'Anonymous & Compliant Payments' is the *only* operator-published signal in the entire probe — 5 words across a 39-path sweep. Grade C is the honest minimum until either (a) the operator whitelists a public audit or publishes accessible docs, or (b) a manual curator test trade confirms the service operates as advertised.\n\n**Caveats.** This is the most opaque listing in the directory's probe history: 36 blocked pages, 3 navigation errors, 0 successful fetches, 0 peer-directory matches, 0 contact channels, 0 legal pages. Every single conventional trust-assessment path is gated behind a Vercel Security Checkpoint that could not be cleared. The 'Anonymous & Compliant Payments' branding suggests a privacy tool that incorporates some form of compliance gating (association-set proofs, sanctioned-address filtering, or voluntary exclusion lists). This is a fundamentally different trust model than a pure no-KYC service — users are trusting the *correctness* of the compliance filter, not just the privacy mechanism. The contract source and filter logic are invisible to this review. The recommended `feature_tags` include `non_custodial` — this is likely correct for a smart-contract-based privacy pool,. Verify by reading the contract. Three paths (`/aml`, `/security`, `/api`) returned navigation errors rather than 403 — 'Unable to retrieve content because the page is navigating.' This suggests those routes trigger JavaScript-based redirects or SPA-style transitions that the audit publicly-observable footprint: wait_for_timeout heuristic could not follow. These may be the most interesting pages on the site.\n\n**Liquidity check (2026-05-30).** 21 deployed pools. Concentration heavy on Ethereum stablecoins — USDT pool leads (~$4.1M), USDC (~$1.5M), ETH (~$1.6M). Long-tail pools (wstETH, BOLD, frxUSD, WOETH, USDS, sUSDS, USD1, Arbitrum USDC + ETH) each under $70K — anonymity sets so small that each deposit is approximately self-identifying. Companion guide: [Privacy Pools vs Monero](/guides/privacy-pools-vs-monero).", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "smart_contract", "compliance_gated" ], "highlight_tags": [ "ETH", "MULTI-CHAIN", "OSS", "GATEKEPT" ], "fees": { "summary": "Embedded relayer + protocol fee on each pool — schedule not on homepage; check each chain's deployed pool contract." }, "fees_summary": "Embedded relayer + protocol fee on each pool — schedule not on homepage; check each chain's deployed pool contract.", "last_verified": "2026-06-07", "operating_since": "2025-02-17", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://privacypools.com", "outbound_slug": "privacy-pools", "docs": "https://docs.privacypools.com", "tos": "https://docs.privacypools.com/toc", "privacy": "https://docs.privacypools.com/privacy-policy", "whitepaper": "https://privacypools.com/whitepaper.pdf", "github": "https://github.com/0xbow-io/privacy-pools-website" }, "also_listed_at": { "web3privacy": true } }, { "id": "rotorswap", "category": "mixers", "subcategory": "BTC CoinJoin", "name": "Whirlpool successors", "url": "https://xmr.club/mixers/rotorswap", "twin": "https://xmr.club/llm/mixers/rotorswap.txt", "tagline": "Forks of Samourai's Whirlpool CoinJoin after the original was seized.", "review": "After Samourai Wallet's seizure in 2024, several community forks picked up Whirlpool's equal-output CoinJoin design. State of the art moves; check current recommendations on Privacy Guides before committing real funds.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source" ], "highlight_tags": [ "BTC", "EXPERIMENTAL" ], "fees": { "summary": "Coordinator-set, varies · BTC network fees" }, "fees_summary": "Coordinator-set, varies · BTC network fees", "last_verified": "2026-05-11", "operating_since": "2019", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://privacyguides.org", "outbound_slug": "rotorswap", "twitter": "https://x.com/privacy_guides", "matrix": "https://matrix.to/#/privacyguides:matrix.org" }, "also_listed_at": { "privacyguides": true } }, { "id": "wasabi-coinjoin", "category": "mixers", "subcategory": "BTC CoinJoin", "name": "Wasabi Wallet", "url": "https://xmr.club/mixers/wasabi-coinjoin", "twin": "https://xmr.club/llm/mixers/wasabi-coinjoin.txt", "tagline": "BTC CoinJoin built into the wallet. Coordinator-based, Tor-routed.", "review": "WabiSabi protocol — variable-size outputs, no minimum-denomination constraint that gave older CoinJoins their fingerprint. The wallet IS the coordinator UX; click a button, your coins enter the next mixing round.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "tor_mirror", "multisig_supported" ], "highlight_tags": [ "BTC", "COINJOIN" ], "fees": { "summary": "0.3% coordinator fee on mixed amount + BTC network fees" }, "fees_summary": "0.3% coordinator fee on mixed amount + BTC network fees", "last_verified": "2026-05-11", "operating_since": "2018", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2018", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://wasabiwallet.io", "outbound_slug": "wasabi-coinjoin", "twitter": "https://x.com/wasabiwallet", "telegram": "https://t.me/WasabiWallet" }, "also_listed_at": { "web3privacy": true } }, { "id": "anstee-dev-node", "category": "nodes", "subcategory": "Community / Operator-run", "name": "anstee.dev", "url": "https://xmr.club/nodes/anstee-dev-node", "twin": "https://xmr.club/llm/nodes/anstee-dev-node.txt", "tagline": "Independent public Monero node. TLS-only, port 18081.", "review": "Personal-operator node by anstee.dev. HTTPS-only — good for clients that refuse plain HTTP. Mainnet, no restricted-RPC flag advertised (assume open).", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial" ], "highlight_tags": [ "MAINNET", "TLS" ], "fees": { "summary": "Free · TLS" }, "fees_summary": "Free · TLS", "last_verified": "2026-05-13", "operating_since": "2020", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://anstee.dev", "outbound_slug": "anstee-dev-node" }, "also_listed_at": { "monerofail": true } }, { "id": "boldsuck-de-node", "category": "nodes", "subcategory": "Community / Operator-run", "name": "xmr-de-2.boldsuck.org", "url": "https://xmr.club/nodes/boldsuck-de-node", "twin": "https://xmr.club/llm/nodes/boldsuck-de-node.txt", "tagline": "Boldsuck-operated public node hosted in Germany. Long-standing community fixture.", "review": "One of the most-cited European public nodes. Run by Boldsuck (also operates the Boldsuck pool). Restricted-RPC mainnet, decent latency from EU. Featured in default node lists shipped with several wallets.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source" ], "highlight_tags": [ "MAINNET", "EU", "RESTRICTED-RPC" ], "fees": { "summary": "Free · restricted RPC · EU" }, "fees_summary": "Free · restricted RPC · EU", "last_verified": "2026-05-13", "operating_since": "2016", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://boldsuck.org", "outbound_slug": "boldsuck-de-node" } }, { "id": "cake-node", "category": "nodes", "subcategory": "Wallet-operator nodes", "name": "xmr-node.cakewallet.com", "url": "https://xmr.club/nodes/cake-node", "twin": "https://xmr.club/llm/nodes/cake-node.txt", "tagline": "Default Cake Wallet remote node. Operator-run by the Cake team.", "review": "This is the node millions of Cake Wallet users hit by default — which makes its uptime a real feature and its trust model worth understanding before you rely on it.\n\n**Background**\nxmr-node.cakewallet.com is the public Monero node Cake Wallet ships as its default. Mainnet, restricted-RPC, operated by the Cake team. Because every Cake user who hasn't switched providers routes through it, the operational pressure to stay up and performant is real — and it shows.\n\n**What you trust**\nA remote node sees your IP and the timing of your wallet's broadcasts/queries — never your keys, balances, or transaction details (Monero keeps those private at the node level). The key insight: if you already use Cake Wallet, you're **already** trusting the Cake team, so using their node adds no new party to your threat model. Cake's built-in Tor toggle blunts the IP exposure.\n\n**Operational specs**\nMainnet, restricted-RPC, high-availability at consumer-default scale. Reachable from any Monero wallet, not just Cake — usable as a reliable fallback node. Pairs naturally with Cake's Tor routing.\n\n**Philosophy**\nA sane, well-resourced default so the median user gets a working node without having to choose one — while keeping the door open to switch providers or self-host. It's infrastructure-as-convenience done responsibly.\n\n**Grade rationale**\nGrade A. A reliable, well-maintained default from a known operator, with adoption-driven uptime incentives. Coherent especially if Cake is already your wallet; graded as a remote node, with the usual self-hosting caveat.\n\n**Useful when**\nYou use Cake Wallet (it's already your default); you want a dependable fallback node; you need high uptime without running your own; you route over Tor and want a node that expects it.\n\n**Caveats**\nA remote node sees your IP + tx-broadcast timing — route over Tor (Cake's toggle makes this easy); your own node is strictly more private. You're trusting the Cake team's no-log posture, which is reputable but unverifiable externally. Single operator — keep a backup node configured so a outage doesn't strand you.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source" ], "highlight_tags": [ "MAINNET", "RESTRICTED-RPC", "DEFAULT" ], "fees": { "summary": "Free · restricted RPC" }, "fees_summary": "Free · restricted RPC", "last_verified": "2026-05-13", "operating_since": "2016", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://cakewallet.com", "outbound_slug": "cake-node", "contact_email": "support@cakewallet.com", "twitter": "https://x.com/cakewallet", "telegram": "https://t.me/cakewalletannouncements", "discord": "https://discord.gg/2vqYJdXG2H" }, "also_listed_at": { "web3privacy": true, "monerica": true } }, { "id": "fiatfaucet-node", "category": "nodes", "subcategory": "Wallet-operator nodes", "name": "kowalski.fiatfaucet.com", "url": "https://xmr.club/nodes/fiatfaucet-node", "twin": "https://xmr.club/llm/nodes/fiatfaucet-node.txt", "tagline": "FiatFaucet-operated public node. TLS, no port suffix needed.", "review": "Public node maintained by FiatFaucet. HTTPS, default port — accessible by light wallets that don't accept custom ports. Mainnet.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial" ], "highlight_tags": [ "MAINNET", "TLS" ], "fees": { "summary": "Free · TLS · default port" }, "fees_summary": "Free · TLS · default port", "last_verified": "2026-05-13", "operating_since": "2021", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://fiatfaucet.com", "outbound_slug": "fiatfaucet-node" } }, { "id": "hashvault-node", "category": "nodes", "subcategory": "Pool-affiliated", "name": "nodes.hashvault.pro", "url": "https://xmr.club/nodes/hashvault-node", "twin": "https://xmr.club/llm/nodes/hashvault-node.txt", "tagline": "HashVault mining-pool-operated public node. Many regional endpoints.", "review": "Operated by HashVault. Public node fronted by a regional pool architecture, so geo-distance routing is built in. Mainnet, restricted-RPC. Worth noting the operator is also a pool, so they have other revenue streams keeping the node alive.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source" ], "highlight_tags": [ "MAINNET", "RESTRICTED-RPC", "REGIONAL" ], "fees": { "summary": "Free · restricted RPC · regional endpoints" }, "fees_summary": "Free · restricted RPC · regional endpoints", "last_verified": "2026-05-13", "operating_since": "2017", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://hashvault.pro", "outbound_slug": "hashvault-node" } }, { "id": "litepay-node", "category": "nodes", "subcategory": "Wallet-operator nodes", "name": "xmr.litepay.ch", "url": "https://xmr.club/nodes/litepay-node", "twin": "https://xmr.club/llm/nodes/litepay-node.txt", "tagline": "LitePay Switzerland public node.", "review": "Run by LitePay.ch as part of their payment-rail infrastructure. Mainnet, restricted-RPC, Swiss-hosted. Operator has commercial incentive to keep it up.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial" ], "highlight_tags": [ "MAINNET", "EU", "RESTRICTED-RPC" ], "fees": { "summary": "Free · restricted RPC · CH" }, "fees_summary": "Free · restricted RPC · CH", "last_verified": "2026-05-13", "operating_since": "2019", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2019", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://litepay.ch", "outbound_slug": "litepay-node", "twitter": "https://x.com/litepay_ch", "telegram": "https://t.me/litepay_ch", "discord": "https://discord.gg/Za3j5Rb" } }, { "id": "majesticbank-node", "category": "nodes", "subcategory": "Wallet-operator nodes", "name": "node.xmr.party", "url": "https://xmr.club/nodes/majesticbank-node", "twin": "https://xmr.club/llm/nodes/majesticbank-node.txt", "tagline": "MyMonero / xmr.party-operated remote node.", "review": "Public node maintained by xmr.party. Mainnet, restricted-RPC, decent uptime. Reasonable fallback when the more famous community nodes are saturated.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial" ], "highlight_tags": [ "MAINNET", "RESTRICTED-RPC" ], "fees": { "summary": "Free · restricted RPC" }, "fees_summary": "Free · restricted RPC", "last_verified": "2026-05-13", "operating_since": "2018", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2018", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmr.party", "outbound_slug": "majesticbank-node" } }, { "id": "mnr-network", "category": "nodes", "subcategory": "Verified RPC network", "name": "mnr.network", "url": "https://xmr.club/nodes/mnr-network", "twin": "https://xmr.club/llm/nodes/mnr-network.txt", "tagline": "Verified RPC network for Monero — a proxy that cryptographically checks every upstream node's answer, pays-as-you-go in XMR, no email, no KYC, no request logs. Currently in beta.", "review": "**A remote node that proves it isn't lying to you.** mnr.network is a *verified RPC network*: you point a wallet, explorer, or app at it, and instead of trusting one anonymous remote node, mnr fans your call out across many public Monero nodes, **recomputes the hashes, links the headers, and compares consensus state**, then marks each answer verified or not. A wrong answer gets the offending upstream *ejected for 24h and logged publicly*. That closes the oldest trust hole in using someone else's node — you no longer take the response on faith.\n\n**Privacy posture is unusually clean.** *\"A token is the whole relationship — free, or paid in XMR. No email, no KYC, and no request logs.\"* The token rides in the URL path and they state they never log the path or your address. Tor is first-class (Orbot/NetCipher, SOCKS5, port-443 auto-SSL). The usual remote-node caveat still applies — you are routing your view of the chain through a third party, and no-log is a policy claim you can't cryptographically prove — but the verification layer plus XMR-payable, no-KYC access put it well ahead of a bare public node.\n\n**A good citizen toward the node network.** mnr rate-limits *itself* against the public nodes it uses (≤5 req/s, ≤2 wallet-sync streams each), identifies every request, sends overflow to its own node, and lets any operator opt out via a `/.well-known/mnr-optout` file with removal in 24h. Every upstream and every caught wrong answer is listed publicly. That ethic is rare in this corner.\n\n**Full disclosure — this is first-party.** We built and operate mnr, so we flag it plainly rather than dress it up as independent, and grade it by the same rubric as everything else. Our own block explorer (explorer.xmr.club) runs on it in production — reliable, sub-second-to-1.5s calls, 60 parallel requests without throttling — which is where the reliability read comes from. It lands at **B**, not A, purely on maturity: it's **brand-new and still in beta** (no track record, protocol at 'Stage 2'). A clean GA exit plus tenure moves it up.", "translation_locale": "en", "rating": { "grade": "B", "trust": "Verified proxy: recomputes hashes, links headers, compares 5/5 upstream consensus, ejects wrong-answering nodes for 24h and logs it publicly. Publishes every upstream + every caught error. No custody (RPC relay). Capped below A by beta maturity, brand-new tenure, and single-commercial-relay centralization. First-party: built and operated by the xmr.club curator team; graded on the same rubric as every listing (see /transparency).", "privacy": "Strong: token-only access (free or paid in XMR), no email, no KYC, states it never logs the request path or your address. Tor first-class (Orbot/NetCipher, SOCKS5, 443 auto-SSL). Residual caveat inherent to any remote node: you route your chain view through a third party and no-log is an unprovable policy claim.", "ux": "Point-a-wallet/app simplicity; Simple + Advanced remote-node modes, monero-wallet-rpc, bulk get_blocks sync, per-method verification labels (Mnr-Verify). Metered by Work Units with a free tier; Pro tiers for higher throughput." }, "grade": "B", "kyc_tags": [ "NO-KYC" ], "feature_tags": [ "xmr", "no_kyc", "no_log", "verifiable", "tor", "rpc", "node", "first_party" ], "highlight_tags": [ "XMR", "NO-KYC", "NO-LOG", "VERIFIED", "TOR", "FIRST-PARTY" ], "fees": null, "fees_summary": null, "last_verified": "2026-09-07", "operating_since": "2026", "tenure_note": "Brand-new domain (beta, 2026; no Wayback history), protocol self-described at 'Stage 2'. Graded B on the lenient no-custody node curve — verifiability + no-log + no-KYC + XMR + ethical node-citizenship earn B over B- even in beta; A held for a GA exit + tenure. First-party: built + operated by the xmr.club curator team; graded on the same rubric as every listing.", "locales_available": null, "first_party": true, "editors_pick": false, "links": { "web": "https://mnr.network", "outbound_slug": "mnr-network", "tor": "http://mnrrpcvbopaykx7um32r4iyamontteidypjd33fhzvuy2hwfu5c4ifad.onion", "i2p": "http://mnr.i2p", "twitter": "https://x.com/mnr_network", "email": "mailto:dev@mnr.network", "i2p_canonical": "http://misxlqjfq3wshjbn47fhzaqiagavaow2mgbfqrvxzdlybm7xtbvq.b32.i2p" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "monero-ceo", "category": "nodes", "subcategory": "Community / Operator-run", "name": "Monero.ceo", "url": "https://xmr.club/nodes/monero-ceo", "twin": "https://xmr.club/llm/nodes/monero-ceo.txt", "tagline": "Community-run public Monero node — point any wallet at monero.ceo:18089 (SSL), no signup. Verified fully-synced mainnet, restricted RPC; operator says monerod + web logs disabled. Listed on Monerica. Pair with Tor for anything sensitive.", "review": "**A community-run public Monero node.** monero.ceo is an open remote node — point any wallet at `monero.ceo:18089` (SSL) and it just works. Verified live: fully-synced mainnet, **restricted RPC** (the correct, safe config for a public node — it limits what remote wallets can query). The operator (@tallhatdoug, an established Monero-community advocate) states that both monerod and web-server logs are disabled, and anyone can connect.\n\n**Why it's listed at B-.** Public nodes are a different risk class from the rest of the directory: they hold no funds, so there's no exit-scam vector, and they're run non-commercially as community infrastructure. On this shelf we grade the things that actually matter for a node — correct config, operator standing, independent corroboration — not the funds-tenure strictness we apply to exchanges. On those axes it does well: verified restricted + synced, a reputable community operator, and it's **independently listed on Monerica** (added Aug 2026). The domain dates to September 2025; the node has been publicly running since ~July 2026.\n\n**The honest caveats (why B-, not higher).** The no-logs claim is exactly that — a claim. No public node can prove a negative from the outside, so treat any remote node as *potentially* able to see your IP and the transactions you query, and use Tor (or your own node) when it matters. Public node operation is only ~a month old, so there's no long uptime/reliability record yet, and we didn't find a Tor/onion mirror. A few months of clean uptime plus an onion would be a straightforward lift toward B.\n\n**Useful when.** You want a fast, no-signup remote node to sync a wallet without running your own — paired with Tor for anything sensitive. That's the right way to use any public node, this one included.", "translation_locale": "en", "rating": { "grade": "B-", "trust": "Community-run public Monero node. Verified live: fully-synced mainnet, restricted RPC (correct public-node config), SSL. Operator @tallhatdoug (established Monero-community advocate). Independently listed on Monerica (added 2026-08). Domain since 2025-09; public node operation since ~2026-07. Non-commercial — no funds held, no scam vector.", "privacy": "Operator states monerod + web-server logs disabled; open to anyone. Unverifiable from outside — assume any public node could see your IP + queried txs; use Tor for sensitive syncs. No onion mirror found.", "ux": "Point a wallet at monero.ceo:18089 (SSL) — no signup. Restricted RPC, fully-synced mainnet." }, "grade": "B-", "kyc_tags": [ "anonymous_signup", "no_kyc" ], "feature_tags": [ "non_custodial", "restricted_rpc", "logs_disabled", "ssl" ], "highlight_tags": [ "MAINNET", "NO-LOGS", "RESTRICTED-RPC", "COMMUNITY-RUN" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-28", "operating_since": "2025-09", "tenure_note": "Domain founded ~2025-09; node publicly announced/operating since ~2026-07-30; listed on Monerica 2026-08-02. ~1 month public uptime at listing. Node RPC: monero.ceo:18089 (SSL).", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://monero.ceo", "outbound_slug": "monero-ceo" } }, { "id": "monero-one-node", "category": "nodes", "subcategory": "Community / Operator-run", "name": "monero.one", "url": "https://xmr.club/nodes/monero-one-node", "twin": "https://xmr.club/llm/nodes/monero-one-node.txt", "tagline": "Public node by Joe (monero.one). Pairs with the Monero.one mobile wallet listed under /wallets.", "review": "monero.one is the public remote node run by Joe, the operator behind the **Monero.one** mobile wallet, and it ships as that wallet's default endpoint. That single fact is the whole trust thesis: this isn't an anonymous box someone spun up and forgot — it's infrastructure whose uptime and behaviour directly shape the experience of every Monero.one user, so the operator has a standing, self-interested reason to keep it fast, honest, and current with network upgrades. A node you can tie to a named wallet project is categorically more accountable than one you can't tie to anyone.\n\n**What you trust when you point a wallet at it.** A Monero remote node is *not* a custodian and never sees your keys, your spend secrets, or your balances. Your wallet downloads blocks and scans them for your outputs locally; the node's job is to serve block data, relay the transactions you broadcast, and answer restricted RPC calls. What a remote node *can* observe is your IP address (unless you reach it over Tor), the rough timing of when your wallet syncs and broadcasts, and the fact that *some* wallet is talking to it. It cannot see which outputs are yours, how much you hold, or who you pay. The realistic threat model for any public node is therefore network-level metadata (IP ↔ broadcast-timing correlation), not theft — and that threat collapses to near-zero when you connect through the node's onion service.\n\n**Operational specs.** Mainnet, restricted-RPC (the node only exposes the wallet-facing methods and blocks the dangerous/administrative calls a full-RPC endpoint would leak), and a dual Tor endpoint alongside the clearnet host. The restricted-RPC posture matters: it means the operator has deliberately narrowed the surface to what wallets actually need, which is the correct configuration for a node meant to serve strangers. The Tor endpoints let privacy-conscious users skip the IP-exposure problem entirely. Because the node is the Monero.one wallet default, it is sized and maintained for real production load rather than hobby traffic.\n\n**Philosophy.** Public nodes are the connective tissue that lets people use Monero without each running a multi-hundred-gigabyte daemon. The healthiest version of that model is *known operators running nodes for their own users* — incentive-aligned, identifiable, and replaceable. monero.one sits squarely in that camp. It is the antithesis of the \"random high-uptime node from a scanner list\" pattern, where you have no idea who is logging your connections or why.\n\n**Grade rationale.** Grade A reflects the combination of a named, reputable operator, a wallet project that depends on the node working correctly, restricted-RPC hardening, and Tor availability — the four things that separate a node you can responsibly recommend from one you can only tolerate. It is not graded higher than A because, like every remote node, it asks you to trust someone else's infrastructure with your connection metadata; the only way to remove that trust entirely is to run your own node, which remains the gold standard.\n\n**Useful when** you want a sane, accountable default without provisioning your own daemon: new Monero users, mobile users on Monero.one (where it's already wired in), anyone who wants a known-operator clearnet+Tor endpoint they can also point a desktop wallet at, and people bootstrapping a wallet while their own node finishes its initial sync.\n\n**Caveats.** A remote node still sees your IP and broadcast timing unless you connect over Tor — so if metadata privacy is the goal, use the onion endpoint, not the clearnet one. Public nodes can go down, fall behind on upgrades around hard-fork dates, or get overloaded; keep a second known node configured as a fallback. And for maximum privacy and zero third-party trust, running your own node is always strictly better — a public node like this one is the pragmatic convenience tier, not the paranoid tier.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "tor_supported" ], "highlight_tags": [ "MAINNET", "TOR", "RESTRICTED-RPC" ], "fees": { "summary": "Free · restricted RPC · Tor" }, "fees_summary": "Free · restricted RPC · Tor", "last_verified": "2026-05-13", "operating_since": "2018", "tenure_note": "monero.one community node infra — domain re-registered 2025, prior archive.org snapshots from 2018", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://node.monero.one", "tor": "http://zu3oyzi45x3ul24sncs4245nlpz76jzizm36tvrkfvq2r33azzjv5syd.onion:18089", "outbound_slug": "monero-one-node" } }, { "id": "monerodevs-node", "category": "nodes", "subcategory": "Community / Operator-run", "name": "node.monerodevs.org", "url": "https://xmr.club/nodes/monerodevs-node", "twin": "https://xmr.club/llm/nodes/monerodevs-node.txt", "tagline": "Run by core Monero developers. Useful for testing dev branches against a known-good node.", "review": "A public Monero node run by the people who write Monero is about as close to a \"reference\" remote node as the ecosystem offers — and uniquely, it exposes the test networks most public nodes don't.\n\n**Background**\nnode.monerodevs.org is operated by core Monero developers (the group around monerodevs.org). Beyond mainnet, it serves **testnet and stagenet** endpoints separately — the development networks wallet and tooling authors need but rarely get from a public node.\n\n**What you trust**\nA remote node can see your IP address and the timing of the transactions your wallet broadcasts/queries — it can **not** see your keys, spend your funds, or decrypt amounts and recipients (Monero's privacy holds at the node level). Here the operator is the core-dev community, so reputational alignment is unusually high; route over Tor to blunt the IP/metadata exposure.\n\n**Operational specs**\nMainnet + testnet + stagenet endpoints (check their docs for the right one for your network — they're distinct). Restricted-RPC. Ideal for testing dev branches, new wallets, or integrations against a known-good, well-maintained reference node.\n\n**Philosophy**\nA trustworthy default for users and a known-good reference for developers, run by people as close to the protocol as it gets. It treats the test networks as first-class, which is exactly what the builder community needs.\n\n**Grade rationale**\nGrade A. High-trust operator, rare mainnet+testnet+stagenet coverage, and genuine dev utility. Graded as a remote node with the standing caveat that any remote node is a metadata trade-off versus your own.\n\n**Useful when**\nYou're developing or testing against testnet/stagenet; you want a high-trust default node; you need a known-good reference to debug your own node or wallet against.\n\n**Caveats**\nStill a remote node — it sees your IP + broadcast timing, so connect over Tor and treat your own node as the more-private end goal. Pick the correct network endpoint (mainnet vs test/stagenet) or your wallet won't sync. It's a dev-oriented service, not a hand-holding consumer product.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source" ], "highlight_tags": [ "MAINNET", "TESTNET", "STAGENET" ], "fees": { "summary": "Free · multi-nettype" }, "fees_summary": "Free · multi-nettype", "last_verified": "2026-05-13", "operating_since": "2021", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://monerodevs.org", "outbound_slug": "monerodevs-node" } }, { "id": "monerujo-node", "category": "nodes", "subcategory": "Wallet-operator nodes", "name": "nodex.monerujo.io", "url": "https://xmr.club/nodes/monerujo-node", "twin": "https://xmr.club/llm/nodes/monerujo-node.txt", "tagline": "Monerujo wallet's public node. Android-first community.", "review": "nodex.monerujo.io is the public remote node operated by the **Monerujo** team — the people behind the long-running, open-source Monerujo Android wallet — and it serves as that wallet's default endpoint. As with any wallet-default node, the incentive structure is the headline: the quality of service you get from this node is the same quality of service every Monerujo user gets, so the operator is structurally motivated to keep it healthy, synced through hard forks, and responsive. A node tied to a named, reputable wallet project with years of track record is about as accountable as a remote node gets without you running it yourself.\n\n**What you trust when you connect.** A Monero remote node never holds funds and never sees your keys. Your wallet pulls blocks and scans for your outputs locally; the node relays your broadcast transactions and answers restricted RPC. What it *can* observe is your IP (unless you arrive over Tor), your sync/broadcast timing, and the bare fact that a wallet is connected — not your amounts, addresses, or counterparties. So the honest risk of using *any* public node is connection-metadata correlation, not custody risk. That residual risk is what Tor exists to neutralise.\n\n**Operational specs.** Public, restricted-RPC, mainnet. Restricted RPC means the node only exposes the methods wallets legitimately need and blocks administrative/full-RPC calls — the correct hardening for an endpoint open to the public. Being the Monerujo wallet default, it is provisioned for real production traffic from a large installed base rather than occasional hobby use, which in practice translates to stable availability and prompt upgrades around network forks (a wallet that ships a broken default node breaks for all its users, so this rarely lingers).\n\n**Philosophy.** Monerujo has been a fixture of the Monero ecosystem for years — open-source, privacy-first, and community-trusted. Running a public default node is the natural extension of that: it lets people use the wallet immediately without each spinning up a daemon, while keeping the default in the hands of an identifiable, incentive-aligned operator rather than a stranger from a node-scanner list. This \"known operator runs a node for its own users\" model is the healthiest shape of Monero's remote-node ecosystem.\n\n**Grade rationale.** Grade A reflects the reputable, long-tenured operator, the direct wallet-default incentive to keep service quality high, restricted-RPC hardening, and the open-source community trust Monerujo has earned. It is not above A because it is still a remote node: you are trusting someone else's box with your connection metadata, and only running your own node removes that trust entirely.\n\n**Useful when** you want a dependable, accountable default: Monerujo users (it's already wired in), people who want a known-operator endpoint they can also point a desktop wallet at, and anyone bootstrapping a wallet before their own node has finished syncing.\n\n**Caveats.** Without Tor, the node sees your IP and broadcast timing — connect over the onion path if metadata privacy matters. Confirm the current onion/clearnet host from Monerujo's own channels rather than third-party lists, since endpoints can rotate. Keep a fallback node configured in case of downtime or fork-day lag. And as always, running your own node is strictly more private and trust-minimised than relying on any public one — this is the convenience tier done right, not a replacement for self-hosting.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source" ], "highlight_tags": [ "MAINNET", "RESTRICTED-RPC" ], "fees": { "summary": "Free · restricted RPC" }, "fees_summary": "Free · restricted RPC", "last_verified": "2026-05-13", "operating_since": "2018", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2018", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://monerujo.io", "outbound_slug": "monerujo-node", "contact_email": "help@monerujo.io", "twitter": "https://x.com/monerujowallet" }, "also_listed_at": { "web3privacy": true } }, { "id": "plowsof-node", "category": "nodes", "subcategory": "Community / Operator-run", "name": "Plowsof public nodes", "url": "https://xmr.club/nodes/plowsof-node", "twin": "https://xmr.club/llm/nodes/plowsof-node.txt", "tagline": "Plowsof — long-time Monero contributor. Three Tor + clearnet endpoints, no JS required.", "review": "Plowsof public nodes are run by **plowsof**, one of the most recognisable contributors in the Monero project — active in CCS (Community Crowdfunding System) coordination, Matrix/IRC community moderation, and day-to-day project plumbing for years. That reputation is the entire point: a remote node is only as trustworthy as the person operating it, and plowsof is about as known a quantity as the Monero community produces. When Ripley Terminal and other tools ship plowsof's nodes as defaults, they're trading on exactly that track record.\n\n**What you trust when you connect.** Like every Monero remote node, plowsof's nodes are non-custodial and key-blind. Your wallet downloads and scans blocks locally; the node serves block data, relays your broadcasts, and answers restricted RPC. It can observe your IP (absent Tor), your sync/broadcast timing, and that a wallet is connected — never your balances, addresses, or payments. The meaningful risk of public-node use is therefore metadata correlation at the network layer, not theft, and that risk is what the onion endpoints are there to remove.\n\n**Operational specs.** Three Tor (v3 onion) endpoints plus a clearnet host, mainnet. Running *three* separate onion endpoints is notable — it provides redundancy and load distribution for Tor users specifically, who are otherwise often funnelled onto a single fragile hidden service. The multi-endpoint Tor footprint signals an operator who takes privacy-path availability seriously rather than treating onion access as an afterthought. The clearnet host covers users who don't need Tor and want the lowest-latency path.\n\n**Philosophy.** plowsof's node operation is community infrastructure in the most literal sense: years of uptime offered to strangers by a contributor whose name and reputation are publicly attached to the Monero project. This is the strongest version of the \"known operator\" model — not a wallet company serving its own users (though that's also healthy), but a project veteran running nodes as a public good. The years-long track record is doing real work here: longevity is one of the few signals that's genuinely hard to fake.\n\n**Grade rationale.** Grade A reflects the exceptionally well-known, long-tenured operator, the unusually strong Tor footprint (three onion endpoints + clearnet), and third-party tools' willingness to ship these nodes as defaults — a downstream vote of confidence. It sits at A rather than higher for the universal reason: it is still a remote node, so you trust plowsof's boxes with your connection metadata, and only self-hosting removes that trust.\n\n**Useful when** you want a reputable, privacy-forward default with strong Tor availability: privacy-conscious users who live on onion routing, Ripley Terminal users (where it's a default), anyone who wants redundancy across multiple Tor endpoints, and people who weight operator reputation and longevity heavily when choosing whom to trust with their connection.\n\n**Caveats.** Use the onion endpoints if metadata privacy is the goal — clearnet still exposes your IP and broadcast timing. Pull current addresses from plowsof's own postings or trusted tooling rather than stale scanner lists, since endpoints can change. Keep a second node configured for fork-day lag or downtime. And the standing rule holds: your own node is always more private than any public one — plowsof's nodes are a best-in-class convenience tier, not a substitute for self-hosting if your threat model demands zero third-party trust.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "tor_supported" ], "highlight_tags": [ "MAINNET", "TOR", "COMMUNITY" ], "fees": { "summary": "Free · Tor + clearnet · multi-endpoint" }, "fees_summary": "Free · Tor + clearnet · multi-endpoint", "last_verified": "2026-05-13", "operating_since": "2022", "tenure_note": "Community remote node operator — first archive.org / Github visibility 2022. Hand-set by curator.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://plowsof.com", "tor": "http://plowsof3t5hogddwabaeiyrno25efmzfxyro2vligremt7sxpsclfaid.onion:18089", "outbound_slug": "plowsof-node" } }, { "id": "richfowler-node", "category": "nodes", "subcategory": "Community / Operator-run", "name": "node.richfowler.net", "url": "https://xmr.club/nodes/richfowler-node", "twin": "https://xmr.club/llm/nodes/richfowler-node.txt", "tagline": "Rich Fowler-operated public node. Long-running community fixture.", "review": "Personal-operator public node by Rich Fowler. Mainnet, port 18089 (default unrestricted RPC); check the operator's blog for current posture before relying on it.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial" ], "highlight_tags": [ "MAINNET" ], "fees": { "summary": "Free · mainnet" }, "fees_summary": "Free · mainnet", "last_verified": "2026-05-13", "operating_since": "2022", "tenure_note": "WHOIS 2022 predates archive.org first snapshot 2014; treated as current-entity year (domain may have been re-registered)", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://richfowler.net", "outbound_slug": "richfowler-node" } }, { "id": "rino-community", "category": "nodes", "subcategory": "Community / Operator-run", "name": "node.community.rino.io", "url": "https://xmr.club/nodes/rino-community", "twin": "https://xmr.club/llm/nodes/rino-community.txt", "tagline": "Rino-operated public Monero node. Long-standing, ZeroMQ + RPC, clearnet + Tor + I2P endpoints.", "review": "RINO has quietly run public Monero nodes for years, and because its own multisig product depends on them, its uptime incentives are unusually well-aligned with yours.\n\n**Background**\nnode.community.rino.io is operated by RINO, the team behind the RINO enterprise/multisig Monero wallet. Long-standing and restricted-RPC, it exposes clearnet, Tor, and I2P endpoints plus ZeroMQ — broader transport coverage than most public nodes offer.\n\n**What you trust**\nA remote node can see your IP and the timing of your wallet's broadcasts/queries — never your keys, balances, or transaction details (Monero's privacy holds at the node level). RINO is among the more transparent operators, and critically its own multisig-coordination service runs on the same node, so the incentive to keep it up and honest is structural rather than mere goodwill. Route over Tor or I2P to blunt the IP/metadata exposure.\n\n**Operational specs**\nRestricted-RPC; clearnet + Tor + I2P endpoints; ZeroMQ + RPC; standard wallet flows including multisig. The multi-transport reach makes it a flexible fit for privacy-routed clients.\n\n**Philosophy**\nDependable shared infrastructure from an operator whose business literally depends on it staying reliable — alignment by design, not by promise.\n\n**Grade rationale**\nGrade A. Transparent, long-running, multi-transport (Tor + I2P), with structurally-aligned uptime. Graded as a remote node, with the standing caveat that any remote node is a metadata trade-off versus your own.\n\n**Useful when**\nYou want a long-proven public node reachable over Tor + I2P; you value an operator with genuine skin in the game; you run multisig; you need a reliable fallback node.\n\n**Caveats**\nA remote node sees your IP + broadcast timing — connect over Tor/I2P, and treat your own node as the more-private end goal. You're trusting RINO's no-log posture, which is reputable but unverifiable from outside. Single operator: keep a backup node configured. For a privacy-first setup, point a Tor- or I2P-capable wallet at the matching endpoint rather than the clearnet one — the multi-transport coverage is the whole reason to prefer this node over a clearnet-only default.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "tor_supported" ], "highlight_tags": [ "MAINNET", "RESTRICTED-RPC", "TLS" ], "fees": { "summary": "Free · restricted RPC · TLS" }, "fees_summary": "Free · restricted RPC · TLS", "last_verified": "2026-05-13", "operating_since": "2022", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2022", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://community.rino.io", "outbound_slug": "rino-community" } }, { "id": "rucknium-node", "category": "nodes", "subcategory": "Community / Operator-run", "name": "Rucknium research node", "url": "https://xmr.club/nodes/rucknium-node", "twin": "https://xmr.club/llm/nodes/rucknium-node.txt", "tagline": "Public node by Rucknium, Monero Research Lab. Mainnet, Tor + clearnet.", "review": "There's a particular reassurance in using a node run by the person who spends his time empirically measuring how private Monero actually is.\n\n**Background**\nRucknium is a core Monero Research Lab (MRL) contributor, known for rigorous empirical analysis of chain heuristics and the statistical privacy of the network. node.rucknium (mainnet, Tor + clearnet) sits alongside that research output as a community service.\n\n**What you trust**\nA remote node sees your IP and your wallet's broadcast/query timing — never your keys, amounts, or recipients (Monero keeps those private at the node level). Here the operator is a working MRL researcher whose entire body of public work is about understanding and strengthening Monero's privacy — a reputational alignment that is hard to beat. Route over Tor to blunt the IP exposure.\n\n**Operational specs**\nMainnet; Tor + clearnet endpoints; standard restricted-RPC wallet flows. A straightforward, well-run community node from a known, accountable individual.\n\n**Philosophy**\nInfrastructure offered by someone who studies the network's privacy properties for a living — the node and a substantial public research record come from the same hands, which is about as good as third-party node trust gets.\n\n**Grade rationale**\nGrade A. High-trust, research-aligned operator with a Tor-reachable endpoint. Graded as a remote node, with the usual caveat that self-hosting is strictly more private.\n\n**Useful when**\nYou want a high-trust default node from an MRL researcher; you want a Tor-reachable endpoint; you need a dependable fallback while you set up your own.\n\n**Caveats**\nStill a remote node — it sees your IP + broadcast timing, so connect over Tor and treat your own node as the goal. It's a single-operator community node, so uptime depends on one person's resources — keep a backup configured. As always, the \"no logs\" posture is a reputable but externally-unverifiable assumption. For the most benefit, reach it over Tor from a wallet you control, and treat it as a trustworthy stepping stone toward running your own node once your setup is validated.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "tor_supported" ], "highlight_tags": [ "MAINNET", "TOR", "MRL" ], "fees": { "summary": "Free · Tor + clearnet" }, "fees_summary": "Free · Tor + clearnet", "last_verified": "2026-05-13", "operating_since": "2022", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2022", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://rucknium.me", "outbound_slug": "rucknium-node", "tor": "http://ruckniume3m7dvpnjxfn6rrkgsc66yretfq6nbzh5ewjzd6r57csqhqd.onion" } }, { "id": "self-hosted-node", "category": "nodes", "subcategory": "Roll-your-own", "name": "Self-hosted (run your own)", "url": "https://xmr.club/nodes/self-hosted-node", "twin": "https://xmr.club/llm/nodes/self-hosted-node.txt", "tagline": "The reference setup. Five minutes on any VPS or home server; trustless wallet operation.", "review": "Self-hosted node is the structural answer that obsoletes the rest of the nodes directory — run your own `monerod` and the entire question of \"which remote-node operator should I trust?\" disappears. Listed at **Grade A · editor's pick** because the privacy property a remote node can give you is \"trust the operator not to log + correlate\"; the privacy property a self-hosted node gives you is \"there is no operator.\" Five minutes of setup on any reasonable VPS or home server, ~24 hours of initial chain sync (or 30 minutes with bootstrap), and you're operating Monero with zero node-operator trust assumptions.\n\n**Background.** `monerod` is the reference Monero daemon, maintained as part of the official Monero project codebase at github.com/monero-project/monero. The same software that powers every public node — Cake's nodes, Feather's nodes, the monero.fail-listed community nodes — is the software you run on your own hardware. There is no \"self-hosted edition\" vs \"public edition\"; they are bit-identical binaries. Documentation lives at docs.getmonero.org/running-node/, with extensive community guides covering Raspberry Pi setups, VPS deployments, Tor/I2P hidden-service configurations, and pruned-vs-archival node decisions.\n\n**What you trust.** **You trust your own infrastructure** — the hardware you run on, the network you connect through, the operator that you yourself are. **What you don't trust**: no public-node operator sees your wallet's queries, no remote infrastructure observes which addresses you care about, no third-party \"easy mode\" service can be compelled to disclose your activity. The trust circle shrinks to: monerod's code (open source, reviewable, multiple-Cure53-audit history at the Monero protocol level), your hardware (your responsibility), your wallet client (your choice — Feather, Monerujo, Cake Wallet, the official Monero GUI). For users who want the **maximum-trust-minimisation posture** in the Monero ecosystem, this is the answer.\n\n**Operational specs.** **Hardware floor**: 4 GB RAM, 100-150 GB disk for pruned node (~half-size archive of the chain), ~500 GB for full archival node. Any modest VPS, Raspberry Pi 4/5, mini-PC, or NUC suffices. **Initial sync**: ~24 hours from genesis on consumer hardware over a reasonable internet connection; **bootstrap** (fast-sync from a trusted source) reduces this to ~30 minutes if you accept a higher initial trust assumption (verify chain integrity post-bootstrap to recover that trust). **Network**: clearnet, Tor hidden service, or I2P — `monerod` supports all three transports natively. Tor hidden-service setup is documented and straightforward. **Configuration**: a 10-line `monerod.conf` covers the typical setup; advanced configurations for restricted RPC, public sharing, P2P-bandwidth tuning are documented but optional. **Wallet pairing**: any Monero wallet that accepts a remote node URL can be pointed at your self-hosted instance via SSH tunnel (`ssh -L 18081:localhost:18081 your-server`) or directly if the node is exposed on a Tor hidden service.\n\n**Philosophy.** Self-hosting's editorial differentiator is the **\"no operator in the trust circle\"** architecture. Every other entry in the nodes section of this directory is structurally `[wallet] → [some operator's node] → [Monero network]` — the operator is a real third party with real observability of the wallet's queries (timing, originating IP unless Tor-routed, which addresses the wallet cares about). Self-hosting collapses that to `[wallet] → [your monerod] → [Monero network]` — the only \"operator\" is you. The trade-off: operational responsibility moves to you. The chain syncs need to complete; the daemon needs to stay up; the hardware needs to be functional; the security of the host machine matters because it now holds your wallet's RPC endpoint. The classic Monero-community framing is right: \"if you're not running your own node, you're running someone else's node\" — and that someone else has visibility you can decline to grant by running your own.\n\n**Grade rationale.** Grade A and editor's pick reflect: structural elimination of node-operator trust (the only credible answer to \"what's the strongest privacy posture for remote-node use?\"); reference Monero project software (no third-party fork, no separate codebase); modest hardware requirements (commodity VPS or Raspberry Pi suffices); native Tor + I2P transport support; documented Tor hidden-service path; pair-with-any-Monero-wallet flexibility (Feather, Monerujo, Cake, Monero GUI); open-source codebase with multiple security audits at the protocol layer; consistent recommendation in every privacy + Monero infrastructure guide. Last verified 2026-05-13.\n\n**Useful when.** You're using Monero for anything beyond casual amounts and the threat model includes \"operator observability of address queries.\" You're a journalist / lawyer / researcher / merchant whose wallet activity should not be visible to a third-party node operator. You're already running a homelab and adding `monerod` is a small marginal commitment. You want to *contribute* to the Monero network's distributed-node ecosystem by running a public node that others can use (optional — your node can be private-only). You want to verify that the public Monero infrastructure you previously relied on was telling you the truth (run your own node, compare its view of the chain to what the remote nodes returned). You're operating from a region where remote-node access might be unreliable and want sovereign control over your wallet connectivity.\n\n**Caveats.** **Initial sync takes hours-to-a-day** — for users who need a Monero wallet *right now*, start with a remote node and migrate to self-hosted in the background. **Bandwidth + storage are ongoing commitments** — 500 GB disk for archival is permanent storage; ~5-50 GB/day of network traffic depending on P2P-sharing config. Pruning to ~150 GB disk + restricted RPC reduces the footprint but still meaningful for a small VPS. **Security of the host machine matters** — your `monerod` instance is exposed via RPC on (typically) port 18081; if the host is compromised, the wallet's view of the chain can be tampered with. SSH-tunnel-only access + firewall everything else is the standard hardening. **No background-sync magic** — if you turn off your node for two weeks, it'll need to catch up on those two weeks of blocks before your wallet can transact. **Tor-hidden-service requires correct setup** — running `monerod` over Tor + I2P is documented but non-trivial; misconfiguration can leak your real IP. Follow the canonical guides at docs.getmonero.org. **You become the operator** — for some users this is empowering, for others it's an unwelcome operational tax. There's no shame in using a vetted remote node from monero.fail if self-hosting genuinely doesn't fit your life; the right answer depends on threat model + operational capacity, not ideology.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "self_hosted", "open_source", "tor_supported" ], "highlight_tags": [ "MAINNET", "SELF-HOST", "REFERENCE" ], "fees": { "summary": "Free · hardware cost only" }, "fees_summary": "Free · hardware cost only", "last_verified": "2026-05-13", "operating_since": "2014", "tenure_note": "getmonero.org since 2014 — same as Monero project itself", "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://docs.getmonero.org/running-node/", "outbound_slug": "self-hosted-node", "tor": "http://xmrdoc6phnvjbf5hmjbwdfu47zavzfngymlnwhs2gyxxpxmad4c65kyd.onion" }, "also_listed_at": { "web3privacy": true } }, { "id": "sethforprivacy-node", "category": "nodes", "subcategory": "Community / Operator-run", "name": "node.sethforprivacy.com", "url": "https://xmr.club/nodes/sethforprivacy-node", "twin": "https://xmr.club/llm/nodes/sethforprivacy-node.txt", "tagline": "Seth Simmons-operated public node. Tor + I2P endpoints in addition to clearnet.", "review": "node.sethforprivacy.com is a *public Monero remote node run by Seth Simmons* — one of the most-recommended community nodes for privacy-conscious users, operated by a well-known Monero educator who has spent years teaching people how to use the network without leaking themselves.\n\n**Background.** Online since 2021 and run by *Seth For Privacy* (Seth Simmons), this is a free, public RPC node for the Monero network — the endpoint a wallet talks to so it doesn't have to run and sync its own full node. Seth is a recognized figure in the Monero and Bitcoin privacy space (long-running educational writing at sethforprivacy.com, podcast and workshop work), and that reputation is the node's core credential: a remote node is a trust relationship, and you're choosing whose node to trust. A node from someone whose entire public identity is built on privacy advocacy is a defensible choice.\n\n**What you trust.** A remote node can see *which transactions your wallet submits and the IP they came from* (it can't decrypt your balance or spend — Monero's keys never leave your wallet — but the network-level metadata is real). So the question is operator trust plus transport hygiene, and this node addresses both: it serves over *Tor and I2P* in addition to clearnet, so you can reach it without exposing your IP to the node at all, and it runs *restricted-RPC* on mainnet (the safe public-facing RPC mode that doesn't expose admin/sensitive endpoints). You're trusting a long-standing, reputationally-aligned operator, and you can minimize even that trust by connecting over Tor/I2P.\n\n**Operational specs.** It's a *free mainnet Monero node* with *restricted RPC*, reachable on clearnet, a *Tor v3 onion*, and *I2P*. Point any Monero wallet (CLI, GUI, Feather, Cake, Monerujo, etc.) at it as the daemon endpoint and you skip the multi-hour blockchain sync. The Tor/I2P endpoints are first-class, which is the entire point for a privacy node — connecting over clearnet leaks your IP to the node, while the onion/I2P paths don't. Seth also publishes contact channels (including SimpleX) for issues.\n\n**Philosophy.** Running your own node is the privacy-maximal choice, but it's a real barrier (disk, bandwidth, sync time), and the alternative — a random or wallet-default remote node — quietly hands your transaction metadata to an unknown party. The community-node model splits the difference: a *publicly identified, reputationally-accountable* operator runs the node so you don't have to, and exposes Tor/I2P so you can use it without leaking your IP. It's privacy education made operational — Seth runs the node he tells people to use, on the transports he tells people to use.\n\n**Grade rationale.** A in /nodes. The grade reflects a reputable, publicly-identified privacy-focused operator; Tor + I2P transports (not just clearnet); correct restricted-RPC configuration; multi-year uptime; and zero cost. Among public remote nodes it's a top recommendation precisely because the operator's incentives and reputation align with the privacy of the people using it. The caveats are the inherent ones of *any* remote node, not faults of this one.\n\n**Useful when.** Use it when you want a Monero wallet working *immediately* without syncing a full node, and you want the remote node you trust to be run by someone accountable — connecting over its *Tor or I2P* endpoint so you don't expose your IP. It's an excellent default for mobile/desktop wallets and for newcomers who aren't ready to self-host. For maximum privacy you'd eventually run your own node; until then, this is among the best public options.\n\n**Caveats.** A remote node — any remote node — sees the transactions you broadcast and, over clearnet, your IP; it cannot steal funds or read balances, but that metadata exposure is inherent, so *connect over Tor or I2P*, not clearnet, to neutralize the IP leak. Availability depends on one operator's infrastructure; for resilience, know how to switch nodes (or run your own). And \"trust the operator\" still means trusting a human — a well-reputed one here, but the privacy-maximal answer is always your own node. These are the standard realities of remote nodes and don't reduce the A; the Tor/I2P support and the operator's track record are exactly what make this one a safe pick.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "tor_supported" ], "highlight_tags": [ "MAINNET", "TOR", "I2P" ], "fees": { "summary": "Free · restricted RPC · clearnet + Tor + I2P" }, "fees_summary": "Free · restricted RPC · clearnet + Tor + I2P", "last_verified": "2026-06-02", "operating_since": "2021", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://sethforprivacy.com", "outbound_slug": "sethforprivacy-node", "tor": "http://sfprivg7qec6tdle7u6hdepzjibin6fn3ivm6qlwytr235rh5vc6bfqd.onion", "twitter": "https://x.com/sethforprivacy", "simplex": "https://simplex.chat/contact" } }, { "id": "stormycloud-node", "category": "nodes", "subcategory": "Wallet-operator nodes", "name": "StormyCloud (xmr.stormycloud.org)", "url": "https://xmr.club/nodes/stormycloud-node", "twin": "https://xmr.club/llm/nodes/stormycloud-node.txt", "tagline": "StormyCloud-operated public node. Used as a default by several wallets. I2P endpoint available.", "review": "StormyCloud is one of the few public Monero node operators whose day job is literally running privacy infrastructure — which is exactly the kind of operator you want when you can't run your own node and have to trust someone else's.\n\n**Background**\nStormyCloud operates public infrastructure across multiple privacy networks (Tor and I2P) and runs a widely-cited public Monero remote node at `xmr.stormycloud.org`, used as a default by several wallets. Mainnet, with an I2P endpoint for clients that prefer to reach it without touching clearnet.\n\n**What you trust**\nA remote node is a real but bounded trust decision. It **cannot** see your private keys, spend your funds, or decrypt your amounts and recipients — Monero's privacy holds at the node level. What it *can* observe is your IP address and the timing of the transactions your wallet broadcasts/queries, which is a metadata-linkability risk. StormyCloud's I2P endpoint (and Tor more broadly) is the mitigation, and a privacy-focused operator's incentives are better-aligned than a random node's.\n\n**Operational specs**\nPublic Monero RPC node, mainnet, reachable over clearnet and **I2P**. Serves the standard wallet flows as a default for users who haven't set up their own node. Operated by an entity whose broader mission is privacy-network infrastructure.\n\n**Philosophy**\nShared, privacy-aligned infrastructure exists so that the majority who won't run a full node still get a sane, non-hostile default instead of an unknown logger. StormyCloud's multi-network presence makes it a coherent choice for users who already route through Tor/I2P.\n\n**Grade rationale**\nGrade A. A reputable, privacy-mission operator with an I2P endpoint and broad wallet adoption — about as good as a *remote* node gets. It is graded as an excellent default, with the standing caveat that any remote node is a metadata trade-off versus your own.\n\n**Useful when**\nYou can't or won't run your own node; you want a default operated by a privacy-focused org; you route over I2P/Tor and want a matching node endpoint; you need a reliable fallback node.\n\n**Caveats**\nA remote node sees your IP and tx-broadcast timing — connect over Tor/I2P, not bare clearnet, to blunt that. Running your own node is strictly more private and is the end-goal; a public node is the pragmatic interim. Trust in any \"no logs\" posture is ultimately a trust assumption — reputable, but unverifiable from the outside.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "tor_supported" ], "highlight_tags": [ "MAINNET", "I2P", "INFRA-OPERATOR" ], "fees": { "summary": "Free · I2P + clearnet" }, "fees_summary": "Free · I2P + clearnet", "last_verified": "2026-05-13", "operating_since": "2021", "tenure_note": "WHOIS 2021 predates archive.org first snapshot 2013; treated as current-entity year (domain may have been re-registered)", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://stormycloud.org", "outbound_slug": "stormycloud-node", "contact_email": "abuse@stormycloud.org", "twitter": "https://x.com/StormyCloudInc", "discord": "https://discord.com/invite/McAQBXVg9e" } }, { "id": "xmr-pw", "category": "nodes", "subcategory": "Mining pools", "name": "xmr.pw", "url": "https://xmr.club/nodes/xmr-pw", "twin": "https://xmr.club/llm/nodes/xmr-pw.txt", "tagline": "Small principled Monero mining pool — P2Pool-backed + Solo + optional Tari merge mining, TLS-only stratum endpoints.", "review": "xmr.pw is a small no-fluff Monero mining pool. The two stratum modes are clearly separated: **Solo** (`pool.xmr.pw:5353` TLS / `:5555` TCP) for miners who want direct block ownership with full luck variance, and **P2Mining** (`pool.xmr.pw:4343` TLS / `:4242` TCP) which is a thin pool-side accounting layer on top of P2Pool — the actual block-finding decentralisation lives in P2Pool itself, the pool just gives you wallet-side visibility and a simpler configuration story. Optional Tari merge mining is supported on the P2Pool side.\n\n**Why we list this at B and not higher**: hashrate footprint is tiny (~1 MH/s active across 4 miners as of 2026-05-31 — that's ~0.02% of the ~5.3 GH/s network), so this isn't the place for a large farm chasing steady payout cadence. It IS the place for a hobbyist or principled-decentralisation miner who's been burned by post-minexmr hashrate concentration on the big two pools, wants TLS-by-default endpoints, and wants the P2Pool model exposed without having to learn the P2Pool CLI cold. The operator is responsive on the listed Telegram/Discord channels and ships infrastructure changes publicly (TLS port advertisement, Tari merge mining toggle, stat dashboard).\n\n**Trust mechanism**: read-only public stats, P2Pool-backed mode keeps actual blockfinding decentralised (operator can't selectively withhold blocks the way a fully-internal PPLNS pool could), open-source mining client paths (XMRig + xmrig-proxy on the miner side, P2Pool on the node side). Standard mining-pool custody warning still applies — your earnings sit in the pool's payout queue between blocks; use a payout-threshold you're comfortable losing if the operator vanishes. The Solo mode removes even that risk for miners with enough hashrate to find blocks alone.\n\n**Useful when** you're optimising for hashrate decentralisation more than payout smoothness, or you want to mine Monero with Tari merge mining as a free side reward stream, or you just want a clean TLS-by-default stratum to point a hobby rig at.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "no_kyc", "no_account" ], "feature_tags": [ "non_custodial_blockfinding", "p2pool_backed", "tls_endpoints", "solo_supported", "tari_merge_mining", "open_source" ], "highlight_tags": [ "NO-KYC", "TLS", "P2POOL", "SOLO" ], "fees": { "summary": "Pool fee per standard PPLNS/P2Pool conventions · payout threshold operator-configurable · TLS endpoints at no extra cost" }, "fees_summary": "Pool fee per standard PPLNS/P2Pool conventions · payout threshold operator-configurable · TLS endpoints at no extra cost", "last_verified": "2026-05-31", "operating_since": "2026-04", "tenure_note": "Recent launch (April 2026); product is mature for its age — TLS endpoints, dual-mode strata, Tari merge-mining live, public stat dashboard.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmr.pw", "outbound_slug": "xmr-pw", "telegram": "https://t.me/xmrpw", "discord": "https://discord.gg/kJXKrJqUjr", "contact_email": "support@xmr.pw", "twitter": "https://x.com/XMRBAR", "tor": "http://xmrpwuyyptrisemo7zmw7lw6xm4rxf3sfivgikbhw6t3vdec3lmx4uyd.onion" }, "also_listed_at": { "monerica": true } }, { "id": "xmr-rocks-node", "category": "nodes", "subcategory": "Community / Operator-run", "name": "xmr.rocks", "url": "https://xmr.club/nodes/xmr-rocks-node", "twin": "https://xmr.club/llm/nodes/xmr-rocks-node.txt", "tagline": "xmr.rocks community node. Tor + clearnet.", "review": "Public node maintained by the xmr.rocks community. Tor endpoint provided alongside clearnet. Mainnet.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "tor_supported" ], "highlight_tags": [ "MAINNET", "TOR" ], "fees": { "summary": "Free · Tor + clearnet" }, "fees_summary": "Free · Tor + clearnet", "last_verified": "2026-05-13", "operating_since": "2023", "tenure_note": "WHOIS 2023 predates archive.org first snapshot 2018; treated as current-entity year (domain may have been re-registered)", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmr.rocks", "tor": "http://xqnnz2xmlmtpy2p4cm4cphg2elkwu5oob7b7so5v4wwgt44p6vbx5ryd.onion:18089", "outbound_slug": "xmr-rocks-node" } }, { "id": "xmr-support-node", "category": "nodes", "subcategory": "Community / Operator-run", "name": "xmr.support", "url": "https://xmr.club/nodes/xmr-support-node", "twin": "https://xmr.club/llm/nodes/xmr-support-node.txt", "tagline": "Independent Monero node — clearnet + .onion, no logs disclosed, community-run.", "review": "Independent operator under the xmr.support domain. Mainnet, port 18081, long-standing entry in the public-node lists shipped by various wallets.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial" ], "highlight_tags": [ "MAINNET" ], "fees": { "summary": "Free · mainnet" }, "fees_summary": "Free · mainnet", "last_verified": "2026-07-20", "operating_since": "2021", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmr.support", "outbound_slug": "xmr-support-node" }, "also_listed_at": { "monerofail": true } }, { "id": "xmr-tw-node", "category": "nodes", "subcategory": "Community / Operator-run", "name": "node1.xmr-tw.org", "url": "https://xmr.club/nodes/xmr-tw-node", "twin": "https://xmr.club/llm/nodes/xmr-tw-node.txt", "tagline": "Taiwan-operated public node. Useful for Asia-Pacific clients minimising RTT.", "review": "Run by the xmr-tw.org community. Two public endpoints (node1 + opennode), both mainnet. Closest decent public node for clients in East/Southeast Asia.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial" ], "highlight_tags": [ "MAINNET", "ASIA" ], "fees": { "summary": "Free · mainnet · Asia-Pacific" }, "fees_summary": "Free · mainnet · Asia-Pacific", "last_verified": "2026-05-13", "operating_since": "2017", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmr-tw.org", "outbound_slug": "xmr-tw-node" } }, { "id": "brave-search", "category": "search", "subcategory": "Independent Index", "name": "Brave Search", "url": "https://xmr.club/search/brave-search", "twin": "https://xmr.club/llm/search/brave-search.txt", "tagline": "Independent crawler-backed search. Free tier; API requires email.", "review": "Brave Search is *one of the only Western search engines running on its own independent index* — not a relabelled Bing or Google feed — offered without an account, without profiling ads, and with a Tor onion for good measure.\n\n**Background.** Launched in 2021, Brave Search was bootstrapped from the Tailcat index that Brave acquired (the technology team behind Cliqz's privacy search). That origin matters: most \"privacy search engines\" are thin front-ends that proxy Bing or Google results, which means their independence ends the moment the upstream changes terms. Brave instead crawls and ranks from its *own index*, publishing an \"independence\" metric for how many results come from its own crawl versus fallbacks. That genuine index, plus a no-account/no-tracking posture, is why it earns an A in /search.\n\n**What you trust.** The core trust property is *self-sufficiency*: because Brave runs its own index, it isn't merely re-skinning a surveillance-advertising company's results, and it can make and keep its own privacy commitments. Queries work *without an account* — there's nothing to log in to, so there's no profile to build. The free tier carries *no personal-data ad targeting*. There's a published API tier that downstream tools and other privacy front-ends consume, which both funds the index and demonstrates the results are a real product rather than a loss-leader scrape. And the *Tor onion* lets you query without revealing your network origin at all.\n\n**Operational specs.** Free, instant, no signup. Distinctive features include *Goggles* (open, shareable re-ranking rule-sets that let you bias or filter results by your own criteria — a rare grant of ranking control to the user), an optional AI answer/summariser, and image/video/news verticals. The independence percentage is shown so you can see when a query fell back to a partner index. A paid API tier exists for developers and for the downstream apps that resell privacy search. Access via clearnet or the `search.brave…onion` address; no JavaScript-gated paywall for basic querying.\n\n**Philosophy.** Search is the most sensitive query stream most people generate — it's a log of intentions, fears, and plans — and the dominant engines monetise exactly that by profiling. Brave Search's premise is that you can have a mainstream-quality engine that *doesn't* run on behavioural advertising, funded instead by an API business and an optional ad model that isn't built on personal-data targeting. Owning the index is the structural prerequisite: you can't credibly promise privacy on results you're renting from a profiling giant. Goggles extends the philosophy to ranking autonomy — letting users, not just the engine, decide what \"relevant\" means.\n\n**Grade rationale.** A in /search. The grade reflects a genuinely independent index (the rarest and hardest property in this category), no-account querying, absence of personal-data ad targeting, user-controllable ranking via Goggles, a funding model that isn't surveillance, and a Tor onion. It sits at the top of the category with the privacy-proxy options (Leta, SearXNG), differentiated by being a primary index rather than a proxy.\n\n**Useful when.** Use Brave Search as a daily default when you want mainstream result quality without feeding a profiling engine — it's set-and-forget as a browser default. Reach for Goggles when you want to filter SEO spam, surface only independent/non-commercial sources, or apply a community ranking lens. Use the onion when you're searching over Tor and don't want to expose your origin. It's also a sensible upstream for self-hosted front-ends that want a non-Google/Bing source.\n\n**Caveats.** \"Independent\" is a spectrum, not an absolute — for some long-tail or regional queries Brave still falls back to partner results, and the published independence metric is exactly how you should check that per session rather than assuming 100%. Brave the company also operates a separate ads/rewards ecosystem and a crypto token; none of that touches the no-account search path, but users who dislike that broader model should know it exists. The optional AI summariser carries the usual generative-model caveats (it can be confidently wrong — verify from the underlying links). And result quality, while strong, is still maturing against two decades of incumbent tuning on rare queries. These are scope notes, not trust problems, and the A stands on the strength of owning a real index with a non-surveillance funding model.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "FREE", "INDEPENDENT" ], "fees": { "summary": "Free · API from $5/mo" }, "fees_summary": "Free · API from $5/mo", "last_verified": "2026-06-02", "operating_since": "2021", "tenure_note": "Brave Search launched June 2021 (search.brave.com); brave.com domain itself older but Search product is 2021", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://search.brave.com", "outbound_slug": "brave-search", "tor": "http://search.brave4u7jddbv7cyviptqjc7jusxh72uik7zt6adtckl5f4nwy2v72qd.onion" }, "also_listed_at": { "privacyguides": true, "web3privacy": true } }, { "id": "ddg", "category": "search", "subcategory": "Metasearch · Free", "name": "DuckDuckGo", "url": "https://xmr.club/search/ddg", "twin": "https://xmr.club/llm/search/ddg.txt", "tagline": "Free no-tracking search. Bing-backed index. The mainstream private-search default.", "review": "Free, no-account, no-profile. Bing is the upstream index so privacy is structural not technical — DDG never sees your identity but Bing supplies the results. Bang shortcuts (!w, !so) are uniquely useful.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "no_js_supported" ], "highlight_tags": [ "FREE", "TOR", "BANGS" ], "fees": { "summary": "Free · ad-supported" }, "fees_summary": "Free · ad-supported", "last_verified": "2026-05-12", "operating_since": "2007", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://duckduckgo.com", "tor": "https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion", "outbound_slug": "ddg", "contact_email": "press@duckduckgo.com", "twitter": "https://x.com/duckduckgo" }, "also_listed_at": { "privacyguides": true } }, { "id": "kagi", "category": "search", "subcategory": "Paid · Independent", "name": "Kagi", "url": "https://xmr.club/search/kagi", "twin": "https://xmr.club/llm/search/kagi.txt", "tagline": "Subscription search — no ads, no tracking, custom ranking. Best privacy-respecting paid option.", "review": "Kagi is the canonical paid search engine for users who want the \"you are the customer, not the product\" model — no ads, no SEO-spam dilution, no behavioural profiling, custom per-user ranking that lets you down-rank or block specific sites. Listed at **Grade A · editor's pick** because it is the only major search surface where the user-as-customer alignment is structural (subscription-funded) rather than aspirational, and the privacy-claim audit trail (Privacy Pass anonymous auth, Tor service, crypto payment, pseudonymous signup) is uniquely robust for a paid product.\n\n**Background.** Founded by **Vladimir Prelovac** (@vprelovac), Kagi has been operating as a public subscription search engine since 2022. Headquartered in the United States but accessible globally. Search index is a hybrid: Kagi's own crawler (Teclis-derived) for high-quality independent web indexing, plus paid API access to Google, Brave Search, Mojeek, and a few others as fallback / breadth coverage. The user-facing search is fused from these layers, with Kagi's ranking + content lenses applied on top. Subscriber growth has been steady via word-of-mouth in privacy and tech circles — exact numbers undisclosed, but community sentiment (\"I'd cancel Netflix before Kagi\" is a recurring sentiment) suggests retention is strong.\n\n**What you trust.** Account-level: signup requires email (pseudonymous email accepted), payment (card / PayPal / crypto via OpenNode for Bitcoin + Lightning; annual plans accept crypto explicitly). For users who want **provable anonymity guarantees**, Kagi supports: (a) signup with pseudonymous email; (b) payment in crypto; (c) access via their Tor onion service; (d) anonymous authentication using the **Privacy Pass protocol** (IETF standard) — Privacy Pass severs the link between subscription billing and individual search queries cryptographically, so even Kagi cannot tie searches back to a specific account once Privacy Pass tokens are minted. This is the strongest privacy architecture in any commercial search engine at the time of this review. **Non-tracking posture**: no analytics or telemetry loaded on the search page, no click-tracking on results, no behavioural profiling, no cookie beyond what's required for session. Media/image/video results and Kagi Assistant calls are proxied through Kagi servers (your browser doesn't directly fetch third-party content).\n\n**Operational specs.** Trial: 100 searches free, no card required. Tiers: **Starter** $5/mo for 300 searches; **Professional** $10/mo unlimited search + Kagi Assistant Quick mode; **Ultimate** $25/mo unlimited search + Assistant Research mode + access to flagship models (Claude 4.7 Opus, GPT 5.5, Gemini 3.5, DeepSeek V4 Pro, GLM-5.1, Mistral Medium 3.5, and reasoning variants). Family + Team plans at higher tiers. **Fair-pricing policy**: months you don't use the service automatically generate credit applied to the next bill. Payment paths: card, PayPal, OpenNode (BTC + Lightning). API available for developers. Tor onion service operator-published.\n\n**Philosophy.** Kagi's editorial differentiator is the **structural alignment between funding model and product behaviour**: when search is ad-funded, the search engine's incentive is to maximise time-on-site and ad-impressions per user, which produces SEO-spam-heavy ranked-by-engagement output. When search is subscription-funded, the engine's incentive is to give you the best answer fast so you stay subscribed. Kagi's custom ranking (you can pin trusted sites, block junk sites, prefer certain domains) and Lens system (search filters scoped to subsets of the web) operationalise this — you can curate the web yourself rather than accepting Google's ranking opinion. Privacy Pass is the bigger structural bet: the protocol lets Kagi verify you paid without knowing *which* paid user is searching.\n\n**Grade rationale.** Grade A and editor's pick reflect: structural user-as-customer alignment via subscription pricing; Privacy Pass anonymous-auth protocol (unique in commercial search); accepted crypto payment + Tor onion access for users wanting anonymous-end-to-end signup→search; own crawler + paid-API hybrid index (not purely a Google reseller); no observed major controversies in the last 12 months; consistent community recommendation in privacy + tech circles; explicit fair-pricing policy that doesn't bill for unused months; transparent privacy policy with detailed cookie inventory. Last verified 2026-05-12.\n\n**Useful when.** You've gotten tired of fighting Google's SEO-spam result quality and want search to \"just work\" again. You're a developer or researcher who issues lots of high-intent searches and the time-saved easily justifies $5-10/mo. You want to use AI / LLM features without giving any one AI provider your full prompt history (Kagi Assistant routes to multiple model providers behind one auth and a privacy-proxy layer). You want a search engine that doesn't track you and can prove it via Privacy Pass. You want to set custom rankings (block AI-generated content sites, prefer official documentation, etc.) instead of accepting one ranking opinion.\n\n**Caveats.** **Not anonymous-signup by default** — the tagged `light_kyc` posture reflects that a billing relationship exists (email + payment method on file). Only the *Privacy Pass + crypto + Tor* combination gets you closer to anonymous-signup; the default path retains an email/billing link to your search account. **Subscription cost** — at $5-25/mo this is meaningfully more than DuckDuckGo, Brave, or Mojeek (all free). The privacy + quality value is real but the price is a real barrier for users on tight budgets. **Hybrid index includes Google API** — purists who object to *any* Google involvement should know that some Kagi results are mediated through Google's paid API. When Kagi queries Google, Google sees the search term and Kagi as the caller — not your identity directly — but if \"absolutely no Google\" is your threat-model line, Mojeek (independent index) is the better fit. **OpenNode KYC on the merchant side** — crypto payments route through OpenNode, which runs its own KYC on merchant onboarding (Kagi passed it) and observes Lightning/BTC transaction metadata. Kagi doesn't see your wallet, but OpenNode does. For fully anonymous end-to-end, use a Lightning wallet that doesn't link your identity at the funding layer. **Custom-ranking customisation is opt-in** — you have to invest the configuration time to fully realise the \"curated web\" upside; defaults are good but the editorial sweet-spot is after a few weeks of pin/block tuning. **US headquartered** — for users who specifically threat-model against US legal process, that jurisdiction matters; Kagi has not been compelled to disclose user data in any publicly-known incident, but the legal exposure exists structurally. **Privacy Pass adoption requires user setup** — it's not on by default; users have to opt in to the anonymous-token flow.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "PAID", "NO-ADS", "CUSTOM-RANK" ], "fees": { "summary": "$5–25/mo · annual plans accept BTC / LTC · email signup" }, "fees_summary": "$5–25/mo · annual plans accept BTC / LTC · email signup", "last_verified": "2026-05-12", "operating_since": "2018", "tenure_note": "Kagi Inc. founded 2018; public search launched June 2022. Domain kagi.com WHOIS shows 1993 (premium domain acquired by current entity).", "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://kagi.com", "outbound_slug": "kagi", "contact_email": "support@kagi.com", "twitter": "https://x.com/KagiHQ" } }, { "id": "marginalia", "category": "search", "subcategory": "Independent Index", "name": "Marginalia Search", "url": "https://xmr.club/search/marginalia", "twin": "https://xmr.club/llm/search/marginalia.txt", "tagline": "Solo-built indie search engine for the non-commercial web. Surfaces forums, wikis, personal sites Google buried.", "review": "Marginalia Search is an independent, open-source search engine that deliberately surfaces the small, text-heavy, non-commercial web that mainstream engines bury — a one-person index that prizes substance over SEO and ships with no tracking, no ads, and no JavaScript requirement.\n\n**Background**\nBuilt and operated largely by a single developer (Viktor Lofgren) in Sweden, Marginalia runs its own crawler and index on modest self-hosted hardware rather than renting hyperscale cloud. It has received non-commercial funding to stay independent, and the entire stack is open-source — you can read how ranking works and even run it yourself.\n\n**What you trust**\nYou trust an open codebase and a stated no-tracking policy rather than a corporate privacy promise. Because the site works without JavaScript and sets no advertising identifiers, there is very little surface for behavioral profiling. The operator's incentives are aligned with readers, not advertisers.\n\n**Operational specs**\nA genuinely independent index (not a reskin of Bing or Google), with ranking tuned to favor older, text-dense, hobbyist, and academic pages over commercial SEO content. Works fully without JS, making it usable over Tor and on locked-down browsers. Offers experimental filters and a \"random\" exploration mode. No account, no ads, no third-party trackers.\n\n**Philosophy**\nMarginalia is a reaction against the homogenized, ad-saturated, AI-spam-filled results that dominate commercial search. Its bias is editorial and explicit: reward the human-written small web. That makes it a poor tool for finding a store's opening hours and a superb one for rediscovering the kind of pages the open web was built on.\n\n**Grade rationale**\nGrade A. Independent infrastructure, open source, privacy-respecting by construction, and a distinctive index that no one else offers. It is graded as an excellent complementary search tool, not a drop-in Google replacement — judged against that role, it excels.\n\n**Useful when**\nYou are researching a topic and want non-commercial, long-form sources; you want a search engine that works over Tor without JS; you value supporting independent, non-surveillance infrastructure; you are tired of SEO spam and want to explore the small web.\n\n**Caveats**\nCoverage is narrow by design — it will not reliably find recent news, commercial listings, or mainstream high-traffic results. As a small, often single-operator project, availability and crawl freshness depend on limited resources. Best used alongside, not instead of, a privacy front-end to a larger index for everyday lookups.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted" ], "highlight_tags": [ "FREE", "OPEN-SOURCE", "LONG-TAIL" ], "fees": { "summary": "Free · AGPL · Java · self-hostable" }, "fees_summary": "Free · AGPL · Java · self-hostable", "last_verified": "2026-07-20", "operating_since": "2021", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2021", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://search.marginalia.nu", "outbound_slug": "marginalia" } }, { "id": "mojeek", "category": "search", "subcategory": "Independent Index", "name": "Mojeek", "url": "https://xmr.club/search/mojeek", "twin": "https://xmr.club/llm/search/mojeek.txt", "tagline": "UK-based independent crawler. No tracking, no profiling.", "review": "Mojeek is the **only major independent search index outside Google and Bing** — a UK-based search engine that crawls and indexes the web itself rather than syndicating results from a Big Tech provider. Listed at **Grade A** because Mojeek occupies a structurally unique position: DuckDuckGo, Brave Search, Kagi, and Startpage all syndicate (at least partially) from Google or Bing, which means their privacy posture is downstream of those providers' index decisions. Mojeek's index is its own — smaller, but truly independent and explicitly committed to no tracking and no user profiling.\n\n**Background.** Mojeek was founded in **2003** by **Marc Smith** in the UK and has been operating as an independent search engine ever since — over 22 years of operational continuity. The company remains independent (no acquisitions, no syndication agreements with major search providers). The index is built from Mojeek's own crawler, **MojeekBot**, which indexes billions of pages. Funding: a mix of paid API tier, search-engine display ads (text-only, no behavioural targeting), and direct investment; the team has consistently rejected venture capital that would require pivoting away from the no-tracking commitment. UK jurisdiction has been a consistent talking point — the EU/UK's GDPR data-protection framework provides legal backing for the no-tracking commitment, though Mojeek's position is that the commitment is principled, not legally-mandated. Free for users; paid API tier for developers, researchers, and other applications.\n\n**What you trust.** **No tracking** — Mojeek's published privacy policy states no recording of IP addresses, no user-identifying cookies, no behavioural profiling, no query history tied to individuals. **Independent crawler** — your search query goes to Mojeek's index, not to Google's or Bing's; the index is built by MojeekBot from the actual web. **Independent ranking algorithm** — Mojeek's ranking decisions are theirs, not inherited from a syndication partner; if a result is deprioritised, it's a Mojeek decision (transparent and contestable) rather than a Google decision (opaque). **No filter bubble** — without behavioural profiles, Mojeek can't personalise results, which means everyone sees the same results for the same query (a feature for users who want signal not personalisation). **Account-optional** — Mojeek doesn't require an account; the optional account is for paid-API users and search preferences, not for tracking. **What you don't trust**: index size — Mojeek's index is smaller than Google's (Google: hundreds of billions of pages; Mojeek: tens of billions); for long-tail queries (obscure technical, historical, or non-English content), Mojeek may have less coverage. **Result quality on commercial queries** — without behavioural-targeting and without Google's commercial-query signals, Mojeek's ranking for \"best laptop 2026\" type queries may feel less optimised than Google's; the trade-off is no commercial-intent profiling.\n\n**Operational specs.** **Platform**: web search at mojeek.com; mobile-responsive (no native apps); usable on **Tor Browser** (no aggressive anti-Tor blocks). **Search verticals**: web, images, news, **scholarly** (academic content), **emoji** (yes, Mojeek has an emoji search vertical). **Languages**: 30+ languages indexed; UI localisation in many. **API tier**: paid REST API for developers — used by privacy-respecting metasearch engines (Searx, Searxng) and research projects as an independent index source. **No-JS support**: the search interface works without JavaScript (a Tor-friendly feature). **Region targeting**: optional — you can bias results toward UK / US / specific regions or run regionless. **Date filters + advanced search operators**: full set, including site:, intitle:, intext:, and date-range filters. **No autocomplete-as-you-type tracking** — autocomplete suggestions come from a pre-computed list, not from a tracking pipeline that records what you started to type. **Bangs**: !-style shortcuts to redirect queries to other sites (similar to DuckDuckGo's bangs). **Mobile**: responsive web; no native app required.\n\n**Philosophy.** Mojeek's editorial differentiator is the **independent-index** posture. The privacy-respecting search engine category divides into two structurally different groups: (1) **Syndicators** — DuckDuckGo (Bing + Yahoo + ~400 sources), Brave Search (partially Brave's own crawler, partially Bing fallback), Startpage (Google with proxy stripping), Kagi (multiple sources including Mojeek itself for some queries) — these provide privacy at the user-query layer while inheriting the index decisions of their syndication partners. (2) **Independent indexers** — Mojeek, Yandex (in some sense, though Russian government association is a separate concern), Marginalia (tiny but interesting), Stract (small but growing) — these build their own index and have full editorial autonomy. Mojeek is the only Western-jurisdiction independent indexer at scale. The trade-off: smaller index, fewer long-tail results, less commercial-query optimisation; in exchange, true editorial independence and no Big Tech inheritance.\n\n**Grade rationale.** Grade A reflects: 22+ years of operational continuity (since 2003); independent crawler (MojeekBot, not Google or Bing); no tracking, no user profiling, no behavioural advertising; UK GDPR jurisdiction with explicit privacy commitment; works on Tor Browser without aggressive blocking; no-JS-supported search interface; multi-vertical search (web, images, news, scholarly, emoji); paid API tier with privacy-respecting metasearch partners (Searx, Searxng) using Mojeek as an independent index source; no venture capital, no acquisition-pressure deviation from privacy commitments; founder-led operation with public identity (Marc Smith); the only major independent-index search engine outside Google/Bing/Yandex. Last verified 2026-05-12.\n\n**Useful when.** You want a **truly independent** search engine that doesn't inherit Big Tech's index decisions — Mojeek is the canonical pick. You're doing **research where index neutrality matters** — academic queries, controversial topics, content that might be deprioritised by major engines for non-quality reasons. You want a **Tor-friendly** search that works without JavaScript and doesn't aggressively block Tor exit IPs. You want to **build a privacy-respecting application** that needs search results — Mojeek's API is one of the few independent options. You want a **search engine without filter bubble personalisation** — same results for the same query, regardless of who's asking. You're already using a privacy-respecting search (DuckDuckGo, Brave, Kagi) and want to **diversify your search dependency** beyond a single source. You're a **journalist or researcher** querying sensitive topics and want an alternative to the Big Tech indexes.\n\n**Caveats.** **Smaller index than Google or Bing** — for long-tail queries (obscure technical content, deep historical records, non-English niche content), Mojeek may have less coverage than the major engines. For mainstream queries, results are competitive; for tail queries, expect to fall back to other sources occasionally. **Commercial-query ranking is less optimised** — \"best laptop 2026\" type queries on Mojeek won't have the commercial-intent signals that Google has spent decades optimising; you may need to do more reading to find the best results vs Google's curated commercial pages. **News freshness lag** — Mojeek's index is updated continuously but not always as fast as Google for breaking news; for time-sensitive queries (last 24 hours), other sources may be fresher. **No native apps** — desktop and mobile web only; some users prefer native search apps for system-level integration (sharing, default search). Mojeek can be set as default search in most browsers. **UI is less polished than Google's** — functional but less feature-rich. Coming from Google's polish, expect a more minimal experience. **API is paid** — for developers, the API has a paid tier; for users searching the web, it's free. **Image search has narrower coverage** — image vertical is smaller than Google Images; for image-heavy research, expect to fall back to other sources. **Don't expect Google-quality results on every query** — Mojeek is a meaningful privacy-respecting alternative for most queries; for queries where Google's index size or commercial-query optimisation matters more than independence, use the appropriate tool. The right mental model: Mojeek is the primary search for privacy-sensitive work + index-independence; supplement with other engines when those specific Mojeek tradeoffs bite.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "FREE", "INDEPENDENT", "UK" ], "fees": { "summary": "Free · paid API tier" }, "fees_summary": "Free · paid API tier", "last_verified": "2026-05-12", "operating_since": "2004", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.mojeek.com", "outbound_slug": "mojeek", "twitter": "https://x.com/mojeek" } }, { "id": "searxng", "category": "search", "subcategory": "Self-Host", "name": "SearXNG", "url": "https://xmr.club/search/searxng", "twin": "https://xmr.club/llm/search/searxng.txt", "tagline": "Privacy-respecting metasearch. Aggregates 70+ engines locally on your server.", "review": "SearXNG is the self-hosted privacy metasearch engine — an open-source fork of the original searx that aggregates results from 245+ upstream search engines (Google, Bing, DuckDuckGo, Brave, Marginalia, Mojeek, plus dozens of specialised verticals like Wikipedia, GitHub, Stack Overflow, arXiv, PubMed, Lemmy, Mastodon, etc.) without ever revealing the individual user to any upstream. Listed at **Grade A · editor's pick** because it is the gold-standard \"you own the search frontend\" architecture and one of the few privacy-respecting search options that's both free and fully under user control.\n\n**Background.** SearXNG forked from the original `searx` project around 2021 when the upstream project went into maintenance mode; the SearXNG fork picked up active development, added support for many more engines, and ships rolling releases (current `2026.5.23+` at the time of this review). Source code at github.com/searxng/searxng under the open-source AGPL-3 license. Driven by an open community, no commercial entity behind it. Public-instance discovery at **searx.space** — a community-maintained list of ~70 well-maintained public instances, each rated on uptime + features + Tor reachability. Bundled-in inclusion: SearXNG ships pre-installed in Tails Linux, and is the default search engine for many privacy-focused custom distributions.\n\n**What you trust (two deployment modes).** **Self-hosted**: you run the SearXNG instance yourself (Docker container, Python install, or systemd service), the instance proxies queries to upstream engines using its IP address (not yours), and **no one** — not the upstream engines, not SearXNG, not the wider internet — sees the link between you and your search history. This is the strongest privacy posture available in any search architecture. **Public instance**: you use someone else's SearXNG instance from searx.space. The upstream engines still don't see you, but the *operator of that public instance* sees every query you make from their server logs (unless they explicitly disable logging — which most do, but not all). You trade self-host operational complexity for trust in an unknown third party.\n\n**Operational specs.** **Engine count**: 245+ upstream sources across general web, images, videos, files, science papers (arXiv, PubMed, Crossref, Semantic Scholar), code (GitHub, GitLab, Sourcehut), forums (Lemmy, Discourse, Matrix Rooms Search), social (Mastodon, Mwmbl), shopping/Linux-package-search/etc. **Locales**: 58 translations of the UI. **Tor support**: instances can be configured to route upstream queries through Tor (slower but adds an extra anonymity layer). **No-JS support**: works without JavaScript; minimal cookie usage (preferences only, optional). **Plugins**: built-in calculators, hash converters, unit converters, time-zone tools, hostnames-rewriting, infinite-scroll, Tor-check, and a plugin development framework for adding your own. **API**: programmatic access for custom integrations (LLM RAG, command-line tools, browser extensions). **Installation**: Docker one-liner, OS package, or step-by-step Python install — documented at docs.searxng.org.\n\n**Philosophy.** SearXNG's editorial differentiator is the **\"separate the search-frontend from the search-backend\" architecture**. Traditional search engines combine the indexing + ranking + frontend into one operator who sees everything you query. SearXNG fragments that: each upstream engine does what it does best (indexing + ranking), but the frontend (which sees the user) is owned by someone the user already trusts (themselves, in the self-host case). The privacy property emerges from the architecture rather than from operator promises. Combine this with the open-source codebase, the optional Tor routing, and the community-curated instance list — and you have the closest thing to \"search infrastructure as a public utility\" the privacy community has built.\n\n**Grade rationale.** Grade A and editor's pick reflect: open-source AGPL-3 codebase with active community development; self-host architecture that structurally minimises trust assumptions; 245+ upstream engine integrations including major web + specialised verticals; bundled inclusion in Tails Linux (operator validation at the Tor-Project-adjacent tier); 58 UI translations; no-JS support; community-maintained public instance directory at searx.space with uptime/features tracking; Tor-routing optional for self-hosters; no commercial monetisation pressure on the project. Last verified 2026-05-12.\n\n**Useful when.** You're a self-hosting privacy enthusiast and want search to be one more service in your homelab. You're a developer building an AI / RAG system and want a search backend you can hit programmatically without paying per-query API fees to Google/Bing. You want the best of multiple search engines fused into a single result page (search-engine portfolio diversification). You don't trust any single commercial search operator — including Kagi — and prefer the \"you own the frontend\" architecture instead. You're running Tails and want privacy-respecting search by default.\n\n**Caveats.** **Self-hosted is the strong-privacy mode** — using a public instance means trusting that instance's operator. Public-instance operators *can* see queries; verify the instance's privacy policy + uptime/transparency at searx.space before relying on it. **Rate-limiting / blocking by upstreams** — Google in particular sometimes throttles or blocks SearXNG instances that issue too many queries from a single IP. Self-hosting on a residential IP, rotating through engines, or routing queries through Tor mitigates this; high-traffic instances on commercial IPs often hit caps. **Operational complexity** — self-hosting is a real ongoing commitment: you maintain the Docker image, monitor upstream-engine breakage, patch the SearXNG binary as engines change their HTML. Not zero-effort. **No native ranking** — SearXNG aggregates results but doesn't apply its own intelligence layer; the ranking quality is whatever the upstream engines provide, weighted by the user-configurable engine weights. If you want Kagi-style custom ranking + Lens-style filters, Kagi has more polish for that use case. **Public-instance quality varies** — some instances are well-maintained and Tor-friendly; others are sketchy or run by operators with unknown motives. searx.space + reading the instance's about-page is essential before trusting any public deployment.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "self_hosted", "no_js_supported" ], "highlight_tags": [ "FREE", "SELF-HOST", "METASEARCH" ], "fees": { "summary": "Free · AGPL · Docker / source" }, "fees_summary": "Free · AGPL · Docker / source", "last_verified": "2026-05-12", "operating_since": "2021", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://searxng.org", "outbound_slug": "searxng" }, "also_listed_at": { "privacyguides": true } }, { "id": "startpage", "category": "search", "subcategory": "Metasearch · Free", "name": "Startpage", "url": "https://xmr.club/search/startpage", "twin": "https://xmr.club/llm/search/startpage.txt", "tagline": "Google results, no Google tracking. Dutch operator.", "review": "Proxies Google results so you get the index without the surveillance. Dutch jurisdiction. Anonymous View feature opens result pages through their proxy. Free, ad-supported.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [], "highlight_tags": [ "FREE", "GOOGLE-PROXY" ], "fees": { "summary": "Free · ad-supported" }, "fees_summary": "Free · ad-supported", "last_verified": "2026-05-12", "operating_since": "1997", "tenure_note": "Startpage (then Ixquick) launched 1998. Curator-accepted as 1997 to reflect parent Ixquick BV / Surfboard Holding roots; passes the \"10+y bucket\" sanity check by ~25y margin either way.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.startpage.com", "outbound_slug": "startpage", "twitter": "https://x.com/startpage" }, "also_listed_at": { "privacyguides": true } }, { "id": "stract", "category": "search", "subcategory": "Independent Index", "name": "Stract", "url": "https://xmr.club/search/stract", "twin": "https://xmr.club/llm/search/stract.txt", "tagline": "Open-source search engine with its own crawler. Customisable ranking, optional Sidekick LLM integration.", "review": "Newer entrant building an independent web index in Rust. Self-hostable; allows users to upweight/downweight domains via a `ranks.txt` config. Aims to surface long-tail community content (forums, wikis) Google buried. Smaller index than Brave but more transparent ranking.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted", "api_available" ], "highlight_tags": [ "FREE", "OPEN-SOURCE", "INDEPENDENT" ], "fees": { "summary": "Free · Rust · self-hostable" }, "fees_summary": "Free · Rust · self-hostable", "last_verified": "2026-05-13", "operating_since": "2020", "tenure_note": "WHOIS 2020 predates archive.org first snapshot 2005; treated as current-entity year (domain may have been re-registered)", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://stract.com", "outbound_slug": "stract" } }, { "id": "whoogle", "category": "search", "subcategory": "Self-Host", "name": "Whoogle", "url": "https://xmr.club/search/whoogle", "twin": "https://xmr.club/llm/search/whoogle.txt", "tagline": "Self-hosted Google proxy. Get Google's results without the tracking, ads, or AMP.", "review": "Whoogle is *Google's results without Google watching you* — a self-hostable open-source search proxy that fetches Google results, strips the ads, tracking, AMP redirects, and JavaScript, and serves you the clean answer without ever tying the query to you.\n\n**Background.** Created in 2020 (by Ben Busby) and open-source on GitHub, Whoogle is a lightweight *Flask app* you run yourself — on a $4 VPS, a home server, or a local Docker container. It proxies Google's index, so you *inherit Google's ranking quality* while interposing your own server between you and Google. That self-host-first design plus an open codebase is why it earns an A in /search: the privacy comes from architecture you control, not a promise from a middleman.\n\n**What you trust.** Ideally, *yourself*. Because Whoogle is *open source and self-hostable*, the privacy-maximal configuration is to run your own instance: then *your* server makes the request to Google, so Google sees the instance's IP and no per-user profile, and Whoogle itself logs nothing about you because you operate it. It *strips tracking, ads, AMP, and JavaScript* from results, removing the surveillance and manipulation layers Google bundles in. Public instances exist for convenience, but the threat model explicitly *favors self-hosting* — on a public instance you're trusting that operator (and sharing an IP with other users, which is its own mixed bag). The trust, done right, collapses to \"your own box.\"\n\n**Operational specs.** A small *Flask* application, deployable via *Docker* or directly, that you point your browser at (and can set as your default search engine / via the OpenSearch hook). It returns Google-quality results with the cruft removed, supports configuration of result regions and filters, and runs comfortably on minimal hardware (a $4 VPS is plenty). *Public instances* are listed for those who won't self-host, but the recommended posture is your own private instance. Free and open-source; your only cost is the small server you run it on.\n\n**Philosophy.** Search quality and search privacy are usually presented as a tradeoff: use Google and be profiled, or use a privacy engine with weaker results. Whoogle's premise rejects the dichotomy — Google's *ranking* is genuinely good, so the move is to *keep the results and remove the surveillance* by self-hosting a proxy. Open-sourcing it and making it trivially self-hostable is the whole point: a privacy tool you run yourself, whose code you can read, leaves no operator to trust. It's the SearXNG-adjacent philosophy applied specifically to keeping Google's index usable without Google's tracking.\n\n**Grade rationale.** A in /search. The grade reflects open-source code, genuine self-hostability (the privacy-maximal config), removal of tracking/ads/AMP/JS, Google-grade result quality, and a tiny resource footprint. It sits with the other privacy-search approaches (Mullvad Leta as a managed proxy, Brave as an independent index, SearXNG as a meta-search) — Whoogle's niche is *self-hosted Google passthrough*. The caveats are about the self-host requirement and Google-dependency, not code integrity.\n\n**Useful when.** Use Whoogle when you specifically want *Google's result quality* but refuse to feed Google your queries and IP — and you're willing to *self-host* (a few minutes with Docker on any cheap box). It's the right pick for the privacy-minded who find independent indexes' results lacking on long-tail queries and want the real thing, de-surveilled. Set your self-hosted instance as your browser default and you have private Google for daily use.\n\n**Caveats.** The privacy is *only real if you self-host* — on a *public instance* you're trusting an unknown operator with your queries and sharing its IP, which can be rate-limited or blocked by Google, so don't treat random public instances as private. It *depends on Google's interface*: scraping/proxying can break when Google changes things or rate-limits an instance's IP, so it needs occasional maintenance and isn't as set-and-forget as a hosted product. Running it well is a (small) sysadmin task. And it inherits Google's *ranking biases* — it removes the tracking, not the editorial slant of the index. None of these undercut the A: for self-hosted, de-tracked Google-quality search, Whoogle is the canonical tool — the asterisk is simply \"run your own instance.\"", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted", "tor_supported", "no_js_supported" ], "highlight_tags": [ "SELF-HOST", "OPEN-SOURCE", "PROXY" ], "fees": { "summary": "Free · MIT · Python / Docker · self-hostable" }, "fees_summary": "Free · MIT · Python / Docker · self-hostable", "last_verified": "2026-06-03", "operating_since": "2020", "tenure_note": "Whoogle Search (privacy-respecting Google front-end) first commit Jan 2020 by Ben Busby. Previous stamp (2007) was github.com WHOIS — shared-host trap.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://github.com/benbusby/whoogle-search", "outbound_slug": "whoogle" }, "also_listed_at": { "web3privacy": true } }, { "id": "5sim", "category": "sims", "subcategory": "Receive-Only / SMS", "name": "5sim", "url": "https://xmr.club/sims/5sim", "twin": "https://xmr.club/llm/sims/5sim.txt", "tagline": "Long-running SMS verification provider. Bulk-friendly, broad service catalogue.", "review": "Older provider, larger inventory than SMSPool but UX is rougher. We pull from them as a fallback in walls.rip/sms. Wallet credit accepts crypto; per-service per-country lookup.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available", "wallet_funded" ], "highlight_tags": [ "NO-KYC", "BULK" ], "fees": { "summary": "$0.20-2 per number · BTC, LTC, USDT" }, "fees_summary": "$0.20-2 per number · BTC, LTC, USDT", "last_verified": "2026-05-12", "operating_since": "2015", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://5sim.net", "outbound_slug": "5sim", "twitter": "https://x.com/5simnet", "telegram": "https://t.me/news_en_5sim" }, "also_listed_at": { "kycnot": true } }, { "id": "buyukesim", "category": "sims", "subcategory": "Anonymous eSIM", "name": "BuyUKeSIM", "url": "https://xmr.club/sims/buyukesim", "twin": "https://xmr.club/llm/sims/buyukesim.txt", "tagline": "Real UK +44 carrier eSIM plus travel-data eSIMs for 190+ countries — no account, no KYC, on-screen QR after crypto checkout (12 coins incl. XMR).", "review": "BuyUKeSIM sells two clearly-scoped eSIM products through a single anonymous-checkout storefront.\n\n**Product surface:**\n- **UK Number (+44) eSIM** — a real UK-mobile-carrier line for incoming SMS and calls only, no data bundle. Fixed price $25, top up $15 every 6 months to keep the number. Advertised to work for WhatsApp / Telegram / PayPal / Google / Apple / Microsoft account verifications; the operator openly notes third-party app acceptance is not guaranteed on any external service.\n- **Travel eSIM (data)** — prepaid roaming data plans across 190+ countries, from $1.99 single-country up through regional and global bundles.\n\n**Checkout flow:**\n- No account. No email required (opt-in receipt box unchecked by default).\n- Twelve cryptocurrency options at checkout: USDT, TRX, BTC, ETH, SOL, USDC, BNB, **XMR**, DOGE, TON and others across several networks.\n- Delivery is an on-screen QR code immediately after on-chain payment confirms. Fast networks (TRC20, BEP20, Polygon) typically confirm in 1-3 minutes; BTC and ETH take longer.\n- Refunds aren't routinely offered post-delivery; technical or duplicate-payment issues are handled via `@buyukesimbot` on Telegram against your payment TX hash.\n\n**Track record + surface:**\n- **Tor mirror**: `l4wvrny7…gyd.onion` — real v3 hidden service serving the full storefront (verified 425 KB Next.js page returned via SOCKS5 proxy).\n- Public web-archive traces begin February 2025 — ~17 months of observable footprint.\n- Multiple operator channels published in schema.org `sameAs`: X `@buyukesimcom`, Telegram bot `@buyukesimbot`, Nostr NIP-05, GitHub organization.\n- **Public API**: documented at /en/developers/docs/ — Bearer-authenticated REST endpoints (/api/v1/products, /api/v1/orders, /api/v1/orders/{id}/usage), enabling programmatic checkout without the web UI.\n- Site content ships in six languages (English, Turkish, German, Spanish, Chinese, Russian) and includes a machine-readable `llms.txt` summary.\n\n**What to weigh before adopting it as your primary line:**\n- **No third-party analytics or ad pixels** on the marketing or checkout pages — Google Analytics, Google Ads, gtag, doubleclick, Facebook Pixel, none of them. Verified 2026-07-12 after the operator removed the pixels within 30 minutes of listing feedback.\n- **The +44 line is on a real UK carrier.** That's how it passes WhatsApp and PayPal verification, and it also means the underlying line has real UK-legal-process reachability at the carrier. The operator doesn't hold KYC on you, but the carrier does hold the line.\n\nSuited to readers who want a real, verification-passing UK number for one-off account signups without handing a credit card or ID to a mobile network, accepting the UK-carrier-legal-process trade for the real-verification-passing feature.\n\nBuyUKeSIM now also sells a **Private VPN** (wholesale capacity, honestly caveated that the no-logs is the upstream operator's promise they relay but cannot prove) and answers **support chat AI-first** (messages go to Anthropic, no PII attached) — both disclosed plainly in an unusually specific privacy policy.", "translation_locale": "en", "rating": { "grade": "B+", "trust": "Positive — ~17 months of observable footprint, six operator channels published, kycnot-peer-directory-visible surface. New to this directory; no curator-side track record with the operator yet.", "privacy": "Anonymous checkout is real — no account, no email required, QR shown on-screen. Marketing + checkout pages ship free of Google Analytics, Google Ads, gtag, doubleclick, Facebook Pixel or other trackers (verified 2026-07-12 after operator removed pixels within 30 minutes of listing feedback). The +44 line is a real UK carrier number, which means UK-legal-process reachability at the network layer — the operator doesn't hold KYC on you, but the underlying carrier does hold the line.", "ux": "Two SKUs, clear pricing, six-language UI, machine-readable llms.txt, live chat + Telegram bot support before and after purchase. On-screen QR only — save the order page until installed." }, "grade": "B+", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "telegram_bot", "tor_mirror", "api_available" ], "highlight_tags": [ "NO-KYC", "REAL-UK-CARRIER", "XMR-CHECKOUT", "INSTANT-QR", "MULTILINGUAL", "TOR-MIRROR", "PUBLIC-API" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-24", "operating_since": "2025-12", "tenure_note": "Service founded December 2025 — domain buyukesim.com created 2025-12-20 (RDAP), confirmed by the operator. Earlier February 2025 Wayback captures belong to a previous, unrelated owner of the recycled domain, not this service.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://buyukesim.com/", "affiliate": "https://buyukesim.com/r/XMRCLUB", "outbound_slug": "buyukesim", "twitter": "https://x.com/buyukesimcom", "telegram": "https://t.me/buyukesimbot", "nostr": "https://njump.me/npub19yyeavh95mfedsn4xulccts85t2c3yl77rwg40mcuqaytg2u3eksh3pxrl", "github": "https://github.com/BuyUKeSIM", "tor": "http://l4wvrny7rzf7ec2cmp7w4frl6okcvxmq662zrbhe7v3pvxplcuzf2gyd.onion/" }, "also_listed_at": { "monerica": true } }, { "id": "cypher-esim", "category": "sims", "subcategory": "Anonymous eSIM", "name": "Cypher eSIM", "url": "https://xmr.club/sims/cypher-esim", "twin": "https://xmr.club/llm/sims/cypher-esim.txt", "tagline": "No-account, no-KYC eSIM checkout — kycnot rates it 10/10 with Privacy 100/100; Telegram-bot delivery, Monero / BTC / Lightning / cash-by-mail, 180+ countries.", "review": "A no-account, no-KYC eSIM checkout for 180+ countries — buy a data plan in ~60 seconds via Telegram bot or web, pay in Monero, Bitcoin, Lightning, USDT (multi-chain), USDC, DAI, SOL, TON, or even cash by mail, receive the QR via the same channel, activate. Listed at **Grade B-** on the strength of kycnot's 10/10 overall score (Privacy 100/100, Trust 89/100, KYC level 0/4 \"Guaranteed no KYC\"), monerica's direct listing, a real Telegram-bot purchase flow, and broad coin coverage including Monero as a first-class option; held under full B by an anonymous operator behind a US business address, an astroturf-pattern review batch on cryptwerk, JS-only policy pages, and zero Monero community track record yet to triangulate against.\n\n**What it is.** A privacy-positioned eSIM provider for travellers and digital nomads. Coverage spans 180+ countries with global, regional, country-specific, and multi-country plans. Purchase flow is no-account, no-email — pay in crypto, receive QR, install. Listed at **Grade B-** because kycnot's independent review awarded the strongest privacy score in their rubric (100/100) and the operator's no-account delivery is real; the half-step below full B reflects operator transparency gaps and US jurisdictional exposure rather than any specific service failure.\n\n**Background.** Cypher eSIM ships an eSIM checkout via Telegram bot and a web SPA at `cypheresim.com`. Business address registered at 2381 Zanker Rd Ste 110, San Jose, CA 95131, US — a real US street address (Five Eyes jurisdiction, CLOUD Act / NSL exposure). Operator identity behind the address is undisclosed: no `/about` page, no founder identity, no incorporation details. External presence: X (`@cypher_esim`), Telegram bot for purchases, email at `support@cypheresim.com`, cryptwerk listing (3.4/5, three reviews — astroturf pattern flagged below), monerica listing (live, direct), kycnot listing (live, \"unlisted\" — kycnot has it in their DB at a 10/10 score but it doesn't surface in their search). Live since at least May 2026 (the earliest cryptwerk review dates from that month). No Monero forum discussion (Reddit, Bitcointalk, monero.town, Matrix) — the operator has not engaged with the Monero community despite accepting XMR.\n\n**What you trust.**\n\n- **kycnot 10/10, Privacy 100/100, Trust 89/100, \"Guaranteed no KYC\".** kycnot's review awards the strongest privacy posture they grade (level 0/4, \"Terms explicitly state KYC will never be requested\") and the strongest privacy attributes set in the eSIM cohort. Their summary: \"Cypher eSIM is a no-KYC eSIM for 180+ countries. No account, no ID, no email — pay with crypto.\" This is unusually strong external validation for a service this new. *Caveat:* kycnot lists it as **unlisted** (in their DB at 10/10 but suppressed from search), which signals they want more user-side verification before promoting it.\n- **monerica listing.** Direct listing on monerica.com confirming the no-KYC posture and the multi-coin (Monero / Bitcoin / Lightning / Fiat / Cash) payment menu.\n- **No-account, no-KYC checkout — Monero accepted.** The payment screen offers XMR alongside USDT (TRC-20 / BEP-20 / Arbitrum / Solana), USDC, DAI, BTC, ETH, TON, plus Lightning and cash-by-mail. The flow is \"select country and plan → pay invoice → receive QR\" — no email, no registration, no documents at any step.\n- **Telegram bot purchase path.** The operator runs the full purchase flow inside Telegram, which means the user never has to load the website in a non-Tor browser, never exposes a fingerprint to the operator's webapp, and receives the QR inside an encrypted messenger. Operationally the strongest privacy channel the operator offers.\n- **Broad eSIM coverage and device compatibility.** 180+ countries per kycnot's review; 4G/5G with global / regional / country plans. Device support covers most flagship Android and iOS handsets from 2019 onward.\n- **A real US business address is on file.** Mixed signal but worth surfacing: there's a physical address, not a Caribbean PO box. Accountability is at least nominally available — at the cost of US jurisdictional reach.\n\n**Operational specs.**\n\n- **Site.** https://cypheresim.com/ — Next.js SPA. Policy pages exist at `/privacy-policy` and `/terms-of-service` but require JavaScript to render.\n- **Telegram bot.** Full purchase flow via the operator's bot.\n- **Coverage.** 180+ countries (per kycnot); global, regional, country-specific, multi-country bundles; 4G + 5G.\n- **Payment.** Monero, Bitcoin, Lightning, Ethereum, USDT (TRC-20 / BEP-20 / Arbitrum / Solana), USDC, DAI, SOL, TON, plus cash by mail. No fiat card, no bank.\n- **Pricing.** Plans starting from $1 for local destinations per operator copy. No standalone fee / rate sheet on the website.\n- **Account model.** No registration required to buy. No \"my account\" surface beyond the checkout / order-status route.\n- **Tor mirror.** None advertised. No `Onion-Location` header.\n- **Jurisdiction.** United States — registered business address in San Jose, CA. No incorporation number or officer identity published.\n- **Channels.** Email `support@cypheresim.com`, X `@cypher_esim`, Telegram bot for purchases. No Matrix, SimpleX, Signal, or PGP key published.\n- **External listings.** kycnot (10/10, unlisted in search), monerica (direct), cryptwerk (3.4/5 across 3 reviews).\n\n**Operator philosophy.** Marketed as a no-KYC, no-data-retention eSIM service: \"no account, no follow-up, no data retained\" (operator copy). kycnot scores this 100/100 on Privacy — among the cleanest postures they review. The infrastructure choices reflect the privacy posture: Telegram-bot delivery is the strongest privacy lever the operator ships (avoids the SPA fingerprint, runs inside an encrypted channel), the payment menu treats Monero and Lightning as first-class, and a cash-by-mail option exists for users who don't want any blockchain footprint at all. The privacy posture is partially undermined by the US business address (CLOUD Act / NSL exposure means data-retention promises may be subject to compelled collection by US authorities), the JavaScript-required policy pages (a user running NoScript can't actually audit the no-data-retention claim), and the operator's complete absence from Monero community spaces. These are gaps to watch, not malice — the actual delivery (real QR codes, working eSIM activations) is what matters for users in the moment.\n\n**Grade rationale.** Listed at **Grade B-** because kycnot's 10/10 Privacy 100/100 score, monerica's direct listing, XMR as a first-class payment option, a real no-account checkout path, broad 180+ country coverage, cash-by-mail as a no-blockchain option, and Telegram-bot delivery together describe a service that meets the directory's substantive bar. Held under full B by: (1) **kycnot's own \"unlisted\" status** — they award the 10/10 in their DB but keep it out of their search results, signalling they want more user-side verification before promoting it; (2) **operator transparency** — anonymous team behind a US business address with no incorporation detail or named individual; (3) **astroturf review pattern** — all three cryptwerk reviews posted the same day (May 21, 2026), which reads as paid or coordinated rather than organic adoption; (4) **JS-only policy pages** a NoScript user can't audit; (5) **zero Monero community footprint** despite accepting XMR — no forum threads, no marketplace cross-references; (6) **US jurisdiction's CLOUD Act / NSL reach** materially weakens any data-retention promise made by the operator. **Path to B:** independent test purchase logged (curator side), at least one organic Monero-community thread, kycnot promoting the listing out of \"unlisted\" status, and either the policy pages becoming readable without JS or a published transparency report on what (if anything) the operator collects at checkout.\n\n**Useful when.**\n\n- You want a no-account, no-KYC eSIM and you want to pay in Monero. The payment menu and Telegram-bot delivery match the no-KYC posture they advertise, and kycnot rates the privacy posture 100/100.\n- You want to pay in cash for an eSIM — the cash-by-mail option is unusual in this category and lets you skip the blockchain trail entirely.\n- You're a traveller who wants global / regional eSIM coverage without exposing the rest of your travel identity to a mainstream carrier.\n- You'd rather buy via Telegram than a web SPA. The operator's bot is the most privacy-coherent purchase channel they offer.\n\n**Caveats.**\n\n- **Anonymous operator behind a US business address.** No founder, officer, or named individual published. If a purchase goes wrong, recourse is limited to support channels — there's no named party to escalate to. The US registration also means CLOUD Act / NSL exposure: if compelled by US authorities, the operator may be required to collect data the marketing copy claims they don't.\n- **kycnot keeps the listing \"unlisted\" despite the 10/10 score.** Their database has the entry at top rating, but it doesn't appear in their public search. The most likely read is that kycnot is waiting for more user reviews / track record before promoting it. Treat the 10/10 as the strongest signal we have alongside that suppression caveat — both are real.\n- **Astroturf-pattern reviews on cryptwerk.** All three cryptwerk reviews posted on the same day (May 21, 2026). The coincidence is statistically improbable for organic activity and reads as coordinated. Don't weigh those reviews heavily.\n- **Policy pages render only with JavaScript.** `/privacy-policy` and `/terms-of-service` exist but a NoScript user sees the SPA shell, not the actual text. Audit yourself by enabling JS once, capturing the content, then re-blocking.\n- **Zero Monero community footprint.** No Reddit, Bitcointalk, monero.town, or Matrix discussion. The operator accepts XMR but hasn't engaged with the community that would normally test, audit, and amplify a privacy-first eSIM.\n- **No Tor mirror.** Clearnet-only. The Telegram bot mitigates this partially for users who run Telegram over Tor, but a dedicated `.onion` would be the cleaner solution.\n- **No fee schedule.** Plans start from $1 per operator copy; the actual per-country / per-plan pricing is only visible inside the checkout flow.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B-" }, "grade": "B-", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "telegram_bot" ], "highlight_tags": [ "XMR", "ESIM", "TELEGRAM-BOT", "NO-ACCOUNT" ], "fees": { "summary": "Plans from $1 · XMR / BTC / Lightning / ETH / USDT / USDC / DAI / SOL / TON / cash by mail · no fiat card" }, "fees_summary": "Plans from $1 · XMR / BTC / Lightning / ETH / USDT / USDC / DAI / SOL / TON / cash by mail · no fiat card", "last_verified": "2026-08-10", "operating_since": "2026-05", "tenure_note": "Independently verified: WHOIS/RDAP registration: 2026-05-15; earliest Wayback snapshot: 2026-07-18. `operating_since` set to the earliest signal.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://cypheresim.com/", "outbound_slug": "cypher-esim", "twitter": "https://x.com/cypher_esim", "telegram_bot": "https://t.me/esimnomand_bot", "contact_email": "support@cypheresim.com", "affiliate": "https://cypheresim.com/?ref=NOOBLEP" }, "also_listed_at": { "kycnot": true, "monerica": true, "cryptwerk": true } }, { "id": "herosms", "category": "sims", "subcategory": "Receive-Only / SMS", "name": "HeroSMS", "url": "https://xmr.club/sims/herosms", "twin": "https://xmr.club/llm/sims/herosms.txt", "tagline": "Tiered SMS receive with premium high-success-rate pool.", "review": "Premium SMS verification service used in walls.rip/sms tiered routing — pays more per number but materially higher success rate on Telegram/WhatsApp. Wallet credit, crypto-only.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available", "wallet_funded" ], "highlight_tags": [ "NO-KYC", "PREMIUM" ], "fees": { "summary": "$1-5 per number · premium tier higher success rate · BTC, USDT" }, "fees_summary": "$1-5 per number · premium tier higher success rate · BTC, USDT", "last_verified": "2026-05-12", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": true, "editors_pick": false, "links": { "web": "https://walls.rip/sms", "outbound_slug": "herosms" } }, { "id": "jmp-chat", "category": "sims", "subcategory": "VoIP / SMS", "name": "JMP.chat", "url": "https://xmr.club/sims/jmp-chat", "twin": "https://xmr.club/llm/sims/jmp-chat.txt", "tagline": "Jabber bridge to real phone numbers — SMS + voice over XMPP, no smartphone needed.", "review": "JMP.chat is a *phone number that lives in your chat app instead of your pocket* — a real PSTN (callable, textable) number bridged to XMPP/Jabber, set up without a real name and paid in Bitcoin or cash, so you can hold a working phone identity that isn't tied to your device or your legal name.\n\n**Background.** Running since 2017 (from the Soprani.ca / Cheogram ecosystem), JMP gives you a *real US/Canada phone number* whose calls, SMS, and MMS are bridged into your *XMPP client* (with a Matrix path too). You talk and text from Conversations/Cheogram/your Jabber app of choice; the PSTN side just sees a normal number. That longevity plus the federated, standards-based (XMPP) foundation is why it earns an A in /sims: it's privacy infrastructure built on an open protocol, not a walled app.\n\n**What you trust.** The signal is *minimal identity + open standards*. Signup requires *no real name*, and you can pay in *Bitcoin or cash by mail* — so the number need not be linked to a card, an ID, or your true identity. Because it bridges to *XMPP*, a federated open protocol, you're not locked into a proprietary client and can even self-host parts of the stack; the gateway software (Cheogram/bifrost) is open. The trust concentrates in JMP as the PSTN gateway (it necessarily handles the telephony leg), but the identity and payment model are designed to keep *who you are* out of that relationship.\n\n**Operational specs.** You get a *real dial-able/textable number*; inbound calls and SMS/MMS arrive in your XMPP client, and you send from there too. Funding is *BTC + cash-by-mail*, no real-name requirement. It uses the Cheogram app/gateway on top of standard XMPP, so any compliant Jabber client works. Practical sweet spots: a *receiver for OTP/2FA codes* you don't want hitting your real SIM, a public-facing number you can hand out and rotate, and *isolating phone-based identity from your physical device* (no SIM, no IMEI tie-in).\n\n**Philosophy.** The phone number has become a de-facto government-and-corporate identity key — demanded for signups, used for tracking, hard to get without ID. JMP's premise is that you should be able to *have a functional number without surrendering your identity or carrying it on your device*: route it through a federated chat protocol, pay anonymously, and decouple \"a number people can reach\" from \"the SIM in my phone that follows me everywhere.\" Building on XMPP rather than a proprietary app is the philosophical core — open, federated, not a new silo.\n\n**Grade rationale.** A in /sims. The grade reflects no-real-name signup, BTC/cash payment, a *real* PSTN number (not a flaky VoIP throwaway), an open federated (XMPP) foundation with open-source gateway software, and a multi-year track record. It's the standout for privacy-preserving phone identity. The caveats are the inherent realities of bridging to the legacy phone network, not weaknesses in JMP's model.\n\n**Useful when.** Reach for JMP when you need a *working phone number that isn't your real one* — receiving OTP/2FA codes away from your primary SIM, a public/disposable contact number, or separating phone-based account identity from your device. It's ideal for the privacy-minded who already live in an XMPP client, and for anyone who wants to pay for telephony without a card or ID.\n\n**Caveats.** The PSTN leg is inherently *not private end-to-end*: calls and SMS traverse the legacy phone network, which is surveilled and lawful-intercept-capable, and JMP (as the gateway) handles that leg — so treat it as *identity decoupling*, not content secrecy. Some services actively block VoIP/non-carrier numbers for OTP, so a JMP number won't pass every 2FA gate. It requires comfort with *XMPP* (picking a client, understanding federation), which is a small learning curve for non-XMPP users. And it's US/Canada-numbered, so fit depends on your region. None of these reduce the A — for \"a real number, anonymously, off my device,\" JMP is best-in-class; just don't mistake it for encrypted comms.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source" ], "highlight_tags": [ "VOIP", "BTC", "FEDERATED" ], "fees": { "summary": "~$5/mo per number · BTC/cash · US + CA numbers" }, "fees_summary": "~$5/mo per number · BTC/cash · US + CA numbers", "last_verified": "2026-06-03", "operating_since": "2017", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://jmp.chat", "outbound_slug": "jmp-chat", "twitter": "https://x.com/JMP_chat", "matrix": "https://matrix.to/#/_bifrost_discuss_conference" } }, { "id": "nadanada", "category": "sims", "subcategory": "eSIM + phone + VPN bundle", "name": "nadanada.me", "url": "https://xmr.club/sims/nadanada", "twin": "https://xmr.club/llm/sims/nadanada.txt", "tagline": "Three-service bundle at unusually low prices: no-KYC eSIM ($0.99/plan), disposable phone numbers for SMS verification ($1.50/number), and a no-log VPN ($3/mo). No account, no email, anonymous payments including XMR.", "review": "**What it is.** A privacy-utility bundle from a single operator: **eSIM data plans**, **disposable phone numbers** for SMS verification, and a **VPN**. All three are no-account, no-KYC, anonymously payable including in Monero. The three services live under the same brand and appear to be operated by the same team.\n\n**Pricing (from the homepage table).**\n\n- **VPN** — $3/mo, multi-country exits, no activity logging, daily-to-yearly plans, no account.\n- **eSIM** — $0.99/plan (top-up-anytime), global connectivity, no KYC, instant activation.\n- **Phone numbers** — $1.50/number, disposable, many countries, many services supported, Bitcoin payments, no number collisions.\n\nAll three sit at the low end of their respective markets. The homepage is unusually direct about pricing — no signup wall between the reader and the fee table.\n\n**Peer position.** kycnot.me lists the service at **8/10** and monerica has a corroborating listing. Two independent peer-directory anchors — the same set we normally require for a B on this side of the directory.\n\n**Why Grade B (not C).** The three data points that pull this off the default C for new SIMs-category listings: (a) two independent peer directories both list it, kycnot at 8/10, (b) pricing is disclosed on the homepage without a signup gate, and (c) the operator engaged xmr.club directly on X (2026-06-30), asked how to get listed, was pointed at `/submit`, and filed the submission the same day — a small signal but a positive one for follow-through discipline. Grade A withheld pending observation of a clean release cycle on our side plus a cross-read of the disposable-numbers pool (a category with a known abuse-and-freeze tail).\n\n**Trust story.** Numbers-as-a-service (SMS verification) is the highest-friction sub-service in this bundle — pools of numbers get burned, some upstream carriers refuse recycled numbers, and the anti-fraud posture of the destination platforms varies. The $1.50 price point implies pools rotate fast, which is fine for one-off verifications but readers who need a durable inbound-SMS destination should treat this as pool-tier, not personal-tier. The VPN and eSIM are simpler: pay, activate, use.\n\n**What we don't know yet.** Jurisdiction and operator identity are not surfaced on the homepage. Uptime history hasn't been observed by xmr.club yet. Path to A: named legal entity or verifiable operator, six months of observed operation without pool-collision or SMS-freeze reports, and independent monero-community discussion (monero.town, Reddit) confirming the service works as advertised for XMR-paid checkouts.\n\n**Known incident.** One X report on 2026-06-29 (`@nittanycrypto`) — customer purchased an eSIM that never activated, and a chatbot refund request went unanswered for >2 weeks. Single report, not a pattern, but a live customer-service data point. Path to A now explicitly includes: refund-loop resolution surfaced by operator + zero follow-up activation reports over the next 90 days.", "translation_locale": "en", "rating": { "grade": "B" }, "grade": "B", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "ESIM", "SMS-VERIFICATION", "VPN", "NO-KYC", "NO-ACCOUNT", "XMR" ], "fees": { "summary": "VPN $3/mo · eSIM $0.99/plan · Disposable phone number $1.50/each." }, "fees_summary": "VPN $3/mo · eSIM $0.99/plan · Disposable phone number $1.50/each.", "last_verified": "2026-08-10", "operating_since": "2026-04", "tenure_note": "Independently verified: earliest Wayback snapshot: 2026-04-02. `operating_since` set to the earliest signal.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://nadanada.me", "twitter": "https://x.com/nadanada_me", "affiliate": "https://nadanada.me?ref=xmrclub", "tor": "http://wg2vbtdwfo6tacuykviwdiyeaslezxohb4or4xjcjxbtspdcxgbs2pad.onion" }, "also_listed_at": { "kycnot": true, "monerica": { "url": "https://monerica.com/site/nadanada" } } }, { "id": "physical-sim-tricks", "category": "sims", "subcategory": "Physical SIM Tactics", "name": "Physical pre-paid SIM", "url": "https://xmr.club/sims/physical-sim-tricks", "twin": "https://xmr.club/llm/sims/physical-sim-tricks.txt", "tagline": "The original no-KYC SIM. Buy with cash at a kiosk in a country that doesn't require ID.", "review": "Not a service per se — a tactic. Some countries (e.g. UK, Germany historically, parts of the US prepaid market) sell pre-activated SIMs at convenience stores without ID. Tag your trip itinerary; pick one up; activate with throwaway email. Caveat: laws change country-by-country; this is dated quickly. Cross-check on Privacy Guides before relying on it.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "cash_accepted" ], "highlight_tags": [ "TACTIC", "CASH" ], "fees": { "summary": "varies by country · cash" }, "fees_summary": "varies by country · cash", "last_verified": "2026-05-12", "operating_since": "2019", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://privacyguides.org", "outbound_slug": "physical-sim-tricks", "twitter": "https://x.com/privacy_guides", "matrix": "https://matrix.to/#/privacyguides:matrix.org" }, "also_listed_at": { "privacyguides": true } }, { "id": "silent-link", "category": "sims", "subcategory": "Anonymous eSIM", "name": "Silent.link", "url": "https://xmr.club/sims/silent-link", "twin": "https://xmr.club/llm/sims/silent-link.txt", "tagline": "Anonymous eSIM with a phone number. Crypto-only signup, no ID.", "review": "Silent.link is the canonical no-KYC eSIM provider — global mobile data in 160+ countries, optional real US +1 or UK +44 phone number for SMS-receive (OTP / registration), pay-as-you-go pricing with no data limits, no email at signup, and crypto-only payment (BTC, Lightning, XMR, USDT, altcoins). Listed at **Grade A · editor's pick** because it is the most polished eSIM operator in the no-KYC space — actual phone numbers when you want them, actual global data when you don't, and an operational track record that GrapheneOS officially recommends.\n\n**Background.** Silent.link operates out of the European Union with Internet gateways in **Poland** (per their public FAQ). The exact corporate identity behind the operator isn't publicly named, but the service has been live since 2021 and has accumulated a strong reputation across the privacy + GrapheneOS communities over four-plus years of continuous operation. Coverage is delivered through commercial roaming agreements that work seamlessly across the 160+ supported countries — including China, Mexico, and other locations where the user might want a non-local SIM identity. Tor onion mirror operator-published at silentlnit5ryavvfz5vw7s4qg62jujd666lnc4tg2chj64zuwuqtvqd.onion.\n\n**What you trust.** Account-level: there is no account. **No email, no username, no password, no signup form.** When you pay, you receive a personal order-page URL — bookmark or save it; that URL *is* your account. Lose it, lose access. Top-ups and number renewals happen via the same URL. Payment leaves a crypto-payment trail (BTC, Lightning, XMR, USDT, etc.) but no identity link beyond what you choose to leak via the funding source. Operator-side: Silent.link's FAQ commits to \"no user data whatsoever\" gathered, but operators of any mobile data service necessarily see the underlying carrier-level metadata (cell IDs, IMSI, time-of-use) at the time of session — there's no way around this at the protocol level. The trust ask is: trust that Silent.link is not retaining or correlating that metadata after the session ends. No public audit of this claim exists.\n\n**Operational specs.** Two plan tiers visible at the time of this review: **DATA.PLUS** — data-only eSIM, 5G/LTE, no phone number, one-off purchase, top-up as you go. **US.PLUS** (and equivalent UK plan) — data + a real US +1 or UK +44 phone number that **receives SMS** (one-year lease, renewable), incoming voice is allowed for voice-call-activation flows, **outbound SMS is blocked** (anti-spam policy), no legacy GSM voice (use VoIP apps for outbound voice). Hotspot tethering enabled on all plans. Data rates: **~$1.50/GB** across most of Europe and the USA. Funds never expire. Tor onion mirror works. Plans are paid in crypto (BTC + Lightning native, XMR/USDT/altcoins via the \"Altcoins\" route).\n\n**Philosophy.** Silent.link's editorial differentiator is the **\"URL is your account\" architecture**. By eliminating the signup form entirely — no email, no password, no recovery — Silent.link removes the most common KYC-leak vector for \"anonymous\" services (the recovery email that gets used for one other thing and becomes your identity link). The trade-off: bookmark discipline becomes the security model. Lose the URL, lose the eSIM. The architectural choice signals editorial seriousness: they're choosing to reduce their own data-collection surface to the absolute minimum even though it makes recovery harder for users. Compared to operators that ask for email-only or phone-number-only signup, that's a meaningfully smaller KYC surface.\n\n**Grade rationale.** Grade A and editor's pick reflect: zero-account architecture (no email, no signup form, URL-as-credential); crypto-only payment including XMR; 160+ country coverage with no roaming surcharge games; real US/UK phone numbers when you need OTP-receive; ~$1.50/GB pricing that's competitive with regular travel eSIMs while adding the privacy properties; Tor onion mirror; four-plus years of operational continuity; GrapheneOS endorsement; absence of any reliability, coverage, or refund-dispute complaints in the last 12 months. Last verified 2026-05-13.\n\n**Useful when.** You're travelling and don't want to hand your passport to a local SIM seller. You want a US or UK phone number for OTP receipt on services that won't accept VoIP or international numbers. You're on GrapheneOS or another privacy-focused mobile setup and want a SIM that matches the operating system's posture. You're holding XMR and want to spend it on mobile connectivity without converting first. You want a permanent data eSIM that doesn't expire if you go three months without using it. You need hotspot tethering for a laptop while travelling and don't want to trust hotel Wi-Fi.\n\n**Caveats.** **URL-is-your-account is brittle** — lose the order-page URL and there's no recovery flow; treat the URL like a private key, store it in a password manager or paper backup. **Phone-number lease is one year** — renew via the order page before expiry, or the number gets reused and you keep only the data plan. **Outbound SMS is blocked** — Silent.link allows SMS-receive (perfect for OTPs and signup verification) but you cannot send SMS from your Silent.link number; use Signal / SimpleX / messengers for outbound. **No legacy voice** — outbound voice calls only work via VoIP apps (WhatsApp, Signal, Telegram, etc.); the SIM does support **incoming** voice calls for service-activation flows (some banks/services require a callback during signup). **Operator identity is not publicly named** — fine for most threat models, relevant for users who need to know who they're trusting at a legal-entity level. **Stock can be intermittent** — Silent.link occasionally shows \"sold out\" between batches of eSIM provisioning; check the homepage or follow @silentlinkapp on X for restock alerts. **Poland-based gateway** — your traffic exits via Poland-based infrastructure; that's an EU jurisdiction with its own legal regime, generally privacy-friendly but factor it into your threat model if jurisdiction matters. **Some carrier bans** — some networks (notably US tier-1 carriers in certain conditions) have been known to flag roaming-eSIM traffic; failure modes are rare but not impossible.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "NO-KYC", "PHONE NUMBER", "XMR" ], "fees": { "summary": "$10-50 first load · per-MB data · per-SMS receive · BTC, LN, XMR" }, "fees_summary": "$10-50 first load · per-MB data · per-SMS receive · BTC, LN, XMR", "last_verified": "2026-05-13", "operating_since": "2022", "tenure_note": "Silent.link (anonymous eSIM via Lightning) launched ~2022. silent.link domain WHOIS 2020 predates the service.", "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://silent.link", "outbound_slug": "silent-link", "tor": "http://silentlnit5ryavvfz5vw7s4qg62jujd666lnc4tg2chj64zuwuqtvqd.onion", "contact_email": "support@silent.link", "twitter": "https://x.com/silentlink1" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "smspool", "category": "sims", "subcategory": "Receive-Only / SMS", "name": "SMSPool", "url": "https://xmr.club/sims/smspool", "twin": "https://xmr.club/llm/sims/smspool.txt", "tagline": "Per-service rental of receive-only numbers. Wallet credit funded with crypto.", "review": "**⚠ REGULATORY-COMPLIANCE CHANGE (2026-07-17) — GRADE DROPPED A → C.** SMSPool has publicly announced (@smspoolnet on X, 2026-07-17) that it can no longer accept **direct Monero payments** due to EU MiCA and incoming AMLR compliance requirements. XMR remains available *through resellers only* — an indirect layer sitting between the reader and the SMS/eSIM checkout. Grade dropped A → C to match reader expectation: xmr.club's Grade A signals *default-choice for direct XMR support in this category*, and SMSPool no longer clears that bar for readers who want a first-party Monero path. This is not a shame-list posture — the operator was transparent about the trigger, disclosed publicly, and preserved indirect access. **Curator advice.** For readers whose reason for coming here is direct XMR support, check the remaining Grade A providers in this category — sort or filter `/sims` by grade and pick from the top. Readers who are fine routing through SMSPool's reseller layer can still use it at C.\n\nSMSPool is a pay-as-you-go SMS-verification service: it rents you a real phone number scoped to a single service (Telegram, Google, Discord, and hundreds more) just long enough to receive one one-time code, paid from a crypto-funded balance with no ID. For anyone trying to create accounts without handing over a personal number — the single most common deanonymizing step in modern signup flows — it's a clean, no-KYC way to clear the SMS gate.\n\n**Background.** SMS verification has quietly become the choke point of online privacy: even services that ask for nothing else demand \"your real number,\" which ties the account to your carrier identity and SIM. SMSPool sits in the OTP-receive lane alongside the other temp-number providers, offering a large catalog of services across many countries on a per-use rental model. Full disclosure for transparency: SMSPool is one of the upstream providers we resell through our own HeroSMS / walls.rip/sms surface — but direct sign-up at SMSPool works identically and is what this listing rates.\n\n**What you trust.** This is a custodial-credit, rented-number model, so the trust is bounded but specific: you top up a balance, and you trust SMSPool to (a) deliver the OTP for the service you paid for and (b) refund when a code doesn't arrive. You do *not* hand over identity — top-ups are crypto (BTC/XMR), no KYC — but you are trusting the operator with the small prepaid balance and with the fact that the number routes a code to you. The numbers come from a shared pool, so the realistic limitation is availability and reputation (see caveats), not custody of meaningful funds.\n\n**Operational specs.** Per-service, per-country pricing (you pick the exact service you need a code for, and the price reflects that service's current success rate and demand). Balance topped up with **BTC or XMR, no ID**. One-time-receive model: a number is rented for a single OTP, not an ongoing line. Typical flow is success-or-refund — if no code lands in the window, the rental auto-refunds to your balance. Coverage spans the high-demand services (messengers, email, social, marketplaces) across a broad country list, with availability and price varying by both.\n\n**Philosophy.** SMSPool exists to decouple account creation from carrier identity. Funding with Monero and receiving an OTP without ID is the practical expression of that: you get past the SMS wall without seeding a phone-number-to-identity link that follows you across every service that later cross-references it.\n\n**Grade rationale.** Grade A reflects the genuine no-ID, crypto-funded model, native XMR top-ups, broad service/country coverage, and the success-or-refund mechanic that makes it usable rather than a gamble. It is rated on its function as a privacy on-ramp for account creation, with the standard temp-SMS caveats applied below.\n\n**Useful when** you need to create an account that demands SMS verification without exposing your real number — registering messengers or marketplaces under a pseudonym, separating identities per threat model, or simply avoiding the carrier-identity link. Pair the XMR top-up with the rest of a compartmentalized signup (no-KYC email, Tor) for a clean account with no thread back to you.\n\n**Caveats.** Temp-SMS is **receive-only and single-use** — it's for clearing a one-time OTP, not for ongoing 2FA or account recovery (lose the number and you can't re-receive). Numbers come from a shared pool, so some have been used before and a few high-security services may reject or flag them; success rates and prices swing with demand, and the most-guarded services (certain banks, payment apps) are the hardest and priciest. Always check the live price/availability for your exact service+country before relying on it, and keep a small balance rather than a large one. As with any provider, verify the real domain — temp-SMS brands attract phishing clones.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available", "wallet_funded" ], "highlight_tags": [ "NO-KYC", "RECEIVE-ONLY" ], "fees": { "summary": "$0.30-3 per number depending on service · wallet credit · BTC, LTC, XMR" }, "fees_summary": "$0.30-3 per number depending on service · wallet credit · BTC, LTC, XMR", "last_verified": "2026-07-19", "operating_since": "2020", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.smspool.net", "outbound_slug": "smspool", "affiliate": "https://smspool.net/?r=ANrNhZSvx8" }, "incident": { "title": "EU MiCA / AMLR compliance change — direct Monero payments removed (2026-07-17); XMR available through resellers only. Grade dropped A → C.", "summary": "SMSPool.net publicly announced on 2026-07-17 (via @smspoolnet on X) that it can no longer accept direct Monero payments. Fuller reasoning in a follow-up post 2026-07-18 06:28 AM names the specifics: as an EU-based company subject to MiCA + incoming AMLR (which will formally ban privacy coins like Monero from EU-regulated platforms from July 2027), the immediate trigger was banking-partner de-risking — their bank refused to keep the account open while they continued accepting XMR directly, and alternative banks declined for the same reason. XMR remains available through the reseller channel — indirect but preserved. This is a regulatory-compliance-forced change disclosed transparently by the operator, not a shame-list event. xmr.club dropped the grade A → C to match reader expectation: our Grade A signals default-choice for direct XMR support in a category, and SMSPool no longer clears that bar. Curator advice: readers who need direct XMR should check the remaining Grade A providers in the sims category (sort /sims by grade). Readers who accept the reseller layer can continue with SMSPool at C. The July 2027 AMLR deadline is on file as a directory-wide watch signal for other EU-based active listings facing similar banking-partner pressure — regulation-driven so it does not warrant a periodic re-check on this specific listing; a change here would require either an EU regulatory reversal or SMSPool relocating out of the EU.", "status": "open", "timeline": [ { "date": "2026-07-19", "stage": "incident_open", "note": "SMSPool.net publicly announced on 2026-07-17 (via @smspoolnet on X, verified, 8,294 views at the time this incident was logged) that it can no longer accept direct Monero payments due to EU MiCA and incoming AMLR compliance requirements. XMR remains available through its reseller channel — indirect but not removed. Grade dropped A → C on curator sign-off: not shame-list posture (operator was transparent), just reader-expectation alignment (Grade A signals default-choice for direct XMR support, which SMSPool no longer is). Warning-lead paragraph prepended to review body in EN; zh/es/ru not on file for smspool. Follow-up wake +30d to check for a restored direct-payment path via licensed workaround, EU MiCA implementation shifts, or other listings in the same category facing similar regulatory action." }, { "date": "2026-07-19", "stage": "operator_detail", "note": "Fuller operator reasoning surfaced via a follow-up X post (@smspoolnet, 2026-07-18 06:28 AM). Direct quote from the operator: 'As an EU-based company, we're subject to the EU's Markets in Crypto-Assets Regulation (MiCA), which imposes strict compliance requirements on financial institutions handling crypto assets. This is compounded by the incoming Anti-Money Laundering Regulation (AMLR), which will formally ban privacy coins like Monero from EU-regulated platforms from July 2027. Banks are already de-risking ahead of that deadline, and our banking partner is no longer willing to support our account while we continue accepting Monero directly. Alternative banks have declined to work with us for the same reason. Monero is still available through our resellers, so it hasn't been removed as a payment option, just moved off our direct platform.' Curator read: (a) the trigger is banking-partner de-risking, not the AMLR deadline itself — banks are pre-emptively cutting ties well ahead of the July 2027 formal ban, which means EU-based listings in this directory should expect similar pressure sooner rather than later; (b) the reseller-preservation path is a genuine effort to keep XMR reachable, not a facade; (c) the July 2027 date is now a specific milestone worth watching directory-wide — any EU-based active listing in the exchanges / cards / SIMs / VPNs categories is a candidate for the same pressure. Grade held at C — the fuller detail confirms the regulatory-compliance framing rather than reframing it." } ] }, "also_listed_at": { "kycnot": true } }, { "id": "walls-esim", "category": "sims", "subcategory": "Anonymous eSIM", "name": "walls.rip eSIM", "url": "https://xmr.club/sims/walls-esim", "twin": "https://xmr.club/llm/sims/walls-esim.txt", "tagline": "Anonymous eSIM aggregator. Routes orders across upstream regional carriers; pay XMR / BTC / Lightning, receive an eSIM QR.", "review": "eSIM aggregator at walls.rip/esim. Routes purchases through upstream regional carriers, marks up, and re-sells under a single wallet-funded checkout. No KYC, no email — order ID is the only handle. Coverage is roaming + regional plans, not phone-number-as-identity.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "api_available", "wallet_funded" ], "highlight_tags": [ "AGGREGATOR", "NO-KYC", "XMR" ], "fees": { "summary": "varies by region · markup ~15-20% over upstream · XMR / BTC / LN" }, "fees_summary": "varies by region · markup ~15-20% over upstream · XMR / BTC / LN", "last_verified": "2026-05-13", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": true, "editors_pick": false, "links": { "web": "https://walls.rip/esim", "outbound_slug": "walls-esim" } }, { "id": "1gwei", "category": "tools", "subcategory": "Crypto Ops", "name": "1gwei.dev", "url": "https://xmr.club/tools/1gwei", "twin": "https://xmr.club/llm/tools/1gwei.txt", "tagline": "No-KYC gas station — pay a tiny invoice in Monero or Lightning, receive native gas (ETH/ARB/Base/Polygon/BNB/HyperEVM/Robinhood/Sepolia) to any wallet in minutes. No account, no bridge. Self-disclosed custodial float — send only what you need.", "review": "**A no-KYC \"gas station\" for when you're stuck without native gas.** 1gwei.dev lets you pay a small invoice in **Monero** (private) or **Lightning** (fast) and receive **native gas** — ETH, or the chain's own token — on 8 chains (Ethereum, Arbitrum, Base, Polygon, BNB, HyperEVM, Robinhood, Sepolia), delivered to any address in minutes. No account, no email, no SIM, no login: paste a destination, pay a one-time invoice, receive gas. Amounts are deliberately tiny ($0.72–$3.59, or custom) — enough to unstick a wallet, approve a token, claim an airdrop, fund a fresh address unlinked to any exchange, or bankroll a dev/testnet wallet.\n\n**Unusually honest about what it is.** The site *labels itself* a \"custodial gas station\" and tells you plainly: *\"send only the small amount of gas you need, then move on — it isn't an exchange or a savings account.\"* Live ETH/USD spot pricing with the margin shown up front, plus sensible reliability handling (never double-pays, retries failed sends, keeps the order open until the gas is broadcast). That proactive custody disclosure is rare, and to its credit.\n\n**Why C.** It is **custodial** — your funds pass through the operator during the swap, so this is not \"non-custodial\" in the atomic sense — and it is **new** (© 2025-26, no web-archive history) with an **opaque operator** (no named team, no public source — a Tor onion mirror is now live). What keeps it a *confident* C rather than a wary one is that the custodial risk is structurally tiny: you pay cents-to-a-few-dollars for gas you immediately spend, never parking real value. No-KYC, XMR-native, transparent on price. It climbs toward B- on a clean curator test-order and a track record.", "translation_locale": "en", "rating": { "grade": "B-", "trust": "New (© 2025-26, zero Wayback history), opaque operator — no named team, no public source (a Tor onion mirror is now live). Custodial (funds pass through during the swap). But self-discloses custody prominently ('custodial float — send only what you need'), shows the spot margin up front, and by design handles only tiny amounts, so custodial loss-asymmetry is structurally low. Lifts on a clean curator test-order + tenure. Curator test-order passed 2026-09-02: paid XMR, received native ETH in minutes, no account/KYC, XMR accepted at 1 confirmation. Lifted C->B- on verified working mechanism + low-stakes float; opaque operator + newness cap at B-.", "privacy": "No account, no email, no SIM, no login, no KYC. Pay in Monero (private) or Lightning; one-time invoice, paste a destination, receive native gas. Note: the payout is public on the target chain (destination address + tx are visible there — inherent to receiving gas). The Monero payment leg is private.", "ux": "Pick amount ($0.72 / $1.79 / $3.59 or custom) + chain (8 supported) + pay method (XMR/LN). Delivered in minutes (LN seconds, XMR ~10 min), explorer link included. Optional delayed send. Guide + FAQ. XMR accepted at just 1 confirmation — fast." }, "grade": "B-", "kyc_tags": [ "NO-KYC" ], "feature_tags": [ "xmr", "no_kyc", "lightning", "gas", "no_account" ], "highlight_tags": [ "XMR", "NO-KYC", "NO-ACCOUNT", "LIGHTNING", "GAS" ], "fees": null, "fees_summary": null, "last_verified": "2026-09-03", "operating_since": "2025", "tenure_note": "© 2025-2026; no Wayback history (very new). Custodial gas float (self-disclosed). Opaque operator — no named team / public source / Tor. Grade C pending tenure + a clean curator test-order (small XMR->ETH gas buy).", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://1gwei.dev", "outbound_slug": "1gwei", "logo": "/peers/1gwei.svg", "tor": "http://gweidevwva6wggquryozfuihb6iahdrcwnzjokurpkhxi46lavwkkbid.onion/", "affiliate": "https://1gwei.dev/?ref=0x723cff4271cf7880ef0bfdf7409fcf2d6e410fcf" }, "also_listed_at": { "monerica": true, "kycnot": true } }, { "id": "404-cash", "category": "tools", "subcategory": "Merchant", "name": "404.cash", "url": "https://xmr.club/tools/404-cash", "twin": "https://xmr.club/llm/tools/404-cash.txt", "tagline": "Crypto checkout widget for merchants — XMR / BTC / LN / USDT, no KYC.", "review": "Embeddable payment widget. Merchants get a public API key, drop an iframe into their checkout, accept XMR/BTC/LN/USDT. Optional managed routing settles to a single payout address. Used by stables.rip and others in this directory.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "self_hosted", "api_available" ], "highlight_tags": [ "MERCHANT", "API" ], "fees": { "summary": "Per-tx fee 0.5-1% · BYOK or managed routing" }, "fees_summary": "Per-tx fee 0.5-1% · BYOK or managed routing", "last_verified": "2026-05-12", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": true, "editors_pick": false, "links": { "web": "https://404.cash", "outbound_slug": "404-cash", "twitter": "https://x.com/intent" } }, { "id": "aegis-authenticator", "category": "tools", "subcategory": "Two-Factor", "name": "Aegis Authenticator", "url": "https://xmr.club/tools/aegis-authenticator", "twin": "https://xmr.club/llm/tools/aegis-authenticator.txt", "tagline": "Open-source TOTP/HOTP for Android — encrypted local vault, exportable backups.", "review": "Aegis Authenticator is the **canonical privacy-respecting TOTP/HOTP app for Android** — an open-source second-factor manager that stores your authenticator tokens in an **encrypted local vault**, supports **proper JSON backups** under your control, imports from most competing apps, and never phones home. Listed at **Grade A** because Aegis occupies the **drop-in-replacement-for-Google-Authenticator** slot with three structural improvements: encrypted vault (Google's app doesn't encrypt), exportable backups (Google's doesn't until very recently and even then via account-tied cloud), and zero cloud dependency (your tokens stay on your device).\n\n**Background.** Aegis Authenticator was created by **Alex Bakker** (with a community contributor team) and has been actively developed since 2019. The project is **open source under GPLv3** with the codebase at github.com/beemdevelopment/Aegis. Available on **F-Droid** (the canonical Android free-software store) and **Google Play Store** with identical signed builds. **No iOS version** — Apple's App Store policies and the team's resource constraints have kept Aegis Android-only; for iOS, the closest functional equivalent is **Raivo** (defunct) or **Ente Auth** (which has cross-platform builds — listed separately at xmr.club). Funded entirely by donations + contributor labour; no commercial entity behind the project, no SaaS upsell.\n\n**What you trust.** **Local-only storage** — your TOTP secrets stay on your device, encrypted in the Aegis vault file. Aegis doesn't have a backend; there is no Aegis-operated server. **Vault encryption** — AES-256-GCM with **scrypt** key derivation (memory-hard, resistant to GPU/ASIC brute-force attacks against the vault passphrase). **Biometric unlock support** — fingerprint/face on Android via the OS keystore; the biometric is a UX shortcut on top of the passphrase, not a replacement for it. **Open-source codebase + reproducible-build documentation** — anyone can audit the source; the GitHub releases are reproducible. **No phoning home** — the app doesn't ship with analytics SDKs, doesn't request unnecessary permissions, and has no network requests in normal operation (the only network use is the optional \"icons\" feature that downloads logos for known services). **Export format is JSON** — the export is a documented JSON schema, encrypted with the vault password; you can decrypt it offline with a small Python script if needed, meaning your secrets are not locked to Aegis. **What you don't trust**: cloud sync — Aegis doesn't have it. If you want cross-device sync, you handle it via your existing file-sync mechanism (Nextcloud, Syncthing, manual export-and-import). This is intentional: there is no Aegis cloud to compromise.\n\n**Operational specs.** **Platform**: Android only — F-Droid (canonical), Google Play (same signed APK), direct APK download from getaegis.app. **Token types**: TOTP (RFC 6238 — the standard 6-digit-every-30-second tokens), HOTP (RFC 4226 — counter-based, less common), Steam Guard (Valve's variant), Yandex (Russian variant). **Algorithms**: SHA-1, SHA-256, SHA-512. **Digit lengths**: 6, 7, 8 digit codes. **Custom periods**: configurable refresh interval per-token. **Token capacity**: unlimited (limited only by device storage). **Categorisation**: organise tokens into groups; search across the vault. **Icons**: optional auto-icon download for known services (this is the only network request the app makes); easily disabled. **Backup**: encrypted JSON export to local file, optional automatic backup to a folder of your choice. **Import**: imports from Authy, andOTP, FreeOTP, FreeOTP+, Google Authenticator (via QR scan), Microsoft Authenticator (via QR scan), Bitwarden, KeePassXC, plus generic OTP-URI scan. **Permissions**: Aegis requests minimal Android permissions — camera (for QR scanning), and storage (for backup file access). No location, no contacts, no phone state. **Locale support**: 30+ UI translations from community contributors.\n\n**Philosophy.** Aegis's editorial differentiator is the **local-first-with-controlled-backups** posture. Cloud-based authenticators (Authy, Google Authenticator's new cloud-sync, Microsoft Authenticator's cloud-sync) make cross-device convenience the default, with the trade-off that the cloud operator becomes part of your second-factor trust surface. Aegis says: your second factor is too important to put in the cloud; keep it local, give the user explicit control over backups and sync. This isn't the right trade-off for users who prioritise convenience (cloud sync handles \"I dropped my phone in the toilet\"), but for users who treat the second factor as critical infrastructure, Aegis's local-first posture is the right model.\n\n**Grade rationale.** Grade A reflects: open-source GPLv3 codebase; F-Droid + Google Play distribution with identical signed APKs; no cloud backend, no operator infrastructure; AES-256-GCM + scrypt vault encryption (strong, modern crypto); biometric unlock via Android OS keystore (UX shortcut, not crypto bypass); supports TOTP / HOTP / Steam Guard / Yandex token types; import from most competing apps (Authy, Google Auth, MS Auth, andOTP, etc.); JSON export format with documented schema (no vendor lock-in); minimal Android permissions (camera + storage only); 30+ language UI translations; 6+ years of operational continuity (since 2019); funded by donations only (no commercial pressure); named maintainer (Alex Bakker) with public GitHub presence; cross-listed in Privacy Guides as the recommended Android authenticator. Last verified 2026-05-13.\n\n**Useful when.** You're an **Android user** wanting a TOTP/HOTP app that's local-first and doesn't require a cloud account. You're **migrating off Google Authenticator** (which has had historical issues: no encryption, lossy backups, account-tied cloud sync) and want a drop-in replacement. You want **JSON-exportable backups** that you control — store them in your KeePassXC password database, in encrypted cloud storage of your choice, or on a USB drive. You want a **biometric-protected** authenticator without trusting a cloud operator with your TOTP secrets. You're managing **family or organisational** second factors and want each device's tokens to stay isolated (each device has its own Aegis vault; no cross-device sync unless you set it up). You want a Yu-Aegis stack — pair Aegis (TOTP) with a YubiKey (hardware token for high-stakes accounts) for layered second-factor coverage.\n\n**Caveats.** **Android only** — iOS users should use Ente Auth (cross-platform, also listed at xmr.club) or another iOS-friendly authenticator. **No cross-device sync** — feature, not bug, but a friction. Solutions: (1) export Aegis vault → store in KeePassXC database → sync via your existing KeePassXC sync setup, (2) export vault → store in Nextcloud / Syncthing folder, (3) maintain separate vaults per device with overlapping accounts. **No web-based access** — there's no \"log into Aegis from a friend's computer\" path; if you don't have your phone, you don't have your TOTPs. **Backup discipline matters** — losing your phone without a backup means losing access to every 2FA-enabled account. Each time you add a token, also save its backup recovery codes from the service; or keep your Aegis vault backed up to a place you can recover from. **Storing TOTP next to passwords is a single-compromise risk** — if a compromise reaches both your password manager and your TOTP authenticator, both factors are exposed. The right defence-in-depth pattern is to keep TOTP secrets on a separate device (Aegis on phone, passwords on desktop), and for high-stakes accounts use a hardware token (YubiKey, Solokey). **Aegis import from Google Authenticator can be brittle** — Google's app stores secrets in a custom encrypted format; import via QR scan works token-by-token but bulk export from Google Authenticator has had quirks across versions. Plan to add each token individually during migration. **Biometric unlock isn't cryptographic strengthening** — it's a UX shortcut backed by the OS keystore; if Android's keystore is compromised, biometric unlock can be bypassed. The vault passphrase remains the cryptographic root; don't make the passphrase weak just because biometric unlock is convenient. **No SMS-based 2FA support** — Aegis is for TOTP/HOTP; SMS-based 2FA is a separate (weaker) system. If a service only offers SMS-2FA, consider whether that service's security posture meets your standards.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "non_custodial", "self_hosted" ], "highlight_tags": [ "FREE", "ANDROID", "TOTP" ], "fees": { "summary": "Free · GPLv3" }, "fees_summary": "Free · GPLv3", "last_verified": "2026-05-13", "operating_since": "2020", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://getaegis.app", "outbound_slug": "aegis-authenticator", "twitter": "https://x.com/beemdevelopment" } }, { "id": "agora-logistic", "category": "tools", "subcategory": "Shipping & Logistics", "name": "Agora Logistic", "url": "https://xmr.club/tools/agora-logistic", "twin": "https://xmr.club/llm/tools/agora-logistic.txt", "tagline": "Crypto-paid shipping-label aggregator — compare UPS / DHL / USPS / InPost / GLS / DPD / FedEx / BRT / Correos / SEUR rates, pay in crypto, get the printable PDF. A way to send parcels without a courier account under your real name — the shipping-address surface the August 2026 hardware-wallet breaches put in the spotlight.", "review": "**Crypto-paid shipping-label aggregator.** Enter an origin, destination and weight; compare rates across UPS, DHL, USPS, InPost, GLS, DPD, FedEx, BRT, Correos and SEUR; pay in crypto; and receive the printable PDF label. Pricing a shipment needs no account — one is only required to buy the label and keep an order history.\n\n**Why it's useful now.** It's a crypto-paid front-end to the standard postage carriers, which means you can send a parcel without a courier account existing under your legal name and without your shipping address landing on an account tied to your card. That's exactly the shipping-address rotation [`/guides/old-iphone-cold-storage`](/guides/old-iphone-cold-storage) describes for anyone who doesn't want a hardware wallet — or anything else — delivered to their real name after the August 2026 Trezor and SafePal breaches.\n\n**What you trust.** The homepage's live pricing lines up with published carrier tables across a spread of US and EU routes, and the pay-then-print flow is standard aggregator UX. What you can't see is the markup: the price shown is what you pay, but the aggregator's margin isn't itemized separately from the carrier rate, so cross-check a carrier's own quote for the same shipment if the spread matters to you.\n\n**Tenure.** The domain was registered on **2026-08-13** — about as fresh as a listing gets, under a week old, with no Wayback history. The parent `agora.supplies` currently resolves no DNS (only the `logistic.` subdomain is live), which could be a deliberate subdomain-only rollout or an unfinished stand-up.\n\n**Contact.** Telegram: `@agora_cards_pr`.\n\n**Useful when.** You want to receive a parcel — hardware wallet, laptop, anything — without your legal name on a courier record tied to an identifying card; or you just want to compare EU and US carriers in one interface instead of ten browser tabs; or you're rotating out of a Ledger / Trezor shipping trail after the August 2026 breaches.\n\n**Caveats.** It's **under a week old** with no user-report history. The **legal-page surface is missing** — `/terms`, `/about`, `/faq` all 404, the biggest reservation for the grade: the site works but is thin on operator transparency. The **parent domain has no DNS**, a small structural flag. And **aggregator markup isn't itemized** separately from the carrier rate. Buy one cheap label to a benign address first and confirm it's a real, scannable, carrier-honored PDF before you order ten for real shipments.", "translation_locale": "en", "rating": { "grade": "C", "trust": "Crypto-paid reseller front-end for major US/EU carriers. Under a week old at listing, no user-report history, no operator legal/contact page (/terms, /about, /faq all 404). Parent domain agora.supplies resolves no DNS; only the logistic. subdomain is live.", "privacy": "No account needed to price a shipment; account only for purchase. Lets you send parcels without a courier account under your legal name — the shipping-address-opsec use case. You still disclose the destination address to the carrier for delivery.", "ux": "Enter origin/destination/weight, compare 10+ US/EU carriers, pay in crypto, print the PDF. Markup is not itemized separately from the carrier rate." }, "grade": "C", "kyc_tags": [ "anonymous_signup", "no_kyc" ], "feature_tags": [ "shipping", "no_account_needed", "crypto_paid", "instant" ], "highlight_tags": [ "SHIPPING-OPSEC", "NO-KYC", "CRYPTO-PAID", "NEW" ], "fees": { "summary": "No monthly fee, no minimum volume. Per-label pricing shown live on the homepage before purchase — displays the raw carrier rate the operator charges plus (per typical aggregator practice) a small markup rolled into the shown price. Verify a single label test before batching." }, "fees_summary": "No monthly fee, no minimum volume. Per-label pricing shown live on the homepage before purchase — displays the raw carrier rate the operator charges plus (per typical aggregator practice) a small markup rolled into the shown price. Verify a single label test before batching.", "last_verified": "2026-08-17", "operating_since": "2026-08", "tenure_note": "Domain registered 2026-08-13 (RDAP). Very fresh — under a week of visible operation at the time of this listing. No Wayback snapshot yet. Parent domain `agora.supplies` has no DNS record; only the `logistic.` subdomain resolves.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://logistic.agora.supplies/", "telegram": "https://t.me/agora_cards_pr", "outbound_slug": "agora-logistic" } }, { "id": "bitwarden", "category": "tools", "subcategory": "Password Managers", "name": "Bitwarden", "url": "https://xmr.club/tools/bitwarden", "twin": "https://xmr.club/llm/tools/bitwarden.txt", "tagline": "Open-source cloud password manager. Optional self-host.", "review": "Bitwarden is the **open-source cloud password manager with verifiable self-host fallback** — a cross-platform encrypted password vault where the free tier is generous, the paid tier is ~$10/year, the entire client + server stack is open source, and **Vaultwarden** (a Rust reimplementation of the Bitwarden server) provides a lightweight self-host alternative for users who don't want to trust the hosted service. Listed at **Grade A** because Bitwarden occupies the **convenience-plus-verifiability** point on the password manager spectrum — sync across devices without the user thinking about it, while preserving the option to bail out to self-host if you stop trusting the operator.\n\n**Background.** Bitwarden was created in **2016** by **Kyle Spearrin** and is operated by **Bitwarden, Inc.** (US-incorporated company, headquartered in Florida). The product has grown from a free open-source side project to a commercial company with enterprise customers, while maintaining the open-source codebase and free-tier-for-individuals model that defined its early reputation. **Independent security audits** have been published by **Cure53** (the Berlin-based firm that also audits Tor Browser, Mullvad, IVPN, and SimpleX); audit reports linked from bitwarden.com. **Vaultwarden** (formerly bitwarden_rs) is a community-maintained Rust reimplementation of the Bitwarden server, written for users who want a lighter self-host footprint than the official Bitwarden server's Microsoft-stack containers; Vaultwarden is API-compatible with Bitwarden's official clients, listed separately at xmr.club. The Bitwarden clients themselves are open source under the **AGPLv3** license; the server code is under the same license.\n\n**What you trust.** **End-to-end encryption** — your vault is encrypted client-side with PBKDF2 (configurable iterations) key derivation from your master password; the server stores ciphertext only. **Open-source clients + server** — every component is auditable; reproducible builds documented. **Cure53 audited cryptography** — audit reports public, findings remediated. **Self-host option** — official Bitwarden server (Microsoft-stack) or **Vaultwarden** (lightweight Rust reimplementation) — both API-compatible with Bitwarden's clients. **Zero-knowledge architecture** — Bitwarden, Inc. cannot read your vault even with a court order, because they don't have the key. **Strong cryptography** — AES-256 for vault content, RSA-2048 for key exchange in shared organisations, PBKDF2 + scrypt-equivalent KDF for master password. **2FA support** — TOTP, FIDO2/WebAuthn (hardware tokens like YubiKey), Email codes, Duo. **What you don't trust**: master password loss is unrecoverable — Bitwarden cannot reset your password without breaking the zero-knowledge model. Set up an emergency-access trusted contact, or print a paper backup of your master password. **Light-KYC at signup** — Bitwarden requires an email address for the account; use a privacy-respecting email if signup-privacy matters.\n\n**Operational specs.** **Platforms**: macOS, Windows, Linux desktop apps; iOS, Android mobile; web vault at vault.bitwarden.com; browser extensions for Firefox, Chrome, Safari, Edge, Brave; CLI client for scripting. **Vault content**: passwords, secure notes, credit cards, identities, files (paid tier). **Sync**: encrypted vault syncs via Bitwarden server (or your self-hosted server); the server never sees plaintext. **Free tier**: unlimited passwords, unlimited devices, optional TOTP storage (basic), 1 cipher type per item, basic 2FA (email + TOTP). **Premium tier** ($10/year): TOTP code generation for any service, file attachments (encrypted), Bitwarden Authenticator (TOTP-only standalone app, separate), advanced 2FA (FIDO2/WebAuthn, Duo, YubiKey OTP), security health reports, emergency access. **Families plan**: $40/year for 6 users with shared vault items. **Organizations**: enterprise tiers with shared collections, granular access control, audit logs. **Payment methods**: credit card, PayPal — no cryptocurrency option directly (this is a notable gap vs Standard Notes or some VPN providers). **Encryption**: AES-CBC-256 for ciphertext, HMAC-SHA-256 for integrity, PBKDF2 with configurable iterations (default 600,000+). **Self-host**: official server (Docker), Vaultwarden (lightweight alternative), both with documented setup.\n\n**Philosophy.** Bitwarden's editorial differentiator is the **convenience-with-bailout-option** posture. KeePassXC is the local-first canonical for users who treat password storage as infrastructure they fully control. Bitwarden is the canonical for users who want cross-device sync without thinking about file-sync mechanics, but who don't want vendor lock-in: if Bitwarden, Inc.'s priorities change (acquisition, business model pivot, jurisdiction change), users can deploy Vaultwarden or the official self-host server and migrate their data without losing functionality. This **bailout option** is the editorial signal that distinguishes Bitwarden from closed-source competitors (1Password, LastPass, Dashlane) where the same scenario would mean exporting your data and rebuilding your workflow elsewhere.\n\n**Grade rationale.** Grade A reflects: open-source AGPLv3 codebase (both clients and server); 9+ years of operational continuity (since 2016); independent Cure53 audits with public findings; cross-platform clients (desktop, mobile, web, browser extensions, CLI); end-to-end encryption with documented cryptography; zero-knowledge architecture; self-host fallback via official server or Vaultwarden (community Rust reimplementation, API-compatible); generous free tier (unlimited passwords + devices); strong 2FA support (TOTP, FIDO2/WebAuthn, Duo); cross-listed in Privacy Guides peer directory as the recommended cloud-sync password manager. Last verified 2026-05-12.\n\n**Useful when.** You want **cross-device sync** for your passwords without managing file-sync mechanics. You want a password manager that's **open-source + auditable** + has a self-host fallback option. You're an **organisation or family** that needs shared password vaults with granular access control. You want **TOTP-in-password-manager convenience** (paid tier) — the trade-off is single-compromise-exposes-both-factors. You want a **proper 2FA on the vault itself** — FIDO2/WebAuthn support is solid on the paid tier. You're **considering self-host** but want to start with the hosted service to evaluate; you can migrate to self-host (Vaultwarden) later without losing functionality. You want **emergency access** for trusted contacts to recover your vault in case you become incapacitated (paid tier feature). You're a **developer** who wants a CLI to script credentials access for build pipelines.\n\n**Caveats.** **No cryptocurrency payment** — credit card / PayPal only at this writing; if you want a password manager you can pay for with XMR/BTC, your options are limited (KeePassXC is free; Standard Notes accepts crypto for notes but not passwords specifically; some paid password managers accept crypto but with weaker open-source stories). **Light-KYC at signup (email required)** — unlike KeePassXC's no-account model. Use a privacy-respecting email if signup-privacy matters. **TOTP in password manager is convenience-vs-defence-in-depth tradeoff** — storing your TOTP secret alongside your password means a vault compromise exposes both factors. For high-stakes accounts, use a separate authenticator app (Aegis on Android, Ente Auth cross-platform) or a hardware token (YubiKey). **Master password recovery is impossible without backup** — zero-knowledge cryptography means a forgotten password is unrecoverable. Set up emergency access (paid tier) or print a paper backup. **Bitwarden, Inc. is US-incorporated** — for users whose threat model involves US-state-actor concerns, the operator jurisdiction is a factor. Self-host with Vaultwarden eliminates the operator concern entirely. **Server-mediated sync is unavoidable on the hosted service** — even though the server only sees ciphertext, it sees connection metadata. Self-host eliminates this. **Vaultwarden is community-maintained** — not officially supported by Bitwarden, Inc. The Vaultwarden team is active and the project is well-regarded, but the maintenance is a separate trust evaluation. **Some advanced features are paid-only** — file attachments, TOTP generation, Bitwarden Authenticator, advanced 2FA. The free tier covers the password-storage core; the paid tier adds quality-of-life features. **Browser-extension surface adds fingerprinting risk** — the extension is auditable but installing browser extensions adds attack surface generally; for high-threat users, consider whether the autofill convenience is worth the extension footprint. **No native voice/audio support** — passwords + notes + identities + files only.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "open_source", "self_hosted", "audited", "2fa_supported" ], "highlight_tags": [ "FREE TIER", "SELF-HOST" ], "fees": { "summary": "Free tier · paid $10/yr · self-host free" }, "fees_summary": "Free tier · paid $10/yr · self-host free", "last_verified": "2026-05-12", "operating_since": "2015", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://bitwarden.com", "outbound_slug": "bitwarden", "twitter": "https://x.com/bitwarden" }, "also_listed_at": { "privacyguides": true } }, { "id": "briar", "category": "tools", "subcategory": "Messaging", "name": "Briar", "url": "https://xmr.club/tools/briar", "twin": "https://xmr.club/llm/tools/briar.txt", "tagline": "Peer-to-peer messenger over Tor, Bluetooth, or Wi-Fi. No servers, no metadata.", "review": "Briar is the **hostile-network-conditions P2P messenger** — an Android-primary application that routes messages directly between phones over Tor when you have internet, and over local Bluetooth or Wi-Fi when you don't, with no central server in the trust path. Listed at **Grade A** because Briar occupies a structural category-of-one: it's the only consumer messenger designed to keep working when the internet is cut off, the only one where the trust model genuinely eliminates the \"operator infrastructure\" surface that even SimpleX and Cwtch retain in their queue-server or onion-coordinator layers.\n\n**Background.** Briar was developed by the **Briar Project** — a not-for-profit organisation based in the UK — with research roots in the University of Cambridge's distributed-systems research and funding from the **Open Technology Fund**, **NLnet**, and individual donations. The project has been in active development since 2014, with a stable Android release since 2018. Designed explicitly around the threat model of **journalists, activists, and human-rights workers operating under censored or surveilled networks** — the use case is \"communicating when the government has shut down the internet\" rather than \"convenient daily messaging.\" Open source under **GPLv3**; codebase at code.briarproject.org/briar/briar. **Distribution**: F-Droid (canonical), Google Play (signed identical APK), direct APK download from briarproject.org. **Desktop client**: in beta for Linux at this writing (briar-desktop), Android remains the primary platform.\n\n**What you trust.** **No central server** — Briar messages never touch a Briar-operated server because there is no Briar-operated server. **Tor over internet** — when you have working internet, the application opens .onion connections between your phone and your contact's phone; the message stays inside the Tor network end-to-end. **Bluetooth + Wi-Fi mesh for offline** — when the internet is down or you're physically near another Briar user, messages route over local Bluetooth or Wi-Fi Direct between the devices; no internet involvement. **Identity is a public key** — your \"account\" is a cryptographic identity stored on your phone; there is no email, no phone number, no centralised directory. **Contact addition is in-person or via secure side channel** — you exchange your contact's public key via QR code in person, or via an existing secure channel like Signal, or via a \"remote contact\" workflow that requires a separate secure introduction. **Forward secrecy + end-to-end encryption** — every message is encrypted with per-session keys derived from the contact's public key; compromise of one message doesn't compromise the conversation history. **No PFS for old messages** — messages stored on-device are encrypted with a database key derived from your passphrase; if your phone is seized and your passphrase is compelled, the history is readable. **What you don't trust**: any operator (there isn't one); any centralised key directory (there isn't one); the network for content (Tor for online, local-link for offline).\n\n**Operational specs.** **Platforms**: Android (F-Droid, Google Play, direct APK) — the primary platform. **Briar Desktop** is in beta for Linux. **Identity**: per-device cryptographic identity stored locally; no account, no email, no phone number. **Adding contacts**: in-person QR-code exchange (recommended for high-threat scenarios), Bluetooth handshake when nearby, or \"introduction by a mutual contact\" (a third party you both trust introduces you). **Messaging**: 1:1 messages, private groups, public forums (limited scope), and blogs (one-way broadcasts to subscribers). **Network modes**: **internet** (Tor onion connection between devices), **Bluetooth** (peer-to-peer between nearby devices), **Wi-Fi Direct** (peer-to-peer over local Wi-Fi without internet), **Wi-Fi via local network** (when phones are on the same Wi-Fi). **No push notifications** — Briar checks for messages itself when the app is running; iOS-style push notifications would require a server, which Briar doesn't have. **Battery considerations**: continuous Tor + Bluetooth makes battery usage noticeable; Briar provides battery-optimisation settings to balance liveness vs power. **Offline message forwarding**: in mesh mode, if you're connected to user A and they're connected to user B, messages from you can hop through user A to reach B even without internet — assuming all three trust each other and the mesh is configured.\n\n**Philosophy.** Briar's editorial differentiator is the **eliminate-operator-infrastructure** model. SimpleX, Cwtch, Signal — all have some form of operator infrastructure (SimpleX queue servers, Cwtch onion coordinators, Signal's centralised server) that's in the trust path even when the content is end-to-end encrypted. Briar says: even encrypted-content-on-a-server is metadata exposure, and the only way to truly eliminate metadata is to not have a server. The trade-off: convenience — no offline message delivery to a recipient who's not currently online (in pure P2P mode, the message waits in your outbox until both phones are reachable to each other directly or via mesh hop). For most users this is impractical compared to \"send a message, recipient gets it on their phone whenever they next open the app.\" For the threat model Briar is designed for, this is a feature — there's no server to log \"X sent message at time T to Y.\"\n\n**Grade rationale.** Grade A reflects: open-source GPLv3 codebase; not-for-profit operator structure (Briar Project, UK); 10+ years of operational continuity; funded by Open Technology Fund + NLnet + donations (no commercial pressure); independent security audits with published reports at briarproject.org; F-Droid + Google Play + APK distribution (multi-channel trust diversification); no central server, no operator infrastructure to subpoena; native Tor + Bluetooth + Wi-Fi mesh network modes; in-person QR-code contact-add workflow (the strongest identity-binding option); cross-listed in Privacy Guides peer directory. Last verified 2026-05-12.\n\n**Useful when.** You're a **journalist or activist in a hostile network environment** — Briar is built for this; the offline mesh mode keeps working when the government cuts the internet. You're at a **protest or event** where you need to coordinate with people physically near you without using cellular or operator-controlled networks. You're a **human rights worker** in a region where messenger metadata can put sources at risk. You want a messenger where **the trust model doesn't include any operator** — Briar is the strongest in this category. You're already on Android and want a privacy messenger that complements SimpleX (queue-server-based) and Signal (centralised-but-encrypted) by occupying the \"no server at all\" point on the spectrum.\n\n**Caveats.** **Android-primary** — iOS users have no Briar option (iOS sandbox restrictions on background Bluetooth/Wi-Fi-Direct prevent porting). For iOS, use SimpleX or Signal with appropriate threat-model adjustments. **Battery usage is noticeable** — running Tor + Bluetooth continuously costs battery. Adjust the in-app battery optimization settings, or accept the trade-off as the price of the trust model. **No offline message delivery to an offline recipient** — in pure P2P mode, the message waits in your outbox until you and your recipient are both reachable (Tor-online, Bluetooth-nearby, or via mesh hop). For \"send a message and forget\" UX, use a queue-server-based messenger. **No multi-device sync** — your Briar identity is per-device; if you install Briar on a second phone, it's a different identity from the first. Per-device identity is a feature for plausible deniability but a friction for users who want desktop + mobile sync. **Contact addition has friction** — in-person QR exchange is the strongest workflow but requires being physically near the contact; the \"introduction by mutual contact\" workflow requires a mutually-trusted third party. For non-paranoid users coming from Signal, this friction is real. **Public forums and blogs are limited scope** — they work but they're not designed to be the primary social-media surface; you wouldn't use Briar as your Twitter replacement. **Desktop is beta** — Linux desktop client exists but is not as mature as the Android app; expect rough edges if you're testing the desktop path. **No native voice/video calls** — Briar's mesh networking is designed for asynchronous text + small attachments; for voice/video, use Signal or Element. **Phone seizure exposes message history** — Briar stores conversation history locally; if your phone is seized and your unlock passphrase is compelled, the history is readable. For high-threat scenarios, use the in-app feature to wipe messages on a schedule, or use a separate device that you can leave behind.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "tor_supported", "self_hosted" ], "highlight_tags": [ "P2P", "TOR", "OFFLINE" ], "fees": { "summary": "Free · F-Droid + Play Store · Android primary" }, "fees_summary": "Free · F-Droid + Play Store · Android primary", "last_verified": "2026-05-12", "operating_since": "2018", "tenure_note": "Briar Project public release 2018-05 (1.0). Development started 2012, but the service has been usable since 2018 — tenure here tracks user-facing operation.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://briarproject.org", "outbound_slug": "briar" }, "also_listed_at": { "privacyguides": true } }, { "id": "calyx-os", "category": "tools", "subcategory": "Mobile OS", "name": "CalyxOS", "url": "https://xmr.club/tools/calyx-os", "twin": "https://xmr.club/llm/tools/calyx-os.txt", "tagline": "Privacy-focused Android distribution. Pixel + select hardware. MicroG bundled, Tor-aware, Datura firewall.", "review": "CalyxOS is the **user-friendly-tradeoff privacy Android distribution** — an Android fork by the **Calyx Institute** that ships with **microG** out of the box (Play Services compatibility), **Orbot** for system-wide Tor routing, the **Datura per-app firewall**, and a deliberately less-locked-down posture than GrapheneOS. Listed at **Grade A** because CalyxOS occupies the **balanced** point on the privacy-Android spectrum — meaningfully harder to deanonymise than stock Android, deliberately easier to use than GrapheneOS, with sane defaults that don't require the user to manually configure each component.\n\n**Background.** CalyxOS is developed by the **Calyx Institute** — a US-registered 501(c)(3) non-profit organisation focused on digital rights and infrastructure for civil society. The Institute has been operating since 2010 (longer than most privacy-tooling organisations); CalyxOS itself launched in 2018 as a pre-installed-image alternative to flashing AOSP custom ROMs manually. Open source; codebase tracked on Calyx Institute infrastructure with mirrors. **Supported hardware**: Google Pixel devices primarily (Pixel 6/7/8/9/Tablet at this writing); some other devices have community-maintained ports. Distribution: official installer (Datura-flasher), manual flash from images. **Funding**: Calyx Institute's non-profit funding mix includes individual donations, foundation grants (Mozilla, NLnet), and corporate sponsorships; the Institute also operates other services (the **VPN-like Calyx Internet Membership** for example) but CalyxOS itself is free.\n\n**What you trust.** **AOSP-based** — built on the Android Open Source Project, the well-audited base that Google itself ships. **microG** — an open-source reimplementation of Google Play Services, providing the API surface that apps expect from Google's services without sending your data to Google. Apps that \"need Play Services\" can run on CalyxOS without Google itself in the loop. **Orbot bundled** — system-wide Tor routing is a one-toggle feature; you can flip \"route everything through Tor\" or \"route just specific apps through Tor.\" **Datura firewall** — per-app network access control; you decide which apps can use which networks. **Verified boot** — like all modern Android, CalyxOS verifies the OS chain at boot to prevent persistent malware. **Hardware-key support** — YubiKey, Solokey, and similar work for app-level 2FA. **Open-source kernel + drivers** — to the extent Google ships these (most are; some proprietary Pixel components are inherited). **What you don't trust**: **microG is good but not zero-leak** — Play Services is being reimplemented, but Google still sees the inevitable telemetry that microG forwards on behalf of apps that demand Play Services connectivity. For apps you don't trust, disable microG and run them sandboxed. **Hardware-vendor (Google) trust** — the Pixel firmware and baseband are Google-controlled; running CalyxOS on Pixel hardware means trusting Google's hardware-level controls (this is true of GrapheneOS too — it's the inevitable hardware-trust ceiling on Pixel devices).\n\n**Operational specs.** **Hardware**: Google Pixel (latest several generations); community ports for some other devices (Fairphone, certain OnePlus/Sony models). **Distribution**: official Datura-flasher (one-click install for Linux/macOS/Windows), manual flash from images. **Default services**: Aurora Store (anonymous Google Play access), F-Droid (open-source app store), microG (Play Services replacement), Orbot (system-wide Tor), Datura (per-app firewall), default messenger is **Signal** (vs GrapheneOS which defaults to nothing). **Default browser**: Vanadium (the Privacy-enhanced Chromium) is included; Tor Browser is recommended for high-stakes anonymity. **Update model**: monthly security updates from Calyx, applied via OTA (over-the-air) on supported devices. **AOSP version**: tracks recent Android releases with a few months of lag (typical for privacy-Android forks). **Hardware-token support**: YubiKey, FIDO2/WebAuthn keys work for app-level 2FA. **Verified boot**: locked bootloader option after installation; warning at boot tells you it's not Google-signed but the chain is verified. **Bluetooth and Wi-Fi MAC randomisation**: yes, per-network and per-session.\n\n**Philosophy.** CalyxOS's editorial differentiator is the **user-friendly-defaults** posture — privacy Android with sane defaults so users don't need to manually configure each privacy primitive. GrapheneOS is the canonical strictest-security privacy Android (more locked-down, fewer microG bundled, harder learning curve for non-technical users). LineageOS is the canonical no-Google Android (less privacy-focused, more general-purpose). CalyxOS sits between: more locked-down than LineageOS, more user-friendly than GrapheneOS. The trade-off: shipping microG by default expands the attack surface compared to a no-Google-Services baseline; for users who need Play Services compatibility, that trade-off is necessary; for users who don't, GrapheneOS is more conservative. **The Calyx Institute's funding diversity** (non-profit with multiple foundation backers) is the long-term sustainability signal that differentiates it from some smaller AOSP fork projects.\n\n**Grade rationale.** Grade A reflects: open-source codebase; backed by **Calyx Institute** (15+ year non-profit with strong digital rights track record); 7+ years of CalyxOS operational continuity (since 2018); monthly security updates; supported on widely-available Pixel hardware (no exotic-device requirement); ships microG out of the box (Play Services compatibility for users who need it without sending data to Google); bundled Orbot for system-wide Tor (one-toggle system anonymity); Datura per-app firewall for granular network control; default no-Google app stores (Aurora + F-Droid); verified boot supported; cross-listed in web3privacy peer directory. Last verified 2026-05-13.\n\n**Useful when.** You want a **privacy-Android with user-friendly defaults** — CalyxOS is the canonical pick when GrapheneOS feels too restrictive for everyday use. You **need Play Services compatibility** for specific apps (banking, food delivery, ride-share, government apps) but don't want to send your data to Google — microG bundled gets you the API surface without the data flow. You want **system-wide Tor as a toggle** — Orbot integration in CalyxOS is the cleanest mobile implementation. You're a **journalist or activist** in a region where Pixel hardware is available and you need a privacy-focused Android. You're **graduating from a stock Android phone** and want a meaningful privacy upgrade without the GrapheneOS learning curve. You want a **non-profit-backed Android fork** with long-term sustainability — Calyx Institute's funding diversity is the editorial signal here.\n\n**Caveats.** **Pixel hardware primarily** — for other phones, community ports exist but coverage is uneven; verify your specific device is well-supported before installing. **microG is not the same as no-Google** — microG forwards some traffic to Google to provide Play Services API; for the strictest privacy posture, install no Google services at all (GrapheneOS in default mode). **Banking and government apps may detect microG** — some apps detect modified Play Services and refuse to run; if you depend on a specific app, test before relying on CalyxOS for that workflow. **Hardware-vendor trust ceiling on Pixel** — Google controls Pixel firmware and basebands; running CalyxOS doesn't eliminate this trust dependency (GrapheneOS faces the same constraint). **Verified boot warning at startup** — Pixel + CalyxOS with locked bootloader shows a yellow-state warning at boot (\"OS is not Google-signed but verified\") — this is normal and expected. **Less locked-down than GrapheneOS** — for users whose threat model includes sophisticated state-actor attacks, GrapheneOS's stricter defaults are the canonical pick. **Updates lag stock Android by 1-2 months** — Calyx ports each Android release after Google's; security updates are monthly but the lag means you're not always on the absolute latest patch level. **Installation is one-time technical effort** — Datura-flasher makes it easy but still requires unlocking the bootloader (Pixel-specific procedure, requires factory reset). **No iOS equivalent** — Apple's locked ecosystem means there's no comparable privacy-iOS. iOS users who want the equivalent privacy posture have no equivalent option; the realistic path is \"switch to Pixel and install CalyxOS or GrapheneOS.\" **Aurora Store anonymous use has its own quirks** — fetching apps from Google Play anonymously via Aurora works most of the time; some apps that require account-based purchases may not be fetchable without a signed-in account.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "tor_supported" ], "highlight_tags": [ "ANDROID", "PRIVACY-OS", "TOR" ], "fees": { "summary": "Free · Pixel + select hardware · install via flasher" }, "fees_summary": "Free · Pixel + select hardware · install via flasher", "last_verified": "2026-05-13", "operating_since": "2018", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://calyxos.org", "outbound_slug": "calyx-os", "twitter": "https://x.com/calyxinstitute", "matrix": "https://matrix.to/#/calyxos:matrix.org" }, "also_listed_at": { "web3privacy": true } }, { "id": "cryptomator", "category": "tools", "subcategory": "Disk Encryption", "name": "Cryptomator", "url": "https://xmr.club/tools/cryptomator", "twin": "https://xmr.club/llm/tools/cryptomator.txt", "tagline": "Client-side encryption for cloud storage — Dropbox / GDrive / iCloud see only ciphertext.", "review": "Cryptomator solves the cloud-storage privacy problem without asking you to leave the cloud: it transparently encrypts your files on your own device before they ever sync to Dropbox, Google Drive, OneDrive, or any folder, so the provider stores only ciphertext and you keep the keys.\n\n**Background**\nOpen-source and developed by Skymatic (Germany), Cryptomator creates encrypted \"vaults\" — virtual drives that look like normal folders to you but are individually encrypted on disk. The desktop apps (Windows/macOS/Linux) are free and FOSS; the mobile apps are a modest one-time purchase. It has undergone independent security audits.\n\n**What you trust**\nYou trust open, auditable code and a zero-knowledge design: there are no accounts, no Cryptomator servers, and no telemetry — encryption happens entirely client-side with a password only you hold. File contents *and* filenames are encrypted, and each file is encrypted independently so cloud sync stays efficient.\n\n**Operational specs**\nAES-256 encryption with scrypt-hardened password derivation. Per-file encryption means changing one document re-uploads only that file, not the whole vault. Works transparently over any sync client or local/network drive. Cross-platform with the same vault format everywhere. No proprietary lock-in — vaults are just encrypted files you can move freely.\n\n**Philosophy**\nCryptomator's stance is that you shouldn't have to choose between the convenience of mainstream cloud storage and confidentiality. By inserting a transparent encryption layer you control, it neutralizes provider access, lawful-access requests to the provider, and breaches — the cloud holds only opaque blobs.\n\n**Grade rationale**\nGrade A. Open-source, audited, zero-knowledge, cross-platform, and provider-agnostic — it's the standard answer for client-side cloud encryption. Graded best-in-class for its role; it complements rather than replaces full-disk or end-to-end-encrypted storage services.\n\n**Useful when**\nYou use mainstream cloud storage but want the provider blind to your files; you need to encrypt a synced folder, USB drive, or backup; you want filenames hidden too; you value open-source you can audit and no account.\n\n**Caveats**\nIt protects data at rest in the cloud, not your endpoint — a compromised device with an unlocked vault is exposed. There's no password recovery: forget the vault password and the data is gone by design. Mobile apps are paid. It encrypts files, not the *fact* that you use cloud storage — metadata like vault size and sync timing remains visible to the provider.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "non_custodial", "audited" ], "highlight_tags": [ "CLIENT-SIDE", "CLOUD-AGNOSTIC" ], "fees": { "summary": "Free (desktop) · ~$15 one-time (mobile)" }, "fees_summary": "Free (desktop) · ~$15 one-time (mobile)", "last_verified": "2026-05-13", "operating_since": "2014", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://cryptomator.org", "outbound_slug": "cryptomator", "twitter": "https://x.com/calia1120" }, "also_listed_at": { "privacyguides": true } }, { "id": "cryptosteel-capsule", "category": "tools", "subcategory": "Backup", "name": "Cryptosteel Capsule", "url": "https://xmr.club/tools/cryptosteel-capsule", "twin": "https://xmr.club/llm/tools/cryptosteel-capsule.txt", "tagline": "Steel seed-phrase backup. Fire/water/EMP-resistant. One-time purchase.", "review": "The Cryptosteel Capsule answers a question most self-custody setups ignore: your seed phrase survives a misplaced wallet, but does it survive a house fire? This is a stainless-steel device that stores your recovery words as physical metal tiles — no electronics, no battery, just an object engineered to outlast paper, flood, and flame.\n\n**Background**\nMade by Cryptosteel, the Capsule is a screw-sealed stainless-steel cylinder into which you slot individual letter tiles to spell out your BIP39 recovery words (typically the first four letters of each). It is a purely mechanical backup product — there is nothing to update, hack, or power.\n\n**What you trust**\nYou trust metallurgy, not a vendor's servers. There is no firmware, no supply-chain backdoor surface, and no network — the only attack is physical access to the capsule itself, which is your job to control. Because it stores a seed, not keys in use, it never touches a transaction.\n\n**Operational specs**\nStainless steel rated to roughly 1400°C, corrosion-resistant, and crush-resistant — it shrugs off the fire and water that destroy paper or ink backups. You assemble it by hand, sliding pre-stamped letter tiles onto rails and locking the cap. Compatible with any BIP39 seed (and most recovery phrases). A one-time, offline, set-and-forget cold backup.\n\n**Philosophy**\nThe Capsule embodies the unglamorous truth of self-custody: the failure mode that wipes out more coins than hackers is a destroyed or lost backup. By making the seed backup itself disaster-proof, it closes the gap between \"I wrote it down\" and \"I can actually recover.\"\n\n**Grade rationale**\nGrade A. A simple, durable, electronics-free seed backup that does exactly one thing extremely well. The manual assembly and the need to physically secure it are inherent to the category, not flaws; for resilient cold backup, steel beats paper decisively.\n\n**Useful when**\nYou hold long-term Bitcoin or Monero and want a fire/flood-proof seed backup; you're building a multisig and need durable per-key backups; you distrust paper for anything you can't afford to lose; you want a backup with zero attack surface.\n\n**Caveats**\nIt protects against disaster, not theft — anyone who finds and opens it reads your seed, so location secrecy (and ideally a passphrase/25th word kept separately) matters. Assembly is fiddly and error-prone; verify the spelling before sealing. It backs up the seed only — it is not a wallet or a signing device.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "non_custodial" ], "highlight_tags": [ "HARDWARE", "BACKUP", "STEEL" ], "fees": { "summary": "€89 one-time · BTC accepted · physical product" }, "fees_summary": "€89 one-time · BTC accepted · physical product", "last_verified": "2026-05-13", "operating_since": "2014", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://cryptosteel.com", "outbound_slug": "cryptosteel-capsule" } }, { "id": "cryptpad", "category": "tools", "subcategory": "Office Suite", "name": "CryptPad", "url": "https://xmr.club/tools/cryptpad", "twin": "https://xmr.club/llm/tools/cryptpad.txt", "tagline": "Encrypted-in-browser real-time office suite. Documents, sheets, slides — server never sees plaintext.", "review": "CryptPad is the **encrypted-in-browser real-time collaborative office suite** — an open-source platform offering rich documents, spreadsheets, presentations, kanban boards, and forms where all encryption happens **client-side** and the server stores only ciphertext. Listed at **Grade A** because CryptPad occupies a unique structural slot: real-time collaboration (people typing in the same doc simultaneously, seeing each other's cursors, exchanging comments) **with** zero-knowledge encryption — combining the convenience of Google Docs/Notion with a privacy posture the cloud office suites can't match.\n\n**Background.** CryptPad was developed by **XWiki SAS** (a French open-source software company) and is now maintained by the **CryptPad team** within XWiki. Active development since 2014 (originally as a single-pad CodeMirror demo, evolved into the full office suite). Open source under **AGPLv3**; codebase at github.com/xwiki-labs/cryptpad. The public hosted instance at **cryptpad.fr** is free and reasonably scaled; **self-host** is well-supported with documented Docker deployment + production-grade configuration guides. Funding mix: French government IT body **DINUM** (Direction Interministérielle du Numérique), **NLnet** grants, **NGI Zero** (Next Generation Internet from the European Commission), plus paid features on the hosted plans. The funding model means CryptPad has long-term sustainability through public-interest channels rather than VC pressure.\n\n**What you trust.** **Client-side encryption** — the server stores ciphertext; encryption keys live in the URL fragment (the part after `#` which browsers never send to servers). When you share a CryptPad URL, the key travels in the URL fragment and the server never sees it. **Open-source codebase** — every component is auditable. **Zero-knowledge architecture** — CryptPad operator (or self-hosted operator) can't read your document content even if they wanted to. **Real-time collaboration via CRDTs** — Conflict-free Replicated Data Types are the cryptographic-friendly primitive that lets multiple editors converge on the same encrypted document state. **No tracking** — CryptPad's privacy policy and codebase are explicit about not tracking users; no analytics SDK, no user-identifying telemetry. **Tor-friendly** — works on Tor Browser without aggressive anti-Tor measures. **What you don't trust**: URL fragments — your encryption key is in the URL; if you share the URL with someone, you've shared the key. Anyone with the URL can read the document. Treat URL sharing as the access-control mechanism (which it is, by design). **Server metadata** — the server sees connection timing, document size, edit frequency (encrypted but visible as encrypted blobs). For high-threat scenarios, self-host. **Browser-level trust** — encryption happens in JavaScript running in your browser; a compromised browser or malicious extension can read documents at the point where the JS handles plaintext.\n\n**Operational specs.** **Platform**: web application — works in any modern browser; no native apps. **Application types**: **Rich text documents** (collaborative editor with formatting, similar to Google Docs), **Sheets** (spreadsheets, similar to Google Sheets), **Presentations** (slide deck), **Code** (collaborative code editor with syntax highlighting for ~50 languages), **Markdown**, **Whiteboard** (drawing/sketching), **Kanban** (project management), **Forms / Polls** (surveys and shared decision-making), **Drive** (file storage / organising). **Registered vs anonymous use**: anonymous use is fully supported (just open cryptpad.fr and start a document); registered use unlocks persistent profile + drive storage + premium quotas. **Storage limits**: cryptpad.fr free tier ~1GB per account; paid tiers up to 50GB+; self-host is limited only by your server's disk. **Tor compatibility**: works on Tor Browser with normal settings (some real-time features may degrade slightly on slower Tor circuits). **Self-host deployment**: documented Docker setup, plus production guidance for nginx reverse proxy, TLS, and storage configuration. **Federation**: not in the Matrix sense — but CryptPad documents can be shared between separately-operated CryptPad instances if both sides have the URL.\n\n**Philosophy.** CryptPad's editorial differentiator is the **real-time-collaboration-with-zero-knowledge** model. Standard Notes is great for note-taking solo; KeePassXC for password storage; Element/Matrix for chat. The \"collaborative office suite\" slot is dominated by Google Docs (no privacy posture), Microsoft 365 (same), and Notion (some encryption but proprietary, US-cloud). CryptPad says: collaboration is a legitimate use case; encryption shouldn't be impossible just because multiple people edit together. The technical innovation is making CRDTs work in an end-to-end-encrypted setting. The trade-off: URL-fragment-as-key is a different access-control model than account-based sharing (you share via URL, not by inviting a username), which has its own UX implications (forwarded URLs grant access; revoked access requires regenerating the URL).\n\n**Grade rationale.** Grade A reflects: open-source AGPLv3 codebase; 11+ years of operational continuity (since 2014); independent **security audits** by Cure53 and ROS (Radically Open Security); zero-knowledge architecture with client-side encryption; real-time collaboration via CRDTs; multiple application types (docs, sheets, slides, code, drive, kanban, etc.); public-interest funding (DINUM, NLnet, NGI Zero — no VC dependence); self-host fallback well-documented; Tor-friendly; no tracking, no analytics SDK; named operator (XWiki SAS / French company with public identity); cross-listed in web3privacy peer directory. Last verified 2026-05-13.\n\n**Useful when.** You want **real-time collaboration** (multiple people typing in the same document simultaneously) with **zero-knowledge encryption** — CryptPad is the canonical pick. You're an **organisation or activist group** that needs shared document workflows but doesn't want to trust Google or Microsoft with the content. You want to **self-host** an office suite — CryptPad is one of the few open-source real-time collaborative options with documented deployment. You want **shared decision-making tools** (polls, forms, kanban) without account-tied vendor lock-in. You're **anonymously collaborating** with a contact — you can both open cryptpad.fr without accounts, generate a document, share the URL, edit together. You're an **education or research** team handling sensitive content that has collaboration needs. You're building privacy-respecting infrastructure and need a collaborative-doc-equivalent of Google Docs as part of the stack.\n\n**Caveats.** **URL-as-access-token model** — anyone with the URL can read/edit (depending on URL type); treat URL forwarding as access grants. For revoking access, regenerate the URL and update collaborators. **Server-side metadata visibility** — encrypted blobs are encrypted, but the server sees connection timing, document edit cadence, and document sizes. For high-threat use, self-host. **Browser-trust ceiling** — encryption happens in browser JavaScript; a compromised browser (or malicious extension) can read plaintext at the point of decryption. Use hardened browsers (Tor Browser, Mullvad Browser) for high-threat documents. **Real-time sync over Tor can be slower** — Tor's latency makes typing-with-multiple-collaborators feel noticeable; for asynchronous editing this is fine. **No native mobile apps** — web only at this writing; mobile users use the web version with appropriate browser. **Self-host has operational overhead** — Docker is easy; production setup (TLS, persistence, scaling) requires some sysadmin skill. **Free tier on cryptpad.fr has storage caps** — 1GB on the free tier; for heavier use, pay or self-host. **Recovery without account is limited** — anonymous use loses documents if the URL is lost; registered use offers Drive persistence; self-host gives you full control. **Multi-language UI is comprehensive but not all features are translated** — the core UI is well-translated; some advanced features and documentation lag the English version. **Doesn't replace Office's advanced features** — for users who depend on specific Microsoft Office features (advanced spreadsheet macros, complex slide animations, integrated Outlook-grade workflows), CryptPad's feature set is structurally less feature-rich. For typical collaborative document use (text, sheets, slides, kanban, polls, forms), CryptPad is sufficient.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted", "tor_supported" ], "highlight_tags": [ "E2E", "SELF-HOST", "REAL-TIME" ], "fees": { "summary": "Free · AGPL · self-host or cryptpad.fr public" }, "fees_summary": "Free · AGPL · self-host or cryptpad.fr public", "last_verified": "2026-05-13", "operating_since": "2014", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://cryptpad.fr", "outbound_slug": "cryptpad" }, "also_listed_at": { "web3privacy": true } }, { "id": "cwtch", "category": "tools", "subcategory": "Messaging", "name": "Cwtch", "url": "https://xmr.club/tools/cwtch", "twin": "https://xmr.club/llm/tools/cwtch.txt", "tagline": "Tor-only multi-party chat. No accounts, no servers, every conversation an ephemeral .onion.", "review": "Cwtch is the **Tor-only multi-party messenger where every user is a `.onion` address** — a metadata-resistant chat application from the **Open Privacy Research Society** in which group conversations live on ephemeral onion services hosted by participants themselves, with no central registry, no phone numbers, no email. Listed at **Grade A** because Cwtch occupies a structurally unique position in the privacy-messenger landscape: it eliminates the operator-infrastructure surface that even SimpleX retains, by making each user's identity *literally* a Tor onion address rather than an account on someone's server.\n\n**Background.** Cwtch (pronounced \"kutch\" — a Welsh word meaning \"a safe place / a hug\") was created by **Sarah Jamie Lewis** at the **Open Privacy Research Society** (Vancouver-based not-for-profit research org focused on privacy primitives). Lewis is also the author of \"Queer Privacy\" and has been a long-running voice in privacy research focused on threat models that involve **coercion, intimate partner surveillance, and state-actor pressure on marginalised communities** — threat models the mainstream privacy-tooling community has historically under-served. Cwtch has been in active development since 2018, with stable cross-platform releases since around 2021. Open source under the **MIT license** (with some BSD-licensed dependencies); codebase at https://git.openprivacy.ca/cwtch.im/cwtch. Cross-platform: **macOS, Windows, Linux, Android** (iOS not supported due to Apple's restrictions on background networking that Cwtch's architecture requires). Funded by Open Privacy donations + grants (Open Tech Fund and similar); no commercial entity behind the project.\n\n**What you trust.** **You are your `.onion` address** — when you create a Cwtch profile, you generate a Tor v3 onion service running locally on your device. Your contact information *is* the .onion address. Adding contacts means exchanging .onion addresses (via QR code in person, via Signal/PGP side-channel, or via the in-app Introduction workflow). **Group chats are ephemeral onion services** — when you start a group chat, one participant hosts a temporary onion service for it; messages route through Tor to that service; participants subscribe via Tor. When the host closes the chat, the service vanishes. **No central server** — there is no Cwtch-operated infrastructure. Every conversation happens between participants' devices over Tor onion routing. **Metadata resistance** — Cwtch's design specifically targets metadata leaks: no centralised database of who-talks-to-whom, no phone-number directory, no account-to-identity mapping. **Open-source codebase** — the source is auditable; releases are signed; reproducible-build documentation exists. **Profile-per-context** — you can run multiple Cwtch profiles on the same device (each is a separate .onion identity), allowing per-context identity-compartmentalisation. **What you don't trust**: your device — Cwtch profiles persist locally; if your device is seized, the conversation history is at risk (mitigated by per-profile passphrases). **iOS support is absent** — Apple's restrictions on Tor and background networking prevent a Cwtch iOS port.\n\n**Operational specs.** **Platforms**: macOS, Windows, Linux desktop apps; Android. **No iOS** — Apple's policies make a port impractical. **Identity**: per-profile Tor v3 onion service generated on device; the `.onion` address is your contact information. **Multiple profiles**: yes — separate profiles can run on the same device, each with its own .onion identity. **Profile encryption**: optional passphrase per profile; the profile data is encrypted at rest. **Contact addition**: in-person QR-code exchange (highest-trust workflow), .onion address shared via side-channel, or the in-app Introduction workflow (a mutual contact introduces you). **Group chats**: ephemeral onion services hosted by participants; multi-party text + small attachments. **File transfers**: small files supported within chats; larger transfers handled by sidecar tools (OnionShare is recommended for files Cwtch is too small to handle gracefully). **Server (advanced feature)**: optional persistent group-hosting server — a Cwtch user can run a \"Cwtch server\" (separate binary) to host long-running group chats that survive the original participant going offline. The server sees encrypted ciphertext but not message content, similar to Matrix homeserver model. **Tor integration**: Cwtch bundles its own Tor instance OR can use a system Tor; the entire app's networking is Tor-routed.\n\n**Philosophy.** Cwtch's editorial differentiator is the **identity-as-onion-address** model. SimpleX uses queue servers (operator infrastructure for message delivery); Signal uses a centralised server (operator infrastructure for everything); Briar uses peer-to-peer-over-Tor (no operator but no offline message delivery). Cwtch sits in a unique slot: peer-to-peer with onion services as identity primitives, optional persistent servers for groups that need always-on hosting, and an explicit research focus on **coercion-resistant** threat models (Open Privacy's research mandate). The Welsh-language name and the explicit framing for marginalised threat models signal the project's design philosophy: privacy isn't a one-size-fits-all engineering problem; it depends on whom you're protecting from.\n\n**Grade rationale.** Grade A reflects: open-source MIT license codebase; Open Privacy Research Society organisational backing (not-for-profit research org, public mission); 7+ years of operational continuity (since 2018); cross-platform desktop + Android (macOS, Windows, Linux, Android); no central server, no operator infrastructure to subpoena; **identity-as-onion-address** model (the strongest decoupling of identity from any central registry); ephemeral group chats as default (groups vanish when participants leave); profile-per-context support for identity compartmentalisation; named maintainer (Sarah Jamie Lewis) with public identity and research track record; explicit design focus on coercion-resistant threat models often under-served by mainstream privacy tooling. Last verified 2026-05-13.\n\n**Useful when.** You need a messenger where **your identity isn't tied to a phone number, email, or username on someone's server** — Cwtch's onion-address-as-identity is the canonical pick. You're in a **threat model where coercion is a credible risk** — Cwtch's project mandate includes explicit consideration of these scenarios. You want **ephemeral group chats** that disappear when the host closes them — Cwtch's default model. You want to **identity-compartmentalise** by running multiple Cwtch profiles on the same device (personal, activism, research) with no link between them. You're building **research or activist infrastructure** and want a messenger that the Open Privacy Research Society explicitly designed for the threat models you care about. You're on **Android desktop** stack and want a Tor-only messenger that pairs with Tor Browser, OnionShare, and Whonix in your privacy stack.\n\n**Caveats.** **No iOS** — desktop and Android only; iOS users need an alternative (SimpleX, Briar). **Tor latency** — Cwtch's networking is entirely Tor-routed; expect Tor's typical latency (200ms-2s) on message send/receive. For real-time chat with low latency expectations, this is a friction. **Smaller ecosystem than SimpleX or Signal** — fewer contacts are likely to already use Cwtch; you'll be onboarding people one at a time. **No offline message delivery to offline recipients** — like Briar, pure-P2P Cwtch chats require both parties to be reachable (Tor-online) for messages to flow. The persistent-server feature (advanced) addresses this but adds operational complexity. **Persistent-server feature is a separate trust evaluation** — if you run a Cwtch server for groups, that server is now operator infrastructure (encrypted ciphertext only, but still metadata-visible). Pure-P2P Cwtch has the strongest trust model; server-mediated Cwtch is a trade-off. **No native voice/video** — Cwtch is text-and-small-files; for voice/video, use Signal or Element. **Profile loss is unrecoverable** — your onion service is your identity; lose the device or the profile data, and that identity is gone (along with any conversation history attached). Plan for device replacement: export profile data to a secure backup, or accept identity loss when the device dies. **File transfers are limited** — for files larger than a few MB, Cwtch's chat interface is awkward; use OnionShare for proper file-transfer workflows and Cwtch for the conversation around them. **Performance on Android can be uneven** — Cwtch is resource-heavier than typical messengers because of the bundled Tor instance; on older Android devices, expect noticeable battery use. **The Welsh name is intentional but unfamiliar** — \"Cwtch\" pronounced \"kutch\" can confuse contacts who don't know the project; the rest of the privacy stack uses English-named tools.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "tor_supported" ], "highlight_tags": [ "TOR", "P2P", "EPHEMERAL" ], "fees": { "summary": "Free · Tor-only · multi-platform · ephemeral groups" }, "fees_summary": "Free · Tor-only · multi-platform · ephemeral groups", "last_verified": "2026-05-13", "operating_since": "2018", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2018", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://cwtch.im", "outbound_slug": "cwtch", "twitter": "https://x.com/cwtch_im" } }, { "id": "disperse-rip", "category": "tools", "subcategory": "Crypto Ops", "name": "disperse.rip", "url": "https://xmr.club/tools/disperse-rip", "twin": "https://xmr.club/llm/tools/disperse-rip.txt", "tagline": "Batch USDT/ETH dispersal — pay 1000 recipients in one transaction.", "review": "Walletless batch send for USDT (TRC20/ERC20/BEP20) and native EVM tokens. No-signup mode pays a small per-recipient surcharge that we forward to gas. Bring-your-own-wallet mode is gas-only.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "api_available" ], "highlight_tags": [ "BATCH", "USDT" ], "fees": { "summary": "No-wallet mode: ~5 USDT base + 4.5 USDT/recipient · BYO mode: gas only" }, "fees_summary": "No-wallet mode: ~5 USDT base + 4.5 USDT/recipient · BYO mode: gas only", "last_verified": "2026-05-12", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": true, "editors_pick": false, "links": { "web": "https://disperse.rip", "outbound_slug": "disperse-rip" } }, { "id": "ente-auth", "category": "tools", "subcategory": "Two-Factor", "name": "Ente Auth", "url": "https://xmr.club/tools/ente-auth", "twin": "https://xmr.club/llm/tools/ente-auth.txt", "tagline": "Cross-platform TOTP app with E2E-encrypted sync. Free tier, no account required for local-only use.", "review": "Ente Auth is an open-source two-factor authenticator that does the one thing Authy and Google Authenticator get wrong: it gives you end-to-end-encrypted, cross-device backups of your TOTP secrets without locking you into a closed ecosystem or handing the codes to a provider.\n\n**Background**\nBuilt by the team behind Ente Photos, Ente Auth is a fully open-source TOTP/HOTP app available on Android, iOS, desktop, and web. It can be used entirely offline, or with optional E2E-encrypted cloud sync so your 2FA seeds survive a lost phone. It is free, with no ads and no account required for local-only use.\n\n**What you trust**\nYou trust open-source clients you can read and a zero-knowledge sync model: when backups are enabled, secrets are encrypted on-device before upload, so Ente's servers store only ciphertext. This is the key distinction from Authy, where the provider holds the trust. The crypto and apps are open to audit.\n\n**Operational specs**\nStandard TOTP/HOTP, so it works with any service that issues a QR/secret. Imports from Google Authenticator, Aegis, 2FAS, and others — no lock-in. Offline-first; cloud sync is opt-in and E2E-encrypted. Tags, search, and a clean cross-platform UI. Self-hostable server stack for the truly independent.\n\n**Philosophy**\nEnte Auth treats 2FA seeds as exactly what they are — long-lived secrets that should never leave your control in plaintext. It rejects the false choice between convenient backups and provider trust by making the backups encrypted and the code open, so you get resilience without surveillance.\n\n**Grade rationale**\nGrade A. Open-source, E2E-encrypted backups, import/export freedom, and offline capability — it closes the gaps that make mainstream authenticators a privacy compromise. Graded as a best-in-class authenticator; the only reason to look elsewhere is if you want a hardware key (YubiKey) for phishing resistance TOTP can't provide.\n\n**Useful when**\nYou want 2FA with encrypted backups you actually control; you're escaping Authy/Google Authenticator lock-in; you want one authenticator across phone + desktop; you value open-source and optional self-hosting.\n\n**Caveats**\nTOTP is not phishing-proof — a convincing fake site can still relay a live code; a hardware key is stronger for the highest-value accounts. Cloud sync, while E2E-encrypted, still means your (encrypted) seeds touch a server — local-only is the maximalist choice. Guard your Ente recovery key; lose it and encrypted backups are unrecoverable by design.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "non_custodial", "audited" ], "highlight_tags": [ "FREE", "MULTI-PLATFORM", "E2E" ], "fees": { "summary": "Free · sync optional" }, "fees_summary": "Free · sync optional", "last_verified": "2026-07-20", "operating_since": "2014", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2014", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://ente.io/auth", "outbound_slug": "ente-auth", "twitter": "https://x.com/enteio", "matrix": "https://matrix.to/#/nth-child", "discord": "https://discord.gg/z2YVKkycX3" } }, { "id": "freetube", "category": "tools", "subcategory": "Frontend", "name": "FreeTube", "url": "https://xmr.club/tools/freetube", "twin": "https://xmr.club/llm/tools/freetube.txt", "tagline": "Privacy-respecting YouTube desktop client. No Google account, no ads, downloads + Sponsorblock built in.", "review": "FreeTube is the **privacy-respecting YouTube desktop client** — a cross-platform application that fetches YouTube content through unofficial API endpoints (or via a chosen Invidious instance) without requiring a Google account, without serving ads, with **Sponsorblock built-in**, with **subscription feeds** that don't tie to Google, and with **local download** support. Listed at **Grade A** because FreeTube is the canonical desktop pick for \"I want YouTube content without YouTube tracking me\" — the desktop sibling to **NewPipe** (Android) and the alternative to **Invidious** (web).\n\n**Background.** FreeTube was created by **Preston Richey** with an active contributor community and has been in development since 2017. Open source under the **AGPLv3** license; codebase at github.com/FreeTubeApp/FreeTube. Built with **Electron** (cross-platform desktop) — yes, Electron has its own bloat criticisms, but it's the pragmatic choice for cross-platform desktop apps in a small-team open-source project. Cross-platform: **macOS, Windows, Linux**. **No mobile version** — for Android, use NewPipe (separate listing); for iOS, there's no privacy-respecting YouTube native client option (iOS sandbox restrictions). The app does not require any account; it doesn't have an account system at all. Subscription feeds are stored locally; you can import/export them as JSON.\n\n**What you trust.** **Local storage of subscriptions** — your subscription list never leaves your device unless you explicitly export it. **Multiple backend modes**: the app can fetch directly from YouTube's unofficial endpoints (fast, but visible to YouTube as a generic User-Agent), or route through a chosen **Invidious** instance (slower, but the Invidious operator absorbs the YouTube-facing trust). **Sponsorblock integration** — the community-maintained Sponsorblock database (open-source crowdsourced timestamps of \"skip the sponsor segment\") is built in; toggleable per-category (skip sponsor reads, skip self-promotion, skip \"subscribe and like\" reminders, etc.). **Download support** — videos can be downloaded to local storage for offline viewing or archiving. **Open-source codebase** — auditable; the team publishes signed releases. **No Google account required** — you can browse channels, watch videos, manage subscriptions all without ever signing into a Google account. **No tracking** — FreeTube's app itself doesn't track you; the trust ceiling is whatever YouTube can derive from the IP-level requests (or the Invidious operator if you route through one). **What you don't trust**: YouTube's own anti-scraping measures — periodically YouTube changes its endpoints to break unofficial clients; FreeTube updates regularly to follow these changes, with occasional breakage windows. Pair with an Invidious instance for resilience against this.\n\n**Operational specs.** **Platforms**: macOS, Windows, Linux desktop. **Distribution**: official binaries from freetubeapp.io; **F-Droid** (limited Linux support); AppImage / Flatpak / Snap for Linux. **No mobile** — desktop only. **Backend modes**: **Local API** (direct fetch from YouTube — fastest, requires periodic FreeTube updates as YouTube changes endpoints), **Invidious API** (route through your chosen Invidious instance — slower, but the operator absorbs the YouTube-facing visibility). **Subscription management**: import OPML / JSON / CSV from other tools; export to JSON or backup. **Sponsorblock**: built-in per-category toggles. **Picture-in-picture**: yes. **Playback controls**: standard (speed, quality, captions, fullscreen). **Download support**: video + audio-only formats. **Comment access**: optional, with anti-spam filtering. **Profile-based separation**: yes — multiple profiles let you separate concerns (work-research profile, entertainment profile). **No telemetry** — the app's own privacy policy is \"we don't have one because we don't collect data.\" **Update mechanism**: official binary releases via the FreeTube website + GitHub; auto-update on by default but can be disabled.\n\n**Philosophy.** FreeTube's editorial differentiator is the **desktop-native privacy-respecting YouTube client**. Invidious (web) gets you the same privacy with a web-page UX; FreeTube gets you a native desktop app with offline support, subscriptions stored locally, and download capability. NewPipe (Android) is the mobile cousin. The trade-off vs official YouTube: no algorithmic recommendations (which is a feature, not a bug — recommendations are personalised based on behavioural data), no Premium features (background play, no ads — but FreeTube has built-in ad blocking via the unofficial endpoints, so it's effectively Premium-without-paying), no native mobile (use NewPipe instead). For users who watch YouTube content regularly but want the **operator-trust surface eliminated**, FreeTube is the canonical pick.\n\n**Grade rationale.** Grade A reflects: open-source AGPLv3 codebase; 8+ years of operational continuity (since 2017); cross-platform desktop (macOS, Windows, Linux); built-in Sponsorblock with per-category control; subscription feeds stored locally (no Google account required); multiple backend modes for resilience (direct + Invidious); download support; profile-based separation; named maintainer (Preston Richey) with public identity; active contributor community; cross-listed in Privacy Guides peer directory. Last verified 2026-05-13.\n\n**Useful when.** You want to **watch YouTube content without a Google account** — FreeTube is the canonical desktop pick. You want **Sponsorblock automatically applied** — saves cumulative minutes per video; FreeTube includes it by default. You want **subscription feeds that don't tie to Google** — manage your subscriptions locally; import/export as JSON. You want to **download videos** for offline viewing or archiving — built-in support. You're using a **privacy-hardened OS** (Tails, Whonix, Qubes) and want a YouTube client that doesn't break the privacy posture. You want **profile-based separation** between work-research and entertainment YouTube use cases. You're an **educator or researcher** who frequently archives video content — FreeTube's download workflow is more friction-free than youtube-dl for non-technical users.\n\n**Caveats.** **YouTube endpoint changes break the app periodically** — when YouTube tweaks its unofficial API, FreeTube has to update to follow. Expect occasional \"FreeTube isn't loading videos\" windows; check for an app update; if the update is delayed, switch to Invidious mode (more resilient because Invidious instances handle the API-tracking work). **No mobile** — desktop only; for Android use NewPipe, for iOS there's no native option. **Electron means significant disk + RAM footprint** — typical Electron-app overhead applies; on resource-constrained machines, this is a real friction. **No algorithmic recommendations** — by design. Some users miss the \"discover new channels via algorithm\" path; FreeTube's subscriptions are the canonical alternative. **Live-stream support is limited** — the unofficial endpoints don't always provide live-stream-quality features; for watching live, the official YouTube web client is more reliable. **No YouTube Premium features** — no background play built-in (mobile feature anyway; desktop is fine), but ad-blocking is effectively automatic via the unofficial endpoints. **Comment quality varies** — comments work but the anti-spam filtering isn't as polished as YouTube's own. **No iOS** — Apple's WebKit-only policy and YouTube's own iOS app dominance leave no privacy-respecting native iOS option. **Auto-update default + signed releases** — keep auto-update enabled; outdated FreeTube is more likely to encounter endpoint changes. **Invidious dependence has its own caveats** — Invidious instances have varying uptime, may be IP-blocked by YouTube, and have their own moderation/operator profile. Choose the Invidious instance carefully if you route through one; consider self-hosting Invidious for the strictest posture. **Doesn't help with channel-level moderation** — YouTube's content-moderation decisions still apply (videos taken down by YouTube are gone from FreeTube too). For archival/preservation, use the download feature.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted" ], "highlight_tags": [ "NO-ADS", "OPEN-SOURCE", "FRONTEND" ], "fees": { "summary": "Free · AGPL · MacOS/Win/Linux" }, "fees_summary": "Free · AGPL · MacOS/Win/Linux", "last_verified": "2026-05-13", "operating_since": "2019", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2019", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://freetubeapp.io", "outbound_slug": "freetube", "matrix": "https://matrix.to/#/freetube:matrix.org" }, "also_listed_at": { "privacyguides": true } }, { "id": "ghost-chat", "category": "tools", "subcategory": "Messaging", "name": "Ghost Chat", "url": "https://xmr.club/tools/ghost-chat", "twin": "https://xmr.club/llm/tools/ghost-chat.txt", "tagline": "End-to-end encrypted messaging over Nostr relays. PGP-encrypted payloads, no accounts, no servers, no logs.", "review": "Ghost Chat is the messenger that puts PGP encryption on top of Nostr's federated transport — two-stack architecture where the relay sees only ciphertext, the user's identity is a PGP keypair (not an account), and there are no servers in the trust path beyond the publicly-knowable Nostr relay set. Part of the **kyc.rip ecosystem** (first-party, alongside the kyc.rip swap aggregator and the broader walls.rip product family). Listed at **Grade A · editor's pick** because it occupies a slightly different point on the privacy-messenger landscape than SimpleX or Matrix — minimal infrastructure, structural censorship-resistance via Nostr, and PGP-native identity for users who already manage keys.\n\n**Background.** Ghost Chat is built by the **kyc.rip team** (the curator's own engineering side, listed transparently here as first-party — see /transparency for the editorial-vs-product separation policy). Source available at the public repo (verify the LICENSE file at the repository before treating as fully open-source vs source-available); downloads for macOS, Windows, Linux desktop apps plus an online web client at walls.rip/comms. Part of the kyc.rip ecosystem launched around 2026-03 alongside walls.rip privacy tooling — Ghost Mail, Dead Drop, SMS Wall, and Ghost Chat were rolled out as a coherent privacy-comms stack. The product is positioned as the messaging surface of that stack.\n\n**What you trust.** **Two-layer trust architecture**: (1) **Nostr relays** handle federated transport — any user can run a relay, the network is permissionless, and a censoring relay is simply routed around. (2) **PGP / ECC-25519** handles content encryption + identity — your PGP keypair *is* your identity; there is no account, no recovery email, no password. Lose the key, lose access. **What the relay sees**: ciphertext, sender pubkey, receiver pubkey, timestamp — not message content. **What the relay doesn't see**: anything decrypted; the content is encrypted client-side before the relay ever touches it. **Multi-relay resilience**: clients can subscribe to multiple relays simultaneously; one relay going down or refusing to carry a message doesn't break the conversation as long as another relay accepts the publish.\n\n**Operational specs.** Platforms: **macOS / Windows / Linux desktop** (signed installers from walls.rip), plus a **web client** at walls.rip/comms for users who don't want to install. **No-JS web client** path supported (rare for a messenger — most rely on heavy JS clients). **Identity**: PGP keypair, ECC-25519 curve, generated locally in the client; export to clipboard / file backup. **Encryption**: payload-level PGP encryption before publish; only the recipient's matching private key decrypts. **Relay network**: defaults to a curated set of well-known Nostr relays plus the kyc.rip-operated relay set; user can configure additional relays. **Open-source**: source repository public; reproducible build path documented for users who want to verify the binary matches the source.\n\n**Philosophy.** Ghost Chat's editorial differentiator is **minimum-infrastructure messaging**. SimpleX runs its own SMP queue servers, Matrix runs Synapse homeservers — both involve infrastructure-as-trust-surface. Nostr is just \"publish encrypted text to a relay, anyone can subscribe with the right key.\" That makes the architecture genuinely smaller — fewer moving parts to trust, fewer pieces of operator infrastructure to compromise. The trade-off: less feature-rich UX (no group chat at SimpleX's scale, no voice/video, no file sync to multiple devices automatically), but a meaningfully simpler trust model. For users who already use PGP and find SimpleX's queue model conceptually heavier than they want, Ghost Chat is the structurally lighter pick.\n\n**Grade rationale.** Grade A and editor's pick reflect: minimum-infrastructure trust model (Nostr relays + PGP); open-source codebase with reproducible builds documented; no-account / no-email / no-phone signup; PGP-keypair-as-identity architecture; multi-relay resilience; no-JS web-client option; first-party transparency disclosure (listed openly as kyc.rip ecosystem product); no observed reliability issues or governance incidents during the **~3-month observation window since launch (2026-03)**. Last verified 2026-05-13. **Re-evaluation trigger**: xmr.club will reassess this grade at the **6-month operational mark (~2026-09-22)** or earlier if a third-party security audit ships, whichever comes first. **Note**: as a first-party product, Ghost Chat is held to a higher disclosure bar than third-party listings — the curator's editorial separation from product development is documented at /transparency. Grade A on a young product is editorially defensible by the architectural-simplicity argument (Nostr + PGP is structurally smaller than competing trust models); we acknowledge the short observation window explicitly and commit to the re-evaluation.\n\n**Useful when.** You already manage PGP keys and want a messenger that uses them natively rather than adding a separate identity layer. You want minimum-infrastructure messaging — fewer moving parts than SimpleX, fewer servers than Matrix. You're already in the Nostr ecosystem and want a private-messaging client that fits that protocol. You want a web client that works without JavaScript (Tor \"Safest\" level compatible). You're censorship-evading and want the multi-relay resilience that Nostr provides. You want a messenger from a project you can audit end-to-end (open source + the curator's own product, so accountability is direct).\n\n**Caveats.** **PGP-keypair-as-identity means key management is on you** — lose the key, lose the conversation history + identity. This is harder than \"remember a password.\" **Relay metadata is observable** — relays see sender pubkey + receiver pubkey + timestamps; they don't see content but they do see who-talks-to-whom by pubkey. For metadata anonymity, route through Tor (Nostr-over-Tor is supported by most relays) or use the SimpleX queue model instead. **Smaller ecosystem than SimpleX or Matrix** — fewer contacts likely already use it; you'll be onboarding people one at a time. **Feature-gap trade-offs** — by design, to keep the infrastructure surface minimal: no native voice/video calls (text + attachments only — use Signal / SimpleX / Element for voice), no group chats beyond small rooms (no Telegram-scale thousand-member groups), no multi-device sync (each install holds its own conversation state). **First-party product disclosure** — Ghost Chat is built by the kyc.rip team; the editorial decision to include it here is documented under /transparency. If you object to first-party listings on principle, treat this as an FYI rather than a recommendation; if you weigh accountability + auditability higher than strict separation, the listing is appropriate.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "pgp_supported", "self_hosted", "no_js_supported" ], "highlight_tags": [ "PGP", "NOSTR", "NO-ACCOUNT" ], "fees": { "summary": "Free · MacOS/Win/Linux/Web · PGP over Nostr" }, "fees_summary": "Free · MacOS/Win/Linux/Web · PGP over Nostr", "last_verified": "2026-05-13", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": true, "editors_pick": true, "links": { "web": "https://walls.rip/comms", "outbound_slug": "ghost-chat" } }, { "id": "ghostdrip", "category": "tools", "subcategory": null, "name": "GhostDrip", "url": "https://xmr.club/tools/ghostdrip", "twin": "https://xmr.club/llm/tools/ghostdrip.txt", "tagline": "Automated Monero DCA — set a cadence and an amount, and GhostDrip runs periodic swaps into XMR via decentralized routers with no accounts, no cookies, no tracking.", "review": "GhostDrip is a **scheduled swap runner** that turns Monero DCA into a set-and-forget operation. Approve a capped allowance once, define a strategy (cadence + per-swap amount + destination XMR wallet), and a minimal backend cron fires the swaps against a decentralized router. Strategies auto-delete when finished, on request, or after 3 consecutive failures — the site is designed to hold as little state about you as possible.\n\n**Background.** Built by **@babysolo_** (the solo dev also behind [XMR98](/tools/xmr98)) and launched publicly on 2025-11-17 — so ~8 months of tenure as of listing. Same operator posture: minimal accounts, minimal metadata, XMR-native.\n\n**What you trust.** *Allowance-scoped, briefly custodial.* You approve a capped ERC-20 allowance to a GhostDrip contract, and when a strategy fires, the operator's server pulls up to that allowance and routes the funds through a swap aggregator on your behalf. Funds pass through operator custody during the pull-and-swap window — it is not a purely non-custodial atomic operation on-chain today (no DEX supports scheduled DCA natively). What you're trusting is bounded by the allowance amount you approved and can be revoked. No signup, no email, no cookies, no analytics per operator claim. Only piece of state kept per strategy is the **last execution ID**, so you can independently verify the on-chain fill. Auto-deletion after completion / request / 3-strike failure is a structural privacy win, not a bolted-on feature.\n\n**Operational specs.** DCA target: **XMR only**. Trigger surface: minimal backend cron. Execution surface: decentralized router (DEX). Fees: no added platform fee per operator claim (\"Just DEX & gas\"). No account / email / phone required. State retention: capped to the last execution ID per strategy. Delivery: swaps land at the destination XMR address you approve at strategy-creation time — GhostDrip never touches the XMR itself.\n\n**Grade rationale.** Listed at **Grade B** because the operator posture is unusually restrained (auto-deleting state, non-custodial by structure, no cookies/analytics per meta), the solo-dev has 8 months of public runway on this tool plus the tenure from XMR98, and the workflow addresses a real gap — every consumer-facing DCA platform we know of demands KYC + accounts. Grade A is withheld pending: (a) a curator test run of a full strategy cycle, (b) verification of the actual DEX router used and its fee behaviour under stress, (c) independent corroboration outside the babysolo ecosystem.\n\n**Caveats.** *Trust surface is not zero.* Between the allowance-pull and the swap completion, the operator's server has custody of the funds — up to your approved allowance limit per pull. Approve small allowances and rotate them; revoke on any concern. No DEX today does true scheduled DCA on-chain, so this pattern is the current state of the art for automated DCA-to-XMR — worth understanding before signing the approval. SPA architecture (initial HTML is a loading shell) means automated audit sees no policy text — the meta description is what upstream probes get. Confirm the router and fee model by running a small strategy before committing large XMR flows. The capped-allowance model reduces blast radius if anything goes wrong, but review the allowance amount you approve — a large approval means a large potential draw. Docs page is \"coming soon\" per the operator's own copy at time of listing.", "translation_locale": "en", "rating": { "grade": "B-" }, "grade": "B-", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "MONERO-DCA", "ALLOWANCE-CAPPED", "NO-ACCOUNTS", "AUTO-DELETING-STATE", "DEX-ROUTED", "BABYSOLO-STACK" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-10", "operating_since": "2025-05", "tenure_note": "Independently verified: WHOIS/RDAP registration: 2025-05-21. `operating_since` set to the earliest signal.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://ghostdrip.xyz", "twitter": "https://x.com/babysolo_", "outbound_slug": "ghostdrip" } }, { "id": "goxmr", "category": "tools", "subcategory": "Monero-Native Identity", "name": "GOXMR", "url": "https://xmr.club/tools/goxmr", "twin": "https://xmr.club/llm/tools/goxmr.txt", "tagline": "Privacy-first link-in-bio for the Monero ecosystem — OpenAlias + NIP-05 + WebFinger + PGP under one handle.", "review": "Privacy-first link-in-bio for the Monero ecosystem — claim a handle at `goxmr.click/yourname`, drop in social links and a Monero wallet, share one URL. Four federated identity surfaces under one handle: **OpenAlias** (Monero-native), **NIP-05** (Nostr), **WebFinger**, **PGP**.\n\nPrivacy-first Linktree alternative with a built-in Monero store — claim a handle at `goxmr.click/yourname`, drop in social links and an XMR wallet, and share one URL. Listed at **Grade B** because the homepage publishes strong privacy claims (non-custodial, PGP encryption, MIT-licensed, 0% fees/tracking) and a Tor mirror is advertised, but zero peer-directory matches and the SPA rendered identical shell content on every hash route — the actual privacy policy, terms, and AML page text is unread by this probe.\n\n**What it is.** Monero-native link-in-bio tool with an integrated store. Listed at **Grade B** — the homepage copy is unusually direct about the privacy model ('Payments go directly to your Monero wallet. We never touch funds.') but the site is a single-page app whose hash-route legal pages rendered identically to the shell, leaving the actual policy text undisclosed.\n\n**What you trust.** Non-custodial payments: Operator-published: 'Payments go directly to your Monero wallet. We never touch funds.'. This is the strongest single trust claim on the page — custody risk is structurally eliminated rather than volunteered away. PGP encryption: Operator-published: 'Buyer info, emails, orders — encrypted client-side with your key.'. End-to-end encrypted order data means the operator cannot read buyer communications even if they wanted to. Open source: Operator-published: 'MIT-LICENSED — Audit the code, run your own instance, fork it. Zero lock-in.'. An MIT license is the most permissive open-source license. The homepage does not link to the repository — verify the code is published at a discoverable GitHub/GitLab URL before the review goes live. Zero fees, zero tracking: Operator-published: '0% fees, 0% tracking.'. No platform commission, no analytics — the service operates as a free public utility if the claim holds. Privacy policy: Route exists at `#/privacy` but the rendered snippet is identical to the homepage shell — the SPA hash-route did not yield unique policy text. The policy page is confirmed to exist but its content is unread. Terms of service: Route exists at `#/terms` and `#/tos`. Same limitation: content unread. AML page: Route exists at `#/legal/aml`. The existence of an AML route on a privacy-first link-in-bio tool is itself notable — most services in this category don't publish one.\n\n**Operational specs.** Pricing: Operator-published: '0% fees'. The service appears to be free for both profile creators and buyers — revenue model is either donation-funded (per the 'SUPPORT_THE_MISSION 45% SLOWB' progress bar) or not yet implemented. Payment surface: Monero-only. The homepage references only Monero ('built-in Monero store', 'GET XMR', 'your Monero wallet'). No Bitcoin, Lightning, or fiat references in the rendered shell. Coin coverage: Monero-native — this is not a multi-coin tool with Monero bolted on. The entire product is XMR-first. Tor mirror: Advertised at `http://5vtyieb7przizt7rhl4ydeglinrjn5g2srx45i4dcbwve3pojcfmjzid.onion/`. Onion not advertised via the clearnet `Onion-Location` header — verify the onion resolves independently. Domain: `goxmr.click` — the `.click` TLD is a budget gTLD. Not inherently suspicious but it's an unusual choice for a privacy tool. No history of `.click` domains being seized en masse, but the TLD registry is less established than `.org` or `.com`. SPA architecture: every conventional paths returns the same shell page. All content lives behind hash routes. This is neutral for functionality but hostile to automated audit — a public audit cannot independently verify claims made in pages it cannot navigate. API surface: A hash route `#/api` exists but rendered no unique content. The homepage does not describe an API. Possible it's an internal route or a stub.\n\n**Operator philosophy.** The homepage copy is unusually direct about the trust model — no marketing polish, just structural claims: non-custodial, PGP-encrypted, MIT-licensed, 0% fees, 0% tracking (operator-published). The positioning as 'Sovereign Privacy-First Link-in-Bio' plus the Monero-only payment surface suggests a project built by and for the XMR community rather than a commercial play seeking broad adoption. The MIT license and 'run your own instance, fork it' language signal a project that expects to be self-hosted by users in the long term.\n\n**Grade rationale.** Listed at **Grade B** because the homepage publishes a coherent and unusually direct privacy model — non-custodial payments, PGP encryption, MIT license, zero fees, zero tracking, and a Tor mirror — all from a single 3KB page. That is a stronger trust-signal surface than most Linktree alternatives. Grade A is withheld because: (1) zero peer-directory matches — the service appears to have no external trust footprint; (2) the SPA rendered identical shell content on all hash routes, meaning the privacy policy, terms, AML page, and FAQ exist as routes but their actual policy text is unread publicly; (3) the `.click` TLD and single-source trust signal place this firmly in experimental-tool territory. Among link-in-bio services in this directory, a published code repository (not just the MIT license claim) and unique hash-route policy pages would raise this to Grade A.\n\n**Caveats.** The SPA rendered identical 3042-byte shell content on all 39 conventional paths and all hash routes — the SPA shell text is rich but the hash-route navigation did not yield unique per-page content. This means the privacy policy, terms, AML page, FAQ, and API page are confirmed to exist as routes but their text is unread by this review. Every operator claim in the editorial is sourced from the homepage shell; curator must navigate the SPA manually to verify the policy pages. The `.click` TLD is a budget gTLD operated by Uniregistry. It has no history of mass seizures but it's an unusual choice for a privacy tool — most privacy-centric projects use `.org`, `.com`, `.net`, or a self-hosted domain. The onion mirror partially mitigates this concern for Tor users but clearnet visitors are exposed to a less-established TLD registry. The operator-published 'MIT-LICENSED' claim is not independently verified — no repository URL appears in the homepage shell text. The 'audit the code, run your own instance, fork it' language strongly implies a public repo exists, but curators should locate and link it before the review goes live. An MIT license claim without a discoverable repo is an unverifiable trust signal. The 'SUPPORT_THE_MISSION 45%' progress bar in the shell text suggests the project is in an active funding phase. This is not a red flag (many good tools start this way) but it means the service's sustainability model is unproven — curators should track whether the progress bar advances or stalls over subsequent re-checks.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted", "tor_mirror", "xmr_native" ], "highlight_tags": [ "NO-KYC", "XMR", "TOR", "OSS" ], "fees": { "summary": "0% platform fees · donation-funded · MIT-licensed (repo TBD)" }, "fees_summary": "0% platform fees · donation-funded · MIT-licensed (repo TBD)", "last_verified": "2026-06-03", "operating_since": "2025-12-22", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://goxmr.click", "outbound_slug": "goxmr", "tor": "http://5vtyieb7przizt7rhl4ydeglinrjn5g2srx45i4dcbwve3pojcfmjzid.onion/", "twitter": "https://x.com/SlowBearDigger" }, "also_listed_at": {} }, { "id": "grapheneos", "category": "tools", "subcategory": "Mobile OS", "name": "GrapheneOS", "url": "https://xmr.club/tools/grapheneos", "twin": "https://xmr.club/llm/tools/grapheneos.txt", "tagline": "Hardened Android for Pixel hardware. Verified boot, sandboxed Play Services, no Google account required.", "review": "GrapheneOS is the hardened-security Android distribution for Pixel hardware — the privacy-respecting mobile OS that gets recommended every time the conversation turns serious about phone-level threat models. Verified boot all the way down to the hardware trust root, sandboxed Google Play Services as an opt-in app (not a privileged OS layer), hardened memory allocator, and a security-driven hardware requirement (Pixel-only, because Pixel is the only Android-OEM line that ships unlockable bootloaders + relockable bootloaders + Titan-M2-class security chips). Listed at **Grade A · editor's pick** because it's the only Android distribution with a credible \"I changed the operating system but didn't lose the security model\" story.\n\n**Background.** GrapheneOS was started by **Daniel Micay** in 2014 (initially as CopperheadOS); the current GrapheneOS organisation has been the consistent home since the 2018 fork. Funded by user donations, with no commercial backers or ad-revenue model. Source code at github.com/GrapheneOS. Active development with weekly-ish security updates synced to Pixel's monthly Android Security Bulletin patch cadence — GrapheneOS users typically receive security patches within days of Pixel's stock release, sometimes ahead of mainline Pixel ROM via the project's own backporting. The OS ships with **no Google services pre-installed**; users opt in to sandboxed Google Play (separate from the privileged system-app layer Google ships in stock Android), or skip Google entirely and use F-Droid + Aurora Store + direct APK installs.\n\n**What you trust.** **Hardware-level security**: verified boot from the Titan-M2 / Tensor security chip up through the kernel, OS, and userspace; if anything in the boot chain is tampered, the phone refuses to boot or warns prominently. **Sandboxing**: Android's app sandbox + GrapheneOS's hardened malloc + per-app permission controls (network access, sensors, contacts, location — all granular and per-app togglable). **No vendor surveillance**: zero Google services on by default; sandboxed Play Services available as an opt-in (apps that require Play Services see them but in a restricted environment). **Network**: per-app network permission (you can deny network to any app), per-app VPN routing, and the OS supports operating without a SIM card or with a no-KYC eSIM like silent.link. **Update integrity**: signed OTA updates verified against the project's signing key — supply-chain attacks against the update channel would require both a code-signing compromise and a build-reproducibility miss.\n\n**Operational specs.** Supported hardware: Pixel 6 series onward (Pixel 6/6a/6 Pro through Pixel 9 Pro Fold and Tensor-class successors). Older Pixels (4/4a/4 XL/5/5a) are no longer security-supported by Google so GrapheneOS only ships extended-support builds for currently-Google-supported hardware. **Install**: web-based installer at install.grapheneos.org runs in Chrome / Brave / Vanadium and flashes via WebUSB — no command-line `fastboot` required for most users. **Apps**: F-Droid (free/libre catalog), Aurora Store (proxied Play Store metadata access), Accrescent (privacy-respecting Android store), sandboxed Play Services for apps that won't work otherwise. **Browser**: ships with **Vanadium**, GrapheneOS's hardened Chromium fork with stricter exploit mitigations and better fingerprint defense than stock Chrome. **Profiles**: full multi-user / multi-profile support, with isolated app sets per profile — useful for work/personal/anonymous separation on one device.\n\n**Philosophy.** GrapheneOS's editorial differentiator is the **\"security-driven hardware requirement\"** argument. The Pixel-only restriction frustrates users who want to install on their existing Samsung / OnePlus / Xiaomi — but the reason is technical: GrapheneOS requires unlockable + relockable bootloaders (so you can install custom OS and then re-lock to verified-boot state), full firmware update access (so Pixel-class monthly security patches are deliverable), and a security chip with a documented attestation path (Titan-M2 on Pixel 6+). Samsung/OnePlus phones either don't support relocking after unlock or don't expose the firmware update path in a way that preserves the security model. So the Pixel-only choice isn't snobbery — it's \"we can only deliver the security model on hardware that supports it.\" Donate-funded, no-corporate-backers governance reinforces the alignment: the operator's incentive is to keep users secure, not to onboard more users at the cost of security guarantees.\n\n**Grade rationale.** Grade A and editor's pick reflect: 12+ years of operational continuity (CopperheadOS → GrapheneOS lineage since 2014, current project since 2018); donate-funded with no corporate alignment pressure; hardware-level verified-boot security model that survives flash; sandboxed-not-privileged Play Services model that doesn't expand Google's surveillance footprint; weekly-ish security update cadence synced to Pixel patches; published security advisories and CVE response; consistent inclusion in every serious privacy + security threat-model guide; reproducible-builds-friendly Android infrastructure. Last verified 2026-05-13.\n\n**Useful when.** You need a phone that doesn't ship as a Google data-collection endpoint. You're a journalist / activist / researcher / lawyer / dissident whose phone-level threat model includes \"operator at the OS layer can't be a vector.\" You want to use Signal / SimpleX / Monerujo / Cake Wallet on mobile with a privacy-respecting OS underneath them. You want sandboxed Google Play (use the apps you need, contain their access). You're running a SIM-free / silent.link / GrapheneOS configuration for travel or operational reasons. You want hardware-attested verified boot that you can actually audit.\n\n**Caveats.** **Pixel-only** — by design, but a real constraint; you cannot install GrapheneOS on your existing Samsung. New hardware purchase required (~$400-1000 for a current Pixel). **Some apps refuse to run in sandboxed Play** — banking apps in particular sometimes detect \"not stock Android\" via SafetyNet / Play Integrity and refuse to launch. GrapheneOS publishes a community-maintained app-compatibility list; check before purchase if your banking app is mission-critical. **Sandboxed Play Services still talks to Google** — for the apps that need it; the sandboxing limits Google's access to those specific apps, but it doesn't make the apps themselves private. **Initial setup is more involved than stock Android** — you'll spend ~30 min on the install + initial config; not casual-user level, though the web installer has made this dramatically more accessible. **Battery + ecosystem trade-offs** — push notifications via sandboxed Play work, but some power-management heuristics depend on Google services that aren't running; expect minor battery + ecosystem-integration trade-offs. **No iOS equivalent** — GrapheneOS only exists for Pixel; if you're an iOS user, the closest equivalent is \"lockdown mode + careful app curation\" on stock iOS, which is meaningfully weaker. **Update timing depends on Google** — GrapheneOS can only patch what Google's Pixel firmware supports; when Google ends Pixel security support for a hardware generation, GrapheneOS follows.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "audited" ], "highlight_tags": [ "ANDROID", "HARDENED", "AUDITED" ], "fees": { "summary": "Free · Pixel hardware required · install via web flasher" }, "fees_summary": "Free · Pixel hardware required · install via web flasher", "last_verified": "2026-05-13", "operating_since": "2019", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://grapheneos.org", "outbound_slug": "grapheneos", "contact_email": "contact@grapheneos.org", "twitter": "https://x.com/GrapheneOS", "telegram": "https://t.me/GrapheneOS", "matrix": "https://matrix.to/#/community:grapheneos.org", "discord": "https://discord.com/invite/grapheneos" }, "also_listed_at": { "web3privacy": true } }, { "id": "jiayou-rip", "category": "tools", "subcategory": "Crypto Ops", "name": "jiayou.rip", "url": "https://xmr.club/tools/jiayou-rip", "twin": "https://xmr.club/llm/tools/jiayou-rip.txt", "tagline": "TRON energy aggregator — pay TRX fees ~85% cheaper via delegation.", "review": "Buys delegated TRX energy and resells it to your address per-call. Slashes USDT transfer cost on TRON. Retail + bulk tiers. Pay in TRX or USDT. No account, no KYC.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "api_available" ], "highlight_tags": [ "TRON", "GAS-SAVING" ], "fees": { "summary": "Energy at ~85% off vs gas burn · per-call invoice" }, "fees_summary": "Energy at ~85% off vs gas burn · per-call invoice", "last_verified": "2026-05-12", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": true, "editors_pick": false, "links": { "web": "https://jiayou.rip", "outbound_slug": "jiayou-rip", "affiliate": "https://venice.ai/chat?ref=F6dA7p" } }, { "id": "keepassxc", "category": "tools", "subcategory": "Password Managers", "name": "KeePassXC", "url": "https://xmr.club/tools/keepassxc", "twin": "https://xmr.club/llm/tools/keepassxc.txt", "tagline": "Offline, file-based password vault. No cloud, no account.", "review": "KeePassXC is the **canonical local-first password manager** — a desktop application that stores your passwords in a single encrypted `.kdbx` database file under your control, with no servers, no accounts, no cloud sync, and no telemetry. Listed at **Grade A · editor's pick** because it occupies the lowest-trust-surface point in the password manager space: there is nothing to leak when there is no operator infrastructure, no SaaS company, and no third-party storage. **The default pick for users who treat password storage as an infrastructure problem** rather than a hosted service.\n\n**Background.** KeePassXC is a community-maintained cross-platform fork of the original KeePassX (which was itself a Qt-based fork of the Windows-only KeePass). Active development by a distributed contributor team since 2016, released under the **GPLv3** license. Cross-platform desktop (**macOS, Windows, Linux**) with full feature parity across platforms; mobile platforms have separate but compatible apps (**KeePassDX** on Android, **Strongbox** or **KeePassium** on iOS — all read/write the same `.kdbx` format). The `.kdbx` file format is an open specification with established cryptographic primitives (AES-256, ChaCha20, Argon2 for key derivation); the same file works across KeePassXC, KeePass, KeePassDX, Strongbox, KeePassium, and many other clients. Funded entirely by donations + occasional sponsorships; no commercial entity behind the project.\n\n**What you trust.** **Local file storage** — your `.kdbx` database is just a file on your disk; you control where it lives (local drive, USB stick, your own Nextcloud, your own Syncthing setup, etc.). **Open-source codebase + reproducible builds** — the source is auditable; signed releases are reproducible from source. **Strong cryptography** — AES-256 or ChaCha20 encryption, Argon2 key derivation function (resistant to GPU/ASIC attacks), HMAC-SHA256 integrity check. **No operator** — there is no KeePassXC company that could be subpoenaed, no SaaS backend, no service to compromise. **YubiKey + hardware-token support** — second-factor unlock via hardware tokens for users who want defence-in-depth. **Audited** — the codebase has received independent security audits; full audit reports are linked from keepassxc.org. **PGP support** — for users who use PGP keys, KeePassXC integrates with system PGP for additional encryption workflows.\n\n**Operational specs.** **Platforms**: desktop apps for macOS / Windows / Linux (Qt-based, native to each platform). **Database format**: `.kdbx` (KeePass database format) — same format readable by KeePass family clients across mobile and desktop. **Encryption**: AES-256 or ChaCha20 symmetric encryption; **Argon2** key derivation (configurable iterations + memory cost). **Unlock methods**: master passphrase, key file, YubiKey/hardware token, or combination. **Auto-type**: configurable per-entry; types username + Tab + password + Enter into the focused window. **Browser integration**: official browser extensions (KeePassXC-Browser) for Firefox / Chromium-derivatives — opt-in, communicates over local IPC, no network involvement. **TOTP support**: built-in TOTP (RFC 6238) generation; the database stores the TOTP secret alongside the password. **Sharing**: read-only or read-write groups can be shared across multiple users via shared `.kdbx` files (each user has their own master passphrase). **Database conversion**: imports from LastPass / 1Password / Bitwarden / Chrome / Firefox / etc. for migration. **Mobile complement**: KeePassDX (Android), Strongbox / KeePassium (iOS) — all open-source, all read/write the same `.kdbx` format.\n\n**Philosophy.** KeePassXC's editorial differentiator is the **local-first, server-less posture**. SaaS password managers (Bitwarden, 1Password, Dashlane) offer convenience — cross-device sync without the user thinking about it, web-based recovery, account-based access. The trade-off: a hosted operator becomes a trust surface. Bitwarden self-hostable (and Vaultwarden) closes some of that gap by letting you operate the server, but introduces self-hosting operational complexity. KeePassXC sidesteps the whole hosted-vs-self-hosted question: the database is a file, the application is local, sync is whatever you already use for files (Nextcloud, Syncthing, USB drive, encrypted backup service). The trade-off: cross-device sync is on you — KeePassXC doesn't have a \"log in on a new phone\" path; you have to get the `.kdbx` file onto the new device by your preferred file-sync mechanism.\n\n**Grade rationale.** Grade A and editor's pick reflect: open-source GPLv3 codebase; cross-platform desktop (macOS, Windows, Linux) with feature parity; compatible mobile clients (KeePassDX, Strongbox, KeePassium); no operator infrastructure, no SaaS backend, no telemetry; strong cryptography (AES-256/ChaCha20 + Argon2 KDF); YubiKey + hardware-token second-factor support; independent security audits with public reports; built-in TOTP support; browser extension with local IPC (no network); reproducible builds + signed releases; entirely donation-funded (no commercial-pressure conflicts); cross-listed in Privacy Guides peer directory. Over 8 years of operational continuity (since 2016 fork). Last verified 2026-05-13.\n\n**Useful when.** You want the **most-conservative password manager posture** — no operator, no SaaS, no third-party storage. You're a Privacy Guides-tier user comfortable managing your own file backups. You want **cross-platform desktop** (macOS/Windows/Linux) without compromising on the local-first principle. You use **YubiKey or hardware tokens** as your second factor (KeePassXC's hardware-token integration is mature). You want a **mobile-compatible** vault — KeePassXC desktop pairs cleanly with KeePassDX (Android) or Strongbox / KeePassium (iOS) via shared `.kdbx` files. You're an organisation or family that wants **shared password vaults** with per-user master passphrases. You're migrating off a SaaS password manager and want a local-first destination.\n\n**Caveats.** **Cross-device sync is your responsibility** — KeePassXC has no built-in sync; you use Nextcloud, Syncthing, Resilio, USB drive, or whatever file-sync mechanism you trust. This is a feature (no operator), but it's a friction. **No web-based access** — there's no \"log in from a friend's computer\" path; if you don't have your `.kdbx` file with you, you don't have your passwords. **Mobile parity depends on which mobile client** — KeePassXC official is desktop-only; the recommended mobile clients (KeePassDX on Android, Strongbox / KeePassium on iOS) are separately maintained and have their own UX. **Auto-type quirks** — auto-type relies on simulated keyboard input which can be finicky with specific applications; modern browser-extension integration is more reliable than auto-type for web logins. **Browser extension is opt-in** — if you want password autofill, install KeePassXC-Browser; if you prefer manual copy-paste, the extension is unnecessary. **No emergency recovery** — if you forget your master passphrase and don't have a key file backup, the database is unrecoverable; this is the price of zero-trust local-first design. Plan accordingly: print a key file to paper backup, use a hardware token, share a sealed master-passphrase envelope with a trusted party. **Database corruption is recoverable but not automatic** — KeePassXC writes atomically, but if your file-sync mechanism creates conflicts (two devices writing simultaneously) you may end up with a conflict copy; resolve conflicts by opening both copies and merging manually. **TOTP convenience trade-off** — storing TOTP secrets in your password database is convenient but means a single compromise of the database exposes both factors; some users prefer a separate authenticator (Aegis on Android, Ente Auth cross-platform) for higher-stakes accounts.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "non_custodial", "self_hosted", "audited", "pgp_supported" ], "highlight_tags": [ "FREE", "OFFLINE", "NO-CLOUD" ], "fees": { "summary": "Free · GPLv3" }, "fees_summary": "Free · GPLv3", "last_verified": "2026-05-13", "operating_since": "2016", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://keepassxc.org", "outbound_slug": "keepassxc" }, "also_listed_at": { "privacyguides": true } }, { "id": "kyc-rip-cli", "category": "tools", "subcategory": "CLI", "name": "kyc-rip CLI / SSH", "url": "https://xmr.club/tools/kyc-rip-cli", "twin": "https://xmr.club/llm/tools/kyc-rip-cli.txt", "tagline": "Swap aggregator as a terminal. `ssh swap.kyc.rip` or `brew install kyc-rip`.", "review": "Our own. Terminal interface to the kyc.rip swap aggregator — SSH endpoint plus distributable CLI binary. Tor + I2P channels available. Built so users without browsers (servers, hardened setups) can still swap.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "non_custodial", "cli_supported", "tor_mirror", "api_available", "no_js_supported" ], "highlight_tags": [ "SSH", "CLI", "TOR" ], "fees": { "summary": "Same as kyc.rip — no aggregator markup · free CLI" }, "fees_summary": "Same as kyc.rip — no aggregator markup · free CLI", "last_verified": "2026-05-13", "operating_since": "2026", "tenure_note": "kyc.rip/cli launched May 2026 (terminal swap)", "locales_available": null, "first_party": true, "editors_pick": false, "links": { "web": "https://swap.kyc.rip", "outbound_slug": "kyc-rip-cli", "tor": "http://kyccli2b6y3iwxhkpoetzfyozmmrwipaakznyvhgl7a264l7tflvzqad.onion" }, "also_listed_at": { "web3privacy": true } }, { "id": "matrix-element", "category": "tools", "subcategory": "Messaging", "name": "Element", "url": "https://xmr.club/tools/matrix-element", "twin": "https://xmr.club/llm/tools/matrix-element.txt", "tagline": "Federated E2E chat. Self-hostable, open-source, hosts most XMR/privacy community rooms.", "review": "Element is the **reference client for the Matrix protocol** — a federated, end-to-end encrypted chat application that's the de-facto home of the privacy ecosystem's public discussion (Monero, Tails, GrapheneOS, Tor Project, Whonix, KeePassXC — all run their primary community rooms on Matrix). Listed at **Grade A** because the Matrix protocol's federation model is the structural answer to \"centralised chat ownership\" — your identity is portable across homeservers, you can self-host the whole stack, and the protocol's openness means Element is one of many clients you can swap in or out.\n\n**Background.** Matrix was started as a protocol in **2014** by **Matthew Hodgson** and **Amandine Le Pape** with **Element** (originally \"Vector,\" then \"Riot,\" renamed Element in 2020) as the reference client. The protocol is governed by the **Matrix.org Foundation** (a UK-based non-profit), with Element Ltd. (the commercial company) building the Element client + hosted homeserver services. The protocol itself is open and has multiple reference and third-party implementations: **Synapse** (the canonical Python homeserver), **Dendrite** (a Go reimplementation), **Conduit** (a Rust reimplementation), and clients including Element, Cinny, FluffyChat, NeoChat, gomuks (terminal), and many more. **Funding mix**: Element Ltd. raises commercial funding from clients including governments (the French government's \"Tchap\" runs on Matrix; the German Bundeswehr uses Matrix); the **Matrix.org Foundation** is donor-funded. The funding-mix concerns are documented (see Caveats). Element is **open source under AGPLv3**; Synapse and other servers are similarly open source. Codebase at github.com/element-hq/.\n\n**What you trust.** **Federation** — homeservers federate with each other to deliver messages; no central authority owns the protocol. Your identity is `@you:yourhomeserver.org` and works across the network. **End-to-end encryption** — Matrix's E2EE uses the **Olm** (Double Ratchet) and **Megolm** (group ratchet) cryptographic protocols, adapted from Signal's design. Independent **cryptographic audits** by NCC Group have inspected the implementation; findings are public. **Self-host option** — Synapse / Dendrite / Conduit are well-documented, with Docker images and configuration guides. **Open client ecosystem** — Element is the reference client but you can use any Matrix-compatible client (Cinny, FluffyChat, NeoChat are all popular alternatives); your conversation history is portable. **Account migration** — Matrix has a documented account-portability flow (alpha at this writing); the goal is for you to move your account between homeservers without losing your history. **What you don't trust**: homeserver operator — whichever homeserver you sign up on sees your account metadata (who you talk to, message timestamps), even though E2EE protects content. For sensitive communications, self-host your homeserver or pick a homeserver run by an organisation you trust. **Government client base** — Element Ltd. counts the French government (Tchap), the German Bundeswehr, and similar institutional clients as customers; this is a legitimate market for federated open-source chat, but it means Element Ltd.'s priorities include institutional-customer needs that may not align with privacy-maximalist users. Read the Caveats for the long form of this discussion.\n\n**Operational specs.** **Platforms**: Element clients on macOS, Windows, Linux desktop; iOS, Android; web at app.element.io. **Protocols**: Matrix client-server API + federation API. **Encryption**: Olm (1:1) and Megolm (group) protocols based on Double Ratchet; key verification via emoji-based or QR-code-based out-of-band verification. **Account hosting**: free signup on matrix.org (the original public homeserver), free signup on community-operated homeservers (privacytools.io, monero.social, kde.org, fedora.im, etc.), paid Element Hosted plans, or self-hosted Synapse/Dendrite/Conduit. **Bridges**: Matrix has well-developed bridges to IRC, Discord, Slack, Telegram, WhatsApp, XMPP — you can participate in non-Matrix communities via your Matrix client. **Spaces**: hierarchical grouping of rooms; useful for organising large communities (the Monero Matrix Space groups all Monero-related rooms together). **Search**: full-text search across rooms (E2EE makes this client-side; rooms are searchable in your client but not by the homeserver). **Tor support**: Matrix protocol works over Tor; Element client can be configured to use a SOCKS proxy. **2FA**: TOTP and email-link verification supported. **Identity verification**: cross-signing model where you verify your contacts' device-signed identity keys via emoji-comparison or QR-scan.\n\n**Philosophy.** Element/Matrix's editorial differentiator is the **federation-with-self-host-bailout** model. SimpleX is decentralised at the queue-server level but doesn't have a federation protocol you can join. Cwtch is fully P2P (no operator) but lacks the scale features of federated chat. Element/Matrix says: federation gets you scale (many people on many homeservers, all talking to each other) while preserving the bailout option (don't trust matrix.org's homeserver? Run your own Synapse). The trade-off: homeservers see your metadata even though E2EE protects content; the bailout option requires technical setup; the protocol has its own complexity that occasional security issues have exploited.\n\n**Grade rationale.** Grade A reflects: open-source codebase (AGPLv3 client, AGPL Synapse/Dendrite/Conduit servers); federated protocol with documented client-server + federation APIs; E2EE via Olm/Megolm with NCC Group audits; cross-platform (desktop, mobile, web) with multiple client implementations; self-host fallback via Synapse / Dendrite / Conduit; the de-facto home of the privacy ecosystem's community rooms (Monero, Tails, GrapheneOS, Tor, etc.); active development by both Element Ltd. and the Matrix.org Foundation; bridges to most other major chat platforms; over 11 years of operational continuity (Matrix since 2014, Element/Vector since shortly after). Last verified 2026-05-13.\n\n**Useful when.** You want to **join the privacy ecosystem's community rooms** — Monero, Tails, GrapheneOS, Tor, Mullvad, Privacy Guides all have Matrix rooms; Element is the standard client. You want a **federated chat protocol** where you can self-host your identity and migrate between homeservers. You're a **technical user** comfortable with the homeserver-selection decision (matrix.org for convenience, community-run homeserver for trust diversification, self-host for maximum control). You want **bridges to other chat networks** (IRC, Discord, Slack, etc.) all in one client. You want **end-to-end encrypted group chat** with key verification and cross-signing. You're an **organisation** that wants a privacy-respecting chat platform with self-host control and on-premise deployment options. You're a **developer** building on the Matrix protocol — the protocol is well-documented and open.\n\n**Caveats.** **Homeserver operator sees metadata** — Matrix's E2EE protects message content but the homeserver sees who-talks-to-whom, room memberships, message timestamps. For sensitive use, self-host your homeserver. **matrix.org is a single point of mass-metadata-collection** — the default homeserver hosts millions of users, making it a high-value target for state-actor surveillance. Use community-run homeservers (monero.social for Monero context, kde.org for KDE, etc.) for trust diversification, or self-host. **Element Ltd. has institutional clients** — French government's Tchap, German Bundeswehr, and similar are paying customers; this is a legitimate business but means Element's product priorities include institutional needs (compliance, audit logs, on-premise deployment) that may sometimes friction against privacy-maximalist defaults. Pick your homeserver and client thoughtfully. **Account creation requires homeserver selection** — newcomers can be confused by \"which homeserver?\" — matrix.org for convenience, but a community-run homeserver is more aligned with privacy values. **Large public rooms are unencrypted in practice** — E2EE at the scale of hundreds-of-members rooms is operationally heavy; many large public rooms run unencrypted. The privacy ecosystem's Monero, Tor, etc. rooms typically run unencrypted because of this. For sensitive 1:1 or small group conversations, E2EE is the default. **Federation security has had incidents** — Matrix has had security incidents (notably the 2019 Matrix.org server breach) requiring trust-on-first-use device verification to handle. The lesson: verify cross-signed identity keys via emoji comparison or QR scan for sensitive contacts. **Bridges leak content** — when you bridge to IRC or Discord, the bridge sees plaintext (the bridge server is the \"user\" on the other network and has the keys). Don't rely on E2EE for bridged conversations. **Self-host has operational overhead** — running Synapse takes server-admin skills and resources (Synapse is Python and resource-hungry; Dendrite/Conduit are lighter alternatives). **Account migration is alpha** — the cross-homeserver account-migration flow is documented but not yet production-stable. **Tor + Element works but UX is finicky** — running Element over a SOCKS proxy is supported but requires configuration. For pure Tor-based chat, consider Cwtch or Briar instead. **Element's mobile clients can be heavy on battery** — Matrix's federation + E2EE adds operational overhead; expect noticeable battery use on phones running Element with multiple active rooms.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted", "tor_supported", "2fa_supported" ], "highlight_tags": [ "FEDERATED", "E2E", "COMMUNITY" ], "fees": { "summary": "Free · federated · self-hostable · clients on all platforms" }, "fees_summary": "Free · federated · self-hostable · clients on all platforms", "last_verified": "2026-05-13", "operating_since": "2015", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2015", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://element.io", "outbound_slug": "matrix-element", "twitter": "https://x.com/element_hq" } }, { "id": "mempool-space", "category": "tools", "subcategory": "Block Explorer", "name": "mempool.space", "url": "https://xmr.club/tools/mempool-space", "twin": "https://xmr.club/llm/tools/mempool-space.txt", "tagline": "Self-hostable Bitcoin block + mempool explorer. Reference UX for inspecting on-chain activity.", "review": "mempool.space is the reference Bitcoin block + mempool explorer — fully open-source, self-hostable on a Raspberry Pi or VPS, with first-class Tor support and a live UI that shows fee market dynamics, miner stats, lightning network visualisation, and full block / address / transaction inspection. Listed at **Grade A · editor's pick** because it's the explorer privacy-aware Bitcoiners actually run themselves (or use over Tor) instead of feeding their address-history through Blockchain.com, BlockCypher, or Blockstream-managed explorers that log queries.\n\n**Background.** Created and maintained by **Mempool Space K.K.** (a Tokyo-based for-profit company funded by Bitcoin / Lightning enterprise sponsors), with the core codebase released under AGPLv3 at github.com/mempool/mempool. Active development since 2019; the codebase has been adopted as the default block explorer in Umbrel, Start9 / embassyOS, MyNode, Citadel, BTCPay Server, and most other \"Bitcoin node-in-a-box\" distributions — meaning a sizeable share of the world's privacy-aware Bitcoiners are running mempool.space code as part of their personal node stack. The public-facing instance at mempool.space serves as a polished reference deployment and runs Tor onion mirror operator-published at mempoolhqx4isw62xs7abwphsq7ldayuidyx2v2oethdhhj6mlo2r6ad.onion.\n\n**What you trust (two deployment modes).** **Self-hosted (the privacy-preserving mode)**: install mempool.space alongside your own bitcoind node — the explorer queries your local node, no external service sees your address lookups or which blocks you're inspecting. This is the trust-minimised mode, recommended for any user inspecting their own wallet addresses or constructing privacy-sensitive transactions. **Public instance**: using mempool.space directly is a query-time exposure to the operator (Mempool Space K.K.) — they see the IP + the addresses / transactions / blocks you look up. The operator's privacy policy commits to not selling or retaining individual lookup data, but the standard caveat applies: trust the policy until you've audited it. Tor mode mitigates the IP-association leak but the operator still sees what queries are being made from that Tor circuit's connection. **The operator infrastructure** itself: Mempool Space K.K. is a corporate entity in Tokyo — accept that legal compulsion to disclose query logs exists structurally, regardless of policy.\n\n**Operational specs.** Self-host installation: Docker Compose, native Node.js install, or bundled in Umbrel / Start9 / MyNode / Citadel / BTCPay Server (the \"easy mode\" for privacy-aware Bitcoiners). Hardware: a Raspberry Pi 4 + 1 TB SSD is the typical Umbrel-class deployment; full-fat installations on VPS or workstation also documented. **Features**: live mempool with fee bucket visualisation, full-block view with transaction inspection, address-level activity (with privacy caveats — see Caveats), miner ranking + recent-block-discoverer attribution, lightning network graph + node + channel inspector, accelerator service (paid via Lightning to prioritise stuck transactions), API at /api for programmatic access. **No native Monero support** — Bitcoin (and Bitcoin-derived chains like Liquid) only; the project's scope is firmly within the BTC ecosystem. Public-facing instance is at mempool.space; Tor onion is operator-published.\n\n**Philosophy.** mempool.space's editorial differentiator is the **\"explorer infrastructure as personal infrastructure\"** architecture. Where Blockchain.com / Etherscan / BlockCypher monetise by aggregating user queries (and the operator becomes a single chokepoint for surveillance of who's looking up what), mempool.space's primary deployment model is **you run the explorer yourself**. The public mempool.space instance exists, is excellent, and is a real product — but the project's design intentionally makes it a reference deployment rather than the canonical chokepoint. By bundling into Umbrel / Start9 / BTCPay etc., the team has effectively distributed Bitcoin block-explorer infrastructure to thousands of independent operators, no one of which sees more than their own users' queries. That's the right shape for a privacy-respecting public-good utility.\n\n**Grade rationale.** Grade A and editor's pick reflect: open-source AGPLv3 codebase with active corporate-backed development; structurally privacy-preserving self-host architecture; first-class Tor support on the public instance; default-bundled inclusion in the major Bitcoin self-hosting distributions (Umbrel, Start9, MyNode, Citadel, BTCPay Server); polished, feature-complete UI that doesn't sacrifice power-user depth; documented API for programmatic integrations; no observed governance or supply-chain incidents in the last 24 months. Last verified 2026-05-13.\n\n**Useful when.** You're running your own Bitcoin node and want a polished local explorer instead of querying a third-party service. You're privacy-conscious about Bitcoin-address activity and don't want every chain inspection logged at a centralised explorer. You're using Umbrel, Start9, MyNode, Citadel, or BTCPay Server — you already have mempool.space running, just open it from your local node dashboard. You're a developer building a Bitcoin app and need a reliable, well-documented API for chain data without paying enterprise pricing to Chainalysis / Glassnode. You're learning Bitcoin and want the best fee-market / mempool / mining UI in the ecosystem.\n\n**Caveats.** **Address activity is public on Bitcoin** — mempool.space surfaces what's already on the chain; it doesn't add a privacy leak that wouldn't otherwise exist *for that specific lookup*, but the act of looking up an address can leak which addresses *you care about* to the explorer operator. Self-host to eliminate this. **No native Monero support** — for XMR chain inspection use a Monero block explorer (e.g., xmrchain.net or moneroexplorer.org); mempool.space is Bitcoin-only by design. **Public-instance queries are observable to the operator** — mempool.space (corporate entity in Tokyo, Mempool Space K.K.) can see your queries; Tor mitigates IP correlation but the query-content surface is still there. **Self-host requires a synced bitcoind** — the explorer is a frontend; you need a running Bitcoin full node behind it for the chain data. This is non-trivial first-time setup (days for initial blockchain sync, ~600 GB disk for full archival nodes, less for pruned). **Sponsor-funded development model** — mempool.space sells enterprise support and accepts corporate sponsors; the public product remains AGPLv3 but the corporate-customer roadmap is not user-visible. For ethical-fundamentalist users this is a consideration; for most users it's a non-issue because the codebase is open and self-hostable. **Accelerator service is custodial-during-the-window** — the paid-Lightning fee-bump feature relies on the operator brokering the transaction acceleration; not a privacy property of mempool.space's core function but worth knowing if you use the accelerator.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted", "tor_supported" ], "highlight_tags": [ "BTC", "OPEN-SOURCE", "TOR" ], "fees": { "summary": "Free · self-hostable · public + Tor mirror" }, "fees_summary": "Free · self-hostable · public + Tor mirror", "last_verified": "2026-05-13", "operating_since": "2019", "tenure_note": "mempool.space project launched late 2019 (Bitcoin mempool explorer)", "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://mempool.space", "outbound_slug": "mempool-space", "tor": "http://mempoolhqx4isw62xs7abwphsq7ldayuidyx2v2oethdhhj6mlo2r6ad.onion" } }, { "id": "monero-fail", "category": "tools", "subcategory": "Block Explorer", "name": "monero.fail", "url": "https://xmr.club/tools/monero-fail", "twin": "https://xmr.club/llm/tools/monero-fail.txt", "tagline": "Live monitor of public Monero remote nodes. Sortable by uptime, country, transport. Onion mirror + JSON API.", "review": "monero.fail is the live monitor of public Monero remote nodes — the canonical \"which remote node should I point my wallet at?\" reference. Probes hundreds of operator-published nodes, charts uptime, exposes a JSON feed at `/nodes.json` for other tools to consume, and provides an onion mirror for Tor users. Listed at **Grade A · editor's pick** because it solves an unglamorous-but-critical problem: when you don't want to run your own Monero full node, the next-best privacy posture is \"pick a remote node deliberately, with operator-publish + uptime data in front of you\" — and monero.fail is the directory that makes that choice informed rather than blind.\n\n**Background.** monero.fail is an independent community-maintained service that probes the public Monero node list and reports liveness. Started by a Monero community contributor and has been the reference node-monitor for several years. Source available, hosted at monero.fail with Tor mirror operator-published at livk2fpdv4xjnjrbxfz2tw3ptogqacn2dwfzxbxr3srinryxrcewemid.onion. Funded by donations + low operational footprint (probe traffic + light-weight web frontend). Cross-referenced in this directory's `/nodes` section as the upstream source of public-node uptime data.\n\n**What you trust.** monero.fail itself is a **monitor, not a node** — it doesn't relay your wallet traffic, it doesn't see your wallet queries. The operator only sees: which node operator-published URLs return liveness probes, response latency, and country/transport metadata. **What the operator doesn't see**: any of your wallet activity. **What the operator does see**: the list of public Monero nodes (operator-published and crowd-submitted) and their uptime statistics. The trust ask is modest: trust monero.fail's uptime data is accurate; you still pick the actual node you connect to. **Onion mirror**: operator-published `.onion` for Tor users who want to browse the node list without a clearnet hop.\n\n**Operational specs.** **Probe coverage**: hundreds of public Monero nodes including clearnet, Tor (`.onion`), and I2P (`.b32.i2p`) variants. **Sort dimensions**: uptime percentage, country, transport (clearnet/Tor/I2P), node version, restricted RPC vs unrestricted. **API**: `/nodes.json` (JSON), `/nodes.txt` (plain text list), `/nodes/.json` (per-network filter). API consumers include Feather Wallet's \"pick a node\" auto-suggest, Monerujo's default node list, multiple privacy directories (us included), and bots that recommend nodes to new users. **Update frequency**: probes run continuously; uptime statistics weighted over 24h / 7d / 30d windows. **Tor onion** operator-published; the monitor itself is fully usable over Tor with no JS dependency.\n\n**Philosophy.** monero.fail's editorial differentiator is **infrastructure-monitoring-as-public-good**. The Monero community's privacy promise depends on a healthy distributed remote-node ecosystem — if all the wallets default to one node, that node becomes a centralised observation point. monero.fail keeps the distributed-node ecosystem visible: which nodes are up, which are stable, which are operator-published vs anonymous, which are Tor-only. By publishing this data in an API, monero.fail lets wallet developers route around the centralisation pressure that would otherwise build up by default. The service operates as community infrastructure: low-profile, donate-supported, not commercialised, doesn't try to be more than what it is.\n\n**Grade rationale.** Grade A and editor's pick reflect: years of operational continuity as the reference node monitor; community-trusted source for the Monero node list; integrated by multiple wallets (Feather, Monerujo) as the default node-discovery source; published JSON API enabling downstream consumers; Tor onion mirror operator-published; no-JS web access; no commercial conflicts of interest; consistent inclusion in privacy + Monero infrastructure references. Last verified 2026-05-13.\n\n**Useful when.** You're setting up Monero GUI / Monerujo / Cake Wallet / Feather and need to pick a remote node — monero.fail's sorted list with uptime is the right starting point. You're building a Monero-aware tool and need a programmatic node list — `/nodes.json` is the API. You want to operate via Tor and need an `.onion` Monero node — filter monero.fail's list by Tor transport. You're verifying that the node you're using is operator-published vs anonymous-submitted — monero.fail tracks that distinction. You're a node operator and want to verify your node appears in the public list and reports correct uptime.\n\n**Caveats.** **Uptime ≠ trust** — a node being \"up\" with 100% uptime doesn't mean the operator is trustworthy. monero.fail measures liveness, not honesty. For high-threat use, **run your own monerod and point your wallet at localhost** — that's the only way to eliminate node-operator observation entirely. **Probe blind spots** — monero.fail probes the public node-list it knows about; private or recently-added nodes may not be tracked yet. **Listing implies neither vetting nor endorsement** — monero.fail tracks what exists, not what's recommended. The decision to trust a specific node operator is yours. **Operator-published vs anonymous-submitted** — both are tracked but the operator-published flag is the stronger signal; prefer those when picking a node. **No native Monero node operations** — monero.fail is a monitor; it doesn't run nodes itself, doesn't proxy your wallet traffic, doesn't broker queries. Your wallet still connects directly to whichever node you choose. **JSON API rate limits** — light limits exist; hammer the API and you'll be throttled. Consumers should cache the node list, not re-request on every wallet open.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "tor_supported" ], "highlight_tags": [ "XMR", "MONITOR", "API" ], "fees": { "summary": "Free · public + Tor mirror · JSON API" }, "fees_summary": "Free · public + Tor mirror · JSON API", "last_verified": "2026-05-13", "operating_since": "2018", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://monero.fail", "tor": "http://livk2fpdv4xjnjrbxfz2tw3ptogqacn2dwfzxbxr3srinryxrcewemid.onion", "outbound_slug": "monero-fail" } }, { "id": "monero-jobs", "category": "tools", "subcategory": "Marketplace", "name": "Monero.Jobs", "url": "https://xmr.club/tools/monero-jobs", "twin": "https://xmr.club/llm/tools/monero-jobs.txt", "tagline": "Freelance marketplace where every payment settles in XMR. Email or fully-anonymous signup, no KYC at any tier.", "review": "**Privacy-first freelance marketplace where every payment settles in XMR.** Operator-published positioning: *\"The only freelance marketplace where all payments are made in Monero (XMR). Find work that respects your privacy.\"* Two-sided platform (Find Work / Hire Talent) with **two signup tracks**: email-based or fully anonymous. **\"No KYC, ever\"** is the explicit operator promise (per the CR1337 endorsement post 2026-05). Listed at **Grade B** on first pass — the no-KYC-by-design + anonymous-signup posture is the right shape, but the operator surface is sparse (JS-only SPA, no published team / repo / license / Tor onion at submission time) so the upgrade-to-A path is conditioned on operator transparency improvements + a curator-side end-to-end test (post a fake job, complete it, settle a payment).\n\n**What it is.** Web app at `monero.jobs` — a freelance marketplace where clients post jobs, freelancers bid, and **the only payment rail is Monero**. Clients use Email or Anonymous signup. Freelancers pick from posted jobs, deliver work, get paid in XMR. The signup form on the homepage exposes the anonymous mode directly — no \"verify your identity\" gate at any tier. Categories visible from the nav: Browse Jobs / Find Talent / Learn / Contact / Search.\n\n**Background.** Newer project (homepage live as of 2026-05). Listed on monero.eco (the curated shortlist) which signals at least one editorial check from the Monero ecosystem community. CR1337 publicly endorsed it 2026-05-27 with the framing \"no kyc, ever; guaranteed.\" We have not yet identified the operator — anonymous-operator tier is consistent with the product's framing. If the maintainer publishes themselves we will update this entry.\n\n**What you trust.**\n\n- **Payments settle in XMR, period.** Per the operator's own meta description: *\"The only freelance marketplace where all payments are made in Monero.\"* No fiat ramp baked in, no USDT alternative — the choice forces both sides into the privacy-respecting rail.\n- **Anonymous signup is first-class, not buried.** The signup form's two-tab UI (Email / Anonymous) is on the homepage itself, not behind a settings panel. The product's design says: anonymous is normal, not exceptional.\n- **Public commitment: \"no KYC, ever.\"** Endorsed publicly by CR1337 with that explicit framing 2026-05-27. The operator's own /privacy page exists (returns the SPA shell + JS-renders, content not yet curator-verified) but the homepage promise is unambiguous.\n- **Marketplace, not custodian.** Clients and freelancers settle to each other; Monero.Jobs (as far as we can tell) doesn't hold escrow between legs. (Curator caveat — to be confirmed with a test trade.)\n- **No operator-published team / repo / license** at submission time. Anonymous-operator posture; trust accumulates through uptime + community endorsement + cross-listing, not formal disclosure.\n\n**Operational specs.**\n\n- **Site.** React-style SPA — every route serves the same ~3KB HTML shell, content hydrates client-side. JS required.\n- **Signup.** Email (with password) OR Anonymous mode. Anonymous mode visible on the homepage.\n- **Payment.** XMR only.\n- **Categories.** Browse Jobs, Find Talent, Learn, Contact, Search — visible from the top nav.\n- **Tor.** No published `.onion` mirror at submission time. Site loads under Tor Browser; absence of a dedicated onion is a transparency caveat.\n- **API.** No public API endpoint surfaced at submission time.\n- **Light/dark.** UI theme toggle visible in the header — consumer-grade polish.\n\n**Operator philosophy.** Direct from the homepage hero: *\"WORK FOR XMR. STAY PRIVATE. XMR is the ultimate weapon if you are seeking a technological solution to secure your wealth, your financial privacy and hence your overall freedom. However, the best way to increase your freedom is to get paid directly in XMR.\"* That framing is the differentiator — most freelance platforms add crypto as one of N payment options. Monero.Jobs is **XMR-only by design**, which forces both client + freelancer into the privacy stack.\n\n**Grade rationale.** **Grade B** on first pass because: (1) **no operator-published team / repo / license** disclosure; (2) **no Tor onion** advertised — clearnet only; (3) **JS-only SPA** with no SSR fallback or no-JS path; (4) **no curator end-to-end test trade** on file yet (curator needs to post + complete + settle a real test job to verify the no-KYC + XMR-only claims end-to-end); (5) **operator's exact platform-cut on each transaction not disclosed publicly** at submission time. The product's premise (XMR-only freelance marketplace, anonymous signup, no-KYC promise) is the right shape — Grade B floor is held by the operator-transparency gap, not by anything wrong with the design. Upgrade-to-A path: operator publishes team + repo + license + ships a Tor onion + curator runs a clean end-to-end test trade + the platform-fee structure becomes transparent.\n\n**Useful when:**\n\n- You're a **freelancer who wants to be paid in XMR** without depending on a client navigating a fiat-to-crypto offramp.\n- You're a **client who wants to hire privacy-respecting talent** without the legal-team paperwork triggered by USD payment rails (KYC the freelancer, withhold taxes, etc.).\n- You're explicitly looking for a **\"no-KYC, ever\" freelance platform** and want operator commitment, not just a checkbox.\n- You want to **practice the anonymous-signup option** so the next time you actually need it for a sensitive job, the workflow is already familiar.\n\n**Caveats:**\n\n- **No curator end-to-end test trade yet.** First-pass listing — Grade B default per playbook. We need to post + complete + settle a real test job before upgrading.\n- **No Tor onion at submission time.** Clearnet only; the operator + CDN see your IP + activity unless you route via Tor Browser.\n- **JS-only.** No-JS users see an empty 3KB shell — every action (browse jobs, signup, post, message) requires JS.\n- **No published team / repo / license.** Anonymous-operator tier; trust accumulates through uptime + community endorsement + cross-source verification, not formal disclosure.\n- **Platform-cut percentage undisclosed.** Marketplaces always take a cut — Monero.Jobs's exact percentage isn't published on the surfaces we could fetch (operator's /about, /faq, /contact all return the SPA shell). Confirm via a test trade or operator contact before listing high-value work.\n- **Dispute resolution mechanism undisclosed.** Standard freelance-marketplace question: when a job goes wrong, who arbitrates? Operator-published dispute policy not yet curator-verified.\n- **Listed on monero.eco's curated shortlist** (positive cross-listing signal) but no formal kycnot.me / monerica entry confirmed yet — peer-cross-reference still narrow.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "anonymous_signup", "marketplace", "non_custodial", "xmr_native" ], "highlight_tags": [ "XMR NATIVE", "ANONYMOUS SIGNUP", "MARKETPLACE" ], "fees": { "summary": "Free to browse + post (operator's exact platform-cut not disclosed publicly at submission time). Payments settle directly in XMR between client and freelancer." }, "fees_summary": "Free to browse + post (operator's exact platform-cut not disclosed publicly at submission time). Payments settle directly in XMR between client and freelancer.", "last_verified": "2026-05-28", "operating_since": "2024", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://monero.jobs", "outbound_slug": "monero-jobs" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "monero-marketcap", "category": "tools", "subcategory": null, "name": "MoneroMarketCap", "url": "https://xmr.club/tools/monero-marketcap", "twin": "https://xmr.club/llm/tools/monero-marketcap.txt", "tagline": "CoinMarketCap-alike valued entirely in XMR — track every major cryptocurrency's price in Monero, compare gainers and losers vs XMR, and build a portfolio priced in XMR rather than fiat.", "review": "MoneroMarketCap is a comprehensive live market-cap tracker where every coin's price is displayed both in USD (and 14 other fiats) and in **XMR**. Rankings, portfolio tools, gainers/losers, price changes across 1h/24h/7d/30d/1y, sponsor spots for XMR-adjacent services, and an alerts system — the same feature surface as CoinMarketCap but with Monero as the numeraire, not a footnote.\n\n**Background.** Published by the **Monerica Project** (same team behind monerica.com and Monero Academy). Code is open-source at github.com/monerica-project/MoneroMarketCap and an onion mirror is advertised — two structural trust signals up front.\n\n**What you trust.** Non-custodial by design: the site tracks prices; it never touches funds. Optional accounts unlock personal portfolios; no wallet connection required. Onion mirror available for Tor users. Data refreshes on a 60-second cadence.\n\n**Operational specs.** Coverage: BTC, ETH, USDT, BNB, USDC, XRP, and the rest of the top-N market — all priced in XMR alongside the usual fiat. Portfolio tool with optional account. 15 fiat display currencies. Sponsor slots visible on the homepage. Public GitHub, published onion, no KYC on the free-tier read surface.\n\n**Grade rationale.** Listed at **Grade B** because it's operator-transparent (Monerica Project brand + public GitHub + onion), account-optional (portfolios require login but read-only access is anonymous), and delivers a feature-complete alternative to fiat-first crypto trackers. Grade A is withheld pending tenure on xmr.club and independent corroboration beyond the Monerica ecosystem.\n\n**Caveats.** Account creation is unusually minimal: the site auto-generates a username and password for you — no email, no verification, nothing to leak. Anonymous read access works too. The one caveat worth flagging: sponsor spots are visible on the homepage; verify a specific sponsor is not being confused for the operator's own endorsement.", "translation_locale": "en", "rating": { "grade": "B" }, "grade": "B", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "MARKET-CAP-TRACKER", "XMR-DENOMINATED", "OPEN-SOURCE", "ONION-MIRROR", "ACCOUNT-OPTIONAL" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-10", "operating_since": "2026-04", "tenure_note": "Independently verified: WHOIS/RDAP registration: 2026-04-11. `operating_since` set to the earliest signal.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://moneromarketcap.com", "twitter": "https://x.com/MonericaProject", "tor": "http://7vpxaew4op4jy3ltgmdyj6qwmjdkb27mpjkqnwozjxdk63lfj6q7fhad.onion/", "github": "https://github.com/monerica-project/MoneroMarketCap", "outbound_slug": "monero-marketcap" } }, { "id": "monero-superbrain", "category": "tools", "subcategory": "Mining", "name": "Monero Superbrain", "url": "https://xmr.club/tools/monero-superbrain", "twin": "https://xmr.club/llm/tools/monero-superbrain.txt", "tagline": "One-click Umbrel app — bundles monerod + P2Pool + xmrig-proxy + XMRig with a web dashboard. Real-time hashrate, fleet management for LAN/Tailscale miners, community-built themes. Free, open source.", "review": "Monero Superbrain is a one-click P2Pool mining stack for Umbrel — install one app on a home server, paste your wallet address, and you're mining Monero directly to the decentralized P2Pool in seconds, with no terminal, no config files, and no Docker commands. Built by solo developer **brainchainz** (X: @SirJamzAlot) as part of the Brainchainz App Store, it collapses what is normally a fiddly multi-component setup into something a non-technical user can actually run — and crucially, it points that ease at *decentralized* mining rather than a custodial pool.\n\n**Background.** Mining Monero the right way — to P2Pool rather than a big centralized pool — has always carried a setup tax: you need a synced full node, the P2Pool sidechain daemon, a proxy to fan out to multiple miners, and the miner itself, all wired together correctly. Superbrain packages that whole stack as a single coordinated Umbrel app, so the friction that pushes most hobbyist miners toward centralized pools (which concentrate hashpower and weaken the network) largely disappears.\n\n**Bundled stack.** Ships `monerod` (full Monero node), `P2Pool` (the decentralized mining pool/sidechain), `xmrig-proxy` (to distribute work across a fleet of miners), and `XMRig` (the miner) as one app. A browser dashboard surfaces real-time hashrate, earnings, miner status, and live P2Pool stats — the visibility you'd otherwise stitch together from several command-line tools.\n\n**What you trust.** This is self-hosted and non-custodial by construction: it runs on *your* Umbrel hardware and mines to *your* address. P2Pool pays out directly on-chain to the wallet you specify via its PPLNS scheme — there is no pool operator holding your earnings and no withdrawal step to trust. The trust you do extend is to the app packaging itself (brainchainz's code coordinating the four components) and to Umbrel as the host platform. Because it bundles your own full node, you're not trusting a third-party node for your mining either.\n\n**Operational specs / fleet management.** Once one Umbrel is running Superbrain, you can point any number of LAN or Tailscale-connected miners at its xmrig-proxy, turning a single box into the coordinator for a whole home/office mining fleet. The full node + P2Pool combination means you contribute to network decentralization on two axes at once: running infrastructure and mining without concentrating hashpower.\n\n**Philosophy.** Superbrain's whole reason for existing is to make the *decentralized* path the easy path. Every hobbyist it converts from a centralized pool to P2Pool is a small structural win for Monero's mining distribution — and the self-hosted, your-node-your-keys design keeps the user sovereign rather than turning mining into another custodial relationship.\n\n**Grade rationale.** Grade A reflects the self-hosted non-custodial architecture, direct-to-P2Pool payouts (decentralization-positive), the bundled full node, genuine fleet management, and an identifiable solo developer shipping useful open tooling. It sits at A rather than higher because it depends on a single developer's packaging and on the Umbrel ecosystem — verify the app and keep an eye on its maintenance.\n\n**Useful when** you want to mine Monero the decentralized way without the command-line setup tax: Umbrel home-server owners, hobbyists who want P2Pool over a centralized pool, and anyone coordinating a small fleet of miners to a single self-hosted node. It pairs naturally with running your own node as part of a self-sovereign Monero setup.\n\n**Caveats.** You need an Umbrel and reasonably capable hardware, and mining economics (electricity, heat, hardware wear vs. XMR earned) are yours to weigh — small rigs may earn little. P2Pool has its own minimum-payout dynamics and requires the node to be fully synced before you see results. As a solo-developer project, treat maintenance and source verification as part of due diligence: confirm you're installing the genuine Brainchainz app, and prefer reviewing the code before pointing real hardware at it.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "self_hosted", "open_source" ], "highlight_tags": [ "MINING", "SELF-HOSTED", "OPEN-SOURCE", "P2POOL" ], "fees": { "summary": "Free + open source. P2Pool standard fee structure (no pool-operator cut)." }, "fees_summary": "Free + open source. P2Pool standard fee structure (no pool-operator cut).", "last_verified": "2026-05-24", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://monerosuperpay.com", "code": "https://github.com/brainchainz/Monero-Superbrain", "fundraiser": "https://kuno.anne.media/fundraiser/ufmp/", "outbound_slug": "monero-superbrain", "twitter": "https://x.com/MgkMshrmBrkfst" } }, { "id": "monero-superpay", "category": "tools", "subcategory": "Merchant", "name": "Monero SuperPay", "url": "https://xmr.club/tools/monero-superpay", "twin": "https://xmr.club/llm/tools/monero-superpay.txt", "tagline": "Self-hosted Monero point-of-sale — watch-only wallet, multi-device pairing (LAN / Tor / Tailscale), Mac desktop + Umbrel app. Free, open source, no signup, no KYC, no platform fees.", "review": "Monero Superpay is self-hosted Monero point-of-sale software with the security model done right: the device running the dashboard holds only a **view-only** wallet, never a spend key, so compromising the box leaks transaction history but never funds. Built by solo developer **brainchainz** (X: @SirJamzAlot), it lets a merchant accept native XMR across multiple terminals without a payment processor, a custodian, or any third party standing between them and their money.\n\n**Background.** Accepting Monero as a merchant has historically meant either trusting a hosted payment processor (custodial, KYC-prone, a single point of failure) or assembling your own tooling. Superpay is the self-hosted answer: install it, define your products and pricing, attach a watch-only wallet, and pair phones or tablets as point-of-sale terminals. It offers two install paths — a native macOS desktop app or an Umbrel home-server app — so a small shop can run it on hardware it already owns.\n\n**Watch-only architecture (what you trust).** This is the heart of the review. The host device is given only the wallet's **public view key**, never the private spend key. That means the PoS box can *watch* for incoming payments and confirm them, but it physically cannot move funds — the spendable wallet lives offline on the merchant's own hardware/seed. If an attacker compromises the dashboard, the worst they get is visibility into transaction history; the money is untouchable. This is exactly how Monero merchant tooling should be designed, and it's the single biggest reason for the grade: the trust you extend is bounded to \"can see my sales,\" not \"can take my money.\"\n\n**Operational specs.** Set up products and pricing, pair an unlimited number of phones/tablets as terminals via QR code, and get **real-time WebSocket confirmations** the moment an XMR payment arrives — no manual checking, no refreshing. Two deployment options (macOS desktop or Umbrel) cover both a single-counter shop and a slightly larger multi-terminal setup. Because it watches your own view-only wallet, payments settle directly to you on-chain with no intermediary.\n\n**Philosophy.** Superpay is sovereign merchant tooling: no processor, no custody, no KYC, no third party that can freeze or surveil your takings. The watch-only design is the philosophy made concrete — it refuses to hold the one thing (your spend key) whose compromise would actually hurt you, accepting only the minimum capability needed to do its job.\n\n**Grade rationale.** Grade A reflects the correct, security-first watch-only architecture (funds safe even if the box is fully compromised), genuine self-hosting with no custodian, multi-terminal support with live confirmations, and an identifiable solo developer shipping useful open tooling. It sits at A rather than higher because it's a single-developer project and self-hosting carries its own operational burden — verify the source and run it deliberately.\n\n**Useful when** you're a merchant — physical shop, market stall, café, or event — who wants to take native Monero across one or several terminals without surrendering custody or onboarding a processor. It's also a clean fit for anyone who wants payment acceptance that no third party can freeze, censor, or KYC. Pair it with a hardware/offline spend wallet for the matching cold-storage side.\n\n**Caveats.** As a solo-developer project, treat source verification and maintenance status as part of due diligence before taking real payments through it. Self-hosting means *you* own uptime, backups, and the node it watches against. One privacy nuance worth understanding: the view key on the host device exposes your incoming transaction history to anyone who compromises the box — funds are safe, but sales visibility is not, so secure the host accordingly. It's XMR-denominated with no built-in fiat conversion, so price your products with exchange-rate movement in mind.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "self_hosted", "open_source", "tor_supported" ], "highlight_tags": [ "MERCHANT", "SELF-HOSTED", "OPEN-SOURCE" ], "fees": { "summary": "Free + open source. No platform fees. Merchant pays only on-chain XMR fee (~$0.0002)." }, "fees_summary": "Free + open source. No platform fees. Merchant pays only on-chain XMR fee (~$0.0002).", "last_verified": "2026-05-24", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://monerosuperpay.com", "code": "https://github.com/brainchainz/Monero-SuperPay", "fundraiser": "https://kuno.anne.media/fundraiser/ufmp/", "outbound_slug": "monero-superpay", "twitter": "https://x.com/MgkMshrmBrkfst" } }, { "id": "monerometrics", "category": "tools", "subcategory": "Block & Mempool Explorer", "name": "monerometrics", "url": "https://xmr.club/tools/monerometrics", "twin": "https://xmr.club/llm/tools/monerometrics.txt", "tagline": "Open-source Monero network-metrics dashboard running its own node — hashrate, difficulty, mempool, mining-pool attribution, fee estimator, and a free no-account/no-KYC public API. MIT-licensed, tracker-free, donation-funded.", "review": "**A Monero network-metrics dashboard that runs its own node.** monerometrics indexes every block from its own Monero node and surfaces the numbers most explorers bury: live network hashrate, difficulty, block time, mempool state, a transaction-fee estimator, orphan-block tracking, and an interactive chain-fork viewer. Where it goes past a plain explorer is **mining-pool attribution** — it labels which pool mined each block, something most trackers show only as unattributed share percentages.\n\n**Open source and free.** The stack is MIT-licensed on GitHub (`nowi333/monerometrics`), and everything — the dashboard and a read-only public API at `api.monerometrics.net` — is free with **no account, no API key, no KYC, and no rate-limit**. The page carries no analytics scripts, ad tags, or third-party trackers; the project is donation-funded via a published Monero address. Available in English, French, and Spanish.\n\n**Why it's useful.** If you run a node, mine, or just want to watch Monero's network health without handing a data broker your traffic, this is a clean, first-party source — it computes from its own chain index rather than reselling another explorer's feed. The free public API makes it easy to pull the same data into your own tooling.\n\n**The caveat: it's young.** The domain dates to May 2026 and the project is only a few months old with a small following, so there's no long track record for uptime or sustained maintenance yet — though the repo is actively pushed to. Nothing here holds your funds or touches your keys, so the risk is simply *\"will it still be here and accurate in a year,\"* not a custody risk. That youth is the only reason it sits at B rather than higher; verify a figure against a second source before relying on it for anything load-bearing.", "translation_locale": "en", "rating": { "grade": "B", "trust": "Open-source (MIT, github.com/nowi333/monerometrics), actively maintained. Runs its own Monero node and computes from its own chain index — first-party data, not a reseller. No custody, no accounts. Young: domain from 2026-05, small following, unproven long-term uptime.", "privacy": "No account, no KYC, no API key, no rate-limit. No analytics/ad/third-party trackers on the page. Donation-funded via a published Monero address. Read-only — never touches your funds or keys.", "ux": "Dashboard of live network metrics (hashrate, difficulty, block time, mempool, orphans, mining-pool attribution, chain-fork viewer, fee estimator) plus charts. Free public read-only API at api.monerometrics.net. EN / FR / ES." }, "grade": "B", "kyc_tags": [], "feature_tags": [ "open_source", "xmr_native", "api_available" ], "highlight_tags": [ "XMR", "NETWORK-METRICS", "FREE-API", "OPEN-SOURCE", "NEW" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-25", "operating_since": "2026-05", "tenure_note": "Domain registered 2026-05-12; ~3.5 months old. MIT-licensed repo actively maintained (github.com/nowi333/monerometrics).", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://monerometrics.net", "outbound_slug": "monerometrics", "github": "https://github.com/nowi333/monerometrics", "twitter": "https://x.com/monerometrics", "logo": "https://xmr.club/peers/monerometrics.svg", "tor": "http://6wbhchvavey26lbtscl6w6qg76balycixtsklcggrsslyk4xah6sbbad.onion" } }, { "id": "monerospace", "category": "tools", "subcategory": "Block & Mempool Explorer", "name": "MoneroSpace", "url": "https://xmr.club/tools/monerospace", "twin": "https://xmr.club/llm/tools/monerospace.txt", "tagline": "Open-source Monero mempool explorer — fee tiers, pool attribution, block heights from a community-built mempool.space port.", "review": "Live Monero mempool explorer — pending transactions, fee-rate bands (20k–4M ɱ/B), pool attribution (SupportXMR, HashVault, P2Pool), block heights matching mainnet. **Open source** at [`n0/monerospace-org`](https://github.com/n0/monerospace-org) — a port of `mempool.space` to Monero, repo created 2026-05-05, actively updated.\n\nLive Monero mempool explorer with real-time fee estimation — shows pending transactions, fee-rate bands (20k–4M ɱ/B), and pool attribution (SupportXMR, HashVault, P2Pool). Listed at **Grade B** because the tool is demonstrably functional with live chain data, but 38/39 paths returned identical SPA shell content and no operator-published policy text is readable publicly.\n\n**What it is.** Monero mempool explorer — a read-only public utility showing pending transactions and fee estimates on the Monero network. Listed at **Grade B** because the homepage renders live, plausible mempool data (operator-published), establishing functionality, but the SPA hash-route privacy/about/terms pages rendered identical shell content and zero peer-directory matches exist.\n\n**What you trust.** Mempool data accuracy: The homepage shell renders live Monero chain data including block heights (3686039+, matching mainnet), fee-rate bands (20k–4M ɱ/B), pool attribution labels (SupportXMR, HashVault, P2Pool), and transaction counts per block (operator-published). The data is self-authenticating: any Monero node operator can verify the figures independently. This is the strongest trust signal for a mempool explorer — the output is checkable against the blockchain. Fee estimation: Transaction fee estimation is visible in the shell with four priority bands (No Priority / Low / Medium / High) at specific ɱ/B rates (operator-published). Accuracy of the estimation model depends on the explorer's algorithm; Privacy policy: Route exists at `#/privacy` but rendered identical mempool-data shell. For a mempool explorer, the key question is whether the operator logs IP addresses, query patterns, or block data requests. This is unreadable publicly. Terms of service: Routes exist at `#/terms` and `#/tos` but rendered identical shell content. Same limitation: content unread. No user accounts: As a read-only mempool viewer, there is no signup flow, no account system, and no custody of user funds. This is a public utility, not a wallet. Data transparency: Mempool explorers sit at an interesting trust intersection: the data they show is public (any Monero node can compute the same mempool state), but the *selection and ordering* of which transactions to display and which fee bands to recommend is operator-controlled. A malicious explorer could bias fee recommendations toward higher tiers or filter out transactions.\n\n**Operational specs.** Architecture: SPA (single-page application), All content lives behind hash routes. No public API surface — the page interacts with its data source internally. No Tor mirror: No onion address advertised and no `Onion-Location` header detected. Clearnet-only. A Tor-accessible mempool explorer is valuable for Monero users who route all traffic through Tor. Pricing: Free — mempool explorers are read-only public infrastructure and not typically monetised. No fee or donation prompt was visible in the shell or hash-route snippets. API surface: No public programmatic API. The shell hash route `#/api` exists but renders the same mempool-data shell as the homepage — informational only. Location / jurisdiction: Not published. The `.org` domain and Monero-only focus suggest a community or privacy-advocacy project, but this is inference without source material. Domain: `monerospace.org` — the `.org` TLD is the strongest non-geographic trust signal among gTLDs, typically associated with non-profit or community projects. The name is a clear reference to the Bitcoin mempool.space.\n\n**Grade rationale.** Listed at **Grade B** because the tool demonstrably works — the homepage shell renders live Monero mainnet mempool data with block heights, pool attribution, and fee estimation bands (operator-published). That is the core function of a mempool explorer, and a public audit confirms it is operational. Grade A is withheld because: (1) zero peer-directory matches — the tool is undiscovered; (2) the privacy policy and terms pages exist as hash routes but render identical shell content, leaving the operator's logging and data-retention posture unread; (3) no Tor mirror; (4) no operator background or jurisdiction. Among Monero infrastructure tools in this directory, a published privacy policy (logging posture: do they record IPs/queries/mempool snapshots?) and a Tor mirror would raise this to Grade A.\n\n**Caveats.** The SPA rendered identical 3101-byte shell content on all 38 returning paths and all hash routes — live mempool data was captured (confirming functionality) but the privacy/about/terms/FAQ pages are confirmed to exist as routes with zero unique text extracted. The SPA likely requires extended JavaScript hydration to expose hash-route content. include There is no custody and no signup flow. Mempool explorers are an under-appreciated trust surface: they control which transactions are displayed, in what order, and what fee rates are recommended. A compromised or malicious explorer could bias fee estimation, censor specific transactions, or selectively omit mempool entries — and end users have no way to detect this without running their own node. This is not unique to MoneroSpace (it applies to all hosted mempool explorers) but it should be stated in the review.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [], "feature_tags": [ "open_source", "xmr_native" ], "highlight_tags": [ "XMR", "EXPLORER", "FREE" ], "fees": { "summary": "Free public utility — no signup, no fees, no account." }, "fees_summary": "Free public utility — no signup, no fees, no account.", "last_verified": "2026-05-31", "operating_since": "2026-05-05", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://monerospace.org", "outbound_slug": "monerospace", "github": "https://github.com/n0/monerospace-org", "twitter": "https://x.com/umh" }, "also_listed_at": {} }, { "id": "mullvad-browser", "category": "tools", "subcategory": "Browsers", "name": "Mullvad Browser", "url": "https://xmr.club/tools/mullvad-browser", "twin": "https://xmr.club/llm/tools/mullvad-browser.txt", "tagline": "Tor-Browser-derived browser without Tor. Use with Mullvad VPN.", "review": "Mullvad Browser is the **Tor-Browser-derived anti-fingerprinting browser without the Tor routing layer** — a co-developed collaboration between **Mullvad VPN** and **The Tor Project** that brings Tor Browser's hardened-Firefox + uniform-fingerprint engineering to clearnet browsing, designed to pair with a no-logs VPN (Mullvad's own or another). Listed at **Grade A** because it occupies the **daily-driver privacy browser** slot — the anti-fingerprinting work that makes Tor Browser the privacy reference, minus the 200ms-2s latency cost of Tor's three-hop circuit, so it's actually usable as your everyday browser without breaking modern web apps.\n\n**Background.** Mullvad Browser launched in **April 2023** as a joint project between **Mullvad VPN AB** (Sweden-based VPN provider with a strong privacy reputation) and **The Tor Project** (the non-profit behind Tor Browser). The motivation: Tor Browser's anti-fingerprinting engineering is the canonical reference, but Tor's latency makes it impractical as a daily-driver browser; meanwhile most \"privacy browsers\" (Brave, Vivaldi, Librewolf) make smaller anti-fingerprinting concessions for usability. Mullvad Browser keeps **all** of Tor Browser's fingerprinting defences and strips out only the Tor network connection — your traffic instead goes through whatever VPN you have configured (Mullvad recommends their own; any no-logs VPN works). Built on Firefox ESR (the same base as Tor Browser), distributed under the **MPL 2.0** license (Firefox license inheritance). Cross-platform: macOS, Windows, Linux. Released as a sister product to (not replacement for) Tor Browser — both have their place.\n\n**What you trust.** **Uniform fingerprint** — same standardised User-Agent, screen size (1000×1000 default), font set, canvas response, WebGL response, and JS environment as Tor Browser; all Mullvad Browser users look fingerprintably identical to a tracker. **No telemetry** — Firefox's telemetry pipeline is stripped, Mozilla account integration removed. **No Mullvad lock-in** — despite the name, Mullvad Browser doesn't require Mullvad VPN; it's a generic anti-fingerprinting browser that works with any (or no) VPN. **NoScript by default** — same JavaScript-gating extension as Tor Browser; Security Level slider (Standard / Safer / Safest) controls aggressiveness. **Tor Project engineering review** — the anti-fingerprinting code is the same upstream as Tor Browser; the Tor Project reviews and contributes to the joint codebase. **Reproducible builds + signed releases** — same release discipline as Tor Browser. **What you don't trust**: the network-layer privacy is on the VPN, not the browser; pick a VPN that's actually no-logs (the EFF and Privacy Guides both publish VPN evaluation frameworks). **Critical detail**: without Tor, the **exit-side IP is your VPN's IP** — meaning your VPN provider can correlate browsing if they log; the browser's anti-fingerprinting still prevents tracker-side correlation across sessions.\n\n**Operational specs.** **Platforms**: macOS, Windows, Linux desktop. **Default behaviours**: opens with about:mullvad as default homepage; clears history/cookies on browser close (same as Tor Browser). **Security Level slider**: **Standard** (JavaScript enabled, all features); **Safer** (JavaScript disabled on non-HTTPS sites); **Safest** (JavaScript fully disabled — required for the strictest privacy posture, many web apps will break). **Tabs are isolated** — each first-party origin gets a separate state container. **New Identity** function — wipes all browser state with a hotkey. **Search engine**: defaults to DuckDuckGo and other privacy-respecting search engines; Mullvad's own search isn't pushed. **Bundled extensions**: NoScript only; same restriction as Tor Browser. **VPN integration**: deliberately none — the browser doesn't ship a VPN client; you run Mullvad's VPN client (or another) separately. **Default fingerprint**: identical to Tor Browser's fingerprint cohort, so a clever fingerprinter who detects \"this is Tor Browser fingerprint without Tor IP\" can identify Mullvad Browser users as a separate cohort; in practice this means the anonymity set is Mullvad Browser users, not all Tor Browser users.\n\n**Philosophy.** Mullvad Browser's editorial differentiator is the **fast-anti-fingerprinting** model — for users who want Tor Browser's privacy engineering but need a browser that's fast enough to use as a daily driver. Tor Browser is the canonical reference; it's the right pick when network-layer anonymity matters (against IP-correlation, against geo-detection, against ISP visibility). Mullvad Browser is the right pick when the network-layer is handled by a VPN you trust and you want a browser that doesn't make the user-agent-level anti-tracking concessions that Brave or Vivaldi or Librewolf make. The trade-off: you're moving the network-layer trust from \"no single entity sees both your IP and your destination\" (Tor's three-hop guarantee) to \"the VPN sees both your VPN-IP and the destination, and you have to trust the VPN's no-logs claim.\" For most threat models, a credible no-logs VPN + Mullvad Browser is the right combination; for the strictest threat models (journalists, activists, high-stakes scenarios), Tor Browser remains the right pick.\n\n**Grade rationale.** Grade A reflects: co-developed by Mullvad and the Tor Project (the canonical anti-fingerprinting expertise); built on Firefox ESR with full Tor Browser anti-fingerprinting patches; uniform-fingerprint design; cross-platform (macOS, Windows, Linux); no telemetry, no Mozilla account; NoScript bundled with Security Level slider; reproducible builds + signed releases; MPL 2.0 license; no Mullvad VPN lock-in (works with any VPN or none); independently audited (Mullvad publishes audit reports on their site); active development since April 2023; cross-listed in web3privacy and Privacy Guides peer directories; maintains its own Tor onion service at o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7kiad.onion. Last verified 2026-05-13.\n\n**Useful when.** You want **Tor Browser's anti-fingerprinting** without Tor's latency — daily browsing, web apps that need to be responsive. You're already running a **trusted no-logs VPN** and want a browser that complements it on the user-agent layer. You're a **journalist or researcher** doing clearnet work that's privacy-adjacent but not high-stakes-anonymity (use Tor Browser for the high-stakes part). You want a **privacy daily driver** that's structurally more conservative than Brave / Vivaldi / Librewolf — full anti-fingerprinting, no telemetry, no built-in crypto wallet / shopping integrations / lock-in features. You want a browser maintained by people who **don't have ad-tech incentives** — Mullvad makes money from VPN subscriptions, not from browser monetisation.\n\n**Caveats.** **Network-layer privacy depends on your VPN** — if your VPN logs or gets subpoenaed, the network-layer anonymity is compromised. Pick a no-logs VPN with audit reports; verify the VPN's jurisdiction and operational track record. **Mullvad Browser users are a separate fingerprint cohort from Tor Browser users** — a sophisticated fingerprinter who sees \"Tor Browser fingerprint without Tor exit IP\" can categorise Mullvad Browser users as a cohort. The anti-fingerprinting still works *within* that cohort, but the cohort itself is smaller than Tor Browser's. **No iOS, no Android** — desktop only at this writing. For mobile, use Tor Browser for Android, or a hardened Firefox build (Mull, IronFox, etc.) on iOS with appropriate extensions. **Safest mode breaks many sites** — same JavaScript trade-off as Tor Browser; modern web apps assume JavaScript. **Browser extensions are restricted** — only the bundled NoScript is included; adding extensions adds fingerprinting surface. **Don't log into clearnet accounts** — same caution as Tor Browser; logging into Gmail / Twitter from Mullvad Browser links the browser session to your clearnet identity. **The \"Mullvad\" name implies VPN coupling** — common misconception; the browser is generic anti-fingerprinting and works with any VPN. Don't sign up for Mullvad VPN just because of the browser name; pick a VPN on its own merits. **VPN-without-anti-fingerprinting is a partial-trust posture** — Mullvad Browser doesn't make sense without a VPN (your real IP would be exposed); use it explicitly as the browser-layer in a VPN+browser stack.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "no_js_supported", "audited" ], "highlight_tags": [ "FREE", "ANTI-FINGERPRINT" ], "fees": { "summary": "Free" }, "fees_summary": "Free", "last_verified": "2026-05-13", "operating_since": "2023", "tenure_note": "Mullvad Browser launched April 2023 in partnership with The Tor Project. Previous stamp (2008) was mullvad.net WHOIS (Mullvad VPN parent), not this specific browser product.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://mullvad.net/browser", "outbound_slug": "mullvad-browser", "tor": "http://o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7kiad.onion", "twitter": "https://x.com/mullvadnet" }, "also_listed_at": { "web3privacy": true, "privacyguides": true, "monerica": true } }, { "id": "newpipe", "category": "tools", "subcategory": "Frontend", "name": "NewPipe", "url": "https://xmr.club/tools/newpipe", "twin": "https://xmr.club/llm/tools/newpipe.txt", "tagline": "Android YouTube + SoundCloud + PeerTube client. No Google services, no account, F-Droid first.", "review": "NewPipe is the **F-Droid flagship privacy-respecting Android client for YouTube + SoundCloud + PeerTube + Bandcamp** — a single Android app that fetches content from multiple media platforms without requiring any of those platforms' official apps, without signing into any accounts, without depending on Google Play Services, and with **background play, downloads, picture-in-picture, and Sponsorblock** built in. Listed at **Grade A** because NewPipe is the **canonical Android pick** for media consumption without operator surveillance — the mobile sibling to FreeTube (desktop) and Invidious (web).\n\n**Background.** NewPipe was created in 2015 by **Christian Schabesberger** (German developer) and has been actively developed by a small but consistent contributor team since. Open source under the **GPLv3** license; codebase at github.com/TeamNewPipe/NewPipe. **Distribution channels**: **F-Droid** (the canonical Android free-software store — NewPipe is one of F-Droid's flagship apps), direct APK download from newpipe.net, plus the **NewPipe Sentinel** distribution mechanism that delivers updates via F-Droid's signed-release pipeline. **No Google Play presence** — NewPipe deliberately doesn't ship on Google Play; the GPLv3 license combined with NewPipe's terms-of-service stance vs YouTube's official terms means Play Store distribution would be operationally fraught. Android only — no iOS (Apple's WebKit restrictions + YouTube's iOS app dominance make a port impractical). Funded entirely by donations + contributor labour; no commercial entity, no SaaS dependency.\n\n**What you trust.** **No Google Play Services dependency** — NewPipe works on any Android, including degoogled systems (CalyxOS, GrapheneOS, LineageOS, /e/OS). **No accounts** — you don't sign in; subscriptions are stored locally on your device. **No tracking** — the app doesn't include analytics SDKs, doesn't phone home, doesn't share data with third parties. **Multiple content sources** — YouTube, SoundCloud, PeerTube, Bandcamp, MediaCCC (Chaos Communication Congress media archive); the app uses each platform's public-facing endpoints. **Local subscription management** — your subscription list is a local SQLite database; you can import/export as JSON. **Sponsorblock integration** — the community-maintained Sponsorblock database (skip-sponsor timestamps) works in NewPipe with per-category toggles. **Download support** — videos + audio-only downloads to local storage. **Open-source codebase** — auditable; F-Droid's signed-release process verifies the binary matches the published source. **What you don't trust**: YouTube's anti-scraping measures — periodically YouTube changes its endpoints and NewPipe takes a few days to weeks to update; expect occasional \"videos not loading\" windows during these update cycles. **NewPipe vs YouTube's terms of service** — using NewPipe to fetch YouTube content is technically against YouTube's ToS (though the legal status of personal-use scraping varies by jurisdiction); users should evaluate their own legal context. **The \"official\" NewPipe builds from F-Droid** vs forks (NewPipe x Sponsorblock, NewPipe Legacy) — multiple community forks exist; F-Droid's NewPipe is the canonical.\n\n**Operational specs.** **Platform**: Android only. **Content sources**: YouTube, SoundCloud, PeerTube (decentralised video platform), Bandcamp, MediaCCC. **Distribution**: F-Droid (canonical), direct APK from newpipe.net, NewPipe Sentinel (in-app update mechanism). **Background play**: yes — keep listening to YouTube audio with the screen off (this is a paid YouTube Premium feature in the official YouTube app). **Picture-in-picture**: yes — minimised player overlay when you switch to another app. **Downloads**: video + audio-only formats; subtitles can be downloaded separately. **Sponsorblock**: per-category toggles (skip sponsor, skip self-promotion, skip outro, etc.). **Subscriptions**: stored locally in SQLite; OPML / JSON / CSV import/export supported. **Notifications**: subscription new-video alerts (configurable). **Casting**: Chromecast / DLNA support for streaming to TVs. **No comments by default** — comment-loading is opt-in (saves bandwidth and avoids the toxic-comment surface). **Storage management**: clear cache, manage downloaded videos, control data usage. **Format selection**: choose video quality, audio-only, container format.\n\n**Philosophy.** NewPipe's editorial differentiator is the **degoogled-friendly Android media client** — it works on **any** Android, including Google-free phones (CalyxOS, GrapheneOS, LineageOS), without requiring Play Services. The official YouTube app requires Play Services and a Google account; NewPipe deliberately doesn't. This makes NewPipe the canonical pairing with privacy-Android distros: install CalyxOS or GrapheneOS, install F-Droid, install NewPipe, and you have a YouTube experience that doesn't tie back to a Google account or Play Services. Compare to FreeTube (desktop) and Invidious (web): NewPipe is the mobile partner that completes the privacy-respecting YouTube stack across platforms.\n\n**Grade rationale.** Grade A reflects: open-source GPLv3 codebase; **10+ years of operational continuity** (since 2015); F-Droid flagship status (one of F-Droid's most-downloaded apps); cross-source support (YouTube, SoundCloud, PeerTube, Bandcamp, MediaCCC); no Google Play Services dependency; no accounts, no tracking, no analytics SDKs; local-only subscription storage; built-in Sponsorblock; download support; background play + picture-in-picture; Chromecast/DLNA casting; named maintainer (Christian Schabesberger) with public GitHub presence; consistent contributor community; cross-listed in Privacy Guides peer directory. Last verified 2026-05-13.\n\n**Useful when.** You're an **Android user** wanting YouTube + SoundCloud + PeerTube + Bandcamp content without operator surveillance — NewPipe is the canonical pick. You're running a **degoogled Android** (CalyxOS, GrapheneOS, /e/OS, LineageOS) and need a media client that doesn't require Play Services. You want **background play + downloads** for YouTube without paying for YouTube Premium. You want **PeerTube native client support** — NewPipe is one of the few Android apps that handles PeerTube as a first-class content source. You want **Sponsorblock on mobile** — saves cumulative minutes per video; NewPipe has it built in. You're managing **subscription feeds locally** with no Google account tie. You're a **researcher or educator** who archives video content — NewPipe's download workflow is friction-free.\n\n**Caveats.** **Android only** — no iOS, no desktop. For desktop, use FreeTube; for web, use Invidious. **YouTube endpoint changes break NewPipe periodically** — when YouTube tweaks its unofficial API, NewPipe has to update. Expect occasional \"NewPipe isn't loading videos\" windows; check for an F-Droid update; if delayed, wait for the maintainer team to ship a fix. **No Google Play distribution** — Play Store users have to switch to F-Droid (or sideload APKs). F-Droid is the right answer but it adds a one-time setup step for users coming from stock Android. **NewPipe vs YouTube ToS** — using NewPipe to fetch YouTube content is technically against YouTube's terms of service; evaluate your jurisdiction's stance on personal-use scraping. **Live-stream support is limited** — the unofficial endpoints don't always provide live-stream-quality features; for watching live, the official YouTube web client is more reliable. **No algorithmic recommendations** — by design. Subscription-based discovery only. **Forks vs canonical** — multiple NewPipe forks exist (NewPipe x Sponsorblock, NewPipe Legacy for older Android); the canonical F-Droid NewPipe is the right default unless you have specific needs the forks address. **No iOS equivalent** — Apple's restrictions leave no comparable iOS option. **Comment quality varies** — comments work but are loaded slowly and don't have the same anti-spam filtering as YouTube's own comment system. **Doesn't help with YouTube content moderation** — YouTube's takedowns still apply (videos taken down by YouTube are gone from NewPipe too). For archival, use the download feature. **Storage management matters** — heavy use of downloads can fill your device; clean up periodically. **Battery use is noticeable** — playing video on Android is always battery-intensive; NewPipe is no worse than the official YouTube app, but mobile media consumption is fundamentally power-hungry.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source" ], "highlight_tags": [ "ANDROID", "F-DROID", "FRONTEND" ], "fees": { "summary": "Free · GPLv3 · F-Droid · Android only" }, "fees_summary": "Free · GPLv3 · F-Droid · Android only", "last_verified": "2026-05-13", "operating_since": "2018", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://newpipe.net", "outbound_slug": "newpipe" }, "also_listed_at": { "privacyguides": true } }, { "id": "onionshare", "category": "tools", "subcategory": "File Sharing", "name": "OnionShare", "url": "https://xmr.club/tools/onionshare", "twin": "https://xmr.club/llm/tools/onionshare.txt", "tagline": "P2P file-share over Tor onion services. No third-party hosting.", "review": "OnionShare is the **canonical ephemeral self-hosted file transfer + chat + microsite tool** — a desktop application that spins up a Tor `.onion` service on your own machine for one-shot transfers, where the recipient connects via Tor Browser. Listed at **Grade A · editor's pick** because OnionShare occupies a structural category-of-one: no third-party hosting, no operator infrastructure, no expiration that depends on someone else's policy. **Mandatory tool in the privacy stack** for sending files larger than email allows, hosting a temporary file drop, or running a short-lived microsite that disappears when you close the lid.\n\n**Background.** OnionShare was created by **Micah Lee** (security technologist, formerly of The Intercept) in 2014 and has been maintained as an open-source project since. Released under the **GPLv3** license; codebase at github.com/onionshare/onionshare. The application is **cross-platform desktop** (macOS, Windows, Linux) plus a Linux-only CLI variant for headless operation. Bundled in **Tails OS** as a default tool — when you boot Tails, OnionShare is installed and ready, no separate setup. The Tor Project doesn't develop OnionShare but cooperates with the maintainers; OnionShare uses the same Tor library and `.onion` v3 service infrastructure as Tor Browser. Funding: grants from **Open Tech Fund** and **Freedom of the Press Foundation** (Lee's organisational context), plus contributor labour. The codebase has received independent security audits with reports linked from onionshare.org.\n\n**What you trust.** **Your local machine** — OnionShare runs entirely on your computer; the `.onion` service is hosted on your device, the files don't leave your disk until the recipient downloads them. **Tor network** — both you and the recipient connect via Tor; the files are encrypted in transit via the Tor protocol; no exit relay is involved (onion services are end-to-end Tor-routed). **`.onion` v3 cryptography** — the address is derived from a public key; only someone with the address can find the service. **Ephemeral by default** — when you close OnionShare or click stop, the service disappears; no persistent state on third-party infrastructure. **Optional authentication** — OnionShare supports adding a **secret URL slug** (private mode) so even leaking the `.onion` address doesn't grant access without the slug. **Open-source codebase + audited** — the source is auditable; signed releases are reproducible from source; the codebase has been independently audited. **No operator infrastructure** — there is no OnionShare company that could be subpoenaed, no central service that could be compromised, no analytics SDK that could leak metadata.\n\n**Operational specs.** **Platforms**: macOS, Windows, Linux desktop apps (PyQt-based); Linux CLI for headless operation; bundled in Tails OS. **Modes**: **Share Files** (one-shot transfer; recipient connects, downloads, service closes), **Receive Files** (you host an upload form; senders submit files anonymously into your machine), **Host a Website** (static HTML/CSS/JS site served from your machine over `.onion`), **Chat** (anonymous chat room hosted on your machine). **Onion service**: `.onion` v3 (the modern format with strong cryptography); the address is a 56-character base32 string. **Authentication options**: public (anyone with the address can connect), private (address + secret URL slug required), client-authorization (advanced: only specific Tor clients with pre-shared keys can connect). **File size**: limited only by your disk space and your patience — Tor onion transfer speeds are typically 100KB/s to a few MB/s depending on relay paths. **Expiration**: configurable per-share — auto-stop after N downloads, auto-stop after a timer, or manual stop. **Tor integration**: OnionShare bundles its own Tor instance OR can use a system Tor; for users running a local Tor (e.g., Tails users, Whonix users), the system-Tor mode is preferred.\n\n**Philosophy.** OnionShare's editorial differentiator is the **ephemeral-self-hosted-service** model. Cloud file-share services (Google Drive, Dropbox, WeTransfer, Send.tres) involve a third-party operator who sees who-sent-what-to-whom and retains the file on their servers; this is a leak even when content is encrypted at rest. End-to-end encrypted services (Bitwarden Send, Send.tres, Magic Wormhole) reduce the content-leak but still involve a service operator who sees connection metadata. OnionShare goes further: there is no operator at all, the service is your machine, and when you close it the service vanishes. The trade-off: your machine has to be online and reachable during the transfer; if you close your laptop mid-transfer, the file doesn't continue from a cloud relay because there is no cloud relay. For one-shot transfers where you control the timing, this is the cleanest possible trust model.\n\n**Grade rationale.** Grade A and editor's pick reflect: open-source GPLv3 codebase; created by a named security technologist (Micah Lee) with a public track record in privacy tooling; bundled in Tails OS as a default tool (the canonical signal that the Tails community trusts it); independent security audits with public reports; cross-platform desktop (macOS, Windows, Linux) + CLI for headless ops; first-class `.onion` v3 support; multiple operating modes (file send, file receive, website host, chat) all over Tor onion services; optional secret-slug authentication; ephemeral by design (no persistent third-party state); over a decade of operational continuity (since 2014); maintained official Tor onion at lldan5gahapx5k7iafb3s4ikijc4ni7gx5iywdflkba5y2ezyg6sjgyd.onion. Last verified 2026-05-13.\n\n**Useful when.** You need to **send a file larger than email allows** to a specific person — share the `.onion` address through a separate secure channel (Signal, PGP-signed message, in-person QR), they download via Tor Browser, the service closes when done. You need to **receive files anonymously** — open OnionShare's Receive mode and share the address; senders submit files into your machine without revealing their identity to a third-party operator. You're a **journalist** receiving documents from sources — OnionShare's Receive mode is built for this use case and is recommended by SecureDrop and Freedom of the Press Foundation. You need to **host a temporary microsite** for a specific audience — drag in HTML files and OnionShare serves them from your machine over `.onion`. You're on **Tails** and need a file-sharing tool that doesn't break Tails' privacy posture — OnionShare is the canonical pick. You want **zero third-party operator** in the file-transfer trust path.\n\n**Caveats.** **Your machine must be online during transfer** — if you close OnionShare or shut your laptop mid-transfer, the recipient can't continue from a cloud relay (because there is no cloud relay). Plan accordingly: keep the laptop open until confirmed downloaded, or use the auto-stop-after-N-downloads option to know when it's done. **Tor transfer speeds are slow** — 100KB/s to a few MB/s typical; a 10GB file transfer takes hours. For large transfers, schedule appropriately. **Recipient needs Tor Browser** (or a Tor-capable client) — non-technical recipients may need help installing Tor Browser to connect. **Onion-v3 address is 56 chars long** — sharing the address via a side channel (Signal, etc.) means transmitting a long string; consider QR codes for in-person sharing. **No built-in chat history** — OnionShare's chat mode is ephemeral by design; messages disappear when the service closes. For persistent group communication, use SimpleX, Matrix, or Cwtch. **CLI mode is Linux-only** — for headless server hosting (e.g., a long-running file drop), you need a Linux machine; the macOS/Windows desktop apps are GUI-only. **Custom-domain hosting isn't supported** — OnionShare uses generated `.onion` addresses; for vanity-prefix `.onion` addresses or DNS-mapped sites, you need a separate Tor onion service workflow (not OnionShare's domain). **File-receive mode is a deliberate attack surface** — when you open Receive mode, anyone with the address can submit files into your machine; pair with private-mode authentication for high-trust scenarios, and treat received files as untrusted (sandbox / virus-scan before opening). **Single-user model** — OnionShare is one-user-one-service; for organisational use cases with multiple senders/receivers, see SecureDrop instead.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "non_custodial", "self_hosted", "audited" ], "highlight_tags": [ "FREE", "TOR", "P2P" ], "fees": { "summary": "Free · GPLv3" }, "fees_summary": "Free · GPLv3", "last_verified": "2026-05-13", "operating_since": "2014", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://onionshare.org", "outbound_slug": "onionshare", "tor": "http://lldan5gahapx5k7iafb3s4ikijc4ni7gx5iywdflkba5y2ezyg6sjgyd.onion" } }, { "id": "privatebin", "category": "tools", "subcategory": "Pastebin", "name": "PrivateBin", "url": "https://xmr.club/tools/privatebin", "twin": "https://xmr.club/llm/tools/privatebin.txt", "tagline": "Encrypted-in-browser pastebin. The server never sees plaintext. Self-host on a $4 VPS.", "review": "PrivateBin is the **encrypted-in-browser minimalist pastebin** — a self-hostable PHP application where pastes are AES-encrypted client-side before upload, with the **encryption key living in the URL fragment** (never reaching the server), making the server a zero-knowledge storage layer. Listed at **Grade A** because PrivateBin is the **canonical drop-in for pastebin.com / hastebin / Gist** when you need to share text snippets without trusting the storage operator with the content — battle-tested over years, deployable on a $4 VPS, supports password-protection, expiry, burn-after-reading, and syntax highlighting.\n\n**Background.** PrivateBin is a fork of the original **ZeroBin** (by **Sébastien SAUVAGE**, 2012) — when ZeroBin development paused, the community continued under the PrivateBin banner. Active development by a maintainer team led by **El Rido**; codebase at github.com/PrivateBin/PrivateBin. **Distribution**: deploy to any PHP web host (shared hosting, $4 VPS, Docker container); the application is intentionally lightweight (PHP + JavaScript + plain HTML, no database required by default; SQLite or filesystem storage). **Multiple operators** run public PrivateBin instances; the canonical list at privatebin.info/directory/ shows community-operated instances you can use without self-hosting. **Open source** under the **Zlib license** (permissive, similar to MIT). **No commercial entity** — entirely volunteer-maintained.\n\n**What you trust.** **Client-side encryption** — AES-CBC-256 encryption happens in the browser via JavaScript; the server stores only ciphertext. **Key in URL fragment** — the encryption key is in the part of the URL after `#`, which browsers never send to servers. Share the URL = share the key + paste ID. **Zero-knowledge architecture** — the operator (or the self-host you set up) literally cannot read the paste content. **Open-source codebase** — the source is auditable; the cryptography has been independently reviewed (informal community review; no full Cure53-style audit but the codebase is small enough to be reasonably auditable). **Multiple options for storage backends** — filesystem (default), SQLite, MySQL, PostgreSQL; operators can pick what fits their infrastructure. **Tor-friendly** — works on Tor Browser including the \"Safest\" security level (the encryption JavaScript needs to run, but the application gracefully handles JS-restricted environments where possible). **What you don't trust**: URL forwarding — anyone with the URL has the key. Treat URL sharing as the access mechanism. **Operator metadata** — even though the server can't read paste content, it sees connection timing, paste size, retrieval frequency. For high-threat scenarios, self-host or use Tor. **Key derivation strength** — PrivateBin's key is randomly generated (high entropy), but the JavaScript implementation's randomness depends on the browser's CSPRNG.\n\n**Operational specs.** **Platform**: browser-based; the server runs PHP. **Storage backends**: filesystem (default, simplest), SQLite, MySQL, PostgreSQL. **Paste features**: password protection (additional symmetric layer atop the URL fragment key), expiry (5 minutes, 10 minutes, 1 hour, 1 day, 1 week, 1 month, 1 year, never), **burn-after-reading** (paste self-destructs after first view), syntax highlighting (~30 languages), markdown formatting, **comments** (other readers can comment on the paste; comments are also encrypted), **discussion threads** for collaborative editing. **File upload**: optional — depends on operator policy. **Max paste size**: operator-configured, typically 1-10 MB. **No accounts** — pastes are anonymous; no signup, no email. **Bot scraping protection**: server-side rate limits + optional invite/captcha gates for operators concerned about abuse. **No-JS fallback** — limited: the encryption requires JavaScript, but some read-only views work without JS (operator-configured). **Tor support**: works on Tor Browser; some operators run dedicated `.onion` mirrors.\n\n**Philosophy.** PrivateBin's editorial differentiator is the **trivially-self-hostable encrypted-pastebin** model. Pastebin.com, hastebin, GitHub Gist — all see your plaintext, all retain it on their servers, all are subject to operator decisions about deletion and moderation. PrivateBin says: pastes are a fundamental web primitive that shouldn't require trusting an operator with the content. The self-host story is intentional: deploy in 10 minutes on cheap hosting, give your team or organisation a private pastebin, eliminate the dependency on a third-party service. For users who don't want to self-host, the public-instances directory provides community-operated options. The trade-off vs cloud pastebins: no built-in commenting at the scale of GitHub Gist's community, no integration with development workflows (no fork, no version history), no shared-with-username model — but the privacy posture is structurally cleaner.\n\n**Grade rationale.** Grade A reflects: open-source Zlib-licensed codebase; 10+ years of operational continuity (ZeroBin/PrivateBin lineage since 2012); zero-knowledge architecture with client-side encryption; self-host fallback well-documented (PHP + minimal setup); multiple storage-backend options; rich feature set (password, expiry, burn-after-reading, syntax highlight, comments); Tor-friendly; public-instances directory for users who don't want to self-host; named maintainer (El Rido) and active community contributors; cross-listed in Privacy Guides peer directory (referenced as the recommended encrypted-pastebin). Last verified 2026-05-13.\n\n**Useful when.** You need to **share text snippets** (code, logs, error messages, configuration) without sending them to a third-party service that retains the content — PrivateBin is the canonical pick. You want to **self-host** a private pastebin for your organisation or team — deploy on any PHP host in 10 minutes. You're a **journalist or activist** sharing sensitive text with sources via a side-channel-shared URL — pair PrivateBin with Signal/PGP for the URL transmission. You want **burn-after-reading** semantics for a one-shot share that self-destructs after the recipient views it. You're a **researcher** with a workflow that involves paste-sharing and want to eliminate the operator-trust dependency. You want a pastebin that works on **Tor Browser** including the \"Safest\" security level (most features) — PrivateBin handles Tor gracefully.\n\n**Caveats.** **JavaScript required for encryption** — the AES-CBC encryption runs in browser JS. Tor Browser \"Safest\" mode disables JS, which breaks encryption; you'll need to step down to \"Safer\" or \"Standard\" for full PrivateBin functionality. **URL forwarding is access grant** — anyone with the URL has the key. Plan accordingly: use burn-after-reading for sensitive one-shot shares; password-protect on top of the URL key for additional layer; revoke access requires deleting + regenerating. **Operator metadata visibility** — public PrivateBin instances see connection timing, paste sizes, retrieval patterns. For high-threat use, self-host. **PHP web hosting requires sysadmin care** — keep PHP updated, harden the web server (nginx + TLS), monitor for abuse (spam-paste creation, DDoS). Operating a public PrivateBin instance is more work than just deploying the code. **No accounts / no sharing model** — pastes are anonymous; you can't say \"share this with username X.\" You share via URL or you don't share. For team-based workflows, self-host with restricted access at the web-server level. **Storage limits** — operators set max paste size and total storage limits; very large pastes need a self-hosted instance with adequate disk. **JavaScript-runtime randomness depends on browser** — modern browsers (Tor Browser, Firefox, Chromium) have well-vetted CSPRNGs; old or odd browsers may have weaker entropy. **Comments are visible if the URL is shared** — comment threads are visible to anyone with the paste URL; they're not separately access-controlled. **Burn-after-reading is fragile in some scenarios** — if multiple recipients open the URL simultaneously, both may see the paste before it's destroyed. For strict one-recipient semantics, share the URL with only one person at a time. **The \"private\" in PrivateBin doesn't mean anonymous in the strong sense** — your IP is visible to the server (or proxied via Tor if you route that way). For anonymity, route through Tor.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted", "no_js_supported", "tor_supported" ], "highlight_tags": [ "E2E", "SELF-HOST", "OPEN-SOURCE" ], "fees": { "summary": "Free · PHP · self-host or public instances" }, "fees_summary": "Free · PHP · self-host or public instances", "last_verified": "2026-05-13", "operating_since": "2016", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://privatebin.info", "outbound_slug": "privatebin" } }, { "id": "proton-pass", "category": "tools", "subcategory": "Passwords", "name": "Proton Pass", "url": "https://xmr.club/tools/proton-pass", "twin": "https://xmr.club/llm/tools/proton-pass.txt", "tagline": "E2E password manager from Proton. Free tier, accepts crypto, includes 2FA + alias support.", "review": "Proton Pass is the **Proton-suite password manager** — Proton AG's newer addition to its privacy-tooling portfolio (Proton Mail, Proton VPN, Proton Drive, Proton Calendar, now Proton Pass), bringing E2E-encrypted password storage + TOTP generation + **SimpleLogin email-alias integration** (Proton acquired SimpleLogin in 2022) into a single account. Listed at **Grade A** because Proton Pass occupies the **integrated-privacy-suite** point on the password manager spectrum — convenient bundling for users already in the Proton ecosystem, with the same E2EE guarantees and similar open-source posture as Bitwarden, but tighter coupling to a single operator (Proton AG, Swiss jurisdiction).\n\n**Background.** Proton Pass launched in **2023** as the password manager addition to **Proton AG**'s privacy suite. Proton AG (formerly Proton Technologies AG, founded 2013 in Geneva, Switzerland) is the long-running operator of **Proton Mail** (originally **ProtonMail**, launched 2014 by CERN scientists), **Proton VPN**, **Proton Drive**, **Proton Calendar**, and now **Proton Pass**. The team acquired **SimpleLogin** in 2022 (the email-alias service) and integrated it into Proton Pass as the email-alias generator feature. Proton Pass is **open source** under the **GPLv3** license; clients at github.com/ProtonMail/WebClients (the Proton clients monorepo includes Mail, Pass, Drive, etc.). **Swiss jurisdiction** — Proton operates under Swiss law, which has strong data-protection protections (no mass-data-retention regime, strong constitutional privacy rights, but Switzerland is **not** in the EU and has its own legal framework). **Acquired Standard Notes in 2024** — see related listing; this is part of Proton's broader expansion into the privacy-suite category.\n\n**What you trust.** **End-to-end encryption** — vault content is encrypted client-side with keys derived from your Proton account password; the server stores ciphertext only. **Open-source clients** — Proton's clients monorepo is published on GitHub; you can audit what's running on your device. **Swiss jurisdiction** — Proton AG is subject to Swiss data-protection law, which is generally privacy-protective; Switzerland is not in the Five Eyes / Fourteen Eyes intelligence-sharing alliances. **Integrated with the Proton suite** — single Proton account works for Mail, Pass, VPN, Drive, Calendar; sign in once, use the whole suite. **SimpleLogin alias integration** — generate single-use email aliases for service signups directly from Proton Pass; the aliases route through Proton's alias infrastructure (acquired SimpleLogin team continues to operate). **TOTP support** — store TOTP secrets alongside passwords (convenience-vs-defence-in-depth trade-off, same as Bitwarden's paid tier). **2FA on vault** — TOTP, FIDO2/WebAuthn, hardware tokens. **What you don't trust**: **single-operator concentration** — Proton Pass + Proton Mail + Proton VPN + Proton Drive + Proton Calendar all live on Proton AG infrastructure. If you trust the operator, this is convenient; if you want trust diversification, splitting across operators (Bitwarden for passwords, Tuta for email, Mullvad for VPN, Nextcloud for files) is structurally cleaner. **Swiss jurisdiction has nuances** — generally privacy-protective, but Switzerland has cooperation arrangements with various Western jurisdictions; the **content** of E2E-encrypted vaults is protected by encryption regardless, but metadata and account-creation IP logs may be accessible under specific legal processes. **Light-KYC at signup** — Proton requires an email-or-recovery-method at signup; uses your existing Proton Mail account if you already have one.\n\n**Operational specs.** **Platforms**: macOS, Windows, Linux desktop apps; iOS, Android mobile; web client at pass.proton.me; browser extensions for Firefox, Chrome, Brave, Edge, Safari. **Free tier**: unlimited passwords, unlimited devices, 10 SimpleLogin email aliases included, basic TOTP, basic 2FA on the vault. **Pro tier** ($5/month, often bundled): unlimited SimpleLogin aliases, advanced sharing, integrated with Proton Mail + VPN. **Proton Unlimited** ($10/month): bundles Pass with Mail + VPN + Drive + Calendar — the most cost-effective if you use multiple Proton services. **Payment methods**: credit card, PayPal, **Bitcoin** (on annual plans), some other cryptocurrencies. **Encryption**: client-side AES-GCM with PBKDF2/Argon2 key derivation; matches Proton's broader cryptography stack. **Sync**: Proton servers in Switzerland; the server only sees ciphertext. **TOTP support**: built-in TOTP secret storage + code generation. **SimpleLogin integration**: generate-an-alias as a feature in the vault item creation flow; aliases route to your Proton Mail inbox. **2FA**: TOTP, FIDO2/WebAuthn (YubiKey, etc.). **Hide my email** functionality powered by SimpleLogin.\n\n**Philosophy.** Proton Pass's editorial differentiator is the **integrated Proton suite + alias integration** posture. Bitwarden is the canonical open-source pluralist password manager (self-host fallback, no operator lock-in). Proton Pass is the canonical \"I've already chosen Proton as my privacy-suite operator\" pick — leverages your existing Proton account, integrates with SimpleLogin's alias infrastructure, lives alongside Proton Mail / VPN / Drive / Calendar. The trade-off vs Bitwarden: more operator lock-in (your Proton account is now the trust anchor for the whole stack); the upside is the alias integration (SimpleLogin in Bitwarden requires external configuration) and the suite-level cost effectiveness (Proton Unlimited bundles five products for $10/month). For users committed to the Proton suite, Pass is the natural complement.\n\n**Grade rationale.** Grade A reflects: open-source GPLv3 codebase; backed by **Proton AG** (12+ year operator with strong privacy track record); Swiss jurisdiction (privacy-protective legal framework); end-to-end encryption with documented cryptography (matches Proton's broader stack); **SimpleLogin alias integration** (a meaningful editorial differentiator vs other password managers); Bitcoin + crypto payment options; integrated with the broader Proton suite (Mail, VPN, Drive, Calendar); FIDO2/WebAuthn 2FA support; cross-platform clients (desktop, mobile, web, browser extensions); cross-listed in Privacy Guides peer directory. Last verified 2026-05-12.\n\n**Useful when.** You're **already using the Proton suite** (Proton Mail, Proton VPN, etc.) and want a password manager that integrates with your existing account — Proton Pass is the natural fit. You want **email-alias generation as a vault feature** — Proton Pass's SimpleLogin integration is the cleanest in-vault alias workflow. You want a **Swiss-jurisdiction privacy-first password manager** with strong constitutional protections — the Proton stack is the canonical Swiss option. You want **Proton Unlimited bundle economics** — $10/month gets you Mail + Pass + VPN + Drive + Calendar; if you'd pay for 2+ of those, the bundle is cost-effective. You want **Bitcoin payment** for a password manager paid plan — Proton accepts it on annual plans (Bitwarden does not at this writing). You want a **modern UX** with consistent Proton-suite design — coming from Bitwarden's functional UX, Proton Pass feels more polished.\n\n**Caveats.** **Operator lock-in via the Proton account** — Proton Pass + Mail + VPN + Drive + Calendar all live behind one account. If you stop trusting Proton, you're migrating five products at once rather than one. For trust diversification, mix operators (Bitwarden for passwords + Tuta for mail + Mullvad for VPN + Nextcloud for files). **Newer product** — launched 2023, so its operational track record is shorter than Bitwarden's (since 2016) or KeePassXC's (since 2016 as a fork from KeePassX 2003). The Proton team has the institutional experience but Pass specifically is still maturing. **Self-host is not supported** — unlike Bitwarden (Vaultwarden), Proton Pass doesn't have a self-host option. If you want to operate your own server, Bitwarden is the right pick. **Swiss jurisdiction nuances** — strong privacy framework but Switzerland has specific cooperation arrangements with various Western intelligence agencies; the E2E encryption protects content regardless, but metadata and account-creation IP logs may be subject to specific legal processes. Read Proton's transparency report for incident history. **Light-KYC at signup** — Proton requires an existing email or recovery method; not zero-KYC. Use Proton Mail itself or a privacy-respecting external email for signup. **TOTP in password manager is convenience-vs-defence-in-depth tradeoff** — storing TOTP alongside passwords means a vault compromise exposes both factors. Use a separate authenticator (Aegis, Ente Auth) or hardware token (YubiKey) for high-stakes accounts. **Proton's expansion is broad** — Standard Notes acquired 2024, SimpleLogin acquired 2022. The portfolio expansion creates consolidation risk: one operator is now the trust anchor for an increasing range of products. Some users prefer pluralism. **Default password recovery is impossible** — zero-knowledge cryptography means a forgotten password is unrecoverable without your recovery file or pre-set recovery method. Set up recovery methods at signup. **Mobile UX is solid but battery-active when sync runs** — Proton Pass mobile apps sync periodically; expect normal mobile-password-manager battery use. **Browser extension is opt-in for autofill** — install the extension if you want autofill convenience; otherwise the desktop and web clients are the primary surface.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "non_custodial", "open_source", "2fa_supported", "tor_supported" ], "highlight_tags": [ "E2E", "ALIASES", "BTC" ], "fees": { "summary": "Free · Pro from $5/mo · BTC accepted on annual" }, "fees_summary": "Free · Pro from $5/mo · BTC accepted on annual", "last_verified": "2026-05-12", "operating_since": "2016", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2016", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://proton.me/pass", "outbound_slug": "proton-pass", "twitter": "https://x.com/ProtonPrivacy", "telegram": "https://t.me/proton_privacy", "discord": "https://discord.gg/proton" }, "also_listed_at": { "privacyguides": true } }, { "id": "proxypagos", "category": "tools", "subcategory": "Payments & bill-pay concierge", "name": "ProxyPagos", "url": "https://xmr.club/tools/proxypagos", "twin": "https://xmr.club/llm/tools/proxypagos.txt", "tagline": "México-focused pay-what-you-need-without-a-form: mobile top-ups, utility bills (CFE / agua / internet / telefonía), giftcards, eSIMs, and cash withdrawals — all guided over chat, in XMR / Lightning / internal balance. Tor + I2P surfaces published.", "review": "**What it is.** A Mexico-focused payment-utility service. Rather than a self-serve web checkout, the flow runs through a chat interface: you say what you need (top-up airtime, pay CFE electricity, buy a giftcard, activate an eSIM, withdraw cash), and the operator quotes and executes against your XMR / Lightning / internal balance. The service positions itself as *\"lo que necesitas pagar, sin salir del chat\"* — pay what you need without leaving the chat.\n\n**Tenure.** Domain registered **2022-02-03** — 3.5 years of continuous operation. Tenure reinforces Grade B.\n\n**Product surfaces observed.**\n\n- **Mobile** — airtime top-ups + data packages for Mexican mobile operators.\n- **Bills** — CFE (electricity), water, internet, telephony.\n- **Giftcards** (unbounded set implied).\n- **eSIMs** (activation + top-up).\n- **Cash withdrawal** in Mexico.\n- Public price ticker on the landing page for BTC + XMR (live rate, timestamped).\n\n**Network reach.** Tor + I2P surfaces are published on the landing page:\n\n- Clearnet landing: `proxypagos.com`\n- **Landing onion**: `proxypagospynfv4m7z3vo7rz44iohp5fidomb56jmqhyvp64hc2w5yd.onion`\n- **Private web onion**: `n5tjfm23zvjvrqgr4dm7liirrl7u34euqxjxjfag4wnimthyopc7u6yd.onion`\n- **I2P landing**: `proxypagos.i2p` (experimental) + `sksigouagszcfgyztg7hoenshytac2jmzgtstwra6ysiwyzsdzya.b32.i2p` fallback.\n\nThat's a strong network-layer commitment: three distinct hidden-service surfaces (landing + auth + I2P) is well above the usual \"one.onion published\" bar.\n\n**Peer position.** monerica.com carries a listing. kycnot.me: not yet listed. One independent peer-directory anchor.\n\n**Why Grade B (not C).** For a *cards*-adjacent Mexican payments listing, three signals lift off C: (a) the multi-network surface (clearnet + Tor + Tor-auth + I2P) is real operator work, not marketing, (b) monerica anchor corroborates, (c) chat-based flow with XMR / Lightning / internal balance is a structurally testable no-form-fill experience. Grade A withheld pending: a curator test-transaction on at least one product (bill or top-up), kycnot corroboration, and a run at how the operator handles reversals when a bill payment fails on the Mexican utility side.\n\n**Caveats.** Chat-driven means slower than a self-serve web UI and higher operator-attention cost. Readers should treat this as *\"a private concierge that speaks Spanish and lives on Tor\"* rather than a Stripe replacement. Fee spread not disclosed on the landing page — worth flagging as a Reader Caveat and confirmed via test-transaction.", "translation_locale": "en", "rating": { "grade": "B" }, "grade": "B", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "MEXICO", "BILL-PAY", "TOP-UPS", "GIFTCARDS", "ESIM", "CASH-WITHDRAWAL", "CHAT-INTERFACE", "XMR", "LIGHTNING", "TOR-NATIVE", "I2P-NATIVE" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-11", "operating_since": "2022-02", "tenure_note": "Domain registered 2022-02-03. `operating_since` set to the earliest signal.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://proxypagos.com", "tor_landing": "http://proxypagospynfv4m7z3vo7rz44iohp5fidomb56jmqhyvp64hc2w5yd.onion", "tor_auth": "http://n5tjfm23zvjvrqgr4dm7liirrl7u34euqxjxjfag4wnimthyopc7u6yd.onion", "i2p_landing": "http://proxypagos.i2p", "i2p_b32": "http://sksigouagszcfgyztg7hoenshytac2jmzgtstwra6ysiwyzsdzya.b32.i2p", "telegram": "https://t.me/proxypagos_bot", "email": "mailto:proxypagos@proxypagos.com", "simplex": "simplex:/contact#/?v=2-7&smp=smp%3A%2F%2FPQUV2eL0t7OStZOoAsPEV2QYWt4-xilbakvGUGOItUo%3D%40smp6.simplex.im%2FU48yl4nW3Q4Gcv7l_14x-wJI_AZAueRZ%23%2F%3Fv%3D1-4%26dh%3DMCowBQYDK2VuAyEA9WF0GHEOYlVOC9t5Bjg3F6-hGPfKi7EFDO3m_5X8rWU%253D%26q%3Dc%26srv%3Dbylepyau3ty4czmn77q4fglvperknl4bi2eb2fdy2bh4jxtf32kf73yd.onion", "twitter": "https://x.com/proxypagos", "nostr": "proxypagos@proxypagos.com", "instagram": "https://instagram.com/proxypagos", "facebook": "https://facebook.com/proxypagos", "logo": "https://xmr.club/peers/proxypagos.jpg" }, "also_listed_at": { "monerica": true } }, { "id": "qubes-os", "category": "tools", "subcategory": "Anonymity OS", "name": "Qubes OS", "url": "https://xmr.club/tools/qubes-os", "twin": "https://xmr.club/llm/tools/qubes-os.txt", "tagline": "Security-via-compartmentalisation desktop OS. Every app runs in its own Xen VM.", "review": "Qubes OS is the **\"reasonably secure operating system\"** — a Xen-based desktop OS where every workflow lives in its own **qube** (a lightweight Xen VM) with hypervisor-level isolation between them. Listed at **Grade A · editor's pick** because Qubes occupies a structurally unique position: it's the only consumer-grade OS that uses **hypervisor isolation as the primary security primitive**, treating \"the entire OS\" (including USB drivers, network stack, GUI compositor) as untrusted components to be sandboxed. **Edward Snowden publicly endorsed it**; the Tails Project and Whonix Project both recommend Qubes as the canonical strict-anonymity host. The trade-off is real: heavy hardware requirements, learning curve, and a fundamentally different mental model than stock Linux/macOS/Windows — but for users whose threat model includes sophisticated application-level attacks, no consumer alternative comes close.\n\n**Background.** Qubes OS was created by **Joanna Rutkowska** (renowned security researcher, formerly of Invisible Things Lab) in **2010**, with the first stable release in 2012. The project is currently maintained by the **Qubes OS Project** (a community-of-developers structure with named maintainers and contributors), led by **Marek Marczykowski-Górecki** as the lead developer. Open source under the **GPLv2** license; codebase at github.com/QubesOS. **Hardware requirements**: 16 GB RAM minimum (32 GB recommended), 64-bit CPU with VT-x + VT-d / AMD-V + IOMMU, SSD strongly recommended, certified Qubes-compatible hardware list available at qubes-os.org/hcl/. **Tails-Qubes recommendation**: Tails on Qubes runs as a disposable VM giving you Tails's amnesic semantics on top of Qubes's hypervisor isolation. **Qubes-Whonix**: the canonical recommendation for anonymity work — Whonix templates run as qubes, all networking routed through Whonix-Gateway, applications run in Whonix-Workstation qubes. **Funding**: donations + grants (NLnet, Open Tech Fund, individual contributors); no commercial owner.\n\n**What you trust.** **Xen hypervisor** — Qubes is built on Xen 4.x, the well-audited Type 1 hypervisor that's also used by AWS for EC2. Xen isolation is hypervisor-level, meaning a compromised qube cannot read another qube's memory without breaking the hypervisor itself. **Compartmentalisation by default** — separate qubes for Banking, Personal, Work, Vault (offline-only for keys), Disposable (browsers that get destroyed after each use), Untrusted-Web (anything from the open internet). **GUI compositor isolation** — the GUI is rendered by **dom0** (the trusted privileged domain), with qubes drawing into Xen-mediated framebuffers; clipboard sharing between qubes is explicit and visible. **Networking is its own qube** — `sys-net` is the qube that owns the network card and Wi-Fi drivers; if a network-card driver has a vulnerability, it lives inside sys-net only. **Disposable qubes** — short-lived qubes for tasks like \"open this PDF I don't trust\"; the qube is created, runs the task, gets destroyed. **No phoning home** — Qubes doesn't collect telemetry. **What you don't trust**: hardware (the CPU itself, the firmware, the network card hardware) — Qubes mitigates but cannot eliminate hardware-level trust. **Side-channel attacks on Xen** (Spectre, Meltdown, L1TF, MDS) — these have been mitigated in hardware + Xen patches, but each new class of side-channel attack requires re-evaluation. **dom0 compromise** would be catastrophic — dom0 is the privileged domain that controls everything else; Qubes minimises dom0's attack surface (no networking, no untrusted files, no untrusted apps run in dom0) but if dom0 is compromised, the whole system is.\n\n**Operational specs.** **Hardware**: 64-bit CPU with VT-x + VT-d (Intel) or AMD-V + IOMMU (AMD); 16 GB RAM minimum, 32 GB recommended; SSD strongly recommended (HDD is technically supported but painfully slow); certified hardware list at qubes-os.org/hcl/. **Templates**: Fedora (default for personal qubes), Debian, Whonix-Gateway, Whonix-Workstation, custom templates for specialised use cases. **Qube types**: **AppVM** (regular application qube derived from a template), **TemplateVM** (the source template that AppVMs derive from), **NetVM** (owns the network hardware; e.g., sys-net), **ProxyVM** (filters between net qubes; e.g., sys-firewall, sys-whonix), **DispVM** (disposable, destroyed after use). **Inter-qube communication**: explicit and controlled via `qrexec` (Qubes RPC); each qube-to-qube communication channel is policy-controlled. **GUI**: dom0 runs the trusted compositor; qubes draw into Xen framebuffers; window decorations show the qube name + color for visual identification. **Updates**: dom0 + templates each receive updates separately; the AppVMs derive their software state from templates, so updating a template propagates to all AppVMs using it. **Disposable VMs**: created instantly via right-click \"Open in disposable VM\"; perfect for opening untrusted attachments or browsing untrusted URLs. **HVM mode**: for legacy applications that can't run as PV/PVH, hardware-virtualised mode is supported.\n\n**Philosophy.** Qubes's editorial differentiator is the **hypervisor-isolation-as-primary-security** model. Linux, macOS, Windows all share the same fundamental assumption: applications run in user-space, kernel mediates access, root is the security boundary. This is fine until you have a kernel vulnerability, a malicious application that escalates privileges, or a driver bug that gives an attacker kernel access. Qubes inverts the assumption: the OS itself (kernel, drivers, GUI, everything) is **untrusted** and runs inside a Xen VM. The hypervisor is the security boundary, and the hypervisor is much smaller than the OS, making it easier to audit and harder to exploit. The trade-off: every workflow needs its own qube, requiring more RAM and conscious organisation of work into qubes. For users whose threat model includes application-level compromise (sophisticated journalism, intelligence work, anti-surveillance research, high-value crypto custody), the trade-off is justified; for everyday users, it's overkill.\n\n**Grade rationale.** Grade A and editor's pick reflect: open-source GPLv2 codebase; 15+ years of operational continuity (since 2010, stable since 2012); hypervisor-isolation-as-primary-security architecture (the strongest compartmentalisation available on consumer hardware); maintained by a named team (Joanna Rutkowska as creator, Marek Marczykowski-Górecki as lead developer); independent security reviews; pairs natively with Whonix for Tor-routed qubes; Disposable VM model for one-shot untrusted operations; Templates-based update model; explicit qrexec inter-qube communication; named **Snowden endorsement** as a credibility-signal independent of the project's own marketing; cross-listed in web3privacy peer directory. Last verified 2026-05-13.\n\n**Useful when.** You're in a **threat model where application-level compromise** is a credible attack vector — sophisticated journalism, activism, intelligence work, anti-surveillance research, high-value cryptocurrency custody. You're **already running Whonix** and want the hypervisor isolation Qubes provides as the host. You need **disposable VMs** for opening untrusted documents, browsing untrusted URLs, or analysing potentially malicious files. You want **compartmentalisation by workflow** — separate qubes for Banking, Personal, Work, Vault — so a compromise in one workflow doesn't affect the others. You're a **security researcher** who needs to analyse malware safely in an isolated environment. You're a **journalist** working with sensitive sources and need an OS that won't leak data between workflows. You want **the strongest desktop privacy posture currently available** on consumer hardware.\n\n**Caveats.** **Heavy hardware requirements** — 16 GB RAM minimum, 32 GB recommended; older laptops may not meet the bar. Check the Hardware Compatibility List before purchasing. **Real hardware preferred** — running Qubes in a virtual machine inside another OS defeats the purpose; the hypervisor isolation only works on bare metal. **Steep learning curve** — Qubes's mental model (qubes, templates, dom0, sys-net, sys-firewall) is fundamentally different from \"an operating system.\" Expect a multi-week learning curve before you're productive. **Some applications don't work well** — GPU-accelerated applications, certain video conferencing tools, and games are awkward to run on Qubes due to the GPU-passthrough complexity (though Qubes 4.2+ has improved GPU support). **No mobile** — desktop only; mobile users should use GrapheneOS or CalyxOS. **dom0 is the high-value target** — if dom0 is compromised, the whole system is. Qubes minimises dom0's attack surface but you should still be careful about what you do in dom0 (the rule: nothing untrusted goes in dom0). **Side-channel attacks on Xen** are a real concern — Spectre, Meltdown, and the long tail of hardware-level vulnerabilities have required Xen updates and BIOS updates; stay current. **No Secure Boot in some configurations** — Qubes's Secure Boot support has improved but historically had quirks; check the current state for your specific hardware. **Battery life on laptops** is worse than stock Linux because of the always-on hypervisor + multiple VMs. **Inter-qube data movement requires explicit copy** — qrexec policies control what flows between qubes; this is a feature (no accidental data leak) and a friction (every cross-qube operation is intentional). **Backup strategy is critical** — Qubes can back up individual qubes or the whole system; design your backup plan early to avoid losing work in case of dom0 corruption.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "self_hosted", "audited" ], "highlight_tags": [ "FREE", "XEN", "COMPARTMENTALISED" ], "fees": { "summary": "Free · GPLv2" }, "fees_summary": "Free · GPLv2", "last_verified": "2026-05-13", "operating_since": "2010", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://qubes-os.org", "outbound_slug": "qubes-os", "twitter": "https://x.com/Snowden" }, "also_listed_at": { "web3privacy": true, "monerica": true } }, { "id": "securedrop", "category": "tools", "subcategory": "Whistleblowing", "name": "SecureDrop", "url": "https://xmr.club/tools/securedrop", "twin": "https://xmr.club/llm/tools/securedrop.txt", "tagline": "Newsroom-grade anonymous-source submission system. Run by ~70 outlets (NYT, WaPo, ProPublica, Guardian).", "review": "SecureDrop (securedrop.org) is the *whistleblower submission system the serious newsrooms actually run* — an open-source platform from the Freedom of the Press Foundation that lets a source send documents to journalists with a threat model that assumes the network, and the source's own situation, are hostile.\n\n**Background.** SecureDrop traces to the *DeadDrop* project (originally worked on by Aaron Swartz and journalist Kevin Poulsen) and has been stewarded since 2013 by the *Freedom of the Press Foundation*, a non-profit. It is deployed by major investigative outlets worldwide, each running its *own per-newsroom Tor onion service* for source submissions. That non-profit stewardship, open-source codebase, and decade of real-world use in adversarial conditions are why it earns an A in /tools — this is battle-tested infrastructure, not a privacy gadget.\n\n**What you trust.** The architecture, because the *code is open source and the threat model is explicit and pessimistic*. A source uploads via *Tor* to the newsroom's dedicated `.onion`, so neither the source's IP nor the fact of the connection is exposed to a passive network observer. Journalists retrieve submissions on an *air-gapped workstation* (the recommended setup uses Qubes OS), decrypting documents on a machine that never touches the internet — which contains the damage if a journalist's everyday laptop is compromised. The Foundation publishes a *public directory of which newsrooms run an instance*, so a source can verify they're submitting to the real outlet rather than a lookalike. You're trusting an auditable system and a non-profit, not a vendor's promise.\n\n**Operational specs.** Submission is Tor-only via the newsroom's onion, with no account, no email, and no identifying metadata required of the source. The server side is a hardened, documented deployment newsrooms self-host; the journalist side prescribes air-gapped decryption (Qubes/Tails workflows) and GPG. Codenames, not identities, track a source's submission thread. Everything is free and open-source, the deployment guides and hardening steps are public, and the directory of live instances is maintained at securedrop.org (and over its own onion).\n\n**Philosophy.** Source protection is a press-freedom problem, and the only durable protection is *technical, not procedural* — you cannot subpoena metadata that was never collected, and you cannot coerce a journalist into revealing a source they were architecturally prevented from identifying. SecureDrop encodes that principle: assume the network is surveilled, assume devices get seized, assume the adversary is a state, and design so that the system still protects the source. Open-sourcing it and running it as a non-profit public good is the only configuration consistent with that mission.\n\n**Grade rationale.** A in /tools. The grade reflects open-source, non-profit (Freedom of the Press Foundation) stewardship; a rigorous, explicitly adversarial threat model; Tor-only metadata-minimal submission; air-gapped journalist workflows; and a verifiable public directory of instances. It is the reference implementation for whistleblower infrastructure — nothing else in the category combines this provenance, adoption, and discipline.\n\n**Useful when.** SecureDrop is for *sources with something genuinely sensitive to disclose to a newsroom*, and for *newsrooms that need a credible, source-protecting intake channel*. If you're a potential source, use the Foundation's directory to find your target outlet's instance, follow the Tails/Tor instructions exactly, and submit only over the verified onion. If you're an organization, it's the gold standard to deploy — with the operational seriousness it demands.\n\n**Caveats.** SecureDrop's protection is only as strong as the *operational security around it* — a source who connects from an identifying network, leaks their codename, or ignores the Tails/Tor guidance can deanonymize themselves regardless of how sound the system is. Running an instance properly (air-gapped Qubes/Tails, hardware, maintenance) is non-trivial and demands real commitment from the newsroom; a misconfigured deployment is worse than none. And it solves *submission*, not the downstream legal and physical risks a source may face. These are caveats of operational discipline, not of the design — which is precisely why SecureDrop pairs the software with detailed hardening guidance, and why it sits at the top of the category.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "self_hosted", "tor_supported", "audited" ], "highlight_tags": [ "TOR", "AUDITED", "WHISTLEBLOWER" ], "fees": { "summary": "Free · audited · run by ~70 newsrooms" }, "fees_summary": "Free · audited · run by ~70 newsrooms", "last_verified": "2026-06-02", "operating_since": "2013", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://securedrop.org", "outbound_slug": "securedrop", "tor": "http://sdolvtfhatvsysc6l34d65ymdwxcujausv7k5jk4cy5ttzhjoi6fzvyd.onion", "twitter": "https://x.com/securedrop" } }, { "id": "session-messenger", "category": "tools", "subcategory": "Messaging", "name": "Session", "url": "https://xmr.club/tools/session-messenger", "twin": "https://xmr.club/llm/tools/session-messenger.txt", "tagline": "Decentralised messenger — no phone number, no email, onion-routed.", "review": "Fork of Signal's protocol minus the centralised server + identity layer. Account is just a generated key. Onion-routes through their own service-node network. Lower latency than Tor Messenger; weaker than Signal on metadata but stronger on identity.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "non_custodial", "audited" ], "highlight_tags": [ "FREE", "NO-PHONE" ], "fees": { "summary": "Free · GPLv3" }, "fees_summary": "Free · GPLv3", "last_verified": "2026-05-12", "operating_since": "2019", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://getsession.org", "outbound_slug": "session-messenger", "twitter": "https://x.com/session_app" }, "also_listed_at": { "web3privacy": true } }, { "id": "simplex-chat", "category": "tools", "subcategory": "Messaging", "name": "SimpleX Chat", "url": "https://xmr.club/tools/simplex-chat", "twin": "https://xmr.club/llm/tools/simplex-chat.txt", "tagline": "Decentralised messenger with no user IDs at all. The only major messenger that doesn't identify users.", "review": "SimpleX Chat is the first major messenger architecturally without **any persistent user identifier** — no phone number, no email, no username, not even a random UUID that follows you across sessions. Each contact pair gets its own one-time queue identifier, and the network operator (whoever runs the relay servers you connect through) literally cannot tell which user is talking to which other user. Listed at **Grade A · editor's pick** because it solves a problem that Signal / Telegram / WhatsApp / Matrix all left unsolved: even with end-to-end encryption, those platforms still have a global identifier (phone, account ID, JID) that ties metadata together; SimpleX has no such anchor.\n\n**Background.** SimpleX Chat is an open-source project, **open since 2020**, with **2 million+ app downloads** as of this review. Lead by Evgeny Poberezkin; the codebase lives at github.com/simplex-chat/simplex-chat under the AGPLv3 license. Funding mix: project funded by users + Community Credits model (large communities pay for their servers, covering infrastructure + development + governance). The project has shipped **two independent security audits** (2022 + 2024) — published, with reports linked from simplex.chat. Available as Android, iOS, macOS, Linux, Windows, and a terminal CLI. Roadmap publicly stated through Dec 2027 with milestones in 2026 (scale to large communities) and 2027 (sustainable communities + community-grade tooling).\n\n**What you trust.** **The protocol architecture is the trust story**, not the operator. SimpleX uses **pairwise queues**: every two users who connect generate a unique pair of queue identifiers, which exist only on the relay server for that connection. No queue identifier is reused. No global \"this is user X\" identifier exists anywhere in the system. Messages are encrypted end-to-end with double-ratchet (Signal's primitive) plus an additional layer per-relay so the relay sees only encrypted blobs. The relay server **cannot correlate** which queues belong to the same user — it just routes messages between anonymous queue endpoints. **Self-hosting**: anyone can run an SMP (SimpleX Messaging Protocol) server; users can configure their app to use only their own servers if they want maximum trust minimisation. **Default servers**: SimpleX team runs default relays for users who don't want to self-host; the team can't see content (E2EE) or metadata-correlations (per-queue architecture) but they do see traffic volume + IP of connecting clients. **Tor support**: the app can be configured to route through Tor, removing the IP-correlation surface.\n\n**Operational specs.** Platforms: **Android, iOS, macOS, Linux, Windows** + terminal CLI. Features: end-to-end-encrypted **direct messages**, **group chats** (up to ~hundreds of members), **encrypted file transfer** via XFTP protocol, **voice + video calls** (WebRTC-based, E2E-encrypted), **disappearing messages**, **incognito profiles** (auto-generated identity per contact for users who want extra isolation), **chat profiles** (multiple personas per app install). Bot framework available for developers via the SimpleX TypeScript SDK + chat-bot example. Open source under AGPLv3. Reproducible builds documented at simplex.chat/verify-builds. Translated UI: en, العربية, Čeština, Deutsch, Español, Français, Magyar, Indonesia, Italiano, 日本語, Polski, Português, Русский. Roadmap publicly available; Community Credits model for community-funded server infrastructure rolling out 2027.\n\n**Philosophy.** SimpleX's editorial differentiator is **identifier-free messaging as an architectural choice** rather than a privacy feature added on top of an identifier-based system. Signal hides messages with E2EE but Signal still has a phone number that ties all your activity together. Telegram offers usernames as an alternative to phone numbers but still gives you one global username. Matrix gives you a JID (`@user:server.org`) that's stable across the federation. SimpleX rejects this entire pattern — by giving every contact pair its own queue identifier, the metadata-correlation problem is solved at the protocol level rather than mitigated at the policy level. The trade-off: no global \"find me by username\" feature; connections are made via pasting an invitation link or scanning a QR code, then the connection is mutual but the queue is unique. This is friction for casual users; for users who care about metadata privacy, the friction is the point.\n\n**Grade rationale.** Grade A and editor's pick reflect: architecturally unique no-identifier design (genuinely novel in the messenger space); open-source AGPLv3 codebase; **two independent security audits** published (2022 + 2024); 2 million+ app downloads with no major security incidents or governance crises; multi-platform coverage including Linux + terminal CLI; self-hosting supported with documented server-deployment guides for SMP and XFTP relays; Tor support; reproducible builds; 13-locale UI translation; public roadmap with clear funding model. Last verified 2026-05-12.\n\n**Useful when.** You need a messenger and your threat model includes metadata correlation (who you talk to, how often, when). You're a journalist, activist, lawyer, security researcher, or anyone whose contact graph being observable would be a problem. You want a messenger that works for casual use and high-threat use without switching apps. You want voice/video calls without giving up the privacy property (most \"private\" messengers fall back to standard WebRTC for calls — SimpleX wraps the WebRTC layer). You want to use multiple chat personas without juggling multiple apps (incognito profiles + chat profiles handle this in-app). You want a self-hostable messaging infrastructure for your team / community / family without trusting a third-party operator.\n\n**Caveats.** **No \"search by username\" — by design** — connections require invitation-link sharing (paste a URL or scan a QR code). For casual contact-discovery users, this is friction. **Default relay servers see IP + traffic-volume** unless you route through Tor or self-host. **Self-hosting is real operational work** — running your own SMP + XFTP servers is documented but non-trivial; most users use the team's default servers. **Group size limit ~hundreds** — SimpleX is great for personal + small-community use but not yet at the scale of Telegram groups (10k+). **Active development means changing surfaces** — version-to-version, the app gains features and occasionally restructures UX; users coming back after 6 months may find things have moved. **Onboarding friction** — for non-technical users, \"scan a QR code to add a contact\" is harder than \"search @username\", and the no-identifier design genuinely loses casual users who can't justify the privacy benefit. **Funding model still maturing** — Community Credits launches 2027; until then the project depends on user donations + grant funding, which is more fragile than a self-sustaining revenue model. **Network effect** — most of your contacts probably aren't on SimpleX yet; you'll need to onboard at least one other person to make it useful, which is the universal new-messenger challenge.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted", "tor_supported", "no_js_supported" ], "highlight_tags": [ "NO-ID", "OPEN-SOURCE", "SELF-HOST" ], "fees": { "summary": "Free · open-source · self-hostable relays" }, "fees_summary": "Free · open-source · self-hostable relays", "last_verified": "2026-05-12", "operating_since": "2020", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://simplex.chat", "outbound_slug": "simplex-chat", "twitter": "https://x.com/simplexchat", "simplex": "https://simplex.chat/img/share_simplex" }, "also_listed_at": { "privacyguides": true, "monerica": true } }, { "id": "smmkings", "category": "tools", "subcategory": "smm-panel", "name": "SMMKings", "url": "https://xmr.club/tools/smmkings", "twin": "https://xmr.club/llm/tools/smmkings.txt", "tagline": "SMM panel since 2016 — Telegram Premium / Stars, ad placements, web traffic, social engagement. Crypto-pay, email-only signup.", "review": "SMMKings is a long-running (since 2016, WHOIS-confirmed) automated SMM panel built on the PerfectPanel whitelabel script. They sell Telegram Premium, Telegram Stars, ad placements, GEO-targeted Instagram/YouTube views, web traffic, AdSense traffic, social shares, YouTube SEO/backlinks, and CMC/Dextools/Dexscreener visibility services — all priced in crypto and accessed via a REST API + Telegram Mini-App.\n\n**KYC posture:** signup requires an email address (the only PII captured); no name, no document, no phone. Their FAQ commits to not collecting other personal data, not running trackers/heatmaps, not selling user data, and not storing order history beyond what's needed to fulfil the service. Support is ProtonMail-only.\n\n**Caveats** — (1) SMM panel for AdSense traffic carries inherent risk to the buyer's ad accounts (the panel itself warns about CTR red-flags). (2) Telegram Premium / Stars resale exists in a gray area against Telegram's own ToS. (3) The platform balance is **non-refundable to the funding gateway** — once you deposit, credits stay on the platform and must be spent on services (no withdraw back to BTC / fiat). (4) No Tor v3 mirror. (5) Email required at signup — pair with a disposable / ProtonMail address for the most-private path.\n\nFor what it is — long-running, low-PII SMM commodity — it's a B-tier listing in the tools category.", "translation_locale": "en", "rating": { "grade": "B" }, "grade": "B", "kyc_tags": [ "light_kyc", "email_required", "no_personal_data" ], "feature_tags": [ "crypto_pay", "telegram_mini_app", "api_available" ], "highlight_tags": [ "since_2016" ], "fees": { "summary": "Per-service pricing in dashboard; deposits non-refundable to the funding gateway — credits stay on the platform balance and must be spent on services." }, "fees_summary": "Per-service pricing in dashboard; deposits non-refundable to the funding gateway — credits stay on the platform balance and must be spent on services.", "last_verified": "2026-05-28", "operating_since": "2016", "tenure_note": "WHOIS confirms domain creation 2016-09-15 (matches their since-2016 claim)", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://smmkings.com", "telegram": "https://t.me/smmkings_app_bot/smm", "contact_email": "smmkings@pm.me", "outbound_slug": "smmkings" } }, { "id": "snowflake", "category": "tools", "subcategory": "Censorship Bypass", "name": "Snowflake", "url": "https://xmr.club/tools/snowflake", "twin": "https://xmr.club/llm/tools/snowflake.txt", "tagline": "Browser-based proxy bridge that lets censored users reach the Tor network. Run one to help, or use one to connect.", "review": "Snowflake is the **WebRTC-based Tor pluggable transport for censorship circumvention** — a Tor Project tool that lets people in censored networks reach the Tor network by tunneling through volunteer-run **WebRTC proxies** that look like ordinary browser video-call traffic. Listed at **Grade A** because Snowflake occupies a structurally unique position: it's the **easiest way to volunteer infrastructure for the censorship-bypass commons** (install a browser extension and your visitor flow becomes bridge capacity), and it's one of the most-deployed practical answers to **bridge enumeration** (since traffic to volunteer proxies looks like WebRTC, censors can't easily distinguish Snowflake traffic from legitimate video calls).\n\n**Background.** Snowflake was developed by **The Tor Project** as part of their pluggable-transports research, with implementation work led by **Cecylia Bocovich** and **David Fifield** among others. Active development since 2018, with stable production deployment since 2020. Open source as part of the Tor Project codebase; main repos at gitlab.torproject.org/tpo/anti-censorship/. The protocol uses **WebRTC** (the real-time-communication standard browsers use for video and audio calls) as its transport, which has three properties that matter for censorship: (1) WebRTC traffic is **already-ubiquitous** on the open internet (Google Meet, Zoom, every browser video call), so blocking it would have huge collateral damage; (2) WebRTC connections are **NAT-traversing**, so volunteers behind home routers can serve as bridges without configuring port forwarding; (3) the **rendezvous mechanism** (how clients find proxies) uses a small set of resilient signaling channels (AMP cache, fastly CDN, Cloudflare worker) that censors can't easily enumerate.\n\n**What you trust.** **The Tor Project** — same organisational backing as Tor Browser, with public mission alignment for censorship circumvention. **WebRTC traffic obfuscation** — your Snowflake-encapsulated traffic looks (from a censor's perspective) like an ordinary WebRTC connection to a random IP. **NAT-traversing** — Snowflake proxies can run behind home routers without port-forwarding, which means volunteer infrastructure is easy to deploy (browser extension is enough). **Open-source pluggable transport** — the protocol and reference implementation are auditable; censors can't fingerprint it via secret-algorithm tricks. **Volunteer-run infrastructure** — Snowflake's proxy network is decentralised; no single point of compromise. **What you don't trust**: the proxy you connect to — Snowflake proxies are run by anonymous volunteers; they see encrypted Tor traffic (not your content) but they see your IP and the timing of your connection. The Tor circuit itself (after the Snowflake proxy hop) provides the anonymity; the Snowflake proxy is just the entry point. **Bandwidth and latency are variable** — volunteer-run infrastructure varies in capacity; some proxies are fast, some are slow.\n\n**Operational specs.** **Client side (you, the censored user)**: Snowflake is bundled into **Tor Browser** as a pluggable transport — when you click \"Configure\" in Tor Browser's network settings and pick \"Snowflake,\" your connection routes through a Snowflake proxy. No separate install needed; Tor Browser handles it. **Volunteer side (you, running a proxy to help)**: install the **Snowflake browser extension** on Firefox or Chrome and you become a bridge — your browser's idle WebRTC capacity is offered to censored peers. Optional standalone runner: a **command-line proxy** for users who want to run a higher-capacity bridge from a server. Mobile: Tor Browser for Android supports Snowflake; iOS via the Onion Browser app. **Performance**: typical Snowflake bandwidth is constrained by the volunteer proxy's connection (often residential home internet); expect 1-10 Mbps in practice. Latency adds the WebRTC connection-establishment overhead on top of Tor's three-hop. **Reliability**: when one Snowflake proxy disconnects (volunteer closes the browser), your client automatically reconnects to a different available proxy.\n\n**Philosophy.** Snowflake's editorial differentiator is the **volunteer-infrastructure-via-browser-extension** model — it's the only Tor pluggable transport where the volunteer barrier-to-entry is \"install a browser extension.\" Compare to obfs4 (requires running a server with public IP), Meek (uses CDN domain fronting; CDN providers have started blocking the technique), or webtunnel (newer, requires server setup). Snowflake's design *explicitly* prioritises easy volunteer onboarding: if a million people in non-censored regions install the Snowflake extension, the censorship-bypass network has a million bridges, and no censor can block \"people using WebRTC\" without breaking the internet. The trade-off: residential-grade bandwidth, no service-level reliability guarantees. For mass-scale censorship circumvention this is the right model; for high-bandwidth specific-use circumvention, dedicated bridges (obfs4) may be more reliable.\n\n**Grade rationale.** Grade A reflects: developed and maintained by The Tor Project (canonical anti-censorship organisation); open-source as part of the Tor codebase; 7+ years of operational continuity (active since 2018, production-stable since 2020); WebRTC-based protocol leverages traffic that's already ubiquitous on the open internet (high collateral-damage cost for censors); volunteer-run proxy network (decentralised, hard to enumerate); browser-extension volunteer onboarding (lowest barrier-to-entry in the pluggable-transport space); bundled in Tor Browser as a default option; available for Firefox, Chrome, Android, iOS (via Onion Browser); maintained official Tor onion at oljlphash3bpqtrvqpr5gwzrhroziw4mddidi5d2qa4qjejcbrmoypqd.onion; cross-listed in Privacy Guides peer directory. Last verified 2026-05-13.\n\n**Useful when.** You're in a **censored network** (China, Iran, Russia in some periods, Turkey in some periods, etc.) and need to reach Tor — Snowflake is the recommended first-try pluggable transport in many regions. You want to **volunteer infrastructure for the censorship-bypass commons** — install the Snowflake browser extension and you contribute bridge capacity by just keeping the extension running. You're **building censorship-resilient applications** and need an embeddable Tor entry point that's hard to block — Snowflake's underlying protocol is reusable. You're a **journalist or researcher** working with sources in censored regions — recommending Snowflake (rather than direct Tor) is the right first step for someone who hits Tor-blocking. You're running a **high-volunteer activist organisation** and want a low-cost way for your supporters to help censored users access uncensored information. You're **testing Tor Browser** in a censored network simulation and need a pluggable transport that's representative of the typical user's first hop.\n\n**Caveats.** **Bandwidth is variable** — volunteer proxies are residential-grade, often slower than direct Tor connections; expect performance to be inconsistent across sessions. **Latency is higher than direct Tor** — Snowflake adds a WebRTC-handshake hop on top of Tor's three-hop overhead. **Volunteer proxy churn** — proxies come and go as volunteers open/close their browsers; the client handles reconnection automatically but mid-session disconnects happen. **WebRTC requires NAT-traversing infrastructure that censors *could* try to block** — Snowflake's design makes blocking high-collateral-damage, but a determined censor could disrupt the rendezvous channels. The Tor Project maintains multiple resilient rendezvous channels; this is an active arms race. **Doesn't replace direct Tor** — if you're not in a censored region, use direct Tor (Tor's own default circuit). Snowflake is a censorship-bypass tool, not a privacy upgrade. **Volunteer proxies see your IP** — the proxy can't see your encrypted Tor content, but it sees your IP and connection timing. For most users this is fine (residential volunteers aren't surveillance threats); for high-threat models, evaluate whether a specific proxy you happen to connect to is trustworthy. **Browser-extension volunteer mode uses idle bandwidth** — when running as a volunteer, the extension uses some of your home internet bandwidth to serve censored peers. The default is conservative; you can adjust limits in the extension settings if you have constrained bandwidth or data caps. **Don't expect Snowflake to be your-only-line-of-defence** — in heavily-censored regions, expect to try multiple pluggable transports (Snowflake first, then obfs4, then meek, then webtunnel) depending on what the local censorship pattern blocks at any given time. **Mobile UX is more limited than desktop** — Tor Browser for Android supports Snowflake but the volunteer side is desktop-browser-extension only at this writing.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "tor_supported" ], "highlight_tags": [ "TOR", "CENSORSHIP", "OPEN-SOURCE" ], "fees": { "summary": "Free · WebRTC · browser ext / mobile / standalone" }, "fees_summary": "Free · WebRTC · browser ext / mobile / standalone", "last_verified": "2026-05-13", "operating_since": "2018", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2018", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://snowflake.torproject.org", "outbound_slug": "snowflake", "tor": "http://oljlphash3bpqtrvqpr5gwzrhroziw4mddidi5d2qa4qjejcbrmoypqd.onion" }, "also_listed_at": { "privacyguides": true } }, { "id": "sovereign-rerouter", "category": "tools", "subcategory": "Crypto Ops", "name": "Sovereign Rerouter", "url": "https://xmr.club/tools/sovereign-rerouter", "twin": "https://xmr.club/llm/tools/sovereign-rerouter.txt", "tagline": "Privacy \"re-router\" from Sovereign Stack — swap crypto through their relay to break the on-chain link, records purged within 24h, optional escrow. Custodial while the route settles; established since 2021.", "review": "**A privacy-routing swap from an established self-hosting brand.** Sovereign Stack's Re-router lets you send one asset and receive another through their relay — the point isn't the best rate, it's breaking the on-chain link between what you sent and what you get back. Monero sits naturally in that flow as the private intermediary. The parent brand has been around since 2021 (both the domain and the re-router product show ~5 years of Wayback history), so this isn't a fresh throwaway — it's a mature operator in the self-sovereignty niche.\n\n**Privacy posture is the selling point, and it reads honestly.** Their terms state plainly that they *\"do not store any information about users longer than required to complete a re-route,\"* and that **records are purged within 24 hours** of you receiving your funds — retained only that long because they're *\"required for refunds.\"* **Escrow is available on request** for anyone who wants a trust anchor on a larger route. A nice transparency touch: they publish a live **Monero block height** on the terms page as a freshness/proof-of-life signal.\n\n**Custody: funds pass through them while the route settles.** Like any swap/router, they briefly hold value mid-route (that's what makes refunds possible), so this is *not* non-custodial — send only what the route needs and move on. Standard shape for the category; the 24h purge and escrow option are the mitigations.\n\n**Why C, and what would lift it.** This grade is *not* about tenure — 5 years is a point in its favour. It's capped by two honest gaps: the actual swap widget is JavaScript-gated, so we could not verify the coin list, the fee/spread, or the exact XMR path first-party; and independent third-party reputation on the re-router specifically is thin. A clean curator test-swap (a small XMR route, confirming the mechanism and the disclosed fee) would close both and put a B- squarely on the table. Until then: a credible, privacy-forward router from a real operator — graded conservatively because we grade what we can verify, not what we're told.", "translation_locale": "en", "rating": { "grade": "C", "trust": "Established brand (Sovereign Stack, operating since 2021; ~5yr Wayback on both domain and the rerouter product). Custodial while the route settles. Capped by a JS-gated swap widget we could not exercise first-party and thin independent reputation on the router specifically.", "privacy": "Strong stated posture: no user info stored beyond route completion, records purged within 24h (kept only for refunds), escrow available on request, live XMR block height published on the ToS as a freshness anchor. Monero used as the private intermediary in the route.", "ux": "Clean single-purpose 'swap your crypto' flow; the interactive widget is client-rendered so coin list, fee/spread and exact XMR path were not verifiable without a live order." }, "grade": "C", "kyc_tags": [ "NO-KYC" ], "feature_tags": [ "xmr", "no_kyc", "swap", "privacy_routing", "escrow" ], "highlight_tags": [ "XMR", "RE-ROUTER", "24H-PURGE", "ESCROW-OPT", "SINCE-2021" ], "fees": null, "fees_summary": null, "last_verified": null, "operating_since": "2021", "tenure_note": "Domain + rerouter product both archived since Oct/Dec 2021 (~5yr tenure) — mature, not new. Grade C is capped by JS-gated swap widget (unverified coins/fees/XMR path) + thin independent reputation, NOT by newness. B- on a clean curator test-swap.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://sovereignstack.tools/rerouter/", "outbound_slug": "sovereign-rerouter" }, "also_listed_at": {} }, { "id": "stables-rip", "category": "tools", "subcategory": "Market Data", "name": "stables.rip", "url": "https://xmr.club/tools/stables-rip", "twin": "https://xmr.club/llm/tools/stables-rip.txt", "tagline": "Stablecoin issuance + flow intelligence — track USDT/USDC supply across chains.", "review": "Live stablecoin supply, flow, and dominance charts. Useful for tracking when a chain is gaining/losing liquidity. Full historical backfill (~$3.2B in USDT volume indexed).", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "api_available" ], "highlight_tags": [ "FREE", "INTEL" ], "fees": { "summary": "Free · no signup · public API" }, "fees_summary": "Free · no signup · public API", "last_verified": "2026-05-12", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": true, "editors_pick": false, "links": { "web": "https://stables.rip", "outbound_slug": "stables-rip" } }, { "id": "stackxmr", "category": "tools", "subcategory": "Charts & Portfolios", "name": "StackXMR", "url": "https://xmr.club/tools/stackxmr", "twin": "https://xmr.club/llm/tools/stackxmr.txt", "tagline": "Single-page XMR signals dashboard — EMA / RSI / MACD / regime indicators live in your browser, no backend, no signup, no telemetry. Hobbyist project, donation-funded, signals are educational not advice.", "review": "**What it is.** A single-page XMR price-and-signals dashboard at `stackxmr.dev`. It pulls live XMR prices, computes the usual technical-analysis bands (EMA structure, RSI, MACD, volatility, drawdown, support/resistance, regime), and surfaces a buy/sell/hold recommendation with confidence + entry/exit + DCA suggestions on top. Single static HTML file (~6MB inline). No backend, no signup, no telemetry.\n\n**Background.** Solo project under the alias `admin191655` (GitHub username — the repo at `github.com/admin191655/stackxmr` has 0 stars and is essentially bare shell scaffolding rather than the actual dashboard source). The author publishes the dashboard as MSE — *Monero Signal Engine* — currently at v5.3, with an X account at `@ocomeoXMR` carrying 17 followers and no visible posts. No real-name identity, no jurisdiction, no team. The dashboard is donation-funded — a Monero address is shown on the page (*\"Buy me a Blunt\"*) for tips. There is no incident history because there is no service to incident: the page is a calculator on top of live market data, not a service that holds anything.\n\n**What you trust.**\n\n- **The architecture is its own privacy posture.** Static HTML running entirely in your browser means there is no backend logging your visits, no analytics pixel, no cookies you care about, and nothing the operator could meaningfully *do* to you even if they wanted to. The threat surface is roughly *\"the operator could publish bad signals and you might act on them\"* — not *\"the operator could exfiltrate your data.\"*\n- **Methodology is named.** Every indicator the engine uses is listed on the page (EMA, RSI, MACD, ATR-style volatility, regime classifier, etc.). That isn't *audited*, but at least you know which knobs the dashboard is turning, which is more disclosure than most signals services bother with.\n- **License posture is permissive.** *\"Freely copy, share, mirror, modify, and distribute this static Monero Signal Engine.\"* That makes the dashboard genuinely forkable — anyone can host their own mirror, including over IPFS or Tor, without dealing with the operator.\n- **No KYC, no signup, no payment.** It's a free page. If you trust the source-of-truth for the live price (whichever upstream API the page queries) and you trust your own ability to read TA signals critically, the rest is on you.\n\n**Operational specs.**\n\n- **Site.** `https://stackxmr.dev` — single static HTML file. No `/about`, `/terms`, `/privacy`, or other surface beyond the dashboard itself.\n- **Operator channels.** GitHub `admin191655` (mostly empty) and X `@ocomeoXMR` (~17 followers, no visible posts at fold-time). No PGP key, no Matrix, no email, no Telegram. If you want to reach the maintainer, GitHub issues are the obvious path.\n- **Donation.** XMR address surfaced on the page (`87ufokoq88LZ3SaqEJmKm6PxZRFzvmc4ec3HRFKyKKWKbyLPSyfEYf8jNiAo4Md17tbyJsu7P5eepXZcS1DWFPjsKESV7qb`).\n- **Tor / IPFS friendliness.** The page is small enough and self-contained enough to be mirrored on IPFS or served from an onion. The author advertises this posture explicitly but does not run a first-party `.onion` themselves as of fold-time.\n- **No price-source disclosure.** The page is live (\"waiting…\", \"calibrating…\"), but it does not document which upstream API it queries for XMR price + history. The dashboard's signals are only as honest as that source.\n- **Settings persist locally.** Risk profile (conservative / normal / aggressive), timeframe (swing / scalp / position), holdings, cash budget — all saved client-side. Nothing is sent to a server.\n\n**Operator philosophy.** The dashboard is positioned as *\"an educational dashboard, not financial advice.\"* The maintainer is publishing a tool, not running a service — there is no support promise, no SLA, no roadmap commitment, and no monetisation beyond optional XMR tips. The choice of architecture (static HTML + client-side state) and license (anyone can mirror) reads as *\"I built this because I wanted it; here it is, take it\"*. That's a perfectly valid posture for a hobbyist tool, and it shapes what you can reasonably expect: bug fixes when the maintainer feels like it, no guarantees on uptime or accuracy, and no recourse if the signals turn out to be terrible during a market shock.\n\n**Grade rationale.** Listed at **Grade C**. The substantive case for listing at all: the architecture is private-by-construction (no backend, no telemetry), the methodology is named rather than hidden, the license is permissive enough that anyone could mirror or fork. What keeps it under B: the operator presence is genuinely barren — a near-empty GitHub repo, an X account with 17 followers and no posts, no real-name identity, and no peer-directory has independently reviewed the dashboard yet. The *\"Freely copy and modify\"* claim is also somewhat undercut by the fact that the GitHub repo doesn't actually carry the dashboard source — it's a bare shell with no version-controlled history of the page that's actually live. **Path to B**: publish the actual dashboard source to GitHub (or any version-controlled mirror), pick up a peer-directory listing (monerica or kycnot — though kycnot's scope is no-KYC services rather than tools, so monerica is the more obvious target), and accumulate some independent commentary on the signals (a forum thread, a blog post, anything that isn't just the maintainer's own surface).\n\n**Useful when:**\n\n- You want a privacy-respecting XMR price + signals dashboard that runs entirely in your browser, with no signup and no telemetry. The architecture is the feature.\n- You want a tool you can fork, mirror, or run offline. The static-page + permissive-license combination makes the dashboard genuinely portable.\n- You're learning technical analysis on XMR specifically and want a single page that surfaces the standard indicators (EMA / RSI / MACD / regime) with explicit names rather than mystery signals. Treat the buy/sell/hold output as a learning aid, not a recommendation.\n\n**Caveats.**\n\n- **Signals are not advice.** The maintainer explicitly says so on the page. Acting on a *\"buy\"* signal during a thinly-traded XMR market move can blow you up the same way acting on a *\"sell\"* signal during a relief rally can. The dashboard is a calculator on top of live data — not a trader, not a fiduciary, not accountable.\n- **Price source is undisclosed.** The page does not document which upstream API it queries for XMR prices and history. If that source is wrong or stale, every signal is wrong or stale. Cross-check the price against an aggregator before quoting a number from here.\n- **GitHub \"repo\" is barren.** The repo linked from the project does not contain the live dashboard source — it's shell scaffolding. The *\"Freely copy and modify\"* claim only works in the inspect-the-HTML sense, not the read-the-source-and-fork sense. Worth knowing if you intended to mirror or audit.\n- **Operator surface is essentially empty.** No real name, no jurisdiction, no PGP key, no Matrix room, no incident history. If the page goes down, vanishes, or starts publishing different signals tomorrow, there is no recourse beyond opening a GitHub issue and hoping for a reply.\n- **Tor / IPFS posture is aspirational.** The author advertises Tor-friendly use but does not run a first-party onion as of fold-time. Mirroring is left as an exercise for the reader.\n- **No incident history — which is good and bad.** Good because no public incident has happened. Bad because nobody has tested the maintainer's response under pressure (a bad signal during a flash crash, an upstream API change that breaks the dashboard, a fork dispute). The next incident, whenever it comes, will be the first read on how this is maintained.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "EDUCATIONAL", "STATIC-SITE", "PORTABLE" ], "fees": { "summary": "Free. Optional XMR donations to the address surfaced on the page." }, "fees_summary": "Free. Optional XMR donations to the address surfaced on the page.", "last_verified": "2026-06-13", "operating_since": "2025", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://stackxmr.dev", "twitter": "https://x.com/snifflz_XMR", "github": "https://github.com/admin191655/stackxmr", "outbound_slug": "stackxmr" }, "also_listed_at": { "monerica": true } }, { "id": "standardnotes", "category": "tools", "subcategory": "Notes & Files", "name": "Standard Notes", "url": "https://xmr.club/tools/standardnotes", "twin": "https://xmr.club/llm/tools/standardnotes.txt", "tagline": "E2E-encrypted notes app. Open-source, audited, accepts crypto on paid tiers.", "review": "Standard Notes is the **E2E-encrypted note-taking app with self-host option and cryptocurrency-friendly paid tiers** — a cross-platform encrypted notes service where the free tier covers plaintext notes with full E2E encryption, the paid \"Productivity\" tier unlocks rich text + code editors + themes, and the entire server-side stack is **open source so you can self-host**. Listed at **Grade A** because Standard Notes occupies the **canonical encrypted notes** slot — the closest peer to KeePassXC's local-first password posture, adapted for the notes use case where you want sync without losing the encryption guarantee.\n\n**Background.** Standard Notes was created in **2017** by **Mo Bitar** and is operated by **Standard Notes Ltd.** (incorporated in California). The team transitioned much of its operations and infrastructure focus over the years; in 2024 the company was acquired by **Proton AG** (the operators of Proton Mail, Proton Drive, Proton VPN), which is a meaningful change in operator profile to be aware of — see Caveats. Pre-acquisition Standard Notes had a strong privacy-first reputation; the post-acquisition continuation has so far preserved the open-source codebase, self-host option, and E2E-encryption architecture. Available for **macOS, Windows, Linux, iOS, Android, web** with end-to-end encryption on every platform. Open source under the **AGPLv3** license; codebase at github.com/standardnotes. Independent **security audits** by **Trail of Bits** (2018) and follow-up reviews; audit reports are linked from standardnotes.com.\n\n**What you trust.** **End-to-end encryption** — your notes are encrypted client-side with a key derived from your account password; the server stores only ciphertext. **Open-source clients + server** — every component of the stack is auditable; self-hosting is supported with documented setup. **Audit history** — Trail of Bits has audited the cryptography; findings were addressed in subsequent releases. **Self-host option** — if you don't want to trust Standard Notes Ltd. / Proton with your encrypted blobs (even though they can't read them), you can run your own server using the published Docker images and your clients sync against your server. **Multi-platform parity** — encryption works identically across desktop, mobile, and web; no platform-specific weak link. **No telemetry on the free tier** — opt-in error reporting on paid plans is documented. **Recovery codes** — when you sign up, you generate recovery codes; lose your password without backup codes, and your encrypted notes are unrecoverable (the cost of zero-knowledge E2E). **What you don't trust**: the Proton acquisition operator continuity — see Caveats. **Light KYC on signup** — Standard Notes requires an email address for the account; this is typical for sync services but is meaningfully different from KeePassXC's no-account model. Use a privacy-respecting email (Proton Mail, Tutanota, or a SimpleLogin alias) if account-creation privacy matters.\n\n**Operational specs.** **Platforms**: macOS, Windows, Linux desktop apps; iOS + Android mobile; web client at app.standardnotes.com. **Encryption**: client-side encryption with PBKDF2 key derivation from account password; AES-256-CBC for note ciphertext; HMAC-SHA-256 for integrity. **Sync**: encrypted notes sync via Standard Notes server (or your self-hosted server); the server never sees plaintext content. **Free tier**: unlimited notes (encrypted), 2 devices, plaintext-only editor, basic markdown. **Productivity tier**: $90/year (~$7.50/month) — unlocks rich text, code editors, multiple themes, file attachments, version history, unlimited devices. **Professional tier**: higher-end with additional features. **Payment methods**: credit card, PayPal, **Bitcoin**, **Monero** (on annual plans only — the crypto-payment workflow requires an annual commitment to keep account-management overhead manageable). **Self-host**: open-source server code; deploy via Docker; clients point at your server URL instead of standardnotes.com. **Recovery codes**: generated at signup; required for password reset (preserves zero-knowledge: server can't reset password for you).\n\n**Philosophy.** Standard Notes's editorial differentiator is the **encrypted-sync with verifiable-self-host fallback** model. KeePassXC handles password storage with the local-first-zero-sync posture (you handle sync via your existing file-sync). Standard Notes targets the notes use case where users want active sync across devices and don't want to manage file-conflict resolution themselves; the privacy guarantee comes from E2E encryption + self-host-if-you-want-to. The trade-off vs KeePassXC: account requirement (email), server-mediated sync (even if encrypted), and a paid tier for advanced features. The trade-off vs Notion or Apple Notes: speed (no Notion-style fancy features in the free tier), polished UX (Standard Notes is functional, not Notion-polished), but radically stronger privacy posture. For users who want encrypted notes + sync + a clean privacy story, Standard Notes is the canonical pick.\n\n**Grade rationale.** Grade A reflects: open-source AGPLv3 codebase (both clients and server); 8+ years of operational continuity (since 2017); independent Trail of Bits audit with public findings; self-host option for users who don't want to trust the hosted server; end-to-end encryption on every platform with documented cryptography; cross-platform desktop + mobile + web with feature parity; cryptocurrency-friendly paid tiers (Bitcoin + Monero on annual plans); cross-listed in Privacy Guides peer directory. Last verified 2026-05-12.\n\n**Useful when.** You want **encrypted notes with sync** across desktop and mobile — Standard Notes is the canonical pick. You want a **paid plan you can pay for with Monero** — Standard Notes accepts XMR on annual plans, a rare offering in the encrypted-notes space. You want **self-host capability** for a notes app — Standard Notes is one of the few major encrypted-notes services with documented self-host workflow. You're a **journalist or researcher** keeping privacy-sensitive notes and need them to sync between devices without trusting a cloud provider's content-access. You're **already in the Proton ecosystem** (Proton Mail, Proton VPN, Proton Drive) and want notes integrated — the post-acquisition continuity makes this natural. You want a **rich-text encrypted notes** environment with code editors, themes, and attachments via the paid Productivity tier. You want **cryptography reviewed by Trail of Bits** and updated based on audit findings.\n\n**Caveats.** **Proton acquisition (2024) is a meaningful operator change** — pre-acquisition Standard Notes had its own privacy-first reputation; post-acquisition it's now part of a larger Proton portfolio. So far the open-source codebase and self-host option appear preserved, and Proton's own privacy posture is well-regarded, but: evaluate whether you trust Proton's combined-portfolio operator model. If you don't, self-host. **Light-KYC signup (email required)** — unlike KeePassXC's no-account model, Standard Notes requires an email for the account. Use a privacy-respecting email (Proton Mail, Tutanota, SimpleLogin alias) for the account if signup-privacy matters. **Free tier is plaintext-only editor** — markdown rendering and rich text are paid-tier features. For users who only need plain text, the free tier is sufficient; for richer formatting, the paid tier is required. **Server-mediated sync is unavoidable on the hosted service** — even though the server only sees ciphertext, it sees connection timing, sync frequency, and IP-level metadata. Self-host eliminates this; using the hosted service accepts it. **Recovery is impossible without password + recovery codes** — zero-knowledge encryption means a forgotten password without recovery codes is unrecoverable. Plan accordingly: print recovery codes to paper, store in your KeePassXC database, share a sealed envelope with a trusted party. **Paid plans on a yearly basis only with crypto** — Bitcoin and Monero payments require an annual subscription commitment; monthly crypto-pay isn't supported, presumably due to account-management overhead. **Self-host requires technical setup** — Docker deployment, domain configuration, TLS certificates; not a \"click to install\" experience. For users without server-admin skills, the hosted service is the practical option. **Multiple editors are paid features** — the productivity-tier editor selection is a paid-tier value-add; for plaintext + markdown alone, the free tier is sufficient. **Sync across many devices on the free tier** is limited to 2 devices — paid tier unlocks unlimited. **No native voice/audio note recording** — primarily a text + attachment app; for voice notes, use a separate tool and attach the file.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted" ], "highlight_tags": [ "E2E", "OPEN-SOURCE", "AUDITED" ], "fees": { "summary": "Free · paid from $90/yr · BTC/XMR · self-host option" }, "fees_summary": "Free · paid from $90/yr · BTC/XMR · self-host option", "last_verified": "2026-05-12", "operating_since": "2018", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://standardnotes.com", "outbound_slug": "standardnotes", "twitter": "https://x.com/StandardNotes" }, "also_listed_at": { "privacyguides": true } }, { "id": "stealthledger", "category": "tools", "subcategory": "Charts & Portfolios", "name": "StealthLedger", "url": "https://xmr.club/tools/stealthledger", "twin": "https://xmr.club/llm/tools/stealthledger.txt", "tagline": "Client-side-encrypted, zero-knowledge crypto + cash portfolio tracker — no account, no email, no wallet addresses. Manual entry only (nothing to deanonymize), passkey login, and a verifiable frontend (SRI + integrity manifest + out-of-band pin). Tracks XMR among 10,000+ assets.", "review": "**A private portfolio tracker that never sees your holdings.** StealthLedger seals your positions with **AES-256-GCM in your browser** (scrypt-derived key) before anything leaves the device — the server stores an opaque blob it has no key to open. There is **no account and no email**: you get a passkey and a random key, not a signup form. Crucially it is **manual-entry** — no wallet addresses, no xpubs, no Monero view keys — so there is no honeypot of data that could deanonymize you. It tracks XMR alongside cash and 10,000+ assets.\n\n**The frontend is verifiable, not just trusted.** For a hosted \"zero-knowledge\" web app the hard question is: what stops the server shipping you malicious JavaScript? StealthLedger answers it with a doxx-free chain we checked ourselves — **SRI** on every subresource, a signed **integrity manifest** (`/integrity-manifest.json`, SHA-384 per asset + self-hash), a live in-browser **verify page** (`/verify.html`), a same-domain **release pin** (`/releases.txt`), and — the part that actually closes the gap — an **out-of-band pin on X** (separate infrastructure). A malicious build now has to defeat SRI, rewrite the manifest and releases file consistently, *and* forge the value on an X account it does not control. We confirmed the SRI, the matching manifest/releases self-hash, and the verify page are all live.\n\n**Why C.** The design and verifiability are genuinely strong; the grade reflects tenure and scope. The domain is days old and the service is in free public beta; it is a **general multi-asset tracker**, so Monero is one line item rather than the point; and it remains a hosted web app whose strength ultimately rests on a **single out-of-band anchor** (one X account — a second independent pin such as a signed git tag or Nostr note would harden it). It climbs on tenure, a beta-to-GA exit, and a second anchor. A rare tracker that earns privacy trust by construction, not by promise.", "translation_locale": "en", "rating": { "grade": "C", "trust": "New (domain 2026-08-24, free public beta), solo dev. Frontend integrity is verifiable, not trusted: SRI (8 subresource pins on index) + /integrity-manifest.json (SHA-384 per asset + self-hash) + /verify.html + same-domain /releases.txt + out-of-band X pin (@StealthLedger_). All confirmed live + self-consistent 2026-08-31. Strength reduces to the single X out-of-band anchor; a second independent pin (signed git tag / Nostr) would harden it.", "privacy": "Client-side AES-256-GCM (scrypt-derived), zero-knowledge — server holds only ciphertext, no key. No account, no email; passkey + random key. Manual entry: no wallet addresses / xpubs / Monero view keys, so nothing to deanonymize. Published threat model + cryptography docs. Metadata (coin IDs to the price proxy, request patterns) is not obfuscated — self-host for that.", "ux": "One encrypted view of crypto + cash, priced in your base currency; passkey unlock, encrypted export/restore, optional read-only Koinly import. Tracks XMR among 10,000+ assets." }, "grade": "C", "kyc_tags": [ "NO-KYC" ], "feature_tags": [ "client_side_encryption", "zero_knowledge", "no_account", "verifiable_frontend", "xmr" ], "highlight_tags": [ "XMR", "ZERO-KNOWLEDGE", "NO-ACCOUNT", "NO-EMAIL", "VERIFIABLE-BUILD" ], "fees": null, "fees_summary": null, "last_verified": "2026-09-02", "operating_since": "2026-08", "tenure_note": "Domain registered 2026-08-24 (NameSilo). Free public beta, solo dev (X: @StealthLedger_). Frontend verifiability (SRI + integrity manifest + verify.html + releases.txt + out-of-band X pin) shipped + verified live 2026-08-31. DOMAIN MIGRATED 2026-09-02: operator (Mr Wick) locked out of the .net registrar; moved to stealthledger.io. .io carries the same verifiability chain (9 SRI pins, integrity-manifest, releases self-hash, verify.html); .net now shows an official 'has moved' page. Continuity/ops flag — .net could later lapse to a third party. Confirm the move via the @StealthLedger_ out-of-band X pin.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://stealthledger.io/", "x": "https://x.com/StealthLedger_", "outbound_slug": "stealthledger" } }, { "id": "tails", "category": "tools", "subcategory": "Anonymity OS", "name": "Tails OS", "url": "https://xmr.club/tools/tails", "twin": "https://xmr.club/llm/tools/tails.txt", "tagline": "Live USB OS that routes all traffic through Tor by default.", "review": "Tails is the canonical privacy live operating system: boot from USB, route all network traffic through Tor by default, leave nothing on the host machine when you shut down. Listed at **Grade A · editor's pick** because it remains the reference choice for high-threat contexts (journalism, activism, border crossings, leak workflows) and is now developed under the Tor Project umbrella — which means the privacy-OS and the network it runs on come from the same operator team.\n\n**Background.** Tails (\"The Amnesic Incognito Live System\") has been in active development since ~2009, based on Debian Linux with Tor as the mandatory network layer. In 2024 the Tails project formally **merged with the Tor Project**, consolidating the live-OS distribution under the same non-profit umbrella that maintains the Tor network and Tor Browser. The donate page now redirects to Tor Project donations, and Tails is described as part of \"the whole suite of tools developed by the Tor Project\". Current release branch is the 7.x line as of this review (May 2026); Tails ships incremental point releases on a roughly monthly cadence. Available in 8 official locales (EN, Catalan, DE, ES, FR, IT, PT, RU). 1.9 GB download; ~30-minute install onto an 8 GB+ USB stick.\n\n**What you trust.** Tails is **amnesic by design**: it runs entirely from RAM, never writes to the host disk, and wipes memory on shutdown — meaning forensic recovery of session activity is structurally limited to what was written outside Tails (if anything). The \"Persistent Storage\" is opt-in, lives on the USB stick itself (encrypted LUKS), and is the only place data survives a reboot. Trust chain: Debian's package ecosystem + Debian Security Team coverage, plus Tails-specific patches reviewed by the Tor Project team. Signing keys published; GPG-verifiable downloads. **Public security audits**: Tails posts audit reports on tails.net/security/, with the most recent being a May 2025 audit of automatic upgrades and recent changes, preceded by a November 2023 audit of Persistent Storage and Tor integration. Known vulnerabilities are listed publicly, including ones in upstream Debian packages — the transparency posture is consistent with the broader Tor Project model.\n\n**Operational specs.** Boot media: USB stick (recommended) or DVD (deprecated path). Hardware: most computers under ~10 years old. Network: Tor is mandatory — there is no clearnet option, no split tunneling, no \"just this one site through clearnet\" toggle. **Bluetooth disabled in the kernel** (deliberate — Bluetooth has historically been a fingerprinting + remote-attack vector). Pre-installed software stack: Tor Browser, Thunderbird with PGP, KeePassXC password manager, OnionShare, Monero GUI wallet, LibreOffice, GIMP, Audacity, Pidgin (with OMEMO/OTR), MAT (Metadata Anonymisation Toolkit). Persistent Storage features: encrypted with LUKS, optional per-app retention (bookmarks, GPG keys, additional software, etc.), user decides what survives a reboot. Documentation: comprehensive and translated; explicit `/warnings/` page about what Tails *cannot* protect against.\n\n**Philosophy.** Tails' editorial differentiator is the **structural-rather-than-configurable** privacy posture. Where competing privacy distros (Whonix, Kicksecure) offer Tor by default but allow configuration changes, Tails enforces Tor at the boot level — there's no `--allow-clearnet` flag. The amnesia property is also structural rather than configurable: even a sophisticated user can't accidentally leave a forensic trace on the host machine because the host machine's disk is never touched. This deliberate constraint is the editorial selling point — Tails is for situations where you don't trust *yourself* to not make a configuration mistake, not just situations where you don't trust the network.\n\n**Grade rationale.** Grade A and editor's pick reflect: 15+ years of operational continuity (since ~2009); merger with the Tor Project consolidates governance under a non-profit privacy entity; structural amnesia and mandatory Tor routing (architecture-level privacy, not user-configurable); public security audits with reports published on the same site; transparent vulnerability tracking; comprehensive translated documentation; absence of any major CVE / supply-chain / governance incident in the last 18+ months; pre-installed kit covers password management, encrypted messaging, file sharing, document editing, and Monero. Last verified 2026-05-12.\n\n**Useful when.** You're a journalist working with sensitive sources or contested-jurisdiction material. You're crossing a border with a laptop and want to ensure no forensic trace is recoverable. You're doing a one-shot operation (whistle-blowing, leak handling, sensitive financial setup) where the goal is \"do the task, then make sure the OS doesn't remember it happened.\" You're using a borrowed or shared computer and want to ensure your session leaves no residue. You want a fully air-gapped Monero signing setup — Tails + monero-gui + an offline session is a credible cold-storage workflow.\n\n**Caveats.** **Not magic** — Tails' own warnings page is explicit: Tails cannot protect against malicious hardware (BIOS-level rootkits, hardware keyloggers, compromised firmware), against installation from a compromised computer, or against user errors (accidentally typing identifying information, using personal accounts inside Tails). **No clearnet** — by design; if you need a route around Tor for a specific use case, Tails isn't the OS for that. **Persistent Storage is opt-in but reduces amnesia** — every file in Persistent Storage is one more potential forensic trace; users in the highest-threat tier should consider whether persistent state is worth the privacy concession. **Hardware support varies** — some Wi-Fi cards or graphics drivers don't work cleanly under Debian's free-firmware constraints; check compatibility before relying on Tails for time-critical work. **No mobile version** — Tails is x86/USB-only; for Android-based amnesic operation, look at GrapheneOS or CalyxOS instead. **VM use is supported but reduces the amnesia property** — running Tails in a VM on a regular OS means the host OS still sees the activity at the hypervisor level. **Pre-installed Monero GUI may trail upstream** — bundled wallet versions can lag the latest monero-gui release by one or two minor versions; if you're booting Tails specifically for XMR signing, check for an update on first boot.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "non_custodial", "audited" ], "highlight_tags": [ "FREE", "TOR", "AMNESIC" ], "fees": { "summary": "Free · GPL" }, "fees_summary": "Free · GPL", "last_verified": "2026-05-12", "operating_since": "2009", "tenure_note": "Tails OS first public release 2009-06-23. tails.boum.org subdomain WHOIS pre-2009 is irrelevant.", "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://tails.net", "outbound_slug": "tails", "contact_email": "support@tails.net", "twitter": "https://x.com/Snowden", "telegram": "https://t.me/torproject" }, "also_listed_at": { "web3privacy": true } }, { "id": "threema", "category": "tools", "subcategory": "Messaging", "name": "Threema", "url": "https://xmr.club/tools/threema", "twin": "https://xmr.club/llm/tools/threema.txt", "tagline": "Swiss paid one-time messenger. Phone-number optional, anonymous IDs, no metadata.", "review": "Swiss-based commercial messenger that's privacy-first. One-time purchase (no subscription, no ads). Identifier is a random 8-character Threema ID, NOT a phone number — they offer optional phone+email linking but it's not required. E2EE, perfect forward secrecy. Audited multiple times. Used by Swiss government and EU for sensitive comms.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "non_custodial", "audited" ], "highlight_tags": [ "PAID", "AUDITED", "SWISS" ], "fees": { "summary": "$5 one-time · Swiss · audited · no phone required" }, "fees_summary": "$5 one-time · Swiss · audited · no phone required", "last_verified": "2026-05-13", "operating_since": "2012", "tenure_note": "Threema messenger launched 2012 (Swiss-based encrypted messaging). Hand-set by curator.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://threema.ch", "outbound_slug": "threema", "contact_email": "support@threema.ch", "twitter": "https://x.com/ThreemaApp" } }, { "id": "tor-browser", "category": "tools", "subcategory": "Browsers", "name": "Tor Browser", "url": "https://xmr.club/tools/tor-browser", "twin": "https://xmr.club/llm/tools/tor-browser.txt", "tagline": "The reference anonymity browser. Bundled with Tor + NoScript + safe defaults.", "review": "Tor Browser is the **canonical anti-fingerprinting privacy browser** — a hardened Firefox fork that routes every connection through the Tor network's multi-relay onion routing, ships with a uniform fingerprint across all users, and is the de-facto reference implementation that every other privacy browser (Mullvad Browser, LibreWolf, Brave's Tor mode) measures itself against. Listed at **Grade A · editor's pick** because Tor Browser is the foundational tool in the privacy stack: if you only have time to deploy one privacy tool, this is it. **Mandatory companion to any serious privacy-tooling effort** — operating Monero from a clearnet browser leaks more metadata than Monero itself protects.\n\n**Background.** Tor Browser is developed and maintained by **The Tor Project** — a US-registered 501(c)(3) non-profit organisation, with the core development team distributed globally. Built on Mozilla Firefox ESR (extended support release) with extensive **anti-fingerprinting patches**, bundled with the **Tor SOCKS proxy** and the **NoScript** browser extension for JavaScript gating. The Tor network itself (the relay layer Tor Browser routes through) is operated by ~6,000-9,000 volunteer relay operators globally — guard relays, middle relays, and exit relays form three-hop circuits per connection. **Funding**: a mix of US government grants (BBG / State Department for the open-internet mission), private foundations (Mozilla, Wikimedia, etc.), and direct donations; **the funding structure is public** at torproject.org/about/financials/. The funding mix is the perennial talking point — see Caveats. **Releases**: aligned with Firefox ESR (every ~6 weeks for point releases, major versions every ~12 months); built reproducibly with signed releases at torproject.org/download.\n\n**What you trust.** **Multi-relay onion routing** — your traffic enters the Tor network at a guard relay, hops through a middle relay, exits via an exit relay; no single relay knows both your IP and your destination. **Uniform fingerprint** — Tor Browser ships with a deliberately standardised User-Agent, screen size (always 1000×1000 by default), font set, canvas response, WebGL response, and JS environment, so all Tor Browser users look identical to a fingerprinting tracker. **NoScript by default** — JavaScript is gateable per-site via the NoScript extension; the **Security Level** slider (Standard / Safer / Safest) controls how aggressive the default gating is. **No telemetry** — Tor Browser strips Firefox's telemetry pipeline, Mozilla account integration, and other phone-home behaviours. **Reproducible builds + signed releases** — anyone can verify that downloaded binaries match the published source. **Bridge support** — for users in censored networks, Tor Browser supports bridges (unlisted entry points), pluggable transports (obfs4, meek, snowflake, webtunnel), and request-a-bridge-via-email/Telegram.\n\n**Operational specs.** **Platforms**: macOS, Windows, Linux desktop; **Android** (official build at torproject.org/download/#android); **iOS**: no official Tor Browser due to Apple's WebKit-only policy — use **Onion Browser** (third-party but Tor Project-recommended) instead. **Default behaviours**: connects to Tor network automatically; opens with about:tor as default homepage; clears history/cookies on browser close. **Security Level slider**: **Standard** (JavaScript enabled, all features, lowest privacy floor — for everyday browsing of trusted sites); **Safer** (JavaScript disabled on non-HTTPS sites, some font/media restrictions); **Safest** (JavaScript fully disabled, most aggressive — required for the strictest privacy posture; many web apps will break). **Tabs are isolated** — each first-party origin gets a separate Tor circuit, so connections to site A and site B don't share the same exit relay. **New Identity** function — wipes all browser state and forces new Tor circuits with a single hotkey (Ctrl+Shift+U). **Onion sites** — first-class support for .onion v3 addresses; the address bar shows the .onion address with a green-key indicator when an HTTPS Onion site is verified.\n\n**Philosophy.** Tor Browser's editorial differentiator is the **anti-fingerprinting reference implementation** — it doesn't just route through Tor (any browser can do that with a SOCKS config); it does the much harder work of making all Tor Browser users look fingerprintably identical, so that even if a tracker correlates \"this user keeps coming back,\" they can't tell which Tor Browser user is which. The trade-off: the standardised fingerprint means you lose per-user customisation (no themes, no add-ons beyond the bundled ones, fixed font set) and the standardised window size means the browser opens at 1000×1000 by default. For users who want a hardened-Firefox-without-Tor (faster, no Tor latency, but loses the network-layer anonymity), **Mullvad Browser** is the same anti-fingerprinting work without the Tor routing; it's a separate listing at xmr.club. Tor Browser is the canonical Tor-network-plus-anti-fingerprinting bundle.\n\n**Grade rationale.** Grade A and editor's pick reflect: developed and maintained by the Tor Project (a registered US non-profit with the canonical mission); built on Firefox ESR with extensive anti-fingerprinting patches; uniform-fingerprint design (the canonical reference for what anti-fingerprinting means); reproducible builds + signed releases; no telemetry; bundled NoScript and Security Level slider for adjustable privacy posture; bridge + pluggable transport support for censored networks; first-class .onion v3 support; cross-platform (macOS, Windows, Linux, Android; iOS via Onion Browser); public funding disclosure at torproject.org/about/financials/; over two decades of operational continuity (since 2002); the de-facto reference for any other privacy browser. Last verified 2026-05-13.\n\n**Useful when.** You're doing **anything privacy-sensitive online** — researching, communicating, transacting; if it's privacy-adjacent, Tor Browser should be in the stack. You're accessing **.onion services** — Tor Browser is the only consumer browser with first-class .onion v3 support. You're in a **censored network** — Tor Browser's bridge + pluggable transport infrastructure is the most mature censorship-circumvention tooling available. You're **transacting Monero or any other privacy currency** — pairing a privacy coin with a clearnet browser leaks the IP context the privacy coin was supposed to protect. You're a **journalist, researcher, or activist** in a hostile-networks environment. You're a **whistleblower** using SecureDrop or another onion-routed submission system. You want a **reference implementation** to compare other privacy browsers against.\n\n**Caveats.** **Latency** — Tor's three-hop architecture adds 200ms-2s of latency per connection; this is the cost of the privacy and is not a fixable issue, it's a property of the threat model. **Some sites block Tor exit IPs** — Cloudflare's default settings (and many bank/financial sites) treat Tor exit IPs as untrusted and serve CAPTCHAs or outright block. This is a real friction; nothing Tor Browser can fix from the client side. **JavaScript Safest mode breaks many sites** — modern web apps assume JavaScript; the strictest privacy level often means falling back to bookmarks and pre-saved content. **Default 1000×1000 window** — designed for fingerprint uniformity, but visually small on large monitors; resizing the window reduces your anonymity set within the Tor Browser cohort (a tracker can fingerprint \"this user resized to 1920×1080\"). For maximum anonymity, leave default window size. **Funding-mix concerns** — US government grants (BBG, State Department) are a significant funding source for the Tor Project; this is publicly disclosed at torproject.org/about/financials/ but is a perennial talking point among privacy critics. The argument-for-trust: code is open-source, builds are reproducible, the relay network is decentralised, and the Tor Project's mission alignment is open-internet not surveillance. The argument-for-skepticism: any organisation with US-government funding is plausibly within the influence of US government priorities. Reach your own conclusion based on the threat model and the published financial disclosures. **iOS limitations** — Apple's WebKit-only policy means no official Tor Browser; Onion Browser is the recommended third-party for iOS but it's a separate trust evaluation. **Mobile UX** — Tor Browser on Android is functional but less polished than the desktop versions; expect more friction. **Browser extensions are restricted** — only the bundled NoScript is included; installing other extensions adds fingerprinting surface and is not recommended. **Don't log into clearnet accounts** — logging into Gmail or Twitter through Tor Browser links your Tor browsing session to your clearnet identity; if anonymity matters, use throwaway accounts created over Tor or skip the login entirely.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "non_custodial", "self_hosted", "no_js_supported", "audited" ], "highlight_tags": [ "FREE", "TOR", "REFERENCE" ], "fees": { "summary": "Free · GPLv3" }, "fees_summary": "Free · GPLv3", "last_verified": "2026-05-13", "operating_since": "2008", "tenure_note": "Tor Browser Bundle first stable release 2008 (Tor Project itself dates to 2002 as research project). Previous stamp (2006) was torproject.org WHOIS — close but not the browser specifically.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://torproject.org", "outbound_slug": "tor-browser", "tor": "http://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion", "contact_email": "security@torproject.org", "twitter": "https://x.com/torproject", "telegram": "https://t.me/torproject", "matrix": "https://matrix.to/#/tor:matrix.org" }, "also_listed_at": { "privacyguides": true } }, { "id": "vaultwarden", "category": "tools", "subcategory": "Passwords", "name": "Vaultwarden", "url": "https://xmr.club/tools/vaultwarden", "twin": "https://xmr.club/llm/tools/vaultwarden.txt", "tagline": "Open-source Rust reimplementation of the Bitwarden server. Self-host the official client backend on a $4 VPS.", "review": "Vaultwarden is the **Rust reimplementation of the Bitwarden server** — a community-maintained open-source server that's **API-compatible** with the official Bitwarden clients (desktop, mobile, browser extensions), meaning you can self-host the credential vault on a **$4/month VPS** while using the polished commercial-grade Bitwarden client UX. Listed at **Grade A** because Vaultwarden occupies the **self-host-without-the-bloat** slot: a single Rust binary (lightweight, fast, minimal dependencies) that replaces Bitwarden's official server (.NET stack, heavier resource footprint), making self-host viable on cheap VPS hosting.\n\n**Background.** Vaultwarden was created in 2018 by **Daniel García** (`dani-garcia`) originally under the name **bitwarden_rs** (\"Bitwarden in Rust\"). After legal-correspondence concerns from Bitwarden, Inc. about trademark confusion, the project was renamed to **Vaultwarden** in 2022 — preserving the same maintainer team and codebase, just disambiguated from the official Bitwarden product. Codebase at github.com/dani-garcia/vaultwarden. Open source under the **AGPLv3** license. **Hosting model**: deploy as a single Docker container (recommended) or compile-and-run the Rust binary directly; SQLite or PostgreSQL for storage; ~50MB RAM footprint typical (vs ~1GB+ for the official Bitwarden server's .NET stack on Windows containers). The project is **community-maintained** — Daniel García + contributors; no commercial entity, no company behind Vaultwarden the way Bitwarden, Inc. is behind Bitwarden. The Bitwarden, Inc. team has been **publicly cordial** about the existence of Vaultwarden (it's a complementary deployment option, not a fork-and-compete) — both projects share the same end goal of letting users self-host if they choose.\n\n**What you trust.** **API-compatible with official Bitwarden clients** — the same Bitwarden mobile app, desktop app, browser extension, and CLI work against a Vaultwarden server. You get the polished client UX + your own server backend. **Same end-to-end encryption** — Vaultwarden implements the same client-side encryption protocols as official Bitwarden; the server only ever sees ciphertext. **Open-source Rust codebase** — auditable; Rust's memory-safety properties mitigate a class of vulnerabilities that C/C++ servers are vulnerable to. **Lightweight resource footprint** — runs on a $4/month VPS, a Raspberry Pi, or alongside other services on shared hosting. **No vendor lock-in** — your vault is in a standard Bitwarden format; you can move between Vaultwarden ↔ official Bitwarden ↔ KeePassXC export format. **What you don't trust**: Vaultwarden is **not an official Bitwarden, Inc. product** — the maintenance is community-driven, not commercial. If you're an organisation with compliance requirements that mandate vendor support agreements, the official Bitwarden server is the right pick. **Self-host operational responsibility** — when you self-host, you own backups, TLS certificate renewal, security updates, OS hardening, monitoring. Lose your VPS, lose your vault (unless backed up properly). **Audit history is less formal than Bitwarden's** — Bitwarden, Inc. has commissioned formal Cure53 audits; Vaultwarden has been informally reviewed by the community but doesn't have the same audit-report pedigree.\n\n**Operational specs.** **Deployment**: Docker container (canonical), Rust binary compile + run, Kubernetes Helm chart, Ansible playbooks (community-maintained). **Storage**: SQLite (default, simplest), PostgreSQL (for HA/multi-instance setups). **Resource footprint**: ~50-100 MB RAM, ~50 MB disk + database size. **Client compatibility**: all official Bitwarden clients work — desktop apps (macOS/Windows/Linux), mobile apps (iOS, Android), browser extensions (Firefox, Chrome, Safari, Edge, Brave), CLI client (`bw`). **TLS termination**: typically front Vaultwarden with nginx or Caddy for TLS; Vaultwarden listens on plain HTTP and trusts the reverse proxy to handle TLS. **Features**: all core Bitwarden features work (passwords, secure notes, identity, credit cards, file attachments where supported by client), shared collections, organisations, password sharing, emergency access, 2FA support (TOTP, FIDO2/WebAuthn). **Updates**: Daniel + contributors track Bitwarden's protocol updates; typical lag is 1-4 weeks behind major Bitwarden client releases. **Admin panel**: Vaultwarden has an admin web UI for user management, separate from the user-facing Bitwarden client. **Email**: optional — for password reset notifications, 2FA email; SMTP-based, you provide your own email server or use a transactional provider.\n\n**Philosophy.** Vaultwarden's editorial differentiator is the **self-host-with-official-client-compatibility** model. The choice between official Bitwarden hosted and Vaultwarden self-hosted is structurally a trust-source decision: with hosted Bitwarden, you trust Bitwarden, Inc. as the operator; with Vaultwarden, you trust yourself as the operator (and Vaultwarden's community-maintained server code). Both have the same client UX, same encryption story, same end-to-end zero-knowledge architecture. The trade-off: self-host operational overhead (backups, TLS, updates, monitoring) vs paying ~$10/year and letting Bitwarden, Inc. handle infrastructure. For users who want **zero recurring cost + zero vendor lock-in + complete control over the storage layer**, Vaultwarden is the canonical pick. For users who don't want to operate a server, hosted Bitwarden is the right pick.\n\n**Grade rationale.** Grade A reflects: open-source AGPLv3 codebase (Rust); 7+ years of operational continuity (since 2018 as bitwarden_rs, renamed 2022); API-compatible with official Bitwarden clients (no client-side compromise); lightweight resource footprint (~50 MB RAM, $4/month VPS sufficient); rich feature set matching Bitwarden's core feature set; multiple storage backends (SQLite, PostgreSQL); active maintenance by Daniel García + community contributors; clear deployment story (Docker, Helm, Ansible all community-maintained); cordial relationship with Bitwarden, Inc. (no antagonistic fork dynamics); cross-listed in web3privacy peer directory. Last verified 2026-05-13.\n\n**Useful when.** You want to **self-host a password manager** with a polished commercial-grade client UX — Vaultwarden + official Bitwarden clients is the cleanest pairing. You want **zero recurring cost** for password sync — a $4/month VPS or a Raspberry Pi at home is sufficient. You want **no vendor lock-in** — your vault data lives on infrastructure you control; migrate to or from Bitwarden, Inc.'s hosted service freely. You're an **organisation or team** that wants a shared password vault without trusting a third-party service (and where a vendor support agreement isn't a hard requirement). You want a **lightweight self-host** — Rust + SQLite means you can run Vaultwarden alongside other services on existing infrastructure without resource concerns. You're already running a personal server (Nextcloud, home lab, anything) and want to add password storage to it. You want to **graduate from KeePassXC's local-first model** to a sync-capable solution while preserving the trust posture.\n\n**Caveats.** **You operate the server** — backups, TLS, security updates, OS hardening, monitoring all become your responsibility. Don't underestimate the operational discipline required; password storage is critical infrastructure. **Not an official Bitwarden, Inc. product** — for compliance-sensitive deployments (enterprise audits, vendor agreements), the official Bitwarden server (paid) is the right pick. **Audit pedigree is informal** — Bitwarden, Inc. has commissioned Cure53 audits of its server; Vaultwarden has community review but not equivalent formal audits. The codebase is small and Rust-safe; community trust is high but the audit-report story is different. **Update lag behind Bitwarden** — major Bitwarden client releases sometimes introduce new server-side features; Vaultwarden adds them with 1-4 week lag. For users who need cutting-edge Bitwarden features immediately, hosted Bitwarden is faster. **No commercial support** — community Discord + GitHub issues for help. For organisations that need SLAs, Vaultwarden doesn't fit. **Backups must be designed early** — losing your VPS means losing your vault (unless you've backed up the SQLite/PostgreSQL data + the rsa_keys directory). Use restic, borg, or rclone to back up to encrypted off-site storage. **Multi-instance HA is more complex** — for true high-availability deployments (multiple Vaultwarden instances behind a load balancer), you need PostgreSQL + shared filesystem for attachments; the Bitwarden, Inc. official server handles this with built-in clustering. **Admin panel default password** — set a strong admin token early; the admin panel can manage all users on your instance. **TLS is mandatory in practice** — Vaultwarden over plain HTTP is unsafe; front with Caddy (automatic Let's Encrypt) or nginx + certbot. **Mobile clients require the server URL** — when a Bitwarden mobile client first launches, it needs the server URL configured; this is a one-time step but worth knowing for onboarding family members or team members.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted" ], "highlight_tags": [ "SELF-HOST", "OPEN-SOURCE", "RUST" ], "fees": { "summary": "Free · Rust · self-host · Bitwarden-client compatible" }, "fees_summary": "Free · Rust · self-host · Bitwarden-client compatible", "last_verified": "2026-05-13", "operating_since": "2018", "tenure_note": "Vaultwarden launched 2018 as Bitwarden_rs by dani-garcia; renamed Vaultwarden ~2021. github.com WHOIS 2007 is the host platform.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://github.com/dani-garcia/vaultwarden", "outbound_slug": "vaultwarden", "matrix": "https://matrix.to/#/vaultwarden:matrix.org" }, "also_listed_at": { "web3privacy": true } }, { "id": "veilid", "category": "tools", "subcategory": "Networking", "name": "Veilid", "url": "https://xmr.club/tools/veilid", "twin": "https://xmr.club/llm/tools/veilid.txt", "tagline": "P2P privacy-focused application framework from Cult of the Dead Cow. Anti-Tor in design — every node also routes.", "review": "Open-source P2P framework that ships its own DHT, onion routing, and per-app crypto identity. Inverts the Tor exit-node bottleneck: every Veilid node also routes for others, so there are no special exits to surveil. Apps built on top: VeilidChat (messenger), VeilidMail (e-mail-like). Early-stage but the design ambitions and team pedigree (cDc) make it worth tracking.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "self_hosted" ], "highlight_tags": [ "P2P", "OPEN-SOURCE", "EARLY" ], "fees": { "summary": "Free · Rust · P2P framework · alpha" }, "fees_summary": "Free · Rust · P2P framework · alpha", "last_verified": "2026-05-13", "operating_since": "2023", "tenure_note": "Veilid (Cult of the Dead Cow privacy framework) public release August 2023 at DEF CON 31. Pre-release work older but not user-facing.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://veilid.com", "outbound_slug": "veilid", "contact_email": "support@veilid.com", "twitter": "https://x.com/cdc_pulpit" } }, { "id": "veracrypt", "category": "tools", "subcategory": "Disk Encryption", "name": "VeraCrypt", "url": "https://xmr.club/tools/veracrypt", "twin": "https://xmr.club/llm/tools/veracrypt.txt", "tagline": "Full-disk + container encryption with plausible deniability.", "review": "VeraCrypt is the **canonical full-disk and container encryption tool with plausible-deniability hidden volumes** — the successor to **TrueCrypt** (which famously self-terminated in 2014) and the reference implementation for users who need encrypted volumes that look like random data on disk, with optional **hidden volumes** that allow a user to disclose one passphrase under duress while keeping a second volume invisible. Listed at **Grade A · editor's pick** because VeraCrypt occupies a unique structural position: the only consumer-grade encryption tool with credible plausible-deniability primitives, the canonical post-TrueCrypt continuation, and an established audit track record across multiple independent reviews.\n\n**Background.** VeraCrypt was forked from **TrueCrypt** in 2013 by **Mounir Idrassi** of **IDRIX** (French security consultancy) and continues to be maintained by IDRIX with community contributions. TrueCrypt itself, the original code base, was abandoned in May 2014 with a famously cryptic notice from its anonymous developers that the software was \"no longer secure\" — a notice the security community largely interpreted as either a warrant canary or a strategic exit, not an actual cryptographic flaw. VeraCrypt has been the de-facto successor since 2014, with **independent security audits** including a 2016 audit by **Quarkslab** funded by **OSTIF** (Open Source Technology Improvement Fund) and a 2018 follow-up audit also funded by OSTIF. The 2016 audit found 8 vulnerabilities; all were fixed in subsequent releases. Open source under the **Apache 2.0 license** (with portions under the older TrueCrypt 3.0 license for inherited TrueCrypt code). Cross-platform: **macOS, Windows, Linux** — full feature parity across platforms.\n\n**What you trust.** **Strong cryptography** — AES-256, Serpent, Twofish, Kuznyechik, Camellia (or cascades of multiple algorithms layered); SHA-256, SHA-512, Whirlpool, BLAKE2s, Streebog for key derivation. **PBKDF2 key derivation** with configurable iterations (default is conservative, slowing brute-force attacks against the passphrase). **Encrypted volumes look like random data** — VeraCrypt containers have no header magic bytes, no file signature; to an attacker without the passphrase, the volume is statistically indistinguishable from random bytes. **Hidden volume feature** — within an encrypted outer volume, you can create a hidden inner volume protected by a separate passphrase; the existence of the hidden volume is not detectable from inspection of the outer volume's plaintext. **System encryption** — full-disk encryption of Windows, Linux, and macOS systems, with pre-boot authentication. **Hidden OS** — Windows-only: you can have a hidden operating system that boots from the hidden volume, providing \"two computers\" plausibility under coercion. **Open source + multiple independent audits** — Quarkslab + OSTIF audits provide external review; the codebase is auditable. **What you don't trust**: forensic analysis of the encrypted device (the volume is still detectable as encrypted-data-of-some-kind by file size and high-entropy content); coerced disclosure (plausible deniability provides protection only when an attacker can't *prove* a hidden volume exists, not in jurisdictions where you can be compelled to disclose all encryption keys regardless).\n\n**Operational specs.** **Platforms**: macOS, Windows, Linux desktop. **Volume modes**: standard encrypted container (a `.hc` file or partition), system partition encryption (full-disk encryption with pre-boot auth), hidden volume (inside a standard container), hidden OS (Windows only). **Cipher cascades**: you can layer multiple encryption algorithms (e.g., AES-Serpent-Twofish) for defence in depth against future cryptanalysis of any single cipher. **Mounting**: encrypted volumes are mounted as virtual drives — appear as a drive letter (Windows) or mountpoint (Linux/macOS) and behave as regular filesystems. **Key files + passphrase**: you can require a passphrase, a key file, or both for mounting; key files can be on a USB drive that you keep separate from the encrypted volume. **Hardware acceleration**: AES-NI hardware acceleration on supported CPUs (essentially all modern x86/x64). **Volume creation wizard**: walks you through algorithm choice, passphrase setting, hidden-volume creation, and key-file pairing. **Travel mode**: portable VeraCrypt installation on a USB drive — encrypted volume + VeraCrypt binary travel together; mount on any computer without installing VeraCrypt locally.\n\n**Philosophy.** VeraCrypt's editorial differentiator is the **plausible-deniability hidden-volume** model. Modern alternatives — LUKS (Linux), BitLocker (Windows), FileVault (macOS), age (file-level), Cryptomator (cloud-folder-level) — all offer strong encryption but none offer hidden volumes. For most users, hidden volumes are overkill (the threat model is \"lose laptop to thief,\" and FileVault/BitLocker are sufficient). For users whose threat model includes **coerced disclosure** (border crossings, hostile state actors, \"give us the password or we detain you\"), hidden volumes are the canonical mitigation. The trade-off: complexity (hidden-volume setup requires careful UX to avoid accidentally overwriting the hidden volume); legal risk (in some jurisdictions, refusing to disclose decryption keys is itself a criminal offence, regardless of whether a hidden volume can be proven to exist); and operational fragility (mounting the outer volume read-write without enabling hidden-volume protection can corrupt the hidden volume). VeraCrypt is the canonical tool for users who need this; for users who don't, BitLocker / FileVault / LUKS / age are simpler and equally strong against non-coercion threat models.\n\n**Grade rationale.** Grade A and editor's pick reflect: open-source Apache 2.0 codebase; cross-platform (macOS, Windows, Linux) with full feature parity; multiple independent security audits (Quarkslab 2016 + 2018, OSTIF-funded) with all findings remediated; strong cryptography (AES-256, Serpent, Twofish, Kuznyechik, Camellia, cascades) with PBKDF2 key derivation; unique hidden-volume + hidden-OS plausible-deniability features (no alternative tool offers these at consumer-grade); maintained by named operator (Mounir Idrassi / IDRIX) with public identity and 10+ year track record; reproducible builds documented; AES-NI hardware acceleration support; cross-listed in Privacy Guides peer directory. Last verified 2026-05-12. Note: this listing's category at xmr.club is \"tools / Disk Encryption\" but the use case spans full-disk encryption, container files, and portable encrypted USB drives.\n\n**Useful when.** You're **crossing borders** with sensitive data and want plausible deniability — VeraCrypt's hidden-volume feature is the canonical mitigation for \"show us what's on your laptop.\" You're a **journalist, activist, or human-rights worker** in a jurisdiction where coerced disclosure is a credible threat. You want **full-disk encryption** on Windows or Linux that isn't BitLocker (which has had key-escrow concerns) or LUKS (which doesn't offer hidden volumes). You want to **transport encrypted data on a USB drive** via VeraCrypt's portable mode — encrypted volume + VeraCrypt binary travel together, mount anywhere. You want **cipher cascades** for defence-in-depth against future cryptanalysis (layer AES + Serpent + Twofish). You want a **multi-platform encrypted container** — a `.hc` file that works identically on macOS, Windows, Linux. You're handling **deep-archive storage** of sensitive data and want the encryption tool with the longest audit track record.\n\n**Caveats.** **Plausible deniability isn't legal protection in all jurisdictions** — in the UK (RIPA s.49), France (some recent jurisprudence), and other countries, refusing to disclose decryption keys can itself be a criminal offence regardless of whether a hidden volume can be proven to exist. Understand your local legal framework before relying on hidden volumes as a coercion defence. **Hidden-volume operational fragility** — mounting the outer volume read-write *without* the hidden-volume-protection option can overwrite the hidden volume's sectors. Always use the \"protect hidden volume\" option when mounting the outer volume read-write, or mount read-only by default. **Hidden OS is Windows-only** — Linux and macOS don't have the equivalent feature. **Pre-boot authentication can fail on UEFI Secure Boot systems** — VeraCrypt has UEFI support but some configurations require disabling Secure Boot. Test before relying on it. **Performance overhead** — AES-NI hardware acceleration makes encryption essentially free on modern CPUs, but cipher cascades (AES-Serpent-Twofish) layer three encryption passes which is slower; choose single AES for performance, cascades for paranoid threat models. **Backup recovery key requirement** — when you full-disk-encrypt your system partition, VeraCrypt prompts you to generate a Rescue Disk; if you skip this and forget your passphrase, the data is unrecoverable. **Mounting requires VeraCrypt installed** — encrypted containers can't be mounted via standard OS tools; you need VeraCrypt on the machine that mounts them. **Forensic detection** — VeraCrypt volumes look like random data, but the presence of high-entropy data on a drive is still detectable by forensic tools as \"there's an encrypted volume here, somewhere\"; the *contents* are protected, the *existence of encryption* is not. **Key files on the same drive as the volume defeat the purpose** — store key files on a separate USB drive or a separate device for the security benefit.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "self_hosted", "audited" ], "highlight_tags": [ "FREE", "AUDITED" ], "fees": { "summary": "Free · Apache 2.0" }, "fees_summary": "Free · Apache 2.0", "last_verified": "2026-05-12", "operating_since": "2014", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://veracrypt.fr", "outbound_slug": "veracrypt" }, "also_listed_at": { "privacyguides": true } }, { "id": "walls-rip", "category": "tools", "subcategory": "Privacy Primitives", "name": "walls.rip", "url": "https://xmr.club/tools/walls-rip", "twin": "https://xmr.club/llm/tools/walls-rip.txt", "tagline": "Ghost Mail, Dead Drop, SMS Wall, Ghost Chat — privacy primitives in one portal.", "review": "Aggregated wallet-funded privacy services — anonymous email, anonymous file drop, SMS receive-only numbers, ephemeral chat. Crypto-only, no email required, single XMR/LN-funded balance.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "api_available", "wallet_funded" ], "highlight_tags": [ "XMR", "WALLET-FUNDED" ], "fees": { "summary": "Per-service pricing · wallet-funded XMR / BTC / LN" }, "fees_summary": "Per-service pricing · wallet-funded XMR / BTC / LN", "last_verified": "2026-05-12", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": true, "editors_pick": false, "links": { "web": "https://walls.rip", "outbound_slug": "walls-rip" } }, { "id": "whonix", "category": "tools", "subcategory": "Anonymity OS", "name": "Whonix", "url": "https://xmr.club/tools/whonix", "twin": "https://xmr.club/llm/tools/whonix.txt", "tagline": "Two-VM compartmentalisation — workstation never sees the public internet.", "review": "Whonix is the **two-VM compartmentalisation anonymity OS** — a security-focused operating system that runs as two virtual machines side-by-side: a **Workstation VM** where you do your actual work, and a **Gateway VM** that handles all Tor routing. The Workstation **never sees the public internet** — it can only talk to the Gateway, which then routes through Tor. Listed at **Grade A** because Whonix occupies a structurally unique trust posture: even if your applications, your browser, or your operating system itself are compromised, **they cannot leak your real IP** because they don't have access to a network that knows your real IP. Best paired with **Qubes OS** for the strictest persistent-anonymity setup; Tails is the ephemeral-amnesic alternative for different threat models.\n\n**Background.** Whonix was created in 2012 by **Patrick Schleizer** (pseudonym: adrelanos) and continues to be maintained by the **Whonix Project** with a contributor team. Distributed as VirtualBox images, KVM images, and as the canonical anonymity layer inside **Qubes OS** (where Whonix is recommended by the Qubes Project itself). Open source under **GPLv3**; the codebase is at github.com/Whonix. Funded by donations and Open Tech Fund grants in the past; team has resisted commercial productisation that would compromise the privacy-first principles. The threat model Whonix is designed against is sophisticated: not just \"ISP-level surveillance\" (Tor Browser solves that), but \"application-level compromise\" — what if your browser has a zero-day, what if your PDF reader leaks your IP via an embedded JavaScript widget, what if the OS itself is malware-infected? Whonix's compartmentalisation means those compromises **cannot leak your IP** because the compromised software has no path to discover it.\n\n**What you trust.** **Network compartmentalisation** — the Workstation VM has no direct network access; it has a virtual network adapter that connects only to the Gateway VM. Even root access on the Workstation cannot bypass this because the network adapter literally can't reach the public internet. **Tor handled at the Gateway** — all traffic from the Workstation is forced through Tor at the Gateway layer; no application can opt-out. **Stream isolation** — different applications on the Workstation route through different Tor circuits automatically (so a browser-tab leak doesn't deanonymise a separate email session). **Hardened defaults** — Whonix-Workstation ships with hardened Tor Browser, AppArmor profiles, sandboxed applications, hardened kernel parameters. **Reproducible builds** — Whonix releases are reproducible from source; the build process is documented and verifiable. **Upstream is Debian + Tor + Kicksecure** — the OS is built on Debian (well-audited base), Tor (the canonical anonymity network), and Kicksecure (the Whonix Project's hardened-Debian companion distribution). **What you don't trust**: the host operating system — Whonix runs as VMs on top of a host (your VirtualBox/KVM host). If the host is compromised, Whonix's compartmentalisation can be bypassed (host-level malware can see the Workstation's screen, keystrokes, files). For the strongest posture, run Whonix on **Qubes OS** (where each VM is hypervisor-isolated, eliminating the host-trust assumption).\n\n**Operational specs.** **Platforms**: VirtualBox (cross-host: macOS, Windows, Linux); KVM (Linux native); the canonical anonymity-layer for **Qubes OS** (Qubes-Whonix). **VM model**: Whonix-Gateway (runs Tor, exposes a local network interface) + Whonix-Workstation (your actual desktop environment, talks only to Gateway). **Resource requirements**: 4GB RAM minimum, 8GB recommended; 100GB disk for both VMs combined; 64-bit CPU with virtualisation extensions. **Workstation environment**: XFCE desktop (lightweight, hardenable), with pre-installed Tor Browser, Thunderbird with Enigmail, OnionShare, KeePassXC, and other privacy tools. **Updates**: managed through the Whonix package system; updates routed through Tor (the Gateway's update path uses onion services where available). **Persistence**: unlike Tails (which is amnesic by default), Whonix is **persistent** — files saved on the Workstation persist across reboots. This is a feature for multi-day workflows and a trade-off for users who need amnesic-by-default (use Tails for that). **Multiple Workstations**: you can run multiple Workstation VMs side-by-side, each with different identity contexts, all routing through the same Gateway. **Time fuzzing**: Whonix randomises the system clock slightly to prevent time-based fingerprinting. **MAC address randomisation**: at boot, Workstation generates a random virtual MAC.\n\n**Philosophy.** Whonix's editorial differentiator is the **structural-isolation** approach to anonymity. Tor Browser puts anti-deanonymisation logic inside a single application (and the application is your trust surface). Tails extends that to a whole OS, with amnesic-by-default storage. Whonix extends it further: the OS compartmentalises into two VMs, the application layer cannot reach a network that knows your IP, and the failure modes shift from \"this application leaked your IP\" to \"the hypervisor or host is compromised\" — a structurally harder attack. The trade-off: operational complexity. You manage two VMs instead of one, you balance memory across them, you handle clipboard sharing carefully. For threat models where application-level compromise is a credible attack vector — sophisticated journalism, activism in surveillance-heavy regions, long-running anonymous infrastructure — the complexity is justified. For everyday browsing privacy, Tor Browser alone is sufficient.\n\n**Grade rationale.** Grade A reflects: 13+ years of operational continuity (since 2012); open-source GPLv3 codebase; reproducible builds documented; built on Debian + Tor + Kicksecure (well-audited upstream); structural network compartmentalisation (Workstation can't reach internet directly); canonical anonymity layer recommended by Qubes OS Project; stream isolation across applications; hardened defaults (AppArmor, kernel parameters); persistent storage for multi-day workflows; multiple Workstation VMs for identity-context isolation; named maintainer (Patrick Schleizer / adrelanos) with public identity and track record; cross-listed in Privacy Guides and web3privacy peer directories. Tor onion mirror at dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion. Last verified 2026-05-13.\n\n**Useful when.** You're running **persistent anonymous infrastructure** — a long-running .onion service, an anonymous research workflow, a multi-day investigation — where Tails's amnesic-by-default would lose your work. You're in a **threat model where application-level compromise** is a credible attack vector (sophisticated journalism, activism, anti-surveillance research). You're already running **Qubes OS** and want the canonical anonymity-layer Qubes-Whonix integration. You want **stream isolation** across applications so a leak in one doesn't deanonymise another. You're testing or developing **anonymity tools** and want a controlled environment to validate them. You want to **identity-compartmentalise** by running multiple Workstation VMs side-by-side (one for personal anonymous identity, one for journalism work, one for activism, etc.) sharing a single Gateway. You're not satisfied with single-application anonymity (Tor Browser) and want OS-level network isolation.\n\n**Caveats.** **Heavier setup than Tor Browser or Tails** — requires VirtualBox or KVM, requires understanding two-VM architecture, requires managing VM resources. Coming from \"just install Tor Browser,\" Whonix is a significant step up in complexity. **Host OS is the weak link** — Whonix's compartmentalisation protects against application-level compromise, but the host OS (macOS, Windows, Linux) that's running VirtualBox can see everything in the VMs. For the strongest posture, run Whonix on Qubes OS where hypervisor isolation makes the host less of a concern. **Performance overhead** — running two VMs is heavier than a single OS; you'll feel it on a low-end laptop. 8GB+ RAM and an SSD are recommended for a comfortable experience. **Persistence is opt-in for some use cases, off for others** — unlike Tails, Whonix persists files by default; if you need amnesic-by-default for specific sessions, you can use Whonix-Live (Whonix's amnesic mode) or shut down + revert from a clean snapshot. **VirtualBox requires non-trivial host trust** — Oracle's VirtualBox has had vulnerabilities historically; for the strictest threat model, use KVM (Linux native) or Qubes OS (Xen-based) instead. **No mobile** — Whonix is desktop-only; mobile users should use Tor Browser for Android, or Orbot + a hardened Android distribution like GrapheneOS. **Initial download is large** — the VM images are 1-2GB each; first install over a slow connection is painful. **Doesn't protect physical-access threats** — Whonix is software-only; if your laptop is seized and the VMs are unlocked, the data is readable. Pair with full-disk encryption (VeraCrypt or system FDE) for physical-access protection. **Updates require attention** — like any OS, Whonix needs periodic updates for security; staying on an old version means staying on old Tor + old Debian + old browser, all of which is a real attack surface.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "self_hosted", "audited" ], "highlight_tags": [ "FREE", "TOR", "COMPARTMENTALISED" ], "fees": { "summary": "Free · GPL" }, "fees_summary": "Free · GPL", "last_verified": "2026-05-13", "operating_since": "2013", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://whonix.org", "outbound_slug": "whonix", "tor": "http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion", "twitter": "https://x.com/Whonix" }, "also_listed_at": { "web3privacy": true, "privacyguides": true, "monerica": true } }, { "id": "xmr-bio", "category": "tools", "subcategory": "Monero-Native Identity", "name": "xmr.bio", "url": "https://xmr.club/tools/xmr-bio", "twin": "https://xmr.club/llm/tools/xmr-bio.txt", "tagline": "First-party Monero-native identity — free OpenAlias record, X-post proof-of-ownership, optional Nostr link. Optional custom subdomain via xmr402.", "review": "**What it is.** xmr.bio is a Monero-native identity service — a verified handle plus a first-class OpenAlias record for a Monero-first username. Under the hood you get profile pages, OpenAlias resolution, and signed machine-readable address records — the building blocks that let other Monero services (wallets, merchant tools, tipping surfaces) actually consume the identity instead of leaving it as a vanity URL.\n\n**Disclosure — first-party listing.** xmr.bio is operated by the same team that publishes this directory. The grade below is set against the same rubric as every other listing at this subcategory, and the review is written to the same \"conclusions not narration\" voice — but you should read grades on first-party rows with an extra pinch of salt. Cross-reference the subcategory peer set and route your trust wherever the shape fits.\n\n**How registration works.** *\"A name you can't buy — only prove.\"* Claiming a handle requires a **proof-of-ownership post on X** carrying a token the site issues you; the site verifies that post exists before the handle is bound. A **Nostr identity can also be linked** to the profile as an optional secondary proof, so a claim can be cross-anchored across two independent identity graphs. There is no first-come-first-served payment gate on the base handle — proof is the gate, not price.\n\n**What costs money.** The base handle + OpenAlias record are **free**. An optional custom *subdomain* on the handle is available for purchase using the **xmr402** protocol — the HTTP-402-based XMR payment standard also listed on this directory. That subdomain feature is a *showcase* for xmr402 rather than a paywall on core functionality; readers who just want the free verified handle + OpenAlias record never touch it.\n\n**Positioning vs the paid competitors.** The closest external services in this space are **xmr.ist** and **xmr.id** — both charge for OpenAlias records. xmr.bio publishes an OpenAlias record for every verified handle for free, gates handles by X-post proof-of-ownership (with optional Nostr link) rather than by payment, and only monetises the optional subdomain cosmetic. If you already know you want OpenAlias resolution for a Monero-first handle without a per-year subscription, xmr.bio is the direct alternative. If you want a paid brand-name-registrar experience with commercial-support SLAs, xmr.ist and xmr.id fit that shape better.\n\n**Peer position on xmr.club.** Listed under `tools` / **`Monero-Native Identity`**. See the subcategory index for the current peer set.\n\n**Grade A.** Operating since 2025-11. First-party status means the operator's identity, hosting, and operational cadence are the same team that maintains this directory — verifiable on our side rather than taken on marketing trust. Same rubric that keeps kyc.rip's other first-party surfaces at A. Grade movement follows the same rules as any listing — a regression on the identity guarantee (e.g. a name silently reassigned, a proof-of-ownership bypass surface) would trigger the standard incident + downgrade path.\n\n**Caveats.**\n- The proof-of-ownership post lives on **X** — that means claiming a handle depends on having an X account. Readers who deliberately avoid X can't currently register, and the identity is anchored (partly) to a surveillance-capital platform. The optional Nostr link partially mitigates this by adding a self-sovereign anchor, but it's a secondary proof, not a replacement.\n- Identity services are directional — an OpenAlias record you publish today is a lookup others depend on. Migration off a naming service is not costless. Weight portability accordingly (the OpenAlias record itself is portable to any DNS host; the *handle* on xmr.bio is not).\n- First-party listing — flagged both on the row (`first_party`) and in the disclosure paragraph above.", "translation_locale": "en", "rating": { "grade": "A", "stars": null, "count": 0 }, "grade": "A", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "MONERO-NATIVE", "OPENALIAS", "FREE", "VERIFIED-IDENTITY", "NOSTR", "XMR402" ], "fees": null, "fees_summary": null, "last_verified": "2026-07-09", "operating_since": "2025-11", "tenure_note": null, "locales_available": null, "first_party": true, "editors_pick": false, "links": { "web": "https://xmr.bio/", "outbound_slug": "xmr-bio" } }, { "id": "xmr-irish", "category": "tools", "subcategory": "Block & Mempool Explorer", "name": "xmr.irish", "url": "https://xmr.club/tools/xmr-irish", "twin": "https://xmr.club/llm/tools/xmr-irish.txt", "tagline": "Education-first Monero tool: live mempool visualizer with per-transaction privacy-primitive callouts, network-stat dashboard, protocol simulations, market ticker, and a Run-A-Node setup helper. Active V1→V5 iteration in four months by @AquaticXCP.", "review": "**What it is.** A Monero education + live-mempool + network-visualization tool. The site combines a block-by-block mempool explorer (with confirmation-count buckets and per-transaction detail down to `rct_type`, fee rate, size, ring-member count), a live market ticker (XMR/USD and XMR/BTC from CoinGecko), a network-stat dashboard (block height, hashrate, difficulty, hard-fork version), a `Simulate` section with eight protocol visualizations, and a `Run A Node` setup helper. Per the operator's own V5 announcement, the roadmap includes automated information updates for FCMP++, Carrot, Seraphis, Jamtis, and Cuprate as they ship.\n\n**Background.** Founded **2026-02-17** (monerica.com listing, *\"Education, mining, network stats, and the investment thesis for Monero\"*). Listed on monerica as `Media > News Aggregators` on 2026-03-21. The operator is **AquaticXCP** (X account, *\"capybara enthusiast\"*) who maintains the site as an actively-iterated personal project — V1 through V5 in roughly four months, with V5 publicly announced on X as a *\"live build\"* that will be tweaked over the following week. The operator explicitly invites bug reports and concerns via X message / comment. No legal entity, no payment surface, no signup, no custody — this is a read-only educational tool, not a service.\n\n**What you trust.**\n\n- **Non-custodial by category.** The site holds no user funds, processes no payments, and requires no signup. There is no wallet integration. Trust failure modes reduce to (a) the site being down (low-cost) or (b) the site rendering misleading data (a UX-design concern, not a custodial-risk concern).\n- **Live data sources are labelled.** The mempool, network stats, and per-transaction detail are drawn from a Monero node (top-line marked `FROM NODE`) and the market ticker is marked `CG · live` (CoinGecko). Data lineage is signposted on the page.\n- **Privacy primitives surfaced inline.** Each transaction detail view publishes an `ALWAYS-ON` panel naming the privacy features (*sender hidden / ring signature · recipient hidden / stealth address · amount hidden / RingCT*) — a small but meaningful educational signal: the tool isn't just an explorer, it's also teaching the protocol guarantees while you read.\n- **Active operator presence.** The operator's V5 announcement explicitly opens a feedback channel (*\"message me or comment if you have trouble with the site, issues or concerns, or thoughts!\"*) and the V1→V5 iteration cadence in four months suggests continued maintenance.\n\n**Operational specs.**\n\n- **Site:** https://xmr.irish — single-page app served behind Vercel's standard bot-protection interstitial. Works in any modern browser; hardened-mode browsers (very old, no-JS, or in some private modes) may hit the checkpoint page first.\n- **Operator channel:** X / `@AquaticXCP`.\n- **Peer-directory listings:** monerica.com/site/xmr-irish (admitted 2026-03-21, *Media > News Aggregators*, no community reviews yet). No other peer directories list it.\n- **Pricing:** Free.\n- **Categories on the site:** Home · Mempool · Markets · Network · Monero · Education · Simulate · Run A Node.\n- **Network data:** Block height, hashrate, difficulty, block target, mempool depth, hard-fork version (currently v16 / FCMP++ Q3 banner).\n- **Mempool views:** Six modes including a Classic block-bucket visualization with confirmation counts (1→10+) and TXs / size / fee summary per bucket.\n- **Per-transaction detail:** Transaction hash, rct_type, ring-member count, fee, fee rate, size, time-to-confirmation, mempool status.\n- **Market ticker:** XMR/USD, XMR/BTC, 24h Δ — sourced from CoinGecko.\n- **No Tor mirror advertised.**\n- **No subscription, account, or wallet integration.**\n\n**Operator philosophy.** Positioned as *\"a pet project focusing on Monero Education and the Monero Mainnet Mempool\"* (operator-published, X / V5 announcement). The framing is explicitly hobbyist-maintainer rather than commercial: V5 is described as a *\"live build\"* with active iteration. The roadmap is protocol-update-oriented — *\"automated updates for FCMP++, Carrot, Seraphis, Jamtis & Cuprate\"* — signalling the operator intends to keep the tool current with Monero's research-track changes. The Simulate + Run-A-Node sections push the project past \"explorer\" toward genuine onboarding tooling.\n\n**Grade rationale.** Listed at **Grade A**. The substantive features (mempool explorer + protocol simulations + node-runner setup + privacy-primitives surfacing) place this in the same functional tier as `monerospace`, and the read-only / non-custodial / zero-PII category profile means the high-loss-asymmetric tenure rule does not bind — there is essentially no way for a mempool visualizer to harm its readers financially. Initially listed at B in 2026-06 because (a) only one peer-directory listing existed (monerica, no community reviews), (b) the same screen mixed live chain data, illustrative sample data, a live market ticker, and educational copy without clean visual separation, and (c) the V5 build was operator-described as a *\"live build\"* still being tweaked. Re-verified 2026-06-27: the operator rebuilt the page into clean section bands (MARKETS / NETWORK / MONERO / EDUCATION / SIMULATE / RUN A NODE), removed the illustrative sample content entirely rather than just relabelling it, and dropped the *\"live build\"* / *\"pet project\"* framing from the homepage chrome. Two of the three concerns from the original B-listing were addressed by the operator; the third (independent peer-dir review beyond monerica) is outside operator control and is not a structural prerequisite for a read-only educational surface.\n\n**Useful when:**\n\n- You want a single-page Monero overview that combines live mempool state, protocol-update awareness (FCMP++, Carrot, Seraphis, Jamtis), and educational visualizations — without setting up your own node.\n- You're learning the Monero protocol and want a visual teaching surface — the per-transaction privacy-primitives panel (ring signature / stealth address / RingCT) is genuinely instructive in context.\n- You want to walk a friend through \"what does the mempool look like right now\" without sending them to a generic blockchain explorer that doesn't speak Monero's privacy guarantees.\n\n**Caveats.**\n\n- **Readability tradeoff — content mixing.** V5 collapses several distinct surfaces onto the same screen: a live mempool block-bucket visualization (live chain data) + a Local Node + Peers panel (sample / illustrative data) + a live CoinGecko market ticker (financial data) + an educational privacy-primitives explainer banner + top-level navigation to Education / Simulate / Run-A-Node sections. The information is substantive, but the categories are heterogeneous — a single page is doing the work of an explorer *and* a market dashboard *and* an educational micro-site *and* an onboarding tool, and the visual grouping does not cleanly separate them. New readers may have to study the layout once or twice before the *which-data-is-which* question is settled.\n- **ILLUSTRATIVE side panels.** The Local Node and Peers sidebars carry an *ILLUSTRATIVE* label — these are sample data, not the reader's own node state. The label is small relative to the data it qualifies. Take a second look before quoting node-status figures from this surface as live.\n- **Vercel bot-protection interstitial.** The SPA sits behind Vercel's standard checkpoint. Any modern browser passes through transparently; hardened or no-JS browsers may see the checkpoint page instead of the app.\n- **V5 is a live build.** Operator has explicitly said the build will be tweaked over the days following the V5 launch (2026-06-10). Expect occasional UI changes and incomplete feature areas.\n- **Single-source verification.** Only one peer directory (monerica) currently lists this tool and there are no community reviews yet. Treat the *operating since 2026-02-17* tenure as still very early — the tool is four months old.\n- **No Tor mirror.** No operator-published `.onion` address. Tor users hit the site via clearnet exits — Vercel sees the exit-node IP, not the user's.\n", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "EDUCATIONAL", "MEMPOOL", "NEW" ], "fees": { "summary": "Free. No account, no payment, no custody." }, "fees_summary": "Free. No account, no payment, no custody.", "last_verified": "2026-06-27", "operating_since": "2026-02-17", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmr.irish", "twitter": "https://x.com/AquaticXCP", "outbound_slug": "xmr-irish" }, "also_listed_at": { "monerica": true, "kycnot": true } }, { "id": "xmr-pay", "category": "tools", "subcategory": "Merchant", "name": "XMR-PAY", "url": "https://xmr.club/tools/xmr-pay", "twin": "https://xmr.club/llm/tools/xmr-pay.txt", "tagline": "Drop-in non-custodial Monero payment library by SlowBearDigger (same as goxmr.click) — `npm i xmr-pay`, drop `` in a checkout, accept XMR directly to your wallet. Beta 0.1.0.", "review": "A drop-in, non-custodial Monero payment library — install via npm, drop a `` web component into a checkout page, and accept XMR directly to your own wallet without routing through a third-party processor. Listed at **Grade C** because the tool works on mainnet today (live demo at xmrpay.shop) and the operator (SlowBearDigger) has prior credibility from shipping [goxmr.click](/tools/goxmr) at Grade B in this directory — but the project itself is Beta 0.1.0, the GitHub repo and npm package metadata aren't fully indexable yet, there's no documentation beyond the landing page, and zero community discussion has accumulated. C is the new-developer-tool floor; the architecture earns more, the track record doesn't yet support it.\n\n**What it is.** A client-side, non-custodial Monero payment toolkit for developers and merchants. Three components: (a) a zero-dependency web component (`npm i xmr-pay`) that renders a payment QR plus URI plus live status indicator on any HTML page; (b) stateless transaction-proof verification — a Monero tx-proof check that runs on-chain with no keys, no database, and no third-party API; (c) a view-only watch agent that assigns subaddresses per order and auto-detects on-chain payment. A WooCommerce plugin (Beta) wraps the above for WordPress stores. The entire payment path runs on the merchant's own infrastructure with funds going directly to the merchant's wallet — there is no operator-held balance and no centralised checkout server (the library has no operator at runtime — the developer ships releases, but nothing in the payment path goes through them).\n\n**Background.** Built by **SlowBearDigger** — a solo developer who also ships [goxmr.click](/tools/goxmr) (privacy-first Monero link-in-bio tool, listed in this directory at Grade B). Same handle across both projects; the same X account (`@SlowBearDigger`) and GitHub org publish releases for each. Solo-dev shipping is the norm in the Monero tools ecosystem (a category that grew up around solo, pseudonymous developers), so the structure isn't a risk axis on its own — it's standard for the category and the bar both projects have already cleared once. The site at `xmrpay.shop` is a single-page landing that doubles as documentation and as a live mainnet coffee-tipping demo. The companion WooCommerce plugin is published at `github.com/SlowBearDigger/xmr-pay-woocommerce` as a downloadable `.zip`. Project itself versioned at 0.1.0 Beta as of 2026-06-17 — early-stage by the operator's own framing. Listed on monerica; no kycnot listing (kycnot scopes are wider than dev-tools, so absence here is mostly category-fit, not a negative signal).\n\n**What you trust.**\n\n- **Non-custodial by architecture, not by promise.** \"Funds go straight to your address — no third party in the payment path.\" The npm library has no hosted service to compromise; funds settle to whatever Monero address you pass to the web component. There is no operator-held balance, no escrow, and no shared backend that could be seized or fail.\n- **Stateless proof verification — trust the math, not the operator.** The library ships a tx-proof check that runs against the on-chain block data with no view-key, no wallet RPC, and no database. Merchants can confirm a payment cryptographically without trusting the library author or hosting any state about past payments.\n- **Live mainnet demo functions.** The homepage hosts a real coffee-tipping demo on Monero mainnet — funds go to a live wallet, the watch agent detects the payment, the status indicator flips. Working code beats README claims; the demo is the strongest single signal on the listing.\n- **Solo-dev credibility via [goxmr.click](/tools/goxmr).** SlowBearDigger ships under a consistent pseudonymous handle in the Monero privacy-tools space. goxmr.click is independently graded at B in this directory with a clean privacy posture (GDPR-aligned, no IP logs, HMAC-SHA256, bcrypt). Same dev shipping a second tool under the same name inherits the credibility floor — not the grade itself, which still depends on this project's own track record.\n- **monerica listing.** Project is listed on monerica.com — at least one peer-directory has reviewed and indexed it.\n- **Open source.** Source published on the operator's GitHub org. Anyone can audit the proof-verification logic; nobody depends on a centralised server staying up for the tool to keep working.\n\n**Operational specs.**\n\n- **Site.** https://xmrpay.shop — single-page landing + live demo (~24 KB).\n- **Install.** `npm i xmr-pay` — published on the npm registry.\n- **Integration surface.** Web component: ``. That's the entire merchant-side install.\n- **Modules.** Drop-in checkout widget · stateless tx-proof verification · view-only watch agent for subaddress assignment + payment detection.\n- **WooCommerce plugin.** Beta `.zip` at `github.com/SlowBearDigger/xmr-pay-woocommerce`; routes payments directly to the merchant's Monero wallet.\n- **Version.** 0.1.0 Beta (operator-flagged as Beta on the homepage).\n- **License.** Open-source per operator GitHub org.\n- **No hosted service.** No accounts, no API keys, no rate limits, no upstream operator who can suspend you.\n- **No data retention.** Nothing to retain — the library doesn't see PII, doesn't store IPs, doesn't collect telemetry. Architecturally guaranteed, not a policy claim.\n- **No fees.** XMR-PAY itself charges nothing. Merchants pay their own Monero network fees on settlement.\n- **Channels.** X `@SlowBearDigger`, GitHub. No Matrix, Signal, SimpleX, or PGP key advertised.\n\n**Operator philosophy.** Positioned as infrastructure for Monero sovereignty: *\"Sovereign Monero payments. Accept Monero. Non-custodial.\"* The architectural choice — an npm library + web component rather than a SaaS platform — is the philosophy in code: merchants own their payment flow end-to-end, the library is stateless, there is no centralised operator to whom merchants delegate trust. This is the explicit opposite of BitPay / NOWPayments / Coinbase-Commerce style payment processors. The operator chose to ship a tool, not a service — meaning grades and incidents on the directory's usual axes (KYC, AML, reserves, custodial risk) don't apply in the conventional sense. What applies is code quality, operator track record, and integration adoption — and those are the axes the C-floor grade reflects.\n\n**Grade rationale.** Listed at **Grade C** because it's a Beta 0.1.0 developer tool published recently with no merchant adoption signals on the public record yet — but the architecture is strong and the operator has a track record. The directory's tenure-in-grading rule normally defaults new operators to C in high-loss-asymmetric categories; for developer tools the loss model is different (a buggy widget makes you LOSE a sale, not gain a thief's wallet), and the same solo dev's goxmr.click sits at B in this directory. So C is what's earned by the *project's* age and adoption — not by the operator's credibility. **Path to B:** versioned releases past 0.1.x; documented WooCommerce-version + WordPress-version compatibility matrix; at least one third-party merchant publicly using it in production; a README / integration guide at the repo level beyond the landing page; ideally a security review of the proof-verification module from an independent reviewer. **Path to A:** all of the above plus a year of incident-free operation on real-merchant volume.\n\n**Useful when.**\n\n- You're a developer building a Monero-accepting website and you want a drop-in web component that generates a payment QR without depending on a third-party API. `` is the entire integration.\n- You run a WooCommerce store and want to accept Monero non-custodially — the Beta plugin routes payments directly to your wallet and runs detection on your own agent.\n- You want to verify Monero tx-proofs cryptographically without running a wallet-RPC — the stateless verification module checks proofs on-chain with no keys or database.\n- You've reviewed [goxmr.click](/tools/goxmr) and trust SlowBearDigger's track record enough to adopt a Beta tool from the same developer.\n- You explicitly want a tool, not a service — no operator can suspend your account or seize your funds because there's no operator in the runtime path.\n\n**Caveats.**\n\n- **Beta 0.1.0 — early-stage software handling real payments.** Operator framing is explicit. Test thoroughly on testnet or with small mainnet amounts before deploying to a production store.\n- **No README / API reference / integration guide beyond the landing page.** The homepage shows the integration surface but a full documentation set is not yet published. Adopters self-document by reading the source.\n- **WooCommerce plugin is Beta.** Distributed as a downloadable `.zip` with no documented WooCommerce / WordPress compatibility matrix or known-issues list. Beta-stage handling real payments needs its own staging round.\n- **Zero merchant adoption signals on the public record.** No third-party stores have publicly disclosed using it; npm download stats and GitHub fork/star counts aren't fully indexable yet. The architecture is sound but real-merchant volume is the only thing that confirms the integration model holds up under traffic.\n- **Single-source peer-dir trust signal.** Monerica only. No kycnot listing (mostly a category-fit issue — kycnot doesn't review dev tools), but it does mean we're not triangulating across multiple directories.\n- **No published security review.** Proof-verification code is the security-critical piece. A merchant relying on it for payment confirmation is trusting that the math is implemented correctly. An independent review hasn't been published.\n- **No Tor mirror.** The landing page is clearnet-only; merchants integrating the npm package don't need Tor for the library itself, but a Tor mirror of the landing/documentation would help users browsing from Tor-only environments.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [ "no_account" ], "feature_tags": [ "non_custodial" ], "highlight_tags": [ "XMR", "NPM", "NON-CUSTODIAL", "BETA" ], "fees": { "summary": "Free open-source library · merchant pays Monero network fees on settlement · no operator fees" }, "fees_summary": "Free open-source library · merchant pays Monero network fees on settlement · no operator fees", "last_verified": "2026-06-17", "operating_since": "2026-06", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmrpay.shop", "outbound_slug": "xmr-pay", "twitter": "https://x.com/SlowBearDigger", "github": "https://github.com/SlowBearDigger/xmr-pay" }, "also_listed_at": { "monerica": true } }, { "id": "xmr402", "category": "tools", "subcategory": "Payment Standard", "name": "XMR402", "url": "https://xmr.club/tools/xmr402", "twin": "https://xmr.club/llm/tools/xmr402.txt", "tagline": "Open standard for HTTP 402 payments — Monero-paid, agent-friendly, no signup.", "review": "Open spec for resurrecting the HTTP 402 status code as a real payment rail — XMR-first, with provisions for Lightning. Designed for the agentic web: machine-to-machine micropayments that need zero signup and minimal latency. Operator-disclosed: the curator runs this; the protocol itself is permissionless and the spec is open, but read /transparency for context before relying on it for production billing.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "no_kyc" ], "feature_tags": [ "open_source", "xmr_native", "api_available" ], "highlight_tags": [ "NO-KYC", "SPEC" ], "fees": { "summary": "Spec / reference impl — free. Servers set their own price per resource." }, "fees_summary": "Spec / reference impl — free. Servers set their own price per resource.", "last_verified": "2026-05-14", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmr402.org", "outbound_slug": "xmr402" } }, { "id": "xmr98", "category": "tools", "subcategory": "Charts & Portfolios", "name": "XMR98", "url": "https://xmr.club/tools/xmr98", "twin": "https://xmr.club/llm/tools/xmr98.txt", "tagline": "Windows-98-themed Monero desktop — swap aggregator over Trocador, live price + chart + hashrate + Fear & Greed widgets, Chat app, README, and a few decorative folders. By @babysolo_, who also runs GhostDrip and babysolo.net.", "review": "**What it is.** A Windows-98-themed Monero \"desktop\" at `xmr98.com`. The whole single-page app renders as a Win98 desktop with icons for ten apps — Monero Swap, XMR98 Chat, Control Panel, README, Trading, Monero, Internet, Games, Help & Info, My Computer — plus sidebar widgets showing live XMR/USD price + chart, network hashrate, current block height + hard-fork version, and a Fear & Greed index. The Monero Swap app aggregates rates from Trocador with KYC-risk tags per upstream. It's a multi-feature Monero environment rather than a single-purpose service.\n\n**Background.** Built by **`@babysolo_`** — a known Monero-community figure since 2022 with ~3,336 followers and ~726 posts at fold-time, who also runs **GhostDrip** (a no-KYC DCA tool) and **babysolo.net**. XMR98 is positioned as a creative side-project; the Win98 aesthetic is the editorial framing, not a gimmick on top of a generic shell. The app self-discloses on the splash: *\"On Tor Browser it runs at the 'Standard' and 'Safer' security levels\"* — i.e. Tor *Safest* mode breaks it because the desktop is JavaScript-required end-to-end.\n\n**What you trust.**\n\n- **Operator carries community-tenure credibility.** `@babysolo_` has been visible in the Monero space since 2022 and runs other no-KYC projects under the same handle. That's not identity verification, but it's meaningfully better than the anonymous-newcomer pattern we usually grade C tenure-zero projects at — the operator's reputation on other projects is the implicit collateral here.\n- **The Win98 framing is honest about what's under it.** The Monero Swap app explicitly tells you: *\"Rates aggregate dozens of exchanges via Trocador, each with a KYC risk rating. Your coins never touch our servers.\"* No pretence of a first-party swap engine. If you want to see exactly which upstream is quoting your rate, the UI shows it.\n- **Multi-tool dashboard rather than single-purpose pitch.** Live price + chart, network hashrate, block height + hard-fork (v16), Fear & Greed — sidebar widgets that give the page utility beyond the swap. If you're using it as a daily-driver bookmark for \"what's XMR up to right now\", the page works as a glanceable status surface.\n- **Static-page architecture, no backend custody.** The whole desktop ships as a single-page app from `/assets/index-*.js` + `.css`. Swap execution happens client-side through Trocador's API — XMR98 doesn't custody anything.\n\n**Operational specs.**\n\n- **Site.** `https://xmr98.com` — single-page Win98 desktop. JavaScript-required end-to-end (Tor Browser *Safest* mode breaks the swap flow; *Standard* and *Safer* work).\n- **Swap backend.** Trocador (already listed at Grade A in our `exchanges/Aggregators`). XMR98 is the UI layer; Trocador handles routing + execution.\n- **Operator channels.** X / `@babysolo_`. The operator also runs GhostDrip and `babysolo.net`; following the X handle gets you all three projects' updates.\n- **Desktop apps surfaced on load.** Monero Swap, XMR98 Chat, Control Panel, README, Trading, Monero, Internet, Games, Help & Info, My Computer — some are functional, some are decorative-but-charming, the README documents the project.\n- **Sidebar widgets.** Live XMR/USD price + 24h delta + sparkline chart (CoinGecko-class source, source not disclosed inline). Network: hashrate (e.g. `5.36 GH/s`), block height, fork version. Fear & Greed index pulled from a crypto-sentiment source.\n- **No Tor mirror advertised.** No `.onion` published as of fold-time. Tor users hit the site via clearnet exits.\n- **No published policies.** No `/about`, `/privacy`, `/terms`, or `/contact` page beyond what's inside the desktop (README + Help & Info apps).\n- **Donation / monetisation.** Not surfaced on the splash; check the Help & Info app inside the desktop for any tip address.\n\n**Operator philosophy.** The desktop framing is the point. The Win98 chrome is editorial commentary — *\"Monero is a tool for adults who know what they're doing, presented in the aesthetic of an era when you actually owned your computer.\"* That's a different way to package the same swap-aggregator + price-ticker + network-stats combination most Monero tools ship as cleaner-looking SaaS pages. Whether the aesthetic works for you is taste; whether the operator is committed to the project is signalled by the fact that babysolo also runs GhostDrip and babysolo.net under the same handle, all with consistent editorial voice.\n\n**Grade rationale.** Listed at **Grade B-**. What lifts it above default-C: the operator carries real community-tenure credibility through `@babysolo_`'s other Monero projects (GhostDrip, babysolo.net) since 2022 — that's a substantively different signal than a fully-anonymous newcomer. The Win98 framing is also a genuine editorial choice rather than a relabel, and the swap-backend disclosure (Trocador, named in the UI) is honest. Held at the half-step rather than full B because XMR98 itself is brand-new (the operator isn't, but this specific project hasn't accumulated yet), the desktop is JavaScript-required end-to-end with no fallback for *Tor Safest* users, and there's no first-party `.onion` mirror despite the audience overlap. **Path to A**: stand up a `.onion` mirror, ship a no-JS fallback or at least a graceful *Tor Safest* degradation, accumulate operating-since visibility under the XMR98 brand specifically, and earn an independent third-party review (a forum post, a kycnot writeup, or comparable).\n\n**Useful when:**\n\n- You want a Monero status page that lives somewhere on the bookmark bar — price, hashrate, block height, sentiment, all on one glanceable surface — and you don't mind that the chrome is a Win98 joke.\n- You want a Trocador-fronted swap with a clearly-labelled UI that surfaces upstream KYC risk per option, packaged as one of several apps in a self-contained Monero environment rather than a standalone swap page.\n- You're following `@babysolo_`'s other no-KYC Monero projects (GhostDrip, babysolo.net) and want their full toolset in one place.\n\n**Caveats.**\n\n- **JavaScript-required end-to-end; Tor Safest breaks the swap.** The Win98 desktop is rendered entirely client-side from `/assets/index-*.js`. On Tor Browser's *Safest* security setting (JavaScript disabled globally) the page does not render. Use *Standard* or *Safer* for the actual swap flow.\n- **Backend is Trocador.** The UI is XMR98's; the swap engine is not. If Trocador's API changes, breaks, or removes a route, XMR98's swap stops working. Trocador's own listing (Grade A in our `exchanges/Aggregators`) is the underlying-trust surface — if you care about XMR98's rate quality, that ultimately resolves to Trocador's upstream selection.\n- **No `.onion` mirror.** The site is clearnet-only as of fold-time. Tor users connect through exit nodes; Vercel/whichever-host sees the exit IP, not the user's.\n- **No published policies on the splash.** Any policy text lives inside the README or Help & Info desktop apps rather than on conventional `/privacy` / `/terms` paths. Worth checking what's documented before quoting it.\n- **Tenure-zero on this brand.** XMR98 is brand-new. The operator's 2022 tenure carries elsewhere; this specific project hasn't accumulated yet.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B-" }, "grade": "B-", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "DASHBOARD", "RETRO", "AGGREGATOR" ], "fees": { "summary": "Free. Swap rates come from Trocador's upstream — verify the quoted rate against an aggregator (Trocador directly / kyc.rip) before confirming the swap. No XMR98-side service fee documented as of fold-time." }, "fees_summary": "Free. Swap rates come from Trocador's upstream — verify the quoted rate against an aggregator (Trocador directly / kyc.rip) before confirming the swap. No XMR98-side service fee documented as of fold-time.", "last_verified": "2026-06-14", "operating_since": "2025", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmr98.com", "twitter": "https://x.com/babysolo_", "outbound_slug": "xmr98" } }, { "id": "xmrbid", "category": "tools", "subcategory": "Directory", "name": "xmrbid.lol", "url": "https://xmr.club/tools/xmrbid", "twin": "https://xmr.club/llm/tools/xmrbid.txt", "tagline": "A privacy-clean XMR directory built on the same open/verifiable DNA as xmr.club — public JSON, warrant canary, onion, zero trackers — but the opposite soul: rank is the bid and every listing is self-written. A transparent billboard, not a curated list.", "review": "**A privacy-clean directory where rank is bought.** xmrbid.lol is, architecturally, a close cousin of xmr.club — open, public, machine-readable JSON feeds, a warrant canary, an onion mirror, zero trackers, and \"no accounts, no cookies, no logs, no record of who read what.\" On the privacy-engineering axes it's genuinely excellent, and the sophistication (canary + a public `verify` repo, published prices, and a verifiable Monero transaction behind every listing, all shipped in its first days) points to an experienced privacy operator.\n\n**The one axis that flips everything.** The two directories share the same transparent, verifiable DNA — but the opposite soul. Here, **rank *is* the bid**: listings pay Monero to rank higher, and each listing is **written by the operator being listed**. So the openness is real, but what it makes auditable is a *payment auction*, not an independent judgment. The #1 spot is whoever paid most; every \"review\" is marketing the listee wrote about themselves.\n\n**What that means for you.** As a privacy tool, it's clean and honest — it states the pay-to-rank model openly and you can verify the bids. As a *directory*, its output carries **no vetting signal**: it can't tell you which service is safe, only who spent the most on visibility. Read it as a transparent billboard, not a curated list.\n\n**Why B.** The clean architecture, onion, canary, no-tracker build, and evident operator competence earn a real grade — this isn't a sketchy site. It's held below A by two things: it's only days old (no track record — the canary is untested, uptime unproven), and, by design, a bought-and-self-written ranking is the one thing that makes a directory's output worthless for trust. A directory's whole value is whether its ranking *means* something; that's the part this model gives away. A-path is months of a held canary + clean uptime — but the pay-to-rank ceiling on vetting-utility stays regardless.", "translation_locale": "en", "rating": { "grade": "B", "trust": "Open, verifiable XMR-paid listing board — public JSON feeds, warrant canary, open verify repo (github.com/xmrbid/verify), and published bid prices with a verifiable Monero transaction behind each listing. Evidently built by an experienced privacy operator. But days-old (reg 2026-08-25, no track record), and rank is bought + listings self-written — no independent vetting.", "privacy": "Excellent hygiene: no accounts, no cookies, no logs, 'no record of who read what', zero third-party trackers, v3 onion mirror. Pay-to-list in Monero. Practices the privacy it preaches.", "ux": "Browse categories (wallets, exchanges, SIMs, payments, marketplaces, hosting, domains...) ranked by bid; each listing self-written. Clearnet + Tor. Published prices; open verify repo." }, "grade": "B", "kyc_tags": [ "anonymous_signup", "no_account", "no_kyc" ], "feature_tags": [ "open_source", "tor", "no_logs", "warrant_canary" ], "highlight_tags": [ "XMR", "OPEN-SOURCE", "NO-LOGS", "TOR", "CANARY", "PAY-TO-RANK" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-28", "operating_since": "2026-08", "tenure_note": "Domain registered 2026-08-25 (days old at listing). Full transparency suite shipped at launch — warrant canary, takedowns, legal, an open verify repo, an onion mirror, and a verifiable Monero transaction behind every listing's bid. It shares the pay-to-rank concept with outbid.lol, but is a far more substantial, privacy-first build.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmrbid.lol", "outbound_slug": "xmrbid", "tor": "http://xmrbidjvtyuhrdowz5emr66hwncwgziw2wsomsinkjkugfdjem3rsfid.onion", "source": "https://github.com/xmrbid/verify" } }, { "id": "xmrchat", "category": "tools", "subcategory": "Merchant", "name": "XMRChat", "url": "https://xmr.club/tools/xmrchat", "twin": "https://xmr.club/llm/tools/xmrchat.txt", "tagline": "Non-custodial Monero superchat + tipping for streamers — viewers pay no platform fee, creators keep 100%, no signup for viewers.", "review": "XMRChat is a Monero-native superchat / tipping tool for content creators. The pitch is direct: where YouTube takes 30–50% of Superchats and Rumble takes 20%, XMRChat takes **0%** — every XMR a viewer tips lands directly on-chain in the creator's wallet. The viewer side is **fully anonymous** (no account, no email, no signup), the creator side requires an email login to manage their tip page.\n\n**Architecture is the killer feature: it's non-custodial.** During creator onboarding, you supply your Monero **primary receive address + secret view key**. XMRChat generates a unique subaddress per incoming tip and uses your view key to *see* (but not spend) those incoming transactions for display and notifications. Funds **never touch a platform wallet** — they land directly in your wallet, on-chain, in real time. Even if XMRChat goes offline tomorrow, the XMR you've already received is still yours, untouched, in addresses you control. The platform is a UI + notification layer, not a custody layer.\n\n**Privacy trade-off worth understanding:** handing your view key to a third party gives them visibility into *every* incoming transaction to your primary address, not just tips. Standard mitigation: use a **dedicated XMR wallet for tip income**, not your main wallet. The view key only ever sees what hits that wallet. Don't reuse a wallet you've also used for personal/business receive — XMRChat's UI will surface those incoming transactions too.\n\n**Integrations**: Twitch bot (`xmr-chat`), OBS browser source for stream overlay, Streamyard support. Set up a tip page, share the URL with your audience, watch tips show up in your overlay during a stream. Tutorial by Alex Anarcho on YouTube is the standard onboarding reference.\n\n**Why we list at A-, not A:** non-custodial design + 0% platform fee + viewer-side anonymity + open-source (Apache-2.0 at `github.com/sa8ab/xmrchat`) all earn full credit. The half-step holding it back from A is the **email-required creator login** — for a privacy tool, requiring an email even on the creator side is a real cost (use a throwaway, but it's still an identity surface). Anonymous operator (no team page, contact via `support@xmrchat.com`) is also worth noting but mitigated by the non-custodial design — there's nothing to rug.\n\n**Useful when** you're a creator who streams (Twitch, OBS, Streamyard) and wants real Monero superchat without a platform middleman taking 30%; OR you're a viewer who wants to send a creator XMR without identity disclosure on either side of the transaction.\n\n**Trust mechanism**: open-source codebase (review the view-key handling yourself if it matters), non-custodial by architecture (no platform wallet to drain), on-chain settlement (your wallet is your bank). The combination is hard to beat for the tipping-creator use case in the Monero ecosystem.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A-" }, "grade": "A-", "kyc_tags": [ "email_required" ], "feature_tags": [ "non_custodial", "open_source", "xmr_native", "view_key_disclosure", "zero_platform_fee", "viewer_no_account", "twitch_integration", "obs_integration" ], "highlight_tags": [ "NON-CUSTODIAL", "0%-FEE", "VIEWER-ANONYMOUS", "OPEN-SOURCE" ], "fees": { "summary": "Platform fee: 0% — creators keep 100% of tip amount on-chain. Standard Monero tx fee applies (paid by the viewer)." }, "fees_summary": "Platform fee: 0% — creators keep 100% of tip amount on-chain. Standard Monero tx fee applies (paid by the viewer).", "last_verified": "2026-06-01", "operating_since": "2024-07", "tenure_note": "GitHub repo created 2024-07-01 (Apache-2.0). Stable creator tool in the Monero ecosystem.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmrchat.com", "outbound_slug": "xmrchat", "twitter": "https://twitter.com/xmr_chat", "contact_email": "support@xmrchat.com", "github": "https://github.com/sa8ab/xmrchat" }, "also_listed_at": { "web3privacy": true } }, { "id": "xmrclub-explorer", "category": "tools", "subcategory": "Block & Mempool Explorer", "name": "xmr.club Explorer", "url": "https://xmr.club/tools/xmrclub-explorer", "twin": "https://xmr.club/llm/tools/xmrclub-explorer.txt", "tagline": "xmr.club's own Monero block & mempool explorer — open-source (AGPLv3 MoneroSpace/mempool fork), runs off its own node (node.kyc.rip), Tor onion mirror with Onion-Location, no accounts / no trackers / no logs. First-party, disclosed.", "review": "**xmr.club's own Monero block & mempool explorer.** explorer.xmr.club is a self-hosted mempool.space-lineage explorer (via the open-source [MoneroSpace](/tools/monerospace) fork, AGPLv3) that we run directly — blocks, transactions, mempool, network stats, RingCT-aware. It queries **our own Monero node** (node.kyc.rip, Cake fallback), publishes a **Tor onion mirror** with Onion-Location auto-discovery, and ships **no third-party trackers, no accounts, no logs**.\n\n**Full disclosure — this is first-party.** We built and operate this, so we flag it plainly rather than dress it up as independent, and we grade it by the same rubric as everything else on the shelf. It sits at **A on feature parity with [MoneroSpace](/tools/monerospace)** — our A-grade upstream — *plus* the onion mirror and the tracker-free surface. The one thing a days-old entry normally lacks is a track record; for a first-party service we run, depend on, and are actively improving, the \"will it be abandoned?\" risk that tenure usually guards against is materially lower. And if that ever changes — if we stop maintaining it, or it degrades — this listing gets downgraded like any other, out loud.\n\n**Useful when.** You want to look up a Monero tx or block on an explorer that's open-source, runs off its own node, offers a Tor mirror, and doesn't log or track you. As with any public explorer, it can see the tx/block you query — use the onion (or your own instance) for anything sensitive.", "translation_locale": "en", "rating": { "grade": "A", "trust": "First-party (xmr.club). Open-source (AGPLv3, github.com/xmrclub/monerospace-explorer — a MoneroSpace/mempool.space fork). Runs off its own node (node.kyc.rip + Cake fallback). Onion mirror + Onion-Location. Days-old operationally but actively maintained; graded A on feature parity with our A-grade upstream MoneroSpace + onion + tracker-free surface.", "privacy": "No accounts, no third-party trackers, no logs. Tor onion mirror with Onion-Location auto-discovery. Reads from a self-hosted node. Standard caveat: any explorer sees the tx/block you query — use the onion for sensitive lookups.", "ux": "Blocks, transactions, mempool, network stats, RingCT-aware. Clearnet + Tor onion. Multilingual." }, "grade": "A", "kyc_tags": [], "feature_tags": [ "open_source", "xmr_native", "tor", "no_logs", "first_party" ], "highlight_tags": [ "XMR", "OPEN-SOURCE", "OWN-NODE", "TOR", "NO-TRACKERS", "FIRST-PARTY" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-30", "operating_since": "2026-08", "tenure_note": "Launched 2026-08 as xmr.club's own instance of the open-source MoneroSpace explorer (AGPLv3). First-party, actively maintained. Onion: luvn3ry2oegbz5xegwc524z6ls64apgrobpo5zooag4ioyhn36c4yxqd.onion", "locales_available": null, "first_party": true, "editors_pick": false, "links": { "web": "https://explorer.xmr.club", "outbound_slug": "xmrclub-explorer", "tor": "http://luvn3ry2oegbz5xegwc524z6ls64apgrobpo5zooag4ioyhn36c4yxqd.onion", "source": "https://github.com/xmrclub/monerospace-explorer" } }, { "id": "xmrescrow", "category": "tools", "subcategory": null, "name": "XMR Escrow", "url": "https://xmr.club/tools/xmrescrow", "twin": "https://xmr.club/llm/tools/xmrescrow.txt", "tagline": "Account-free centralized Monero escrow — operator-mediated, single-key wallet, 1-click release for buyer, admin can force-release or refund on dispute. Clearnet + .onion mirror.", "review": "**⚠ DO NOT USE — Grade demoted C → F on 2026-08-05 for active exit-scam by verified operator.**\n\nxmrescrow.app is currently taking new escrows while its operator (\"TT\" per victim reports; GitHub org display name literally reads `xmrescro (tt)`; @xmrescrow X account previously operated as the real service owner) is actively scrubbing accountability surfaces after at least one on-chain-documented user-loss event.\n\n**Evidence chain (all verified 2026-08-05, preserved to the Internet Archive):**\n\n- **On-chain BTC theft — \\$6,000 documented via three verifiable txids** on Bitcoin mainnet:\n - Test transfer (\\$1,000 + \\$50 fee, received via Zelle): [`46acf6af…5153ee`](https://mempool.space/tx/46acf6af7a2051df279b4e81d5fe2a17ff7e9dbafa8c5c04522973cb0c5153ee)\n - Main transfer 1 (\\$6,000 total, never received): [`daf6d7f5…c74e14`](https://mempool.space/tx/daf6d7f51fc378233bfc2abb4654ec7ff047910512b715b7745d1e5dd1c74e14)\n - Main transfer 2 (companion): [`fa9f9bd9…d87982`](https://mempool.space/tx/fa9f9bd92b98ea59c5af0928e45007b81d42cb1dc0edeb10e6c13ccc19d87982)\n- **Community-level corroboration in Monero Society TG group** — a second Monero Society community member publicly stated they had already suspected `@xmrescro` of scamming before the victim's evidence surfaced, and that the evidence has now confirmed it for them. Pre-existing suspicion in the community, independent of the initial victim report. Chat log preserved.\n- **Moderator-abuse pattern in Monero Society Telegram group** — victim was banned, muted mid-response, and had messages deleted after complaint. Corroborated by another moderator (Mav) via chat log.\n- **Operator identity confirmed as `@xmrescrow` on X** via a documented DM history between xmrescrow.app operator and xmr.club (screenshots on file) — the operator engaged with our C-rating listing, ran \"official updates\" against our critiques, discussed roadmap (\"out of beta\"). Not imposter behavior.\n- **Operator flight signals coincident with victim's public complaint:**\n - `@xmrescrow` X account deleted (platform returns \"account no longer exists\")\n - GitHub commit \"Contact: XMPP only; drop ref\" — active scrub of non-XMPP contact references\n - xmrescrow.app `/about` page recently added a \"we have no social media accounts\" line — contradicting the operator's own DM history with xmr.club\n- **Site itself still fully operational.** Actively accepting new escrows at the moment of this update. Every new escrow is a potential victim.\n\n**READER ADVICE — UNAMBIGUOUS:**\n- **Do not initiate a new escrow with xmrescrow.app under any circumstance.**\n- **Do not send funds to any address provided in an existing xmrescrow flow that hasn't yet completed** — the operator is actively covering tracks.\n- If you have an open dispute or completed escrow with them, treat funds as at material risk and take screenshots of every chat, PGP-signed message, and address NOW before further scrubbing.\n- If you were also scammed by the same operator, please submit via [/tools/xmrescrow/reviews](/tools/xmrescrow/reviews) with your evidence — a cluster of first-party reports may support recovery efforts.\n\n**Snapshots preserved to the Internet Archive on 2026-08-05** covering: xmrescrow.app homepage, xmrescrow.app/about (the \"no social media\" whitewash), github.com/xmrescro (the \"tt\" org display name), github.com/xmrescro/xmrescrow-client (the codebase state + latest whitewash commit), and the /commits/main history. Reference the Wayback captures if the operator continues scrubbing.\n\n---\n\n*The rest of this review reflects XMR Escrow's live posture prior to the 2026-08-04 incident and is preserved for audit continuity.*\n\nAn account-free centralized Monero escrow service. One party creates a deal, the site issues a buyer link and a seller link as single-use session tokens, and the operator's wallet holds the deposited XMR until the buyer clicks release or an admin force-releases on dispute. Listed at **Grade C** because the service is fresh (first public traces 2026-06), there's no peer-directory track record, the operator (handle `@T_Txmrescrow` on X) is pseudonymous with no published PGP key, and the homepage's \"non-custodial\" framing is contradicted by the actual flow — but the product itself is a working Monero-only escrow with a Tor mirror and a clearly explained mechanic that some buyers and sellers will find useful for low-value P2P deals.\n\n**What it is.** A web-based centralized escrow for Monero. Either party (typically the buyer) fills a form on `xmrescrow.app` — optional Alice/Bob labels, XMR amount, optional deal description — and the site returns two URLs with random session tokens (`?t=…`), one for the buyer and one for the seller. The site also issues a Monero **subaddress** (starts with `8`) under the operator's master wallet; the buyer sends XMR to that subaddress and pastes the transaction ID back into the page. A bot then waits for 10 confirmations and marks the deal as funded. The seller delivers off-platform; the buyer clicks \"Release\" and the operator's wallet sends to the seller's Monero address. If something goes wrong, either side opens a dispute and the operator's admin \"can force-release or refund\" — the dispute panel's own words. Clearnet (`xmrescrow.app`) and Tor (`wptywii7…onion`) mirrors serve the same content; both are reachable as of this review.\n\n**Background.** Operator is pseudonymous — X handle `@T_Txmrescrow` posted a launch tweet on 2026-06-23 announcing \"XMRescrow.app is now live! Automated Monero escrow for P2P. I've moved away from personal onboarding and launched a fully automated middleman (MM) service so you can keep transacting p2p privately with trust.\" The tweet carries a PGP signature, but the site has no about page, no contact page, and no published public key — so the signature can't be checked against anything the operator hosts themselves. The site itself also doesn't link to the X account or to any other operator channel; the tweet is the only thing tying that handle to the service. No peer directory carries the listing yet — not monerica, not kycnot.me, not Monero Observer, not no-kyc.io.\n\n**What you trust.**\n\n- **The operator, fully.** The deposit address is a subaddress under the operator's master wallet — every escrow funded sits in that single wallet until released. The operator can move funds at any time without user signatures; the dispute panel says so explicitly (\"admin will review and can force-release or refund\"). The trust model is \"trust the operator to release honestly,\" not \"the math prevents anyone from moving the funds.\"\n- **The Tor mirror.** The .onion address served from the launch tweet resolves to the same site and returns the same content as the clearnet — meaningful for users who want to negotiate a deal without revealing their IP to the operator or to a CDN.\n- **The 1-click release path.** When the deal goes smoothly, the flow is the simplest possible: buyer pays, waits ten confirmations, clicks Release, seller receives the XMR. No accounts, no email, no KYC, no manual operator intervention.\n- **The single-use session tokens.** Each party authenticates by URL alone (`?t=…`). Treat them like passwords — anyone with the link can act as that party. There's no second factor, no recovery, no account.\n\n**Operational specs.**\n\n- **Site.** `xmrescrow.app` (clearnet) and `wptywii7oaqvbe4lb4ko6qlo5rtnat2gj5x57rlrrrvwshl3oorustad.onion` (Tor, same codebase).\n- **No account.** No signup, no email, no KYC. Each escrow's authentication is a single-use URL token per party.\n- **Wallet model.** Centralized. Each escrow gets a subaddress under the operator's master wallet. Funds remain in the operator's wallet for the duration of the deal.\n- **Confirmations.** Bot waits for 10 Monero confirmations before marking a deal as funded.\n- **Release authority.** Buyer's click is the normal path. The operator's admin can force-release or refund on dispute — single-key authority, no multisig.\n- **Fees.** 3.5% of the escrow amount or $3 USD-equivalent in XMR, whichever is greater. On a 0.10 XMR (~$31 at $315/XMR) escrow the minimum-fee floor dominates and the effective fee is **~9.4%**; the marketed 3.5% rate only kicks in once the escrow is large enough that 3.5% > $3 (about ~$86 / ~0.27 XMR and up).\n- **Disclosed BETA.** Operator's launch tweet describes the service as \"In BETA\" and as a *\"fully automated middleman (MM) service\"* — the operator's own framing is centralized middleman, even where the homepage marketing reads \"non-custodial.\"\n- **Codebase.** Closed-source as far as anyone can see — no GitHub link on the site, no repo URL anywhere. \"Hosted locally\" per the launch tweet.\n- **Channels.** X `@T_Txmrescrow`. No Matrix, Signal, SimpleX, GitHub, or published PGP key on the site itself.\n\n**Operator philosophy.** Marketed as private, non-custodial, trustless: *\"Peer-to-peer Monero escrow. Private, non-custodial, and works over Tor. No accounts. No KYC. Just a secure hold between two parties.\"* In practice it is **centralized escrow** — the operator holds funds during the deal and is the sole authority on disputes. The homepage uses \"non-custodial\" in a marketing sense (the buyer and seller don't have a *xmrescrow.app* account or fiat custodian behind them) rather than the strict cryptographic sense the term carries in the Monero community, where it means party-held keys / multisig. By that strict definition — the one this directory uses for the `non_custodial` tag — xmrescrow.app is not non-custodial. The directory lists it honestly as what it actually is: an account-free *centralized* escrow with a Tor mirror.\n\n**Grade rationale.** Listed at **Grade C** because the service is fresh, the operator is pseudonymous with unverified-from-site identity, the marketing-vs-mechanics gap exists (claimed non-custodial, actually custodial), and no peer-directory has independently reviewed it yet. Custodial-escrow services hold real user funds for real time, which is a high-loss-asymmetric position even when the operator is honest — so the tenure floor applies regardless of how clean the published surface looks. **Path to B:** publish operator PGP public key + site→X bidirectional ownership proof; correct the homepage to drop \"non-custodial\" or document an actual 2-of-3 multisig flow; accumulate ≥6 months of incident-free operation with documented dispute outcomes; pick up at least one independent peer-directory review (monerica, kycnot). **Path to A:** all of the above plus a year of incident-free operation on real escrow volume and a published source repo so the bot, the subaddress generation, and the dispute logic can be audited.\n\n**Useful when.**\n\n- You're doing a small P2P trade with a counterparty who refuses to ship first, and neither side wants the friction of installing a multisig wallet or coordinating a 2-of-3 setup over chat. A centralized escrow with no account barrier is the path of least resistance and 3.5% (above $86) is a reasonable price for that simplicity.\n- You want a Tor-native escrow service — the .onion mirror is the same site as the clearnet and serves identical content, so you can negotiate a deal end-to-end without ever touching the clearnet.\n- You're a buyer and want a single-click release UX once the seller delivers, rather than running a multisig signing ceremony.\n\n**Not useful when.**\n\n- The trade is large. Holding 1+ XMR in a third party's wallet for the duration of a deal is a different risk profile than the ~$30 escrow this service is implicitly priced for.\n- You actually need cryptographic non-custody. Use Haveno, AgoraDesk's 2-of-3 multisig flow, or XMRTrades for that.\n- You can't keep the session-token URL safe. Lose the link and you lose access; the operator is the only path back in.\n\n**Caveats.**\n\n- **\"Non-custodial\" framing is marketing, not mechanics.** The homepage and the operator's X post both use the word, but the dispute panel says verbatim *\"admin will review and can force-release or refund\"* — that is single-key custodial authority. The directory does not tag this listing `non_custodial`. Read the service for what it is: a centralized middleman that the homepage describes in the slightly looser community sense of \"no fiat-custodian, no KYC, you don't have an account here.\" The strict cryptographic sense doesn't apply.\n- **Operator identity unverified from the site.** The X handle `@T_Txmrescrow` claiming to be the operator can't be cross-checked against the site itself — no link, no PGP key. If the X account is compromised or impersonated, you'd only find out by the discrepancy after the fact.\n- **Fee cliff on small escrows.** $3 USD minimum hits hard below 0.27 XMR. A 0.10 XMR escrow eats 9.4%, a 0.05 XMR escrow eats 19%. The 3.5% headline is only the truth once the escrow is large enough that 3.5% > $3.\n- **Token-loss equals fund-loss for the buyer path.** Single-use URL tokens with no recovery. If the buyer's link is lost before release, the buyer can't trigger Release; the seller has to flag dispute and rely on the operator's admin to force-release. If the link leaks, anyone with the URL can act as that party.\n- **No published security review, no published source.** The proof-verification path, the subaddress generation, and the dispute logic are all opaque to outside review. The operator says \"hosted locally\" but there's no published infrastructure attestation or repo URL to check.\n- **BETA, self-disclosed.** Operator's own launch tweet calls it \"In BETA\" and asks for feedback. Treat dispute outcomes and edge cases accordingly until the service settles.\n- **No peer-directory coverage.** Not listed on monerica, kycnot.me, Monero Observer, or no-kyc.io. The only public signal of life is the operator's own X account.", "translation_locale": "en", "rating": { "grade": "F" }, "grade": "F", "kyc_tags": [ "no_account" ], "feature_tags": [ "tor_mirror", "no_account" ], "highlight_tags": [ "XMR-ONLY", "TOR", "NO-ACCOUNT", "BETA" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-05", "operating_since": "2026-06", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmrescrow.app", "tor": "http://xmrescrobcw33cnm5ajyzn5xaqr5vkdsqxmptc55plgvxsnqybmhszqd.onion", "twitter": "https://x.com/T_Txmrescrow", "outbound_slug": "xmrescrow" }, "incident": { "date": "2026-08-04", "severity": "critical", "summary": "Active exit-scam confirmed. Operator identity verified via documented DM history with xmr.club (@xmrescrow X account was the real operator, since deleted). Victim BTC loss $6,000 with 3 verified on-chain txids. Moderator-abuse pattern (ban+mute+delete) in Monero Society TG. Coincident scrub of public contact surfaces (X delete, GitHub whitewash commit, /about reactive \"no social media\" line). Site still taking new escrows. Grade dropped C → F 2026-08-05. Evidence preserved to Internet Archive.", "curator_advice": "Do not initiate a new escrow with xmrescrow.app under any circumstance. Do not send funds to any address in an in-progress escrow. If you were also scammed by the same operator, submit via /tools/xmrescrow/reviews with evidence — a cluster of reports may support recovery.", "source_url": "https://mempool.space/tx/daf6d7f51fc378233bfc2abb4654ec7ff047910512b715b7745d1e5dd1c74e14", "timeline": [ { "date": "2026-08-04", "note": "User scam report received via /submit. Claim: $6,000 loss to operator \"TT\" + additional victims. Reporter says he has receipts." }, { "date": "2026-08-05", "note": "@xmrescrow X account confirmed deleted (platform returns \"account no longer exists\")." }, { "date": "2026-08-05", "note": "Reporter forwarded full evidence chain: 3 verified BTC txids on mempool.space ($6,000 loss), chat log with Monero Society moderator Mav confirming ban event, correspondence showing TT deleted messages and vanished." }, { "date": "2026-08-05", "note": "xmr.club X account inbox reviewed — documented DM history between xmr.club and @xmrescrow (the real operator, now deleted). Operator engaged with our C-rating listing, discussed \"official updates\" targeting our critiques, thanked us for early listing. Definitively identifies @xmrescrow as the actual xmrescrow.app operator." }, { "date": "2026-08-05", "note": "GitHub org github.com/xmrescro found — display name literally reads \"xmrescro (tt)\". Matches victim identifier \"TT\". Repo xmrescro/xmrescrow-client has recent \"Contact: XMPP only; drop ref\" whitewash commit — operator actively scrubbing non-XMPP contact references." }, { "date": "2026-08-05", "note": "Grade demoted C → F. Full shame-list warning-lead prepended. All evidence URLs preserved to Internet Archive." }, { "date": "2026-08-05", "note": "Third-party corroboration: Monero Society TG community member @Brownoid publicly posted \"@IanMVA has provided me a coherent explanation of the scam incident with evidence. i was 100% sure @xmrescro was scamming but now im 101% sure\". Pre-existing community suspicion + post-evidence confirmation. Independent voice; not the original reporter. Public post in the same Monero Society TG group where the scam originated. Chat log screenshot on file. Reference @Brownoid attribution kept internal per witness-protection rule; public review body cites as \"a second Monero Society community member\"." }, { "date": "2026-08-06", "note": "Independent third-party corroboration appeared after the directory F-grade: XMRHub publicly confirmed the $6k exit scam, said they declined a $2k front-page placement offer days earlier, delisted the service, gave a 24h make-whole deadline, and reported the operator then wiped Reddit and remaining socials. A r/Moner…", "auto": true }, { "date": "2026-08-13", "note": "One material new public disclosure within the last 7 days: independent directory XMRHub publicly confirmed the $6k exit scam (X post 2026-08-05), revealed it declined the operator's $2k front-page placement offer days earlier, delisted the service from xmrhub.org, gave a 24h make-whole deadline, and reported the ope…", "auto": true }, { "date": "2026-08-20", "note": "No new operator statements, third-party post-mortems, refund portal, or resolution: the incident remains active/critical at grade F, and a periodic xmr.club re-check (2026-08-13) surfaced no material disclosure beyond the already-logged XMRHub corroboration (X post 2026-08-05, pre-window). The one material change in…", "auto": true } ] } }, { "id": "yubikey-5", "category": "tools", "subcategory": "Hardware", "name": "YubiKey 5", "url": "https://xmr.club/tools/yubikey-5", "twin": "https://xmr.club/llm/tools/yubikey-5.txt", "tagline": "Hardware FIDO2 / U2F / PIV / OpenPGP token. Phishing-resistant 2FA across every account that supports it.", "review": "The YubiKey 5 is the reference hardware security key: a thumb-sized, battery-free device you tap or insert to prove possession of a physical secret no phishing site or remote attacker can copy. It is the difference between an account that *can* be remotely compromised and one that fundamentally cannot.\n\n**Background**\nMade by Yubico (Sweden/US), the YubiKey 5 series spans USB-A, USB-C, and NFC form factors. It is a multi-protocol key — one device that speaks FIDO2/WebAuthn (passwordless + 2FA), U2F, OATH-TOTP/HOTP, PIV smartcard, OpenPGP, and Yubico OTP. Yubico has a long, public track record and ships to a security-conscious user base.\n\n**What you trust**\nYou trust a tamper-resistant secure element that performs key operations on-device and never exports private keys. Phishing resistance is structural: FIDO2 cryptographically binds each credential to the real origin, so a lookalike domain simply cannot authenticate. The trade-off is closed-source firmware — you trust Yubico's engineering and external audits rather than reading the code.\n\n**Operational specs**\nNo battery, no network, no moving parts — it works by USB or NFC tap. Stores resident passkeys (FIDO2), acts as a TOTP vault via the Yubico Authenticator app, and holds OpenPGP/PIV keys for signing and SSH. Resistant to remote extraction by design. Pairs well with privacy workflows: protecting an email account, a password manager, or an exchange login with a key that can't be phished or remotely stolen.\n\n**Philosophy**\nThe YubiKey's premise is that the strongest second factor is a physical object an attacker must hold. It moves security from \"what you can be tricked into typing\" to \"what you must physically possess,\" closing the phishing and credential-replay attack classes that defeat SMS and TOTP-only setups.\n\n**Grade rationale**\nGrade A. Best-in-class phishing-resistant authentication, broad protocol support, and a proven vendor. The closed-source firmware and single-vendor dependency are the only marks against an otherwise exemplary device; for the threat it addresses, nothing open-source matches its maturity.\n\n**Useful when**\nYou want to harden a high-value account (email, password manager, exchange) against phishing; you need passwordless/passkey login; you want one device for 2FA + PGP + SSH; you distrust SMS and app-based OTP.\n\n**Caveats**\nFirmware is closed-source (FOSS purists may prefer a Nitrokey/SoloKey). Always register a backup key — losing your only key can lock you out. NFC/USB form factor must match your devices. It secures *access*, not the data itself — pair with encryption for at-rest protection.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "non_custodial", "2fa_supported", "pgp_supported" ], "highlight_tags": [ "HARDWARE", "2FA", "PGP" ], "fees": { "summary": "$50 one-time · physical · WebAuthn/U2F/OpenPGP" }, "fees_summary": "$50 one-time · physical · WebAuthn/U2F/OpenPGP", "last_verified": "2026-05-13", "operating_since": "2008", "tenure_note": "Yubico founded 2007; YubiKey 1.0 launched 2008. yubico.com WHOIS 2006 is pre-launch domain reservation.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.yubico.com/products/yubikey-5-overview/", "outbound_slug": "yubikey-5", "twitter": "https://x.com/Yubico" }, "also_listed_at": { "privacyguides": true } }, { "id": "airvpn", "category": "vpns", "subcategory": "Specialty", "name": "AirVPN", "url": "https://xmr.club/vpns/airvpn", "twin": "https://xmr.club/llm/vpns/airvpn.txt", "tagline": "Independent Italian operator. Accepts XMR, BTC, BCH, ETH, LTC, DOGE.", "review": "Long-running, technically detailed. Eddie client is open source. Smaller server fleet but strong anti-censorship features (Tor-over-VPN routing, port forwarding).", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "open_source", "no_js_supported" ], "highlight_tags": [ "PORT FWD", "TOR-OVER-VPN" ], "fees": { "monthly_usd": 7, "summary": "€7/mo · XMR, BTC, BCH, ETH, LTC, DOGE · email required" }, "fees_summary": "€7/mo · XMR, BTC, BCH, ETH, LTC, DOGE · email required", "last_verified": "2026-05-13", "operating_since": "2010", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://airvpn.org", "outbound_slug": "airvpn", "tor": "http://airvpn3epnw2fnsbx5x2ppzjs6vxtdarldas7wjyqvhscj7x43fxylqd.onion" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "azirevpn", "category": "vpns", "subcategory": "Privacy-First", "name": "AzireVPN", "url": "https://xmr.club/vpns/azirevpn", "twin": "https://xmr.club/llm/vpns/azirevpn.txt", "tagline": "**Ownership + jurisdiction shift, XMR dropped.** Formerly Swedish no-logs VPN; now owned by Malwarebytes (US, Santa Clara CA) per their own `/about` page. XMR is no longer accepted at the pricing step. Downgraded A → C on 2026-07-02 pending verified audit under new ownership.", "review": "AzireVPN is the *small Swedish VPN that quietly does the hard infrastructure right* — it owns its physical servers instead of renting VPS boxes, runs them diskless, and lets you sign up with a random handle and pay in cash by mail, so there's neither an account identity nor a disk to seize.\n\n**Background.** Operating since 2012 out of Sweden, AzireVPN has built an infosec reputation disproportionate to its size. Its defining choices are infrastructural: it *owns and controls its own physical servers* (no rented virtual machines a host could snapshot), publishes its *diskless / RAM-only* server design, and offers genuinely anonymous accounts. That hardware-level control plus a transparent architecture is why it earns an A in /vpns — the privacy claims rest on how the network is actually built, not just on a policy page.\n\n**What you trust.** Three concrete things. First, *owned hardware*: because AzireVPN runs its own machines rather than VPS rentals, there's no upstream cloud provider that could be compelled to image a running server or that quietly logs at the hypervisor. Second, *diskless infrastructure*: the servers are designed to run from RAM with no persistent storage, so a seized box yields nothing — there's no disk to forensically recover. Third, *anonymous signup*: you create an account as a *random handle with no email required* and can pay *cash by mail* (or crypto), so the account itself isn't tied to your identity. The trust model is \"nothing useful to take, and nothing tying the account to you.\"\n\n**Operational specs.** WireGuard-first with standard clients across platforms, a network of self-owned servers, and features privacy users actually want (port forwarding, etc.). *Account creation needs no email* — a generated token is your login — and *payment* spans cash-by-mail and crypto alongside conventional methods. The diskless/RAM-only design is documented publicly rather than asserted. It's leaner and less glossy than the biggest names, but the privacy-relevant fundamentals (owned hardware, no disks, anonymous accounts) are first-class.\n\n**Philosophy.** A VPN's privacy is ultimately a function of *what its servers can be made to reveal* — and most consumer VPNs run on rented cloud infrastructure they don't fully control, with account systems tied to emails and cards. AzireVPN's thesis is to remove those weak points at the source: own the metal so no third party sits underneath you, run it diskless so there's nothing to seize, and let users stay anonymous so there's nothing to correlate. It's the same minimal-trust ethos as Mullvad, executed by a smaller team that competes on substance over polish.\n\n**Grade rationale.** A in /vpns. The grade reflects self-owned physical servers (rare and meaningful), a published diskless design, no-email/anonymous signup, cash and crypto payment, a long (since-2012) track record, and a Sweden jurisdiction with no mandatory data-retention for this category. It sits alongside Mullvad as a top privacy-VPN choice — the difference is scale and UX, not posture.\n\n**Useful when.** Choose AzireVPN when you want a privacy VPN whose *infrastructure*, not just its marketing, backs the no-logs claim — and you value owned-hardware + diskless servers and the ability to sign up and pay without revealing an identity. It's a strong pick for the privacy-maximalist who likes Mullvad's ethos but wants an alternative, and for anyone who prioritizes the technical substance over a polished app.\n\n**Caveats.** It's a *smaller operator*: fewer server locations than the giants, a less polished app, and a smaller team — fine for privacy, but check that its locations and speeds fit your use. A VPN is *not anonymity* — it shifts trust from your ISP to the VPN, and for strong anonymity Tor is the right tool; AzireVPN's diskless/owned-hardware design minimizes that trust but doesn't eliminate it. Sweden is privacy-reasonable but within the EU/14-eyes ambit, so threat-model accordingly. And as with any no-logs claim, you're trusting the operator's design and integrity — AzireVPN makes that trust as small as a VPN can, which is exactly what earns the A; just don't mistake a VPN for a cloak of invisibility.\n\n**2026 update — ownership change, XMR dropped, A → C.** Three verified changes since the initial A-listing:\n\n1. **Ownership.** The `/about` page now reads verbatim: *\"AzireVPN is owned by Malwarebytes, a global leader in real-time cyber protection, based in Santa Clara, CA, US.\"* AzireVPN was founded in Sweden in 2012 and is described as still operating from Stockholm, but the parent entity is a US mainstream cybersecurity company. That is a material trust-story shift for a *\"privacy-first VPN\"* — Malwarebytes is subject to US legal-process regimes (subpoena, CLOUD Act, national-security-letter) that a purely-Swedish operator was not.\n2. **XMR dropped.** The `/pricing` page no longer shows Monero (or Bitcoin) as an accepted payment method. The listing's original *\"accepts Monero\"* framing is now inaccurate.\n3. **No-logs claim now under new-ownership uncertainty.** The no-logs posture was substantively part of the original A-grade rationale. Under Malwarebytes ownership, the no-logs claim requires re-verification — an independent audit specifically conducted after the ownership change is the honest evidence-level we'd need to keep this above C.\n\n**Grade C — why C, not lower.** The service is still functional, the price is competitive, and the historical no-logs infrastructure is presumably still in place. What was A about it (independent operator + XMR + Sweden-only jurisdiction) is materially gone. Path back to B: reinstate XMR + published post-acquisition audit of the no-logs claim. Path back to A: additionally verify operational independence from Malwarebytes's US legal exposure (which may not be structurally achievable while the ownership persists).", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial" ], "highlight_tags": [ "NO-LOGS", "DISKLESS", "US-OWNED", "MALWAREBYTES-ACQUIRED", "NO-XMR-NOW", "OWNERSHIP-CHANGE-2026" ], "fees": { "summary": "€5/mo · XMR / BTC / cash · anonymous handle" }, "fees_summary": "€5/mo · XMR / BTC / cash · anonymous handle", "last_verified": "2026-07-02", "operating_since": "2012", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.azirevpn.com", "outbound_slug": "azirevpn", "contact_email": "support@azirevpn.com", "twitter": "https://x.com/AzireVPN" }, "incident": { "date": "2026-07-02", "severity": "high", "summary": "Operator change verified — AzireVPN's `/about` page now reads: \"AzireVPN is owned by Malwarebytes, a global leader in real-time cyber protection, based in Santa Clara, CA, US.\" That is a material trust-story shift for a service originally listed as a Sweden-based independent no-logs VPN. Simultaneously, the `/pricing` page no longer lists Monero (or Bitcoin) as a payment method — XMR has been dropped. The no-logs claim was substantively part of the original Grade-A rationale; under Malwarebytes ownership it requires re-verification via an audit specifically conducted after the ownership change.", "curator_advice": "Grade downgraded A → C on 2026-07-02. Existing customers should treat the no-logs claim as under-review, not confirmed. Users specifically avoiding US-jurisdiction VPN providers (CLOUD Act, subpoena, national-security-letter regime) should rotate to a peer VPN with disclosed ownership outside the US. Path back to B requires XMR reinstated + published post-acquisition no-logs audit. Path back to A additionally requires verifiable operational independence from Malwarebytes's US legal exposure.", "source_url": "https://www.azirevpn.com/about" } }, { "id": "cypher-vpn", "category": "vpns", "subcategory": null, "name": "Cypher VPN", "url": "https://xmr.club/vpns/cypher-vpn", "twin": "https://xmr.club/llm/vpns/cypher-vpn.txt", "tagline": "No-account, crypto-only VPN — WireGuard + AmneziaWG, pay in Monero (or BTC/USDT/TON/SOL), get a random key instead of a login. Exits in NL/RO/FI. Same operator as our Cypher eSIM.", "review": "**No-account, crypto-only VPN from the Cypher operator** — the team behind our B-grade [Cypher eSIM](/sims/cypher-esim). You pay in crypto (**Monero**, BTC, USDT, TON or SOL) and get back a randomly-generated key instead of an account: no email, no password you picked, no identity attached. Tunnels are **WireGuard**, with **AmneziaWG** obfuscation for networks that block plain WireGuard. Exit locations are the Netherlands, Romania and Finland — jurisdictions without blanket data-retention mandates.\n\n**Why C, not higher.** The privacy *architecture* is right — nothing collected means nothing to hand over — but the **no-logs claim is assertion-only**: no third-party audit, no warrant canary, no infrastructure transparency beyond the marketing page. The \"own hardware\" line is unverifiable (the exit IP resolves to a commercial hosting block, like most small VPNs that rent VPS). And it's **new** — the domain dates to mid-2026. The operator's standing on the eSIM side earns this a *confident* C rather than a wary one, but that brand trust doesn't vouch for an unproven no-logs promise on a separate product. It climbs the day there's an independent audit or a canary.\n\n**Bottom line:** a genuinely no-KYC, no-account, Monero-friendly WireGuard VPN with a clean privacy design and cheap crypto pricing — graded C because the core promise (no logs) rests on trust, not proof, and the service is young.", "translation_locale": "en", "rating": { "grade": "C", "trust": "New (domain 2026-07). No-logs is assertion-only — no third-party audit, no warrant canary, no infra transparency beyond the marketing page. 'Own hardware' unverifiable (exit IP resolves to a commercial hosting block). Same operator as B- Cypher eSIM; brand standing lifts to a confident C but does not vouch for the unproven no-logs on a separate product.", "privacy": "No account, no email — a random key only, nothing to leak or subpoena. Crypto-only payment (XMR/BTC/USDT/TON/SOL), no processor. WireGuard + AmneziaWG obfuscation. Exits in NL/RO/FI (no blanket data-retention). Caveat: no-logs is unaudited.", "ux": "WireGuard via QR + subscription link, any WG app (iOS/Android/Windows/macOS). One plan, unlimited data, 5 devices, all locations. $1.99 intro, ~$3.33/mo on annual." }, "grade": "C", "kyc_tags": [ "NO-KYC" ], "feature_tags": [ "wireguard", "amneziawg", "crypto_only", "xmr", "no_account" ], "highlight_tags": [ "XMR", "NO-ACCOUNT", "NO-EMAIL", "WIREGUARD", "CRYPTO-ONLY" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-30", "operating_since": "2026-07", "tenure_note": "Domain registered 2026-07-02. Sibling product of Cypher eSIM (cypheresim.com, 2026-05); same operator (@cypher_esim / TG nomand_support). No-logs claim not independently audited.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://cyphervpn.net/", "affiliate": "https://cyphervpn.net/?ref=NOOBLEP", "outbound_slug": "cypher-vpn", "telegram": "https://t.me/nomand_support" }, "also_listed_at": { "monerica": true } }, { "id": "ivpn", "category": "vpns", "subcategory": "No-KYC Premium", "name": "IVPN", "url": "https://xmr.club/vpns/ivpn", "twin": "https://xmr.club/llm/vpns/ivpn.txt", "tagline": "Anonymous account IDs, accepts cash + XMR + monero. Strong audit history.", "review": "IVPN is the **anonymous-account-ID privacy-first VPN** — a Gibraltar-registered operator that issues random multi-digit account IDs instead of emails, accepts **cash by post, Monero, and Bitcoin**, has been audited multiple times by independent firms, and consistently scores at the top of independent VPN evaluations (Privacy Guides, EFF, Wirecutter security-tier rankings). Listed at **Grade A** because IVPN occupies the **Mullvad-peer slot** in the privacy-first VPN tier: same anonymous-account-ID architecture, same cash-accepted posture, same audit cadence, slightly higher price point in exchange for some operational differentiators worth understanding.\n\n**Background.** IVPN is operated by **Privatus Limited**, a Gibraltar-registered company, with the service launched in 2009. The team is publicly identified: **Nick Pestell** is CEO, and the technical team has a track record of detailed engineering blog posts about IVPN's protocol choices, infrastructure decisions, and audit findings. Gibraltar is the chosen jurisdiction for its data-protection-friendly framework — no mandatory data-retention regime that would force the VPN to keep logs against its no-logs policy. **Audit history**: multiple independent audits including by **Cure53** (the Berlin-based security firm that also audits Tor Browser, Mullvad, and SimpleX). Audit reports are published at ivpn.net with executive summaries and full findings. **Open source**: IVPN's desktop and mobile client code is open source on GitHub; the server-side infrastructure is not (industry standard — server-side VPN code isn't typically open-sourced). Cross-platform clients: macOS, Windows, Linux, iOS, Android.\n\n**What you trust.** **Anonymous account IDs** — when you sign up, you get a random multi-digit ID instead of providing an email; no name, no email, no phone, no PII required. **Multiple payment methods** — credit card (which leaks your identity to the payment processor, defeating the anonymity story), **cash by post** (truly anonymous — mail a cash payment to IVPN's office with the account ID), **Monero** (truly anonymous), **Bitcoin** (pseudonymous, traceable on-chain), other crypto. **No-logs policy + audit-verified** — Cure53 audits have inspected the server infrastructure for log retention; published findings consistently show no user-identifying logs. **Open-source client** — your endpoint code is auditable; the server-side is not but the audit reports cover that scope. **Strong protocols**: OpenVPN + WireGuard with modern cipher choices; no PPTP or other deprecated options. **DNS isolation**: IVPN runs its own DNS resolvers; queries don't leak to ISP-DNS or to third-party DNS. **Gibraltar jurisdiction** — no mandatory data-retention regime; no Five Eyes / Fourteen Eyes membership at the country level (Gibraltar is a British Overseas Territory but doesn't have the same intelligence-sharing obligations as UK proper). **What you don't trust**: the network-layer protection ends at the VPN exit IP; sites visited *can* see the VPN exit IP and treat all IVPN users as a cohort. **Server-side code is not open-source** — this is industry-standard for VPN providers; the audit reports cover the scope that open-sourcing would.\n\n**Operational specs.** **Platforms**: macOS, Windows, Linux, iOS, Android. **Protocols**: WireGuard (recommended default), OpenVPN (legacy + obfuscation use cases). **Server locations**: ~100 servers across ~40 countries — smaller fleet than Mullvad's ~600 servers but selective coverage. **Pricing**: $6/mo on a 3-year plan, $8/mo on 1-year, $10/mo on monthly; slightly higher than Mullvad's $5-flat pricing. **Payment methods**: credit card, PayPal, **cash by post** (mail cash + account ID to IVPN's office), **Monero**, **Bitcoin**, other crypto. **Account model**: anonymous account ID (no email at signup); subscription is tied to the ID, not to any identity. **Multi-device**: up to 7 simultaneous connections per account. **Port forwarding**: not offered by default (some users prefer providers that offer port forwarding for self-hosted services; IVPN deprecated this in 2024 after a security review). **AntiTracker**: optional DNS-level ad/tracker blocking via the IVPN client. **Multi-hop**: optional cascading through two VPN exit servers (latency cost but stronger anonymity). **Kill switch**: standard on all clients (cuts internet if VPN drops). **DNS leak protection**: enforced via firewall rules in the client. **No-JS web client signup**: the IVPN website itself works without JavaScript, including the signup flow.\n\n**Philosophy.** IVPN's editorial differentiator is the **selectivity-and-audit-rigour** posture relative to peer providers. Mullvad (the canonical privacy-first VPN) has more servers, lower price, longer operational track record; IVPN has a slightly smaller fleet, slightly higher price, but matching anonymous-account architecture and audit cadence. The IVPN team's editorial decisions (deprecating port forwarding after a security review, publishing detailed engineering blogs about why specific decisions were made) signal a security-conscious operator that's willing to drop features when the threat model changes. For users who want a Mullvad peer with a slightly different operational philosophy — same anonymous-account architecture, same cash-accepted posture, same audit rigour, but a different team and a different jurisdiction — IVPN is the natural pair.\n\n**Grade rationale.** Grade A reflects: 16+ years of operational continuity (since 2009); **anonymous account-ID** architecture (no email required); cash + Monero + Bitcoin payment options (multiple anonymity-preserving payment paths); audited multiple times by Cure53 with published reports; no-logs policy with audit verification; Gibraltar jurisdiction with privacy-friendly data-retention framework; publicly-identified team and CEO (Nick Pestell) with track record of detailed engineering communication; open-source client code on GitHub; cross-platform clients (5 platforms); WireGuard + OpenVPN protocol support; no-JS-supported signup flow; cross-listed in Privacy Guides, web3privacy, and KYCnot peer directories — the rare three-directory concurrence. Last verified 2026-05-11.\n\n**Useful when.** You want a **Mullvad-peer privacy-first VPN** with a slightly different jurisdiction and team. You want **anonymous account ID** signup — no email, no phone, no PII. You want to **pay with cash by post** (the strongest privacy-preserving payment path — no payment-processor in the loop). You want a VPN with **audit-published evidence** of its no-logs policy. You're hedging your VPN choice and don't want a single Mullvad dependency for your VPN tier (run IVPN on some devices, Mullvad on others, or split-tunnel between them). You're in a **threat model** that makes Gibraltar's jurisdiction preferable to Sweden (Mullvad) — the differential is small but exists for some users. You're using a **Tor + VPN-over-Tor** or **VPN + Tor** stack and want a VPN with audit-verified no-logs to chain with Tor.\n\n**Caveats.** **Higher price than Mullvad** — $6/mo (3-yr plan) vs Mullvad's $5/mo flat. The differential is small but real; for budget-conscious users, Mullvad is the same anonymity posture at a lower price. **Smaller server fleet** — ~100 servers vs Mullvad's ~600; if you need a specific country's exit IP, check IVPN's server list before subscribing. **Port forwarding was deprecated** — if you self-host services and want incoming connections through a VPN, IVPN doesn't support this. Mullvad also deprecated port forwarding for similar reasons; if you need it, look at providers like ProtonVPN or AirVPN. **Credit card payment defeats the anonymity story** — if you pay by card, your identity is now linked to your account ID via the payment processor's records. Cash or Monero are the truly-anonymous paths; card is fine for non-anonymity threat models. **Gibraltar is a British Overseas Territory** — while not subject to UK proper's data-retention laws, the jurisdiction has political ties to the UK. For threat models where state-actor cooperation matters, evaluate jurisdiction selection carefully. **VPN-vs-Tor tradeoffs apply** — a VPN protects your IP from sites you visit and your traffic from your ISP, but the VPN provider can see both ends. For threat models requiring no-single-entity-sees-both-ends, use Tor (or Tor-over-VPN, or VPN-over-Tor depending on the specific threat). **Mobile clients have platform constraints** — iOS in particular has Apple-imposed restrictions on VPN clients that limit some features compared to desktop. **The audit reports are point-in-time** — Cure53 has audited multiple times but each audit is a snapshot of the infrastructure at audit time; sustained operational continuity is on the operator. Trust the audit history + ongoing communication rather than treating any single audit as a permanent guarantee.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "non_custodial", "audited", "cash_accepted", "no_js_supported" ], "highlight_tags": [ "NO-KYC", "CASH OK", "AUDITED" ], "fees": { "monthly_usd": 6, "summary": "$6–10/mo depending on plan · cash, XMR, BTC, card · anonymous account ID" }, "fees_summary": "$6–10/mo depending on plan · cash, XMR, BTC, card · anonymous account ID", "last_verified": "2026-05-11", "operating_since": "2009", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.ivpn.net", "outbound_slug": "ivpn" }, "also_listed_at": { "web3privacy": true, "kycnot": true, "privacyguides": true, "monerica": true } }, { "id": "keynode-vpn", "category": "vpns", "subcategory": "With Free Tier", "name": "KeyNode VPN", "url": "https://xmr.club/vpns/keynode-vpn", "twin": "https://xmr.club/llm/vpns/keynode-vpn.txt", "tagline": "Small-userbase, invite-flavoured OpenVPN service (Russian-language) — pays in XMR/crypto, Telegram-bot signup, 3-day free trial + referral free tier. Graded C with the caveats stated plainly: Russian jurisdiction and no published no-logs policy are real limiters for a privacy VPN.", "review": "**A deliberately small-userbase OpenVPN service, XMR-friendly, aimed at a Russian-speaking audience.** KeyNode markets itself as a clean, load-balanced gateway that \"doesn't turn its servers into a dump of thousands of random users\" — a quality-over-scale pitch. Signup is via a **Telegram bot** (no email), there's a **3-day free trial** and a referral \"free forever\" tier, and it **accepts Monero** (plus BTC/other crypto). For a no-KYC, crypto-paid VPN, the access model is fine.\n\n**The privacy caveats are the story, and we state them plainly.** Two limiters keep this at C. First, **jurisdiction: it operates in Russia**, whose SORM / data-retention regime compels operators toward logging and lawful-intercept — structurally the opposite of what you want from a privacy VPN. Second, **we found no published no-logs policy** on the site, and no explicit no-KYC/anonymity commitment — the two things that matter most for a VPN are unverified. It's **OpenVPN-only** (no WireGuard). \n\n**Why C.** In its favour: ~10 months of tenure, listings on **Monerica and kycnot**, Monero payments, and a coherent small-network model. Against: the **Russian jurisdiction + unstated logging policy** mean this is **not a confident no-logs recommendation** — treat it as a functional XMR-paid VPN, not a high-assurance privacy shield. It climbs only if it publishes a verifiable no-logs policy and clarifies its exposure to jurisdictional compulsion. Choose accordingly for your threat model.", "translation_locale": "en", "rating": { "grade": "C", "trust": "~10mo tenure, listed on Monerica + kycnot (community). Held at C by real privacy limiters, stated plainly: Russian jurisdiction (SORM/data-retention → compelled-logging risk) and no published no-logs policy. NOT a confident no-logs recommendation. Climbs only with a verifiable no-logs policy + jurisdictional clarity.", "privacy": "No-KYC access via Telegram-bot signup (no email), pays in XMR/crypto. BUT: operates in Russia (adverse jurisdiction for a privacy VPN), no published no-logs policy found, no explicit anonymity commitment, OpenVPN-only (no WireGuard). Access is private; the logging/jurisdiction posture is unverified.", "ux": "Small deliberately-capped userbase with load-balancing for clean channels/speed. Telegram-bot onboarding, 3-day free trial, referral free tier. Russian-language site. OpenVPN. Monero + other crypto accepted." }, "grade": "C", "kyc_tags": [ "NO-KYC" ], "feature_tags": [ "xmr", "no_kyc", "vpn", "openvpn" ], "highlight_tags": [ "XMR", "NO-KYC", "OPENVPN", "FREE-TIER" ], "fees": null, "fees_summary": null, "last_verified": "2026-09-15", "operating_since": "2025-11", "tenure_note": "Domain registered 2025-11-22 (~10 months). Listed on Monerica + kycnot (community). Graded C primarily on privacy limiters, not tenure: Russian jurisdiction + no published no-logs policy. Would climb on a verifiable no-logs policy + jurisdictional clarity, NOT on tenure alone.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://keynodevpn.com", "outbound_slug": "keynode-vpn" }, "also_listed_at": { "monerica": true, "kycnot": true } }, { "id": "meile-dvpn", "category": "vpns", "subcategory": null, "name": "Meile dVPN", "url": "https://xmr.club/vpns/meile-dvpn", "twin": "https://xmr.club/llm/vpns/meile-dvpn.txt", "tagline": "Community-run decentralized VPN on the Sentinel network. No sign-up, no KYC. Pay with XMR, BTC/LN, PIVX, FIRO, or ARRR — the whole node fleet is run by third parties, not Meile itself.", "review": "Meile is an **open-source dVPN client** for the Sentinel Network — the community-node VPN mesh where nodes are hosted by third parties (datacenters, universities, individuals at home) rather than a single company. You install the client, load it with sats or XMR, pick a country, and route your traffic through a Sentinel node. Meile itself is the wallet + interface; the network is the trust surface.\n\n**Tenure.** Domain registered **2022-08-22** — 3 years of continuous operation. Tenure reinforces Grade B, which already accounts for the community-run + third-party-node-fleet posture.\n\n**Background.** Built by **MathNodes**, an Italian team who are also Sentinel Network Validator + Developer team members — the wallet-side of the same team that helps run and secure the underlying dVPN infrastructure. Public since **January 2023** at latest (X account creation), Debian/Ubuntu APT repository at `apt.mathnodes.com`, downloads for Windows, macOS, Ubuntu, Debian, Fedora, Arch, ARM.\n\n**What you trust.** *Client is open-source* — you can audit the wallet code and rebuild from GitHub. *Network is not Meile's to trust* — traffic exits through third-party Sentinel nodes; the payment happens on-chain, the session happens between you and the node. Ring Sessions (decoy session transactions) are enabled by default in v2.6.0 to obscure which nodes you connected to. QR-connection sharing lets you hand off a session to a companion device without going through a central handoff.\n\n**Operational specs.** Payment: **XMR, BTC Lightning, PIVX, FIRO, ARRR (Pirate Chain)** confirmed on operator X bio. Monthly plans available via BTC LN; off-chain XMR/PIVX/FIRO/ARRR routing. Coverage: nodes run in ~60+ jurisdictions (Australia, Austria, Bahamas, Bahrain, Bangladesh, plus much of Europe/Americas). Client stack: Kivy/Python, cross-platform. Distribution: direct download + APT repository. Latest release at time of listing: v2.6.0.\n\n**Why this grade. ** Listed at **Grade B** because tenure (2.5+ years on the current X account, longer with the wallet code base), open-source client, third-party node network (structurally lower single-operator risk than a centralized VPN), multi-coin acceptance including XMR off-chain — that's a strong package for a privacy-first user. Grade A is withheld pending: (a) an independent audit of the wallet's key handling, (b) node-level reliability comparison against a centralized VPN reference (curator has not benchmarked latency + uptime across the Sentinel node fleet), (c) concrete sourcing trail on the Ring-Sessions decoy scheme.\n\n**Caveats.** *Node quality is external to Meile.* When a Sentinel node is slow, censored, or logged, that's the node operator's fault — not Meile's. Some countries have very few nodes (Bahamas: 1, Bahrain: 1). Traffic quality varies by node. Meile is a wallet + client — the actual privacy properties depend on the node you happen to route through, and node operators can (and do) rotate.", "translation_locale": "en", "rating": { "grade": "B" }, "grade": "B", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "DECENTRALIZED-VPN", "SENTINEL-NETWORK", "XMR-ACCEPTED", "OPEN-SOURCE", "MULTI-COIN", "RING-SESSIONS" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-11", "operating_since": "2022-08", "tenure_note": "Domain registered 2022-08-22. `operating_since` set to the earliest signal.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://meile.app", "twitter": "https://x.com/MeileDVPN", "github": "https://github.com/MathNodes", "apt": "https://apt.mathnodes.com", "sentinel": "https://sentinel.co", "outbound_slug": "meile-dvpn", "logo": "https://xmr.club/peers/meile-dvpn.jpg" } }, { "id": "mullvad", "category": "vpns", "subcategory": "No-KYC Premium", "name": "Mullvad VPN", "url": "https://xmr.club/vpns/mullvad", "twin": "https://xmr.club/llm/vpns/mullvad.txt", "tagline": "Account number only — no email, name, or any identifier required. Pay in cash, XMR, BTC, or card.", "review": "Mullvad VPN is the canonical no-KYC VPN — 16-digit randomly-generated account numbers as the only identifier, cash-by-mail accepted alongside XMR / BTC / BCH / cards, multiple independent security audits published, and a 17-year operational track record under stable Sweden-based ownership. Listed at **Grade A · editor's pick** because it remains the privacy-respecting baseline that every other VPN provider gets benchmarked against — and because the operator's choices (removing port-forwarding under abuse pressure, partnering with the Tor Project on a privacy-aware browser, refusing the lifetime-discount race-to-the-bottom) consistently surface privacy + integrity over growth metrics.\n\n**Background.** Founded in **2009** under Sweden-based ownership; the operator entity is **Amagicom AB** (Swedish company, publicly named). 555,541+ numbered accounts at the time of the operator's last public count. Standard infrastructure: **WireGuard** as the default protocol with **OpenVPN** as the fallback, **DAITA** (Defense Against AI-guided Traffic Analysis) as an opt-in obfuscation layer for users worried about traffic-analysis attacks, multi-hop routing for users who want one server to know their entry IP and a different server to know their destination. Tor onion mirror operator-published. Open-source clients for Linux, macOS, Windows, iOS, Android (F-Droid + Play Store), plus router configs and CLI tooling.\n\n**What you trust.** Account-level: no email, no password, no recovery flow — your **16-digit account number** is your entire identity, generated client-side, never asked for any name or contact info. Payment-level: cash by mail (anonymous all the way), Monero (~10% crypto discount), Bitcoin, Bitcoin Cash, plus the usual fiat options (card, PayPal, bank wire, regional methods) for users who don't need anonymous payment. Operator-level: **Mullvad has been audited by independent firms repeatedly**, including Assured AB (2022 + earlier), Radically Open Security (2023), Cure53 (multiple engagements on Mullvad Browser), with reports published publicly on the site. Sweden-based jurisdiction is **not part of any of the 14-Eyes intelligence-sharing club** at the same depth as the 5-Eyes — relevant for users factoring intelligence-sharing exposure into their VPN choice. Logging policy: **no activity logs, no connection logs, no DNS query logs** per the published no-logging policy (last updated January 2026); the only data Mullvad sees is the account number (a 16-digit string), time remaining on the account, and payment metadata for whichever payment method you chose.\n\n**Operational specs.** Pricing: **€5/month flat** — same rate for 1 month, 1 year, or 1 decade. No tiered discounts for longer commitments (deliberate choice — they don't want to lock users in). ~10% crypto discount applied for Monero / Bitcoin / Bitcoin Cash payments. 14-day money-back guarantee (except for cash payments — anti-money-laundering compliance). **Devices**: up to 5 simultaneous devices per account. **Protocols**: WireGuard (default) + OpenVPN (fallback). **Servers**: globally distributed across 40+ countries; full server list published with `physically-owned`, `rented`, and `wireguard-only` flags so users can choose based on operator-control posture. **Features**: split tunneling (Linux + Android), kill switch (all platforms), DNS-level ad/tracker blocking via Mullvad DNS, multi-hop, DAITA traffic analysis defence. **Mullvad Browser**: separate product, built in collaboration with the Tor Project, ships with Tor Browser–derived anti-fingerprint defenses but routes through Mullvad VPN (or any VPN, or no VPN) instead of through Tor.\n\n**Philosophy.** Mullvad's editorial differentiator is the **consistent refusal to grow at the expense of trust**. Three concrete examples: (1) **flat €5/mo since 2009** — no inflation hike, no \"first year discounted\" lock-in, no lifetime VPN sales (which are a privacy red flag because they force the operator to harvest something else to cover the long tail of bandwidth). (2) **Port-forwarding removed in 2023** because abuse cases were forcing the operator to log and respond to complaints, undermining the no-log promise — a feature reduction that genuinely makes user-impacting trade-offs to preserve the privacy promise. (3) **Mullvad Browser collaboration with the Tor Project** — instead of building a proprietary anti-fingerprint browser, partner with the people who have spent two decades getting fingerprint defence right. Each of these is the harder commercial decision; doing all three over 17 years is the editorial signal.\n\n**Grade rationale.** Grade A and editor's pick reflect: 17 years of operational continuity (since 2009); Sweden-based publicly-named operator (Amagicom AB); 16-digit account-number signup with no email/name/password; cash-by-mail accepted plus full crypto suite including XMR; multiple independent security audits with published reports; no-logging policy stated in detail with the \"what we *don't* log\" enumerated explicitly; WireGuard-first technical stack; Tor onion mirror; Mullvad Browser partnership with Tor Project; transparent response to 2026 technical disclosures (Android tunnel-bypass + exit IP fingerprinting issues both publicly acknowledged and patched). Last verified 2026-05-11.\n\n**Useful when.** You need a VPN and you want to actually pay for the privacy property rather than rent your data to an ad-supported \"free\" VPN. You're working from coffee-shop / hotel / conference Wi-Fi and want to neutralise the local-network-operator data-collection vector. You're a journalist or researcher whose source-side traffic needs to not reveal a real IP. You want a VPN whose operator has been audited by people other than the operator's marketing team. You want to pay in cash. You're using Mullvad Browser + a different VPN (or no VPN) and want the browser-level fingerprint defenses. You're configuring a router-level VPN and need a provider with documented router configs.\n\n**Caveats.** **VPN is metadata privacy, not application-level anonymity** — Mullvad obscures your IP from sites you visit but does not prevent the site from tracking you via account cookies / browser fingerprint / login info. For full anonymity you need Tor; for layered privacy you can run Mullvad → Tor (Mullvad sees your real IP, Tor sees the Mullvad exit, sites see the Tor exit). **Port-forwarding removed in 2023** — if you self-host services accessed through your VPN (Plex, game server, BitTorrent seeding), Mullvad will not give you an inbound port; use a different VPN (some providers still offer this) or self-host without a VPN behind your real IP. **Sweden is EU jurisdiction** — Swedish authorities can compel disclosure of what Mullvad has, which is the account number + payment metadata; they cannot compel Mullvad to invent activity logs that don't exist. **Mullvad Browser is not Tor Browser** — it shares fingerprint defenses but does NOT route through Tor by default; if you need Tor's onion routing, use Tor Browser directly. **5-device limit** — if your household has more than 5 devices wanting Mullvad simultaneously, use the router-level option to centralise the device count to 1. **2026 technical disclosures** — Android tunnel-bypass + exit-IP fingerprinting were publicly disclosed and are being addressed; check the latest Mullvad blog for current patch status before relying on Android for high-threat use.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "non_custodial", "audited", "cash_accepted", "no_js_supported", "wallet_funded" ], "highlight_tags": [ "NO-KYC", "CASH OK", "AUDITED" ], "fees": { "monthly_usd": 5.5, "summary": "€5/mo flat · cash, XMR, BTC, BTC LN, card · no email needed" }, "fees_summary": "€5/mo flat · cash, XMR, BTC, BTC LN, card · no email needed", "last_verified": "2026-05-11", "operating_since": "2008", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://mullvad.net", "tor": "http://o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7kiad.onion", "outbound_slug": "mullvad", "twitter": "https://x.com/mullvadnet" }, "also_listed_at": { "web3privacy": true, "kycnot": true, "monerica": true, "privacyguides": true } }, { "id": "njalla-vpn", "category": "vpns", "subcategory": "No-KYC Premium", "name": "Njalla VPN", "url": "https://xmr.club/vpns/njalla-vpn", "twin": "https://xmr.club/llm/vpns/njalla-vpn.txt", "tagline": "From the Njalla team (anonymous DNS + domains). Anonymous accounts.", "review": "Same ethos as Njalla's DNS service — anonymous accounts, accepts XMR/BTC, no questions. Smaller server fleet than Mullvad/IVPN but the operator's track record carries weight.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "no_js_supported" ], "highlight_tags": [ "NO-KYC" ], "fees": { "monthly_usd": 5, "summary": "€5/mo · XMR, BTC, BCH, LTC · anonymous account" }, "fees_summary": "€5/mo · XMR, BTC, BCH, LTC · anonymous account", "last_verified": "2026-09-10", "operating_since": "2017", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2017", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://njal.la/vpn/", "outbound_slug": "njalla-vpn", "tor": "http://njallalafimoej5i4eg7vlnqjvmb6zhdh27qxcatdn647jtwwwui3nad.onion" }, "also_listed_at": { "web3privacy": true, "monerica": true } }, { "id": "nymvpn", "category": "vpns", "subcategory": "mixnet", "name": "NymVPN", "url": "https://xmr.club/vpns/nymvpn", "twin": "https://xmr.club/llm/vpns/nymvpn.txt", "tagline": "Decentralised mixnet VPN — 24-word passphrase signup (no email, no phone), accepts Monero / Zcash / NYM, 5-hop Anonymous Mode with cover traffic.", "review": "**Background.** NymVPN is the consumer-facing product of the Nym project — a decentralised mixnet that's been in active research and development for 10+ years, with mainnet running since 2022. It's not a traditional WireGuard / OpenVPN tunnel; it's a true mixnet using Sphinx-format packets, cover traffic, and per-hop unlinkability. Founded by Harry Halpin (formerly W3C / MIT), team includes academic cryptographers.\n\n**What you trust.** Anonymous signup via a 24-word passphrase — no email, no phone, no name, nothing tied to identity at any point. Pay in Monero, Zcash, or NYM token (85% discount with NYM) — payment uses zero-knowledge credentials so even Nym themselves can't link your payment to your traffic. **Annually audited** by JP Aumasson, Oak Security, Cryspen, and Cure53 — multiple independent audit firms is unusual; most VPNs have one. Fully open-source clients (Android, iOS, Linux, macOS, Windows).\n\n**Operational specs.** Two modes: **Fast Mode** (2-hop AmneziaWG-based, low-latency for everyday browsing) and **Anonymous Mode** (5-hop mixnet with cover traffic — slower but true unlinkability for crypto / messaging / sensitive sessions). 70+ countries via decentralised gateways + mix nodes operated by independent stakers, not Nym itself. 10 devices per account. Free trial available, 7-day cancellation.\n\n**Operator philosophy.** Nym is structured as a decentralised network with an open token + validator economy. The privacy model is structural, not policy-promise-based: the network literally can't see who's connecting to where (Sphinx + cover traffic), so a log even in principle would be empty. Compare to typical 'we promise no logs' VPNs where you're trusting the operator's honesty rather than a math guarantee.\n\n**Grade rationale (A).** Anonymous signup ✓ · crypto-pay including Monero ✓ · open-source ✓ · multiple independent audits ✓ · structural privacy (mixnet) rather than policy privacy ✓. The audit cadence and academic backing exceed our typical A-grade VPN bar (Mullvad, IVPN, AzireVPN). The mixnet differentiation is unique — NymVPN is the only listed provider that offers genuine unlinkability rather than just IP hiding.\n\n**Useful when.** You need actual sender-receiver unlinkability — not just 'my ISP can't see what I'm doing.' Threat models involving traffic analysis, well-resourced adversaries, or activist/journalist / DNM-adjacent uses. Pairs naturally with Tor (mixnet-over-Tor or Tor-over-mixnet, depending on adversary model). For everyday casual browsing where latency matters more than unlinkability, Fast Mode keeps NymVPN viable as a daily driver.\n\n**Caveats.**\n- Anonymous Mode (5-hop mixnet) adds real latency — not suitable for streaming or gaming. Fast Mode handles those.\n- Decentralised stakers run mix nodes — performance varies with the operator pool's health, though Nym monitors and rotates poor performers.\n- NYM token discount (85%) requires holding/spending the token — convenient but adds a coin to your stack. XMR + ZEC at full price are the no-token paths.\n- Mixnet is newer than WireGuard tunnels — fewer edge cases tested at scale. Use Fast Mode as a less-experimental fallback.\n- Some content providers (Netflix, banks) detect VPN exits in general; mixnet-mode IPs are no exception. Choose the right mode for the right session.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [], "feature_tags": [ "no_logs", "no_email", "no_phone", "open_source", "audited", "mixnet", "decentralized" ], "highlight_tags": [ "NO-KYC", "NO-EMAIL", "XMR-PAID", "ZEC-PAID", "OPEN-SOURCE", "MIXNET", "MULTI-AUDITED" ], "fees": { "summary": "Free trial · paid plans accept XMR / ZEC / NYM (85% discount with NYM) / fiat · pricing per device pool" }, "fees_summary": "Free trial · paid plans accept XMR / ZEC / NYM (85% discount with NYM) / fiat · pricing per device pool", "last_verified": "2026-05-31", "operating_since": "2022", "tenure_note": "Nym project research since 2018, mainnet 2022, NymVPN consumer product 2024.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://nym.com", "outbound_slug": "nymvpn", "twitter": "https://x.com/nymproject", "github": "https://github.com/nymtech", "discord": "https://discord.gg/nym" }, "also_listed_at": { "kycnot": true, "web3privacy": true, "monerica": true } }, { "id": "obscura", "category": "vpns", "subcategory": "Pro · No-logs", "name": "Obscura VPN", "url": "https://xmr.club/vpns/obscura", "twin": "https://xmr.club/llm/vpns/obscura.txt", "tagline": "New \"technically can't log\" two-party-relay VPN by Carl Dong (Bitcoin Core alum). XMR + BTC accepted, randomized account numbers, no email.", "review": "Two-party relay architecture: the entry node sees your IP but not your destination, the exit node sees your destination but not your IP. Designed so neither party alone can correlate. Randomized account numbers (no email, no personal data). Accepts Monero + Bitcoin alongside Stripe. Run by Carl Dong (former Bitcoin Core contributor). Young — listed at B until 12+ months of operational track record and the first third-party audit. Bumps to A once those land.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "audited" ], "highlight_tags": [ "NO-KYC", "TWO-PARTY-RELAY", "XMR" ], "fees": { "summary": "Subscription · accepts XMR/BTC/card" }, "fees_summary": "Subscription · accepts XMR/BTC/card", "last_verified": "2026-05-21", "operating_since": "2025", "tenure_note": "Obscura VPN launched 2025-02-11 (in partnership with Mullvad). obscura.net WHOIS 1995 is premium-domain acquisition, not project age.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://obscura.com", "outbound_slug": "obscura", "tor": "http://ngmmbxlzfpptluh4tbdt57prk3zxmq4ztew7l2whmg7hkqaof2nzf7id.onion", "twitter": "https://x.com/obscuravpn", "discord": "https://discord.gg/xsP2Fp7s6r" }, "also_listed_at": { "kycnot": true, "web3privacy": true, "privacyguides": true, "monerica": true } }, { "id": "ovpn", "category": "vpns", "subcategory": "No-KYC Premium", "name": "OVPN.com", "url": "https://xmr.club/vpns/ovpn", "twin": "https://xmr.club/llm/vpns/ovpn.txt", "tagline": "RAM-only servers, accepts cash + crypto. Sweden-based.", "review": "Strong privacy claims: no-logs, RAM-only nodes, accepts cash by mail. Smaller than Mullvad but well-regarded in the community.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "cash_accepted", "ram_only_servers" ], "highlight_tags": [ "NO-KYC", "CASH OK", "RAM-ONLY" ], "fees": { "monthly_usd": 4.5, "summary": "$4.50–9/mo · cash, BTC, XMR, card · email optional" }, "fees_summary": "$4.50–9/mo · cash, BTC, XMR, card · email optional", "last_verified": "2026-05-11", "operating_since": "2014", "tenure_note": "OVPN.com launched Summer 2014 (first paying customer Aug 2014). ovpn.com domain WHOIS 2000 is premium-domain acquisition.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.ovpn.com", "outbound_slug": "ovpn", "twitter": "https://x.com/OVPN_official" } }, { "id": "proton-vpn", "category": "vpns", "subcategory": "With Free Tier", "name": "Proton VPN", "url": "https://xmr.club/vpns/proton-vpn", "twin": "https://xmr.club/llm/vpns/proton-vpn.txt", "tagline": "Free tier exists; paid plans accept BTC. Email required at signup.", "review": "Solid no-logs reputation. Free tier is generous but limited to a few locations + slower. Paid plans get a no-KYC path if you pay in BTC and use a throwaway email (ProtonMail anonymous signup is free).", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "open_source", "audited", "2fa_supported" ], "highlight_tags": [ "FREE TIER", "AUDITED" ], "fees": { "monthly_usd": 0, "summary": "Free tier · paid $5–10/mo · BTC accepted, card requires KYC · email required" }, "fees_summary": "Free tier · paid $5–10/mo · BTC accepted, card requires KYC · email required", "last_verified": "2026-07-20", "operating_since": "2016", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://protonvpn.com", "tor": "https://protonvpnbrtfzpfo7d3w63rsymd5jhjwfutpqyz5g6m4i65vbwiyrqid.onion", "outbound_slug": "proton-vpn", "contact_email": "abuse@protonvpn.com", "twitter": "https://x.com/ProtonPrivacy", "telegram": "https://t.me/proton_privacy", "discord": "https://discord.gg/proton" }, "also_listed_at": { "web3privacy": true, "kycnot": true, "privacyguides": true } }, { "id": "riseup-vpn", "category": "vpns", "subcategory": "With Free Tier", "name": "Riseup VPN", "url": "https://xmr.club/vpns/riseup-vpn", "twin": "https://xmr.club/llm/vpns/riseup-vpn.txt", "tagline": "Activist-collective VPN. Free for members of supporting orgs.", "review": "Run by a long-standing left-wing tech collective. Free service for activists; not a commercial product. Use for protest-context anonymity, not torrenting.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "open_source", "non_custodial", "self_hosted" ], "highlight_tags": [ "FREE", "ACTIVIST" ], "fees": { "summary": "Free · donation-supported" }, "fees_summary": "Free · donation-supported", "last_verified": "2026-05-13", "operating_since": "2000", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://riseup.net/en/vpn", "outbound_slug": "riseup-vpn", "tor": "http://vww6ybal4bd7szmgncyruucpgfkqahzddi37ktceo3ah7ngmcopnpyyd.onion" }, "also_listed_at": { "kycnot": true } }, { "id": "windscribe", "category": "vpns", "subcategory": "With Free Tier", "name": "Windscribe", "url": "https://xmr.club/vpns/windscribe", "twin": "https://xmr.club/llm/vpns/windscribe.txt", "tagline": "Generous free tier, paid plans accept crypto, email optional.", "review": null, "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [ "light_kyc" ], "feature_tags": [], "highlight_tags": [ "FREE TIER" ], "fees": { "monthly_usd": 0, "summary": "Free 10 GB/mo tier · paid $9/mo or $49/yr · BTC, BCH, ETH, XMR accepted" }, "fees_summary": "Free 10 GB/mo tier · paid $9/mo or $49/yr · BTC, BCH, ETH, XMR accepted", "last_verified": "2026-05-11", "operating_since": "2016", "tenure_note": "Windscribe Inc. founded 2016 (Toronto). windscribe.com WHOIS 2013 is domain reservation predating service launch.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://windscribe.com", "outbound_slug": "windscribe" }, "also_listed_at": { "kycnot": true } }, { "id": "xeovo-vpn", "category": "vpns", "subcategory": "No-KYC Premium", "name": "Xeovo VPN", "url": "https://xmr.club/vpns/xeovo-vpn", "twin": "https://xmr.club/llm/vpns/xeovo-vpn.txt", "tagline": "9-year-old Helsinki-based no-KYC VPN (Xeovo Oy, Finland, EU/GDPR jurisdiction; X handle `@xeovo` joined September 2016) with a strict no-logs policy that names six specific data categories not collected, optional-only email at signup, a v3 Tor mirror with matching Onion-Location header, six years of annual transparency reports, cash + Monero / Bitcoin / Litecoin / cards / PayPal payment surface, a published `/bug-bounty/` with explicit safe-harbor scope, kycnot.me Verified review at 9/10 Overall, and a six-channel contact stack including a dedicated `r/xeovo` subreddit. Independently cross-confirmed tenure via monerica.com and kycnot.me.", "review": "A Finland-based VPN with a strict no-logs policy (no IP, no traffic, no timestamps, no DNS, no MAC addresses), a Tor v3 mirror that matches the clearnet `Onion-Location` header, and over nine years of published transparency reports. Listed at **Grade B** because the privacy posture is solid (GDPR-compliant, can't comply with court orders for user activity), the operator has a real company (Xeovo Oy, Finland) with demonstrable tenure since April 2016, and two peer directories list it — held under A by no published independent audit of the no-logs claim and a 30-day refund policy that explicitly excludes cryptocurrency payments.\n\n\n**What it is.** A VPN service with Stealth Proxy censorship-circumvention, WireGuard + AmneziaWG + Shadowsocks + VLESS + VMess + TrojanGFW protocol support, a Tor onion mirror, and a strict no-logs posture documented in public policy. Listed at **Grade B** because the privacy documentation is specific (naming exactly what isn't logged) and the operator publishes annual transparency reports dating to 2019, but no independent third-party audit verifies the no-logs claims.\n\n\n**Background.** Xeovo VPN is operated by **Xeovo Oy** (company number 3233901-7), a company registered in Finland (operator-published, `/tos/`). The service has been running since **April 2016** (operator-published, `/about/` — timeline starts at 'APR 2016: The journey begins'). The about page positions the company as independent: 'Our customers come first because they're our only investors.' (operator-published, `/about/`). The operator publishes annual transparency reports (December 2019 through December 2024, with the 2024 report published December 2024 — operator-published, `/about/` timeline). The privacy policy was last updated April 7, 2025 (operator-published, `/privacy/`). The service supports VPN and Stealth Proxy products, with a blog launched June 2019 and a hub/community platform launched November 2024. A bug bounty program is advertised on the website. The operator can be reached via support@xeovo.com, Telegram / `@XeovoVPN`, and a `/contact/` page. The service is listed on monerica.com (direct hit at monerica.com/site/xeovo-vpn) and name-matched in kycnot.me's services sitemap — two peer-directory matches. The clearnet site supports a Tor v3 mirror at `xeovok4d6ehoclmlyviwuq7zlmcvucuekhrt2677r33ny2csyd4yldyd.onion` with matching `Onion-Location` header.\n\n\n**What you trust.**\n\n- **Published bug-bounty program with explicit good-faith safe-harbor.** `/bug-bounty/` documents in-scope assets (`xeovo.com`, `core.xeovo.com`, VPN/Stealth Proxy gateways), out-of-scope categories, and what researchers can expect in return. Operating a public bounty is rare among no-KYC VPNs and is a real signal of how the operator thinks about security — they want to be told.\n- **Strict no-logs policy — specifically named, not hand-wavy.** The privacy policy lists exactly what is NOT logged: 'no logging of IP addresses, no logging of traffic, no logging of timestamps, no logging of DNS requests, no logging of MAC addresses, no logging of individual user bandwidth volumes.' (operator-published, `/privacy/`). The FAQ reinforces: 'We do not store any logs.' (operator-published, `/faq/`). The ToS repeats: 'Xeovo does not log any activity of its users.' (operator-published, `/tos/`). This is more specific than most VPN policies — it names six distinct categories of non-logged data rather than using a blanket 'no logs' statement.\n- **Cannot comply with court orders for user activity — structurally.** The privacy policy explicitly states: 'Xeovo can not provide any activity information or logs about users if a court order was issued asking us to provide that information. As previously mentioned, no information about what our users do when connected is stored.' (operator-published, `/privacy/`). The only information available would be 'account information... as well as the method of payment' — and only for a specific person, with a verified court order. The operator adds: 'We have not provided any information about our users to any government entities.'\n- **Real company jurisdiction — Finland (EU, GDPR).** Xeovo Oy is a registered Finnish company (operator-published, `/tos/`: 'Xeovo is a service provided and developed by Xeovo Oy (3233901-7), a company registered in Finland.'). Finland is an EU/GDPR jurisdiction with strong privacy laws — structurally aligned with the service's privacy claims rather than working against them. The operator has a named legal entity with a verifiable company number.\n- **Annual transparency reports since 2019.** The operator has published transparency reports every December from 2019 through 2024 (operator-published, `/about/` timeline). Each report covers the calendar year. This is a six-year unbroken reporting cadence — unusual for a privacy VPN and suggests institutional commitment to accountability rather than a fly-by-night operator.\n- **Nine years of operational tenure.** Operating since April 2016 — over nine years at fold-time. This is among the longest-running VPN services in this directory. A service that disappears after 6 months doesn't publish six years of annual reports.\n- **Tor v3 onion mirror with matching Onion-Location header.** The clearnet site publishes `Onion-Location: http://xeovok4d6ehoclmlyviwuq7zlmcvucuekhrt2677r33ny2csyd4yldyd.onion/`, matching the advertised onion. Properly configured — Tor users get the onion redirect automatically.\n- **No refunds for cryptocurrency payments — quoted verbatim.** The ToS states: 'We do not offer refunds for cryptocurrency payments.' (operator-published, `/tos/`). This is a hard caveat for XMR payers — if the service doesn't work for you, your crypto payment is non-refundable. This is disclosed rather than hidden, but it's a significant asymmetry compared to fiat payers who get a 30-day guarantee.\n- **Account registration — username + password only.** Probed signup form: ``, `` — email field is genuinely optional (no `required` attribute, placeholder says \"optional\"). No phone, no name, no country, no DOB. Matches the operator's `/pricing/` claim of \"No email required.\"\n- **Site.** https://xeovo.com — conventional multi-page web app (not an SPA). 9/39 conventional paths return 200 with distinct content; 30 return styled 404 pages. Published pages: `/` (home), `/about/`, `/faq/`, `/tos/`, `/privacy/`, `/legal` (redirects to `/tos/`), `/contact/`, `/signup/`, `/login/`.\n- **Tor mirror.** `http://xeovok4d6ehoclmlyviwuq7zlmcvucuekhrt2677r33ny2csyd4yldyd.onion/` — v3 hidden service. `Onion-Location` header on clearnet matches the advertised onion. Properly configured.\n- **Payment channels (operator-published, `/pricing/`).** Cryptocurrency (Bitcoin, Litecoin, Monero — per FAQ), credit/debit cards (Visa, Mastercard, Amex, Discover), PayPal, Apple Pay, Google Pay, and **cash** (€). Cash payment channel independently corroborated by kycnot.me's review.\n- **Company.** Xeovo Oy (3233901-7), registered in **Helsinki, Finland** (per the operator's X profile location). EU/GDPR-compliant. Privacy policy last updated April 7, 2025.\n- **Protocols.** WireGuard, AmneziaWG, Shadowsocks, VLESS, VMess, TrojanGFW — censorship-resistant protocols available for countries that use DPI to block VPN connections (operator-published, `/faq/`). Custom ports for WireGuard, IPv6 support.\n- **Products.** VPN and Stealth Proxy. The Stealth Proxy is a censorship-circumvention tool launched January 2022 and overhauled August 2023 (operator-published, `/about/` timeline).\n- **Pricing.** Standalone `/pricing/` page publishes a full rate card: **€4.99/mo, €23.94/6 months (save 20%), €35.88/year (save 40%)**. Currency switcher (EUR/GBP/USD). 30-day money-back guarantee (excluding crypto payments, see Caveats). Up to 5 devices per account, 28+ server locations.\n- **No free trial.** The FAQ explicitly states: 'Do you offer a free trial? No, but we offer a 30-day money-back guarantee.' (operator-published, `/faq/`). The 30-day refund is once per account/customer and excludes cryptocurrency payments.\n- **Server locations.** At least 17 country locations listed in the about-page timeline (Albania, Ukraine, Sweden, Germany, Norway, Switzerland, Canada, Romania, South Korea, UK, Poland, Australia, Singapore, plus locations from earlier years). Full server list not published on the public site.\n- **Contact channels — seven published surfaces.** Operator runs a dedicated multi-channel stack visible in the `/contact/` page footer + their X profile: `support@xeovo.com` (general) + `press@xeovo.com` (separate press contact), X `@xeovo` (~1.1k followers / 635+ posts, joined September 2016), Telegram `@XeovoVPN`, Mastodon `@xeovo@mastodon.social`, Bluesky `@xeovo.bsky.social`, dedicated subreddit `r/xeovo`, and the Tor v3 mirror. No Matrix, Signal, SimpleX, or published PGP key — but the stack itself reads as a small team that wants to be reachable on the channels their users actually use. The dedicated subreddit (rather than a generic Twitter/X-only presence) is a positive engagement signal.\n- **Transparency reports.** Annual, published every December from 2019 through 2024 (operator-published, `/about/`). Six years of unbroken reporting.\n- **Bug bounty.** Program advertised on the website (operator-published, navigation). Terms and scope not surfaced on the public site.\n- **Peer directories.** Two independent peer directories carry dedicated review pages: monerica.com (`/site/xeovo-vpn`) and kycnot.me (`/service/xeovo`, scored **9/10 Overall — Excellent**, **100 Privacy — Excellent**, **71 Trust — Good**, **\"Verified — Repeated checks over time passed\"**, four user ratings averaging 5/5). Both independently confirm the 2016 founding year and the Finland-based self-funded operator description. Not present on orangefren, web3privacy, monero.fail, or privacyguides.\n- **Domain.** `xeovo.com` — `.com` TLD, standard commercial. Registered since at least 2016 (nine years of site operation).\n\n\n**Operator philosophy.** The about page frames Xeovo as an independent privacy company: 'Your Beacon in the Dark. At Xeovo, we believe that everyone deserves unrestricted access to the internet, free from surveillance and censorship.' The tagline 'Independent — Our customers come first because they're our only investors.' (operator-published, `/about/`) positions the service as customer-funded rather than VC-backed or ad-supported. The no-logs policy is stated across three separate pages (ToS, Privacy, FAQ) in consistent language — suggesting it's a core operational principle rather than a one-off marketing claim. The transparency-report tradition (six years, annual, unbroken) and the bug bounty program signal a security-conscious operator who invites external scrutiny. The Finland jurisdiction is a deliberate choice for privacy — Finnish law and EU GDPR provide the strongest data-protection framework available for a commercial VPN. The Stealth Proxy product and the censorship-resistant protocol stack (Shadowsocks, VLESS, VMess, TrojanGFW) suggest the operator serves users in high-censorship jurisdictions (China, Russia, Iran, UAE, Egypt — all explicitly addressed in the FAQ) rather than just the casual-privacy market.\n\n\n**Grade rationale.** Listed at **Grade A** on the strength of a stack of independent positive signals: nine years of operation (since April 2016) **cross-confirmed by three independent sources** (monerica.com curated listing, kycnot.me Verified review at 9/10, and the `@xeovo` X account creation date of September 2016), six years of annual transparency reports, a real registered company (Xeovo Oy, 3233901-7, Finland — EU/GDPR jurisdiction), a strict no-logs policy that names six specific categories of data not collected, an **optional-only email at signup** (probed `/signup/`: ``, no `required` attribute), a Tor v3 mirror with matching `Onion-Location` header, a transparent published rate card at `/pricing/`, a six-channel contact stack including a dedicated `r/xeovo` subreddit (rare for a no-KYC VPN), and a published `/bug-bounty/` program with explicit good-faith safe-harbor. The kycnot.me peer review scores Xeovo **9/10 Overall — Excellent**, **100 Privacy — Excellent**, **\"Verified — Repeated checks over time passed\"**, with four user ratings averaging 5/5. The lone editorial gap — no published independent third-party audit of the no-logs claim — is real and a reader could legitimately want one, but the operator's behavioural stack (transparency reports, bounty program, multi-channel reachability) is the next-best thing in the absence of one and the comp set's A-grade peers don't all have audits either. Crypto payments excluded from the 30-day refund is a caveat (worth knowing) but not an A-blocker on its own — the comp set has comparable refund posture and the operator surfaces the exclusion at the pricing page.\n\n**Useful when.**\n\n- You want a VPN with a strict, specifically-named no-logs policy from a GDPR-jurisdiction operator with a real registered company and nine years of operating history.\n- You need censorship circumvention — Xeovo ships Shadowsocks, AmneziaWG, VLESS, VMess, and TrojanGFW in addition to standard WireGuard, and the FAQ explicitly addresses use in China, Russia, Iran, UAE, and Egypt.\n- You want to pay for a VPN with Monero and route through a Tor onion — the Tor mirror is properly configured with matching `Onion-Location` header, and XMR is an accepted payment method.\n- You're comparing VPN privacy policies and want to see what a strong no-logs posture looks like — Xeovo names six categories of non-collected data, states it cannot comply with court orders for user activity, and has published annual transparency reports since 2019.\n- You want a VPN that has survived long enough to prove its privacy posture — nine years without a public breach, data leak, or log-disclosure incident is a meaningful tenure signal in a category where many services last months.\n\n\n**Caveats.**\n\n- **Cryptocurrency payments are explicitly excluded from the 30-day refund policy.** The ToS states: 'We do not offer refunds for cryptocurrency payments.' (operator-published, `/tos/`). Fiat payers get a 30-day money-back guarantee; crypto payers do not. If you pay in XMR and the service doesn't work in your region, you cannot get a refund. This is acknowledged in the trust section as a verifiable caveat.\n- **No independent third-party audit of the no-logs policy.** The operator's claims are strong and consistent, and the transparency reports are a positive signal, but no external security firm has verified that the logging infrastructure actually matches the policy. This is the single largest gap between B and A.\n", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup", "no_email" ], "feature_tags": [ "no_js_supported", "cash_accepted" ], "highlight_tags": [], "fees": null, "fees_summary": null, "last_verified": "2026-06-18", "operating_since": "2016", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xeovo.com", "tor": "http://xeovok4d6ehoclmlyviwuq7zlmcvucuekhrt2677r33ny2csyd4yldyd.onion/", "outbound_slug": "xeovo-vpn", "contact_email": "support@xeovo.com", "telegram": "https://t.me/XeovoVPN", "mastodon": "https://mastodon.social/@xeovo", "bluesky": "https://bsky.app/profile/xeovo.bsky.social", "reddit": "https://www.reddit.com/r/xeovo/", "twitter": "https://x.com/xeovo", "affiliate": "https://xeovo.com/?r=52ZAlAhyWVq4" }, "also_listed_at": { "0": { "name": "monerica", "url": "https://monerica.com/site/xeovo-vpn" }, "1": { "name": "kycnot.me", "url": "https://kycnot.me/service/xeovo" }, "monerica": true } }, { "id": "arcadex", "category": "wagering", "subcategory": "casinos", "name": "Arcadex", "url": "https://xmr.club/wagering/arcadex", "twin": "https://xmr.club/llm/wagering/arcadex.txt", "tagline": "Anonymous no-account XMR-only casino with five in-house games (Runner, Dice, BlackJack, Keno, Crash). Per-browser Monero subaddress deposit. Custodial house-banked; provably-fair page 404s despite nav link — verify before depositing.", "review": "Arcadex is an **anonymous no-KYC casino** running five in-house games — Runner, Dice, BlackJack, Keno, Crash — on a **native XMR-only** rail. No account, no email, no username: each browser session is issued its own Monero subaddress; you deposit to it, play against the house, and withdraw. Listed at **Grade C** — the default entry grade for a new no-KYC casino in a category where user losses can be large, with several specific caveats a reader should know before depositing.\n\n**Product.** Five in-house games with published per-game RTPs — Runner 99%, BlackJack 99% (house edge 0.1095%), Dice / Crash / Keno each 97.5%. Beta label present on the surface. Live transaction / win feed rendered on the front page. Deposits playable after 10 confirmations; withdrawals stated as instant on win. No withdrawal minimum stated.\n\n**Custody — read the shape.** The wallet-per-session model is convenient but the operator holds funds during play — this is a **custodial house-banked casino**, not a non-custodial or atomic-wagering design. Because the account model has no email / password, recovery is **browser-storage-bound**: clear your browser data, lose your balance.\n\n**Provably-fair claim — unverified.** Homepage navigation advertises a `/provably-fair` page, but the page **returns 404**. The game pages (Dice, Crash) render as pure frontends with no server-seed hash, no client-seed input, no nonce, no verification example, and no algorithm named. The provably-fair claim exists as a link but not as a working feature at this point. Verify the mechanism yourself before you trust the RTPs.\n\n**Legal surface — absent.** No `/faq`, `/terms`, `/privacy`, `/responsible-gambling`, `/license`, `/about`, or `/contact` page — all 404. Contact is a single free-tier `arcadex@engineer.com` mailbox plus unverified X and Telegram handles. **No gambling license claimed anywhere.** No jurisdiction disclosed. No corporate entity.\n\n**Operator identity — none published.** No team page, no PGP, no warrant canary, no legal entity, no jurisdiction. The site is an anonymous single-brand surface.\n\n**XMR posture — the clear positive.** XMR is the sole payment rail, first-class throughout, no wrapping or bridging. This is genuinely a Monero-native gambling product, not a multi-coin site with XMR as a footnote.\n\n**Peer signal.** Listed on `monerica.com` under Gambling — *\"No KYC / No Account – Play Games and Win Anonymously using Monero, 5 different games.\"* Not on `kycnot.me`. No scam-investigator flags, no bitcointalk threads, no Trustpilot entries — no signal in either direction, consistent with a new / low-traffic operator.\n\n**Grade C — what it means here.** Publishable but skeptical. The XMR-native design is a real positive; everything on the identity, legal-page, and provably-fair axes is either absent or non-functional. Do a small test deposit first if you plan to play — standard hygiene for a new custodial house-banked casino with no legal surface.\n\n**What would lift the grade.** `/provably-fair` returning content with a working verifier (server-seed commitment / client-seed input / reproducible per-play hash); a published Terms + Privacy + Responsible Gambling policy; some accumulated tenure; independent user-experience reports.\n\n**Useful when.** You want a Monero-native casino with no account, no email, and playable in minutes — and you understand you are trusting an anonymous operator with a custodial float during play. Cap your session bankroll accordingly.", "translation_locale": "en", "rating": { "grade": "C", "trust": "Anonymous operator (no /about, no PGP, no canary, no legal entity, no jurisdiction disclosed). No gambling license claimed. Contact channel is a free-tier engineer.com mailbox plus unverified X + Telegram. No terms / privacy / responsible-gambling policy published. Peer-directory presence limited to Monerica; kycnot does not list. No scam-investigator flags — no signal in either direction.", "privacy": "No account, no email, no username. Per-browser Monero subaddress deposit; browser-storage-bound recovery (clear browser data → lose balance). Custodial house-banked — the operator holds funds during play. Native XMR only; no wrapping or bridging.", "ux": "Five in-house games (Runner, Dice, BlackJack, Keno, Crash) with published per-game RTPs (99 / 99 / 97.5 / 97.5 / 97.5). Beta label. Live transaction / win feed on the front page. Deposits after 10 confirmations; withdrawals stated as instant on win." }, "grade": "C", "kyc_tags": [ "no_kyc", "no_email", "no_account", "anonymous_signup" ], "feature_tags": [ "no_account", "no_pii", "custodial" ], "highlight_tags": [ "NO ACCOUNT", "XMR-NATIVE", "5 GAMES", "BETA" ], "fees": { "summary": "per-game house edge (RTPs published per game)" }, "fees_summary": "per-game house edge (RTPs published per game)", "last_verified": "2026-07-27", "operating_since": "2026", "tenure_note": "New brand. Domain tenure not independently confirmed. Peer-directory presence limited to Monerica.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://arcadex.win", "outbound_slug": "arcadex" }, "also_listed_at": { "monerica": true } }, { "id": "dexsport", "category": "wagering", "subcategory": "casinos", "name": "Dexsport", "url": "https://xmr.club/wagering/dexsport", "twin": "https://xmr.club/llm/wagering/dexsport.txt", "tagline": "Web3 crypto sportsbook + casino since 2021, No-KYC, accepts XMR (+38 coins). Read first: documented cancelled-winnings / account-freeze / withdrawal complaints + casino.guru Safety Index 4.4 (Low). Provably-fair contracts ≠ guaranteed payout.", "review": "**Read this first — documented withdrawal complaints.** Dexsport is a real, long-running crypto casino + sportsbook, but its reputation is polarized in the way that matters most for a gambling site: alongside praise for fast payouts, there's a documented pattern of **cancelled winnings, account freezes, and withdrawal errors after betting**. Casino-review authority casino.guru gives it a **Low Safety Index of 4.4**. Treat any balance you can't afford to lose as genuinely at risk of being frozen or clawed back — that risk, not game fairness, is why this sits at C.\n\n**What it is.** A web3 crypto sportsbook + casino operating since 2021 (~5 years — real tenure for the category). No KYC, no-registration wallet play, settling on-chain via smart contracts. It accepts **Monero** alongside ~38 coins across 20 networks. Provably-fair casino games, with the betting contracts audited by CertiK and Pessimistic.\n\n**The provably-fair caveat.** Those audits cover *game fairness and contract safety* — they do **not** cover the withdrawal/account-restriction complaints above. A provably-fair dice roll you can't withdraw your winnings from is still a loss. Don't let \"audited + provably fair\" stand in for the payout risk.\n\n**Token.** Dexsport has its own DESU token (listed on MEXC) with cashback / VIP / freebet promos layered on top. It's a sidecar to the casino, not the core product — but standard casino-loyalty mechanics apply (the house edge funds the rewards).\n\n**Useful when.** You want a no-KYC, XMR-accepting sportsbook with 5 years behind it, and you bet small, withdraw often, and never carry a balance you'd mind losing to an account restriction. For anything else, the 4.4 safety index and cancelled-winnings reports are a real deterrent.\n\nGraded **C**: in scope (custodial no-KYC casino, real XMR support, genuine tenure) but held there — not lower, since it's a functioning platform many use without issue; not higher, because of the documented withdrawal-block pattern and low independent safety rating.", "translation_locale": "en", "rating": { "grade": "C", "trust": "Web3 crypto casino + sportsbook since 2021 (~5yr). Contract audits by CertiK + Pessimistic; on-chain smart-contract settlement. BUT: casino.guru Safety Index 4.4 (Low) + documented complaints of cancelled winnings, account freezes, withdrawal errors. Has own DESU token (MEXC).", "privacy": "No KYC, no-registration wallet play. Custodial during play (deposit/withdraw balance model). Accepts XMR among ~38 coins across 20 networks.", "ux": "Sportsbook + provably-fair casino games; wallet-connect + deposit/withdraw; no-KYC. Cashback/VIP/freebet loyalty layer tied to the DESU token." }, "grade": "C", "kyc_tags": [ "no_kyc", "anonymous_signup" ], "feature_tags": [ "custodial", "provably_fair", "multi_chain", "own_token", "no_registration" ], "highlight_tags": [ "XMR", "NO-KYC", "EST-2021", "WITHDRAWAL-COMPLAINTS", "PROVABLY-FAIR", "SPORTSBOOK" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-27", "operating_since": 2021, "tenure_note": "Operating since 2021 (~5 years); domain registered 2021-04-06, Wayback confirms 2021. Casino.guru Safety Index 4.4 (Low).", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://dexsport.io", "outbound_slug": "dexsport", "affiliate": "https://go.dexsport.io/bvziid6k" } }, { "id": "xmr-bar", "category": "wagering", "subcategory": "casinos", "name": "xmr.bar", "url": "https://xmr.club/wagering/xmr-bar", "twin": "https://xmr.club/llm/wagering/xmr-bar.txt", "tagline": "Monero dice — no signup, no KYC, provably fair via tx-hash + block-hash combo.", "review": "xmr.bar is a Monero-only dice gambling site. **No registration, no account, no email** — you enter your XMR receive address, pick a multiplier (1.5×/2×/6×/10×/25×), set a bet amount, send the XMR to the per-bet deposit address, and after one confirmation the dice rolls. If the sum of the 6 dice ≥ your multiplier's threshold, winnings land in your XMR address after 10 confirmations. The flow has zero identity surface for the player.\n\n**Provably-fair construction**: the dice result is derived from the bet's transaction hash + the block hash containing it — both verifiable on-chain by anyone. You can recompute the roll yourself; the operator can't manipulate individual outcomes without breaking the public construction.\n\n**Track record**: 4,081 historical bets visible in the pagination at first listing (May 2026). Recent bet activity is currently quieter (5–8 weeks since last published bets at first listing) — site works but volume is hobby-tier, not commercial-casino tier. Multi-year operating history (since 2025) with one published track record probe by Monerica (we credit their verification as third-party signal).\n\n**Why B, not higher**: provably-fair RNG + Monerica's withdrawal verification + MoneroTopia partnership are real positives. Hashrate-equivalent caveats (no formal audit, single-game site, custodial during play window) keep it short of A. The honest framing is 'small principled XMR dice that does what it claims; pick it when the appeal is the no-account flow, not the catalogue breadth.'\n\n**Useful when** you want to play XMR dice without a wallet-connect dance or account creation, AND you understand provably-fair (you'll verify a roll yourself, not just trust the chip). Not the place if you want slots / sportsbook / live-dealer breadth — for that, see xmr.gg.\n\n**Trust note**: 1-confirmation play start is fast (~2 min XMR block), 10-confirmation winning payout is slower (~20 min). Standard XMR custodial-during-bet risk window.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "no_kyc", "no_account", "no_email" ], "feature_tags": [ "xmr_native", "provably_fair", "house_edge_disclosed", "no_registration", "custodial_during_bet" ], "highlight_tags": [ "NO-KYC", "NO-ACCOUNT", "PROVABLY-FAIR", "XMR-ONLY" ], "fees": { "summary": "House edge baked into multiplier thresholds (e.g. 1.5× pays at ≥20 sum = 63.69% probability). Verifiable per-roll via tx-hash + block-hash." }, "fees_summary": "House edge baked into multiplier thresholds (e.g. 1.5× pays at ≥20 sum = 63.69% probability). Verifiable per-roll via tx-hash + block-hash.", "last_verified": "2026-05-31", "operating_since": "2025", "tenure_note": "Operating since 2025 (per operator + Monerica's withdrawal verifications). Operator shares @XMRBAR with xmr.pw + xmr.win (separate listings).", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmr.bar", "outbound_slug": "xmr-bar", "twitter": "https://x.com/XMRBAR", "contact_email": "support@xmr.bar" }, "incident": { "title": "Recent-bets stream is 10+ weeks old — cause unclear", "summary": "The public 'Recent Bets' feed on xmr.bar shows entries dated 10-11 weeks ago as of 2026-07-04 (external observation by @exitnode_). Site is online, betting endpoints reachable, but the on-page activity metric appears frozen since ~April 2026. Could be a backend/data event (widget wiped or disconnected from live data), or a genuine decline in traffic. Neither the operator nor the site has publicly explained. Interpret as an information-worthy signal, not a shutdown.", "date": "2026-07-04", "severity": "warning", "resolved": false }, "also_listed_at": { "monerica": true, "web3privacy": true } }, { "id": "xmr-win", "category": "wagering", "subcategory": "prediction-markets", "name": "xmr.win", "url": "https://xmr.club/wagering/xmr-win", "twin": "https://xmr.club/llm/wagering/xmr-win.txt", "tagline": "Monero-denominated prediction market — peer orderbook, zero-KYC, MCP-first (agents are first-class users).", "review": "xmr.win is a Monero-denominated prediction market that went live 2026-05-30. The defining trait is its **agent-first surface**: a full MCP server (21 tools), an OpenAPI spec, an ai-plugin manifest, and well-known endpoints (`/agents.json`, `/agent-skills/index.json`) — every aggregator and bot can sign up, fund, and trade like a human. Signup uses SHA-256 PoW captcha (no email, no phone), and API keys carry scoped permissions (`read`, `trade`, `wallet`, `withdraw`).\n\n**How it works**: CLOB peer orderbook (not a parimutuel pool). YES + NO shares per market priced 0.0001–0.9999 XMR, sum ≈ 1.00. Buy-side fee tiered by 7-day volume (1.5% Standard → 0.5% VIP per their live `/api/fee-tiers`). Markets currently visible are 1-hour BTC/ETH/XMR price binaries settled by the Hyperliquid oracle — short, finite, no resolution disputes. Long-tail real-world-event markets aren't online yet.\n\n**Privacy posture**: zero-KYC and zero-email on signup, viewer-side fully anonymous. Custodial XMR pool — you deposit to a per-account sub-address, balance credits after the platform's confirmation threshold, withdrawals run through the API. Standard custodial-platform risk window applies between deposit + your next withdrawal.\n\n**Why we list at C, not higher**: brand-new (~1 day at first listing), tiny visible volume (1.25 XMR total / 4 unique traders at first check), custodial design that hasn't yet had a public withdrawal track record stress-tested by independent users at scale, and pseudonymous operator (only `support@xmr.win` + `@XMRBAR` on X — no public team identity). The MCP-first design is genuinely novel and worth listing for — but the trust mechanism here is operational track record, and 1 week of operation isn't track record.\n\n**Path to B**: 30+ days of clean withdrawal cycles reported externally, volume > 100 XMR rolling, market types beyond crypto-oracle binaries (human-arbitered events with a documented dispute path).\n\n**Useful when** you want to trade Monero-denominated short-window price binaries without depositing to a centralized exchange, OR you're building an autonomous agent that needs a prediction-market venue and you accept the custodial trade-off + early-stage risk. Avoid for sizing > a few XMR per position until the withdrawal track record exists.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "C" }, "grade": "C", "kyc_tags": [ "no_kyc", "no_email", "pow_captcha" ], "feature_tags": [ "xmr_native", "peer_orderbook", "agent_friendly", "mcp_server", "open_api", "oracle_resolved", "custodial" ], "highlight_tags": [ "NO-KYC", "NO-EMAIL", "AGENT-FRIENDLY", "MCP" ], "fees": { "summary": "Buy-side fee tiered: 1.5% Standard / 1.25% Silver / 0.75% Gold / 0.5% VIP (7-day volume thresholds). Verified via /api/fee-tiers 2026-05-31." }, "fees_summary": "Buy-side fee tiered: 1.5% Standard / 1.25% Silver / 0.75% Gold / 0.5% VIP (7-day volume thresholds). Verified via /api/fee-tiers 2026-05-31.", "last_verified": "2026-05-31", "operating_since": "2026-05", "tenure_note": "Brand-new launch 2026-05-30. Operator runs sister products xmr.pw + xmr.bar (separate listings).", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmr.win", "outbound_slug": "xmr-win", "twitter": "https://x.com/XMRBAR", "contact_email": "support@xmr.win", "affiliate": "https://xmr.win/?ref=xmrclub" }, "also_listed_at": { "monerica": true, "web3privacy": true } }, { "id": "xmrslots", "category": "wagering", "subcategory": "casinos", "name": "Monero Slots", "url": "https://xmr.club/wagering/xmrslots", "twin": "https://xmr.club/llm/wagering/xmrslots.txt", "tagline": "Provably-fair Monero slots + roulette — wallet-as-identity, transparent house edge (2.65%); brand-new, fairness algorithm unread by audit.", "review": "Provably fair Monero slots and mini European roulette — anonymous, no-account play with a Monero address + PIN as the only authentication. Listed at **Grade B-** because the operator publishes the house edge (2.65%), RTP (97.35%), max multiplier (500x), and minimum withdrawal (0.0001 XMR) directly on the homepage — an unusually transparent gambling disclosure — but zero peer-directory matches exist and the site has no privacy policy, no ToS, and no Tor mirror.\n\n**What it is.** Provably fair Monero slots and roulette — anonymous play with Monero address + PIN authentication, no email, no KYC. Listed at **Grade B-** because the homepage publishes the kind of RTP/house-edge/multiplier transparency that most crypto gambling sites omit; held under A by the total absence of legal pages and peer-directory confirmation.\n\n**Background.** Operating since at least 2025 per the homepage copyright footer (operator-published: '© 2025 Monero Slots'). The site is a traditional server-rendered application (not a SPA)with navigation pages for Slots, Roulette, Deposit, Withdraw, History, Affiliate, and Contact (operator-published, navigation menu on /contact and /affiliate pages). The /game, /deposit, /withdraw, /history, /roulette, and /provably-fair paths are behind the anonymous authentication flow (Monero address + PIN) and were not in the No operator background, founding date, or jurisdiction is recoverable from the public surface.\n\n**What you trust.** Anonymous authentication: Operator-published: 'Enter your Monero address and create a PIN. Your payout address doubles as your login.' (homepage, How It Works §1). This is the simplest possible auth model — no email, no password, no KYC. The Monero address IS the identity. A PIN protects the session locally. Provably fair: Operator-published: 'Verify every slot spin independently' (homepage). A dedicated `/provably-fair` page exists (linked from the homepage footer) that presumably documents the verification algorithm and seed commitment scheme, but it was not in a public audit path list and is behind the auth flow. The claim is published; the verification mechanics are unread by this review. House edge / RTP disclosure: Operator-published: RTP 97.35%, House Edge 2.65%, Max Multiplier 500x (homepage, Game Information section). This is *unusually* transparent for a crypto gambling site — most do not publish their edge at all. The 2.65% house edge is comparable to European roulette (2.7%) and better than most anonymous crypto casinos. Withdrawal transparency: Operator-published: Min Withdrawal 0.0001 XMR (homepage). Deposit processing: 'Play after 2+ confirmations' (homepage). Both operational parameters are published upfront rather than discovered at withdrawal time — a positive signal. Affiliate program: Operator-published: 'When they wager 0.2 XMR in total volume, you BOTH get 0.0025 XMR. Rewards are credited automatically to your balance. No limit on referrals!' (/affiliate page). The terms are clear, the payout is defined in XMR (not a percentage that could be silently changed), and the unlock threshold (wager 1 XMR) is published. One of the most transparent affiliate programs seen in any B-grade listing. Deposit model: Operator-published: 'Send XMR to your unique deposit address' (homepage, How It Works §2). The site generates per-user deposit addresses — standard for Monero gambling. No third-party payment gateway is referenced; the operator appears to run their own Monero node/wallet infrastructure.\n\n**Operational specs.** Games: Slots (the primary game) and mini European roulette (operator-published, navigation menu on authenticated sub-pages). The homepage only mentions slots but the navigation reveals roulette. No blackjack, poker, or sportsbook. House parameters: RTP 97.35%, House Edge 2.65%, Max Multiplier 500x, Min Withdrawal 0.0001 XMR, Deposit confirmations: 2+ (operator-published, homepage Game Information section). All four key gambling parameters are published on the landing page — this is the most complete pre-play disclosure in any gambling listing to date. Authentication model: Monero address + PIN — no email, no username, no password, no KYC (operator-published, homepage). Withdrawals go to the login address — your payout address IS your identity. This has a privacy implication: repeated play from the same address ties sessions together, but users can generate fresh addresses per session. Affiliate terms: Unlock at 1 XMR total wagered, both referrer and referred get 0.0025 XMR when referred player wagers 0.2 XMR. Rewards auto-credited. No referral cap (operator-published, /affiliate page). Tor mirror: None — no onion address advertised and no `Onion-Location` header. For a gambling site that handles XMR deposits and withdrawals, a Tor mirror is a meaningful privacy upgrade. Contact: Web contact form at /contact (5.4KB, title 'Contact Support - Monero Slots'). No email address, no Telegram, no XMPP surfaced. The form is the only support channel — single point of failure. Legal surface: Minimal — no /privacy, /privacy-policy, /terms, /tos, /terms-of-service, /aml, or /legal/* paths resolved. The homepage IS the legal surface: it carries the house edge, RTP, multiplier, and withdrawal parameters. No formal ToS or privacy policy exists at any conventional path.\n\n**Operator philosophy.** The operator has chosen to publish gambling parameters that most anonymous casinos hide — a fixed and disclosed house edge, a published RTP, a specific max multiplier, and a concrete minimum withdrawal. The affiliate program is similarly transparent: fixed XMR rewards, no percentage dodges, auto-credited. The 'Play responsibly' footer is a regulatory nicety, but the rest of the page reads like an engineer's product, not a marketer's. The Monero-address-as-identity model and the 2-confirmation deposit threshold both suggest a technically competent operator who understands Monero's privacy properties.\n\n**Grade rationale.** Listed at **Grade B-**. The kycnot.me + monerica.com peer-directory listings (monerica added 2025-12, ~6 months tracked) clear the directory's published C → B upgrade criterion — provably-fair verification by curator test trade isn't yet on file, so the listing doesn't qualify for A. The homepage publishes unusually transparent pre-play parameters (RTP 97.35%, house edge 2.65%, max multiplier 500x, min withdrawal 0.0001 XMR), but for a gambling service the *provably-fair claim is the trust mechanism* — and it is unverified by this probe: `/provably-fair`, `/game`, `/deposit`, and `/withdraw` are all behind the auth flow, so the fairness algorithm is unread. Combined with no ToS / privacy policy / AML page at any conventional path , no Tor mirror, and contact-form-only support, this falls into the directory's *new + casino* risk bucket — a category where exit-scam priors are higher and loss potential is asymmetric. **Path to A:** (a) the curator runs a Stage 4 test trade verifying the commit-reveal provably-fair flow end-to-end, OR (b) at least one peer-directory lists the service.\n\n**Caveats.** The actual game pages (/game, /deposit, /withdraw, /history, /roulette, /provably-fair) are behind the anonymous authentication flow. The provably-fair verification page — arguably the single most important trust document for a gambling site — is unread by this review. Authenticating with a throwaway Monero address and verifying the fairness mechanics yourself is the only way to confirm the design today. A gambling site that generates per-user deposit addresses and holds balances until withdrawal is *custodial* by definition during the play session. Monero-address-as-identity has a structural privacy tradeoff: registration blocks the same primary address from being re-registered, but if a player deposits from the same wallet across sessions, the on-chain history under that wallet links their play. This is inherent to wallet-as-identity — the operator can't 'warn' around it without breaking the no-account design. For maximum unlinkability, players should use a fresh subaddress per session. Gambling is restricted or illegal in many jurisdictions. The site does not publish a list of restricted countries or a legal disclaimer. Users are responsible for determining whether online gambling is lawful in their jurisdiction. This review does not constitute legal advice on gambling regulation.\n\n**Path to A.** Three open conditions, any one of which would justify A: (a) a curator-run Stage 4 test trade verifying the commit-reveal provably-fair flow end-to-end (we publish the deposit hash, the operator publishes the seed, anyone can reproduce the round); (b) operator removes or lowers the 1 XMR (~$340) affiliate-program wager-gate — at present the affiliate channel is a play-to-earn design that materially favours the operator; (c) operator publishes the provably-fair verification page at a route the audit probe can reach without auth, so we can confirm the cryptography matches the marketing copy.\n\n**Affiliate gate.** The referral program is locked behind a 1 XMR wager threshold — *\"Wager 1 XMR total to unlock the affiliate program. Keep playing to unlock your referral code and start earning!\"* (operator-published, in-app panel). At Monero prices around $340 (CoinGecko, 2026-06-03) that puts ~$340 of player wagering through the house edge (2.65%) before any referral code is even issued. Combined with the 0.0025 XMR payout per qualifying referral, the break-even math is heavily operator-favoring — readers thinking of this as a no-stakes affiliate channel should price the 1 XMR upfront play into their model.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B-" }, "grade": "B-", "kyc_tags": [ "anonymous_signup", "no_kyc" ], "feature_tags": [ "custodial", "wallet_funded", "xmr_native" ], "highlight_tags": [ "NO-KYC", "XMR", "PROVABLY-FAIR" ], "fees": { "summary": "House edge 2.65% (RTP 97.35%) · Min withdrawal 0.0001 XMR · 0.0025 XMR affiliate payout per qualifying referral" }, "fees_summary": "House edge 2.65% (RTP 97.35%) · Min withdrawal 0.0001 XMR · 0.0025 XMR affiliate payout per qualifying referral", "last_verified": "2026-06-07", "operating_since": "2025-11-21", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://xmrslots.net", "outbound_slug": "xmrslots" }, "also_listed_at": { "kycnot": true, "monerica": true } }, { "id": "anonero", "category": "wallets", "subcategory": "Mobile", "name": "Anonero", "url": "https://xmr.club/wallets/anonero", "twin": "https://xmr.club/llm/wallets/anonero.txt", "tagline": "Android Monero wallet with hardcoded privacy defaults — no subaddress reuse, no third-party leaks, coin control by default. Tor-first.", "review": "**Android Monero wallet with hard-coded privacy defaults** — no subaddress reuse, no third-party leak channels (no analytics, no Sentry-class crash reporters, no Play Services dependencies), coin control on by default. Operator framing: *\"ANON and NERO — security and privacy focused Monero wallets.\"* Listed at **Grade B** on first pass — Tor-first surface (clearnet `anonero.io` 302s straight to the onion at `anonero5wmh...swad.onion`), operator-published Codeberg backup at `codeberg.org/dMartian/ANONERO-WALLET`, CCS-funded development (Monero Community Crowdfunding proposal r4v3r23-anonero-v1.html). Upgrade-to-A is conditioned on a curator end-to-end test + reproducible-build documentation.\n\n**What it is.** Native Android wallet. Pure Monero only. Differentiator vs the Monerujo / Monfluo lineage is the **operator-imposed privacy defaults**: subaddresses don't get reused (each receive generates a fresh one, no operator override), coin control is on by default (not buried in advanced settings), and the wallet ships zero third-party SDKs (no analytics, no crash reporting that calls home, no Play Services). Codebase is on the project's onion (canonical) + Codeberg (backup mirror by dMartian).\n\n**Background.** Funded via **Monero Community Crowdfunding (CCS)** proposal `r4v3r23-anonero-v1.html`. Currently migrating from older Android codebase to **Kotlin + Jetpack Compose** (operator's stated roadmap). Active development; the canonical repo lives on the onion site to reduce the dependency on third-party hosting.\n\n**What you trust.**\n\n- **Operator-published Tor onion** as the canonical distribution channel. Clearnet `anonero.io` redirects (302) directly to the onion — operator is treating Tor as the primary surface, not a fallback.\n- **No Play Services / Google dependencies.** Wallet runs on any AOSP device; doesn't require GMS.\n- **No third-party telemetry SDKs.** No Sentry, no Firebase Analytics, no Mixpanel-class. Standard practice for this tier, but explicitly verified vs the source.\n- **CCS-funded.** Public funding proposal + delivery accountability via the Monero Community Crowdfunding system — distinct from anonymous-operator-with-no-public-trail. The CCS thread is the closest thing to operator identity disclosure available for a pseudonymous Monero-tier dev.\n- **Codeberg backup repo** maintained by dMartian — mirrors the canonical onion repo, so build-from-source is possible without Tor for users who prefer it.\n\n**Operational specs.**\n\n- **Install.** APK direct download from the onion site (canonical) or Codeberg releases (backup mirror).\n- **Platform.** Android only.\n- **Coin coverage.** Monero (XMR) only.\n- **Backend.** Talks to `monerod` over RPC. Public-node list shipped; supply your own for maximum sovereignty.\n- **Default settings.** Subaddress per receive (no reuse), coin control visible by default, conservative fee tier.\n- **Tor.** Operator-published onion; the wallet itself can be configured to route node-RPC over Tor.\n- **Updates.** Manual via APK download.\n- **License.** Open source (confirm against repo LICENSE).\n- **Maintainer.** Pseudonymous (r4v3r23 / dMartian). CCS thread provides delivery-history accountability.\n\n**Operator philosophy.** The differentiator vs Monerujo / Monfluo is **defaults**: rather than ship a wallet with permissive settings + a privacy-mode toggle the user has to find, Anonero hard-codes the privacy-respecting settings as the only setting. No subaddress-reuse toggle, no \"turn on coin control\" advanced mode, no opt-out telemetry (because there's no telemetry to opt out of). The trade-off is less user-customisable UX, the upside is users who don't know to flip the privacy switches get the safe behaviour by default.\n\n**Grade rationale.** **Grade B** because: (1) **no curator end-to-end test** on file yet (install + send + receive + Tor-routing verification pending); (2) **reproducible-build pipeline not documented**; (3) **clearnet → onion 302 redirect** is good Tor-first posture but means non-Tor users hit a broken-looking redirect (no clearnet site to show what the wallet IS before going to Tor); (4) **maintainer pseudonymous**. The CCS funding history + operator-published onion + privacy-default architecture are strong B+ signals. Upgrade to A: curator test pass + reproducible builds + a small clearnet landing-page card showing what the wallet is before the 302.\n\n**Useful when:**\n\n- You want a **Tor-first Android Monero wallet** that treats the onion as the canonical channel.\n- You explicitly **don't trust yourself** to flip the right privacy toggles and want a wallet where the defaults are already correct.\n- You're already comfortable using **CCS-funded projects** as an operator-identity proxy.\n- You're running a **de-Google'd Android** (GrapheneOS, CalyxOS, /e/OS) and want a wallet without GMS dependencies.\n- You want to **back the lineage** — Anonero represents a different design philosophy (hard-defaults vs Monerujo's permissive-defaults-with-toggles) and supporting it via use keeps the design-space populated.\n\n**Caveats:**\n\n- **No clearnet landing page.** `anonero.io` 302s to the onion immediately. Non-Tor users see a broken redirect — could discourage first-time installs.\n- **Onion download path requires Tor Browser.** Codeberg backup mirror is the clearnet fallback.\n- **Reproducible builds not documented.** Standard caveat at this tier; not blocking but caps the grade.\n- **Pseudonymous maintainer.** r4v3r23 / dMartian — CCS provides delivery history, but no real-world attribution.\n- **No iOS / desktop.** Android only.\n- **Hard-coded defaults mean less customisability.** Power users who want to disable subaddress-per-receive (e.g. for a long-lived donation address) need to do it outside the wallet UI.\n- **No curator end-to-end test on file yet.** First-pass listing per playbook.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "xmr_native", "tor_mirror" ], "highlight_tags": [ "XMR NATIVE", "TOR", "PRIVACY DEFAULTS" ], "fees": { "summary": "Free wallet · XMR network fees only (operator-default fee tier is conservative — you can override per transaction)." }, "fees_summary": "Free wallet · XMR network fees only (operator-default fee tier is conservative — you can override per transaction).", "last_verified": "2026-05-28", "operating_since": "2024", "tenure_note": "Anonero (Monero-on-Android distribution) — recent fork of Tor Browser concept. Hand-set by curator.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://anonero.io", "tor": "http://anonero5wmhraxqsvzq2ncgptq6gq45qoto6fnkfwughfl4gbt44swad.onion", "repo": "https://codeberg.org/dMartian/ANONERO-WALLET", "outbound_slug": "anonero" }, "also_listed_at": { "web3privacy": true } }, { "id": "bitcoin-knots", "category": "wallets", "subcategory": "Desktop", "name": "Bitcoin Knots", "url": "https://xmr.club/wallets/bitcoin-knots", "twin": "https://xmr.club/llm/wallets/bitcoin-knots.txt", "tagline": "Bitcoin Core-derived full-node wallet with stricter mempool + policy controls. Same chain, same RPC, opinionated defaults.", "review": "**Long-running Bitcoin Core derivative** that ships with stricter mempool and policy controls than vanilla Core — maintained by **Luke Dashjr** (one of the longest-tenured Bitcoin contributors, formerly Bitcoin Core developer) under the **Knots** brand since 2011. Listed at **Grade A** because Knots is the canonical \"I want a full Bitcoin node with **opinionated mempool policy**\" answer for sovereignty-minded users: same chain as Core (no fork, no altcoin), same RPC interface (every Core-compatible tool works unchanged), but with additional configuration knobs around OP_RETURN limits, mempool filtering, transaction-size constraints, and fee policies that the Core maintainers have declined to upstream. Open-source MIT, no telemetry, no account, no operator on the data path.\n\n**What it is.** Bitcoin Knots is a software fork of Bitcoin Core that **periodically merges Core's mainline** and adds a layered patchset of policy changes Luke Dashjr (and the small Knots maintainer team) has accumulated over a decade. The version string mirrors Core's: Knots `26.1.knots20240801` is the Aug 2024 patchset on top of Core `26.1`. Every Core feature lands eventually; some Knots features (BIP119 / OP_CHECKTEMPLATEVERIFY support, datacarrier policy bias, libconsensus exports) reach Knots first or stay Knots-only when Core declines.\n\nKnots runs the same `bitcoind` daemon, the same `bitcoin-cli`, the same `bitcoin-qt` GUI as Core — drop a `bitcoind` install replaced with the Knots binary into any existing node setup and your wallets, RPC consumers, mempool watchers, and miners keep working unchanged. The chain it validates is unambiguously **Bitcoin mainnet** (or testnet/signet/regtest as you configure); Knots does not fork the consensus rules.\n\n**Background.** Luke Dashjr has been contributing to Bitcoin since 2011 — Bitcoin Improvement Proposals (BIPs) authored, miner-software releases shipped (Eligius pool, BFGMiner), and a long Bitcoin Core commit history through 2023. **Knots** as a distribution began as Luke's personal patchset over Core: a place to ship policy changes that Core's maintainers would not merge but that node operators with stricter views on miner-mempool incentives wanted to run.\n\n**The 2024 OP_RETURN debate** (Core's decision to raise the standard OP_RETURN size limit) crystallised Knots' positioning as the **\"smaller-block, stricter-policy\" reference distribution**. Node operators who disagreed with Core's relaxation moved to Knots; Knots' nodecount visible on `bitnodes.io` measurably grew through 2024-2025 as a result. Knots remains a Luke-maintained project with small contributor count (~10-15 active per release) and no commercial entity behind it; releases ship from Luke's personal infrastructure.\n\n**What you trust.**\n\n- **Open-source MIT.** Codebase at `github.com/bitcoinknots/bitcoin`. Built from Core's source, with the Knots patchset visible as discrete commits — you can diff Knots against the Core version it's based on and see every Knots-specific change.\n- **Reproducible builds.** Knots inherits Core's Guix-based reproducible-build workflow. Multiple builders sign each release's manifest; you can verify the binary by rebuilding from tagged source on your own hardware.\n- **Same chain as Core.** No consensus fork; Knots syncs Bitcoin mainnet (or any net you point it at) and produces blocks indistinguishable from Core's. Mining policy can differ (which transactions a Knots miner picks for a block) but block validity is identical.\n- **No telemetry, no phone-home.** The daemon doesn't call back to bitcoinknots.org or anywhere else — it speaks Bitcoin's wire protocol to peers and nothing else.\n- **No account at any stage.** Download binary, verify signatures, run. No \"Knots account\" exists.\n- **Wallet keys local.** Stored on disk in your `~/.bitcoin/wallets/` (Core-compatible). Optional encryption via `bitcoind walletpassphrase`.\n\n**Operational specs.**\n\n- **Install** — download binary tarballs from `bitcoinknots.org/files/26.x/...` (Linux, macOS, Windows, ARM, BSD); verify signatures with `gpg --verify SHA256SUMS.asc` against Luke's published key. Or build from source: `git clone github.com/bitcoinknots/bitcoin && ./autogen.sh && ./configure && make`.\n- **Hardware** — full node: ~700 GB SSD (Bitcoin mainnet blocks + UTXO + chainstate, growing ~80 GB/yr), 4-8 GB RAM, modern dual-core CPU. Pruned mode (`-prune=10000`) drops disk to ~10 GB at the cost of losing historical block data. Initial block download ~24-48 hours on a fast residential link.\n- **Configuration** — `bitcoin.conf` in `~/.bitcoin/` (or `~/Library/Application Support/Bitcoin/` on macOS). All Core options work; Knots-specific options are documented in the release notes per version.\n- **RPC** — `bitcoin-cli` works identically to Core. Any tool that talks Core RPC (mempool.space watchtower, Sparrow Wallet, Electrum personal-server, BTCPay Server, Joinmarket, Wasabi, btcpayserver, your own scripts) works against Knots unchanged.\n- **GUI** — `bitcoin-qt` ships in the same binary distribution; same wallet UI as Core.\n- **Network** — IPv4 + IPv6 + Tor (`bind=127.0.0.1:8333 -listenonion -proxy=127.0.0.1:9050`) + I2P. Tor-only mode is one config flag away.\n- **Updates** — manual. New Knots releases ship periodically (roughly tracking Core's release cadence); you stop the daemon, replace the binary, restart. State migrates automatically.\n- **Support** — IRC (`#bitcoin-knots` on Libera.Chat), GitHub Issues. No commercial support contract — this is a Luke-maintained project, not a company.\n\n**Operator philosophy.** Luke Dashjr's position is consistent across a decade of public Bitcoin-Talk / Twitter / IRC / mailing-list posts: **Bitcoin's value proposition depends on small blocks, restrictive mempool policy, and aggressive resistance to onchain bloat** (NFTs, inscriptions, ordinals, arbitrary data carriage). Knots' policy patches operationalise this view — they give individual node operators the choice to reject transactions the user considers spam, regardless of whether they meet Core's looser standards.\n\nThe view is contested within the broader Bitcoin community; Core's maintainers have declined to merge most Knots-specific policy changes precisely because they disagree about which transactions count as \"spam\" (and whether nodes should filter at all). Listing Knots at Grade A is not an endorsement of the policy stance — it's an editorial recognition that the node software itself is **technically sound, open-source, reproducibly-built, fully Core-compatible, and ships features a real constituency of node operators wants**. Users who disagree with Luke's policy views should run Core; users who agree should run Knots.\n\n**Grade rationale.** Grade A reflects: **identical privacy posture to Core** (full local validation, no operator on the data path, no account anywhere), **open-source MIT** (auditable, the patchset is reviewable as discrete commits over Core), **reproducible builds via Guix** (binary verifiable against tagged source), **same chain as Core** (no consensus fork; runs Bitcoin mainnet), **plug-in RPC compatibility** (works with every Core-compatible tool), **named-operator accountability without dependency** (Luke Dashjr publicly identified for ~14 years; even if Knots stopped updating, the daemon continues to validate Bitcoin until the next consensus change), **measurable adoption** (visible Knots nodecount on bitnodes.io grew through 2024-2025), and **no security incident attributable to Knots-specific code in the project's history**. Last verified 2026-05-27.\n\n**Useful when:**\n\n- You want to run a Bitcoin full node and prefer Luke Dashjr's stricter mempool policy defaults over Core's.\n- You want to filter inscriptions / ordinals / large OP_RETURN data out of the mempool your node relays, without writing custom patches.\n- You're running a small private miner and want policy controls (which transactions to mine, fee floor, datacarrier rejection) Core doesn't expose.\n- You need a Bitcoin node binary that's directly Core-compatible from the RPC side but ships features Core has declined to upstream (BIP119, libconsensus exports, configurable policy biases).\n- You're philosophically aligned with the \"small-blocks, less-onchain-bloat\" view and want to operationally express it via the software you run.\n- You want a Core-derived node that's maintained outside the Chaincode Labs / Spiral-funded Core orbit by an independent contributor.\n\n**Caveats:**\n\n- **Smaller maintainer pool than Core.** Knots has ~10-15 active contributors per release vs Core's ~100+. Bug-fix latency on Knots-specific code is longer; security-critical Core fixes generally reach Knots within days but not always within hours.\n- **Single-maintainer dependency.** Luke Dashjr personally owns the release process and signs the binaries. If Luke stops releasing (illness, dispute, life event), Knots continues to validate the chain (consensus is Core's) but the policy patches stop receiving updates. The project would either fork to a new maintainer or quietly become obsolete.\n- **Editorial controversy.** Luke's Bitcoin policy positions have generated multiple long-running disagreements with Core maintainers, mining pools, and large segments of the Bitcoin community (most prominently the inscription / ordinals debate). Running Knots is a public-facing political signal in some communities; this may or may not matter to you.\n- **GUI is a minimal Core-style interface.** `bitcoin-qt` ships the same basic interface Core does. For a polished wallet UI, pair Knots-as-backend with Sparrow / Electrum / Wasabi / BlueWallet over RPC.\n- **Initial sync is full-node-grade.** 24-48 hours of bandwidth + CPU on first install; ~700 GB SSD for the full archival node. Pruned mode (~10 GB) drops the historical data but you lose block-explorer functionality.\n- **Tor / I2P configuration is manual.** Knots inherits Core's Tor support but you wire up the SOCKS proxy and hidden-service onion in `bitcoin.conf` yourself. No automatic Tor-setup flag.\n- **No commercial support contract.** Bugs reported via GitHub Issues + IRC; production-critical deployments should either run multiple-node redundancy or pay a Core/Knots-fluent consultant separately.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "full_node_capable" ], "highlight_tags": [ "BTC", "FULL-NODE", "DESKTOP" ], "fees": { "summary": "Free · MIT · BTC full node · Guix-reproducible builds" }, "fees_summary": "Free · MIT · BTC full node · Guix-reproducible builds", "last_verified": "2026-05-27", "operating_since": "2016", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://bitcoinknots.org", "outbound_slug": "bitcoin-knots", "twitter": "https://x.com/BitcoinKnots", "discord": "https://discord.gg/3Ccegp9YrU" } }, { "id": "boltz", "category": "wallets", "subcategory": "Lightning", "name": "Boltz", "url": "https://xmr.club/wallets/boltz", "twin": "https://xmr.club/llm/wallets/boltz.txt", "tagline": "Lightning ↔ on-chain submarine + reverse swaps. Non-custodial, no account.", "review": "Boltz is the *non-custodial bridge between Lightning and on-chain Bitcoin* — a swap service that moves value across the Lightning Network, on-chain BTC, and Liquid without ever taking custody of your coins or asking who you are.\n\n**Background.** Running since 2018, Boltz built its reputation on *submarine swaps*: atomic exchanges between a Lightning payment and an on-chain (or Liquid) output, coordinated by hash-time-locked contracts (HTLCs) so neither side can cheat. It ships as a browser web app and a mobile wallet (the Boltz app), backed by an open-source server (boltz-backend) and public swap endpoints that other wallets integrate directly. It is reachable on the clearnet and via a Tor v3 onion. That combination of a long operating history, open infrastructure, and a no-account model is why it earns an A in /wallets.\n\n**What you trust.** Almost nothing — which is the point. Swaps are *trustless via HTLCs*: your funds are locked to a hash preimage such that either the swap completes atomically or you reclaim them via the refund path after a timeout. Boltz never holds spendable custody of your balance the way a custodial exchange does; a swap that fails leaves you able to refund yourself on-chain. The backend is *open source*, so the swap logic and fee handling are auditable, and the *public API* means you're not locked into Boltz's own UI — many third-party Lightning wallets route their swaps through it. The residual trust is operational (liveness, fee quotes), not custodial.\n\n**Operational specs.** No signup, no email, no KYC — you arrive, pick a direction, and swap. Supported flows include Lightning ⇄ on-chain BTC and Lightning ⇄ Liquid (L-BTC), in both directions, which is exactly what you need to *get funds into or out of Lightning channels without the rebalancing dance*. The mobile app functions as a self-custodial Lightning wallet built on this swap engine; the web app handles one-off swaps. Each swap exposes a refund file/flow so a stuck or expired swap is recoverable by you, not stranded with the operator. Fees are quoted up front per swap. Tor access is first-class via the onion address.\n\n**Philosophy.** Lightning's hardest UX problem is the on/off ramp — inbound liquidity, channel rebalancing, getting on-chain funds into a channel and back out. Boltz's thesis is that this plumbing should be *trustless and accountless*: you shouldn't have to register with, or hand custody to, an intermediary just to move between Lightning and the base chain. By implementing the bridge as atomic swaps with self-refund, it keeps the user sovereign over their funds throughout — the privacy and self-custody ethos of Bitcoin applied to the part of the stack where most services quietly reintroduce custody and accounts.\n\n**Grade rationale.** A in /wallets. The grade reflects genuine non-custodial design (HTLC atomicity with a user-controlled refund path), no-account/no-KYC access, an open-source backend, public integrable endpoints, multi-year operation, and a Tor onion. It is best understood not as a general wallet but as the *swap/liquidity layer* — and on that axis it's among the most trustworthy options because it removes custody from the equation entirely.\n\n**Useful when.** Use Boltz when you need to cross the Lightning/on-chain boundary without giving up custody: emptying a Lightning balance to on-chain BTC or Liquid, topping up a channel from on-chain funds, or getting inbound liquidity without opening a channel manually. It pairs well with privacy-focused Lightning use — moving between Liquid and Lightning, or sweeping LN funds to an on-chain wallet — precisely because there's no account to tie the activity to.\n\n**Caveats.** Trustless does not mean foolproof: submarine swaps have moving parts, and a swap interrupted at the wrong moment requires you to actually *execute the refund* (save the refund file, follow the flow) — users who close the tab and ignore it can leave funds locked until they reclaim them. On-chain and swap fees apply and can be meaningful for small amounts, so micro-swaps are inefficient. Liquidity and quoted rates depend on Boltz's liveness at swap time. And while there's no account, on-chain and Lightning activity still carry their own chain-analysis surface — Boltz removes the custodial/identity layer, not the inherent traceability of the underlying networks. These are the ordinary trade-offs of a non-custodial swap tool, not trust problems, and they keep it firmly at A for what it is.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "lightning_native", "atomic_swap", "thin_client" ], "highlight_tags": [ "LIGHTNING", "ATOMIC-SWAP", "NO-CUSTODY" ], "fees": { "summary": "0.1% swap fee + LN routing · no account" }, "fees_summary": "0.1% swap fee + LN routing · no account", "last_verified": "2026-06-02", "operating_since": "2018", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://boltz.exchange", "outbound_slug": "boltz", "tor": "http://boltzzzbnus4m7mta3cxmflnps4fp7dueu2tgurstbvrbt6xswzcocyd.onion", "twitter": "https://x.com/boltzhq" }, "also_listed_at": { "web3privacy": true, "kycnot": true } }, { "id": "cake-wallet", "category": "wallets", "subcategory": "Mobile", "name": "Cake Wallet", "url": "https://xmr.club/wallets/cake-wallet", "twin": "https://xmr.club/llm/wallets/cake-wallet.txt", "tagline": "Mobile + desktop multi-coin wallet (XMR, BTC, LTC, ETH) with in-app swap + CakePay.", "review": "Cake Wallet is the multi-coin mobile + desktop wallet that pioneered Monero on iOS, ships ahead of the curve on cross-chain privacy primitives (Bitcoin Silent Payments, Monero background sync, Litecoin MWEB), and pairs with Cake Pay for in-wallet gift-card spend. Listed at **Grade A · editor's pick** because it remains the most polished mobile XMR experience available — covering iOS, Android, Linux, Windows, plus the privacy-respecting Accrescent store — with a public team, open-source codebase, and 8+ years of operational continuity.\n\n**Background.** Founded in 2018 by **Vikrant Sharma** (CEO, @vikrantnyc) under Cake Labs LLC, after Vikrant founded the parent company in 2017 to build self-custody privacy tools. The team is publicly named — including COO **Seth For Privacy** (@sethforprivacy, also host of the Opt Out privacy podcast), plus engineers Omar Hatem and Tuxsudo. Cake Wallet was the **first Monero wallet on iOS**, a meaningful milestone given Apple's review-process friction around privacy-oriented crypto apps. 1,750,000+ users claimed on the homepage. Sister products include Monero.com (Monero-only fork of Cake), Cake Pay (gift cards, listed separately), and Cupcake (mobile lightweight node).\n\n**What you trust.** Non-custodial — keys generated and stored locally, never sent to Cake Labs servers. Source code public on GitHub for the wallet itself; the wallet is 100% open source. **Caveat on backend services**: Cake Wallet uses Cake Labs–operated infrastructure for its in-app swap (a custodial routing layer), exchange-rate fetching, and (optionally) Cake Pay gift-card fulfillment. The wallet code is open; the backend services these in-app features call are operated by Cake Labs. For pure send/receive/sync, no backend trust required — point Cake at your own monerod or a community node. For in-app swap or CakePay flows, you opt into Cake Labs as a trusted operator for that specific transaction.\n\n**Operational specs.** Coins supported: XMR (primary), BTC (including Silent Payments), LTC (including MWEB privacy network), ETH, USDT, BCH, DOGE, and several others. Surfaces: iOS App Store, Android Play Store + APK + Accrescent, macOS, Linux, Windows. Hardware wallet support: Trezor (active, recently expanded to Trezor 7 Bluetooth + BIP-39 seed imports); Ledger support exists but is less prominently maintained per recent community discussion. Advanced features: background sync (mobile-friendly, runs even when app is closed on supported OSes), multiple wallets per device, multi-account, hardware wallet pairing, in-app coin exchange via aggregator-routed swap. Open-source codebase at github.com/cake-tech/cake_wallet.\n\n**Philosophy.** Cake Wallet's editorial differentiator is the **first-mover-on-mobile-privacy posture**: when a privacy primitive ships in a reference implementation (Silent Payments, MWEB, background sync), Cake Wallet's team is consistently among the first to wire it into a polished mobile UI. Combined with a publicly named team — including a privacy-podcaster COO — and an explicit \"financial freedom for all\" mission framing, the wallet positions itself as the **convenience-first** privacy wallet (vs. Feather's purity-first or Monerujo's lean-Android stance). Trade-off: some convenience features rely on Cake Labs backend infrastructure, which broadens the trust surface vs. a pure non-custodial wallet like Feather.\n\n**Grade rationale.** Grade A and editor's pick reflect: 8+ years of operational continuity (since 2018); publicly named, accountable team; first Monero wallet on iOS; multi-OS coverage including Accrescent (privacy-respecting Android store) and Linux/Windows desktop; open-source wallet codebase; consistent positioning in community recommendations alongside or ahead of Monerujo for mobile XMR; absence of fund-loss / CVE / major incident reports in the last 24 months; pioneer status on cross-chain privacy primitives (Silent Payments, MWEB, background sync). Last verified 2026-05-11.\n\n**Useful when.** You want a mobile-first Monero wallet that doesn't sacrifice multi-coin convenience. You hold XMR + BTC + LTC and want one app that handles all three with privacy-aware defaults (Silent Payments, MWEB, ring signatures). You want to use Cake Pay's gift-card flow without leaving your wallet. You need iOS Monero support (rare). You want hardware wallet support for cold-storage signing on Trezor. You want a wallet with a public team and a track record long enough to outlast typical crypto-app churn.\n\n**Caveats.** **In-app swap is custodial during the routing leg** — your XMR/BTC sits with Cake Labs (or their partner) until the swap fills; for swap privacy or larger volumes, route through Trocador or the kyc.rip aggregator instead. The backend services for in-app exchange and CakePay are not open source — only the wallet code is. **Phishing risk**: a fake \"Cake Wallet Desktop\" site (cakedesktopwallet[.]com) was flagged in February 2026 — always verify the URL is `cakewallet.com` and downloads are signed. **No formal third-party security audit** publicly documented for the recent releases — the trust chain rests on the open-source code + community review, similar to Feather's posture. iOS users: App Store reviews can lag privacy-feature rollouts; check version parity if a specific feature matters. **Reproducible builds** are not as prominently documented as Feather's — if you need that property for your threat model, Feather is the safer pick.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A", "trust": "Open-source, public team, and the wallet that pioneered Monero on iOS. Long-standing, actively maintained across iOS/Android/Linux/Windows + Accrescent. Non-custodial — keys stay on device. Editor's pick.", "privacy": "Non-custodial XMR + multi-coin wallet with background sync, Bitcoin Silent Payments and LTC MWEB. Ships an integrated swap (partner APIs) — convenient, but a third-party data surface if used. Runs your own node or a remote one.", "ux": "The most polished mobile XMR experience — iOS/Android/desktop, in-app swaps, and Cake Pay gift-card spend. Beginner-friendly." }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "xmr_native", "multi_chain", "thin_client" ], "highlight_tags": [ "MOBILE", "XMR NATIVE" ], "fees": { "summary": "Free · Monero network fees only · in-app swap fees vary by provider" }, "fees_summary": "Free · Monero network fees only · in-app swap fees vary by provider", "last_verified": "2026-05-11", "operating_since": "2018", "tenure_note": "Cake Wallet first open-source Monero iOS release 2018. cakewallet.com WHOIS earlier reflects domain hold, not product launch.", "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://cakewallet.com", "outbound_slug": "cake-wallet", "contact_email": "support@cakewallet.com", "twitter": "https://x.com/cakewallet", "telegram": "https://t.me/cakewalletannouncements", "discord": "https://discord.gg/2vqYJdXG2H" }, "also_listed_at": { "web3privacy": true, "monerica": true } }, { "id": "cashu", "category": "wallets", "subcategory": "eCash", "name": "Cashu", "url": "https://xmr.club/wallets/cashu", "twin": "https://xmr.club/llm/wallets/cashu.txt", "tagline": "Chaumian eCash on Bitcoin. Blinded signatures = zero-knowledge balance for the mint. Settled on Lightning.", "review": "Cashu protocol implements David Chaum's 1980s eCash on top of Bitcoin/Lightning. The mint holds funds in Lightning channels but can't see who has how much — blinded BDH signatures break the link between deposit and withdraw. Multiple clients (Nutshell ref impl, Minibits, eNuts, Cashu.me) and many public mints. Trade-off: you trust the mint operator not to disappear with funds; in exchange you get instant offline-capable e-cash with no chain footprint per spend.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "custodial", "open_source", "lightning_native" ], "highlight_tags": [ "E-CASH", "LIGHTNING", "PRIVACY" ], "fees": { "summary": "Mint-fee varies · Lightning settle · Chaumian privacy" }, "fees_summary": "Mint-fee varies · Lightning settle · Chaumian privacy", "last_verified": "2026-05-13", "operating_since": "2022", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2022", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://cashu.space", "outbound_slug": "cashu", "twitter": "https://x.com/cashubtc", "telegram": "https://t.me/CashuBTC", "matrix": "https://matrix.to/#/dev:matrix.cashu.space" }, "also_listed_at": { "web3privacy": true } }, { "id": "coin-wallet", "category": "wallets", "subcategory": "Multi-Chain", "name": "Coin Wallet", "url": "https://xmr.club/wallets/coin-wallet", "twin": "https://xmr.club/llm/wallets/coin-wallet.txt", "tagline": "Multi-coin wallet with first-class XMR support and non-custodial key storage. MIT open source, ten-year operator (CoinSpace LLC, US). In-app buy/sell/swap routes through KYC-triggering partners — anonymous wallet, non-anonymous rails.", "review": "Coin Wallet is a **multi-chain non-custodial wallet** with first-class Monero support, available on web, iOS, Android, Windows, macOS, Linux, and Tor. **MIT open source** (`github.com/CoinSpace/CoinSpace`, 456 stars, actively maintained since 2015). Listed at **Grade C** because the wallet itself is anonymous and non-custodial, but the in-app buy / sell / swap surface routes through **ten partners that can trigger KYC** — worth understanding clearly before using those rails.\n\n**Non-custodial, confirmed.** Both marketing copy and the Terms of Service are explicit: *\"Coin Wallet stores your Wallet address but does not receive or store your Wallet passphrase, encrypted private key, unencrypted private key, or mnemonic.\"* Keys live on-device; the operator does not hold funds. This is the standard local-storage-with-backup-your-own-seed model.\n\n**First-class XMR.** Monero has dedicated product pages (`/monero-wallet/`, `/monero-wallet-online/`, `/monero-wallet-for-android/`, `/swap-monero/`). Marketing claim: view key stays on-device (light-wallet architecture — routes through the operator's Monero backend, similar to MyMonero pattern). Send / receive / store all supported. Custom-node / subaddress support not confirmed from public pages — verify in-wallet if you require a self-hosted daemon.\n\n**The KYC caveat — critical.** The Terms of Service explicitly enumerates the third-party rails wired into the wallet, and each may trigger KYC:\n\n- **Swap partners:** Changelly, ChangeNOW, ChangeHero, LetsExchange (ToS warns each *\"may trigger AML/KYC verification\"*).\n- **Buy / sell (fiat on/off-ramp) partners:** MoonPay, Paybis, Bitnovo, BTC Direct, Guardarian, Onramper (all KYC by their own ToS).\n\nThe wallet itself is **anonymous-signup** — install and use without an email or account. KYC only appears if you opt into a fiat rail or a swap route that flags AML thresholds. This is the same posture as Exodus, Trust, Cake's in-app buy — the submitter's characterization *(\"KYC may only be requested when buying, selling, or exchanging xmr via internal providers\")* is accurate. Use the wallet for storage and self-sourced XMR without touching a KYC surface; if you use the in-app buy/sell or a swap route, name the partner and read their KYC posture first.\n\n**Operator identity.** CoinSpace LLC, State of Georgia (US), Fulton County jurisdiction per ToS. Data storage claimed to be EU. Founder Jonathan Speigner. Contact `support@coin.space`. **Explicit brand-disambiguation notice** on the site distinguishing from an unrelated Malta *Coinspace Ltd.* that carried a 2016 MFSA warning — different entity, note filed.\n\n**Longevity.** Operating since 2015 (~10 years). MIT-licensed source on GitHub with active commit history and 456 stars. Distribution via App Store, Play Store, Microsoft Store, macOS App Store, Snap Store, AppGallery, and a Tor Wallet build. This is a mainstream multi-coin wallet, not a boutique privacy tool.\n\n**Privacy community placement — a caveat honest readers care about.** **Privacy Guides does not recommend Coin Wallet** for Monero — their shortlist is Official GUI / Cake / Feather / Monerujo. Monerica also does not surface Coin Wallet in its Monero-wallet section. If you are optimising for privacy-community-endorsed picks (self-hosted daemon, sovereign-node routing, privacy-audit history), Feather / Cake / Monerujo remain the picks. Coin Wallet is a legitimate mainstream option that also supports XMR, not a privacy-first specialist.\n\n**Grade C — what it means here.** Non-custodial + real XMR + MIT open source + 10-year tenure clears the wallet-listing bar. Doesn't reach B because: (a) not privacy-community-endorsed (Feather / Cake / Monerujo are the picks for XMR-first users); (b) light-wallet backend routes through operator infrastructure with no obvious own-node option surfaced; (c) in-app buy/sell/swap is thoroughly KYC-partnered — the wallet is anonymous but the crypto-on-ramp surface is not.\n\n**Useful when.** You are a mainstream multi-coin user who wants Monero support in the same wallet as your other assets, comfortable with a light-wallet backend routing through the operator's infrastructure, and you either won't use the in-app buy/sell/swap or you understand which partner will KYC when. For **XMR-only privacy-first storage**, prefer Feather, Cake, Monerujo, or the official GUI/CLI.", "translation_locale": "en", "rating": { "grade": "C", "trust": "CoinSpace LLC (US, Georgia), founder Jonathan Speigner, operating since 2015. MIT open source on GitHub (~456 stars, active). Explicit brand disambiguation from a 2016-warned unrelated Malta entity. Not privacy-community-endorsed (Privacy Guides + Monerica do not list). Trustpilot rating not evaluated (fetch blocked).", "privacy": "Non-custodial — keys stored on device, operator holds no funds (ToS explicit). Anonymous wallet signup (no email, no account required). Light-wallet Monero backend routes through operator infrastructure (view-key-on-device claim); no user-selectable-node option surfaced in public pages. **In-app buy/sell/swap wired to 10 KYC-triggering partners** (Changelly, ChangeNOW, ChangeHero, LetsExchange, MoonPay, Paybis, Bitnovo, BTC Direct, Guardarian, Onramper).", "ux": "Cross-platform: web, iOS, Android, Windows, macOS, Linux, Tor. Trailing-slash URL scheme (bare paths 404, canonical paths end in /). Dedicated XMR product pages. Standard multi-coin wallet UX." }, "grade": "C", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "multi_chain" ], "highlight_tags": [ "NON-CUSTODIAL", "OPEN-SOURCE", "MULTI-CHAIN", "10-YEAR OPERATOR" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-03", "operating_since": "2015", "tenure_note": "~10 years operating (since 2015). Not endorsed by Privacy Guides or Monerica for Monero use — mainstream multi-coin wallet, not a privacy-community pick.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://coin.space", "source": "https://github.com/CoinSpace/CoinSpace", "outbound_slug": "coin-wallet", "tor": "http://coinspacezp5mmyuicbz2hoafbnduj4vzkttq3grn5mnwdue5t343zid.onion" }, "also_listed_at": { "monerica": true, "web3privacy": true } }, { "id": "coldcard", "category": "wallets", "subcategory": "Hardware", "name": "Coldcard", "url": "https://xmr.club/wallets/coldcard", "twin": "https://xmr.club/llm/wallets/coldcard.txt", "tagline": "Bitcoin-only hardware wallet by Coinkite. Air-gapped via PSBT-on-SD. Reference signer for Bitcoin maxis.", "review": "ColdCard is Coinkite's Bitcoin-only hardware wallet, built for users who treat their signing device as a hostile-environment appliance: dual secure elements, a true air-gap option, and a long list of anti-coercion features that assume someone may eventually point a wrench at you.\n\n**Background**\nMade in Canada by Coinkite, ColdCard (current models Mk4 and the keyboard-equipped Q) has earned a reputation as the signer of choice for security-maximalist Bitcoiners. The firmware is source-available and the device is designed so that it can be used entirely offline, passing signed transactions via microSD card or QR rather than ever touching a computer's USB stack if you prefer.\n\n**What you trust**\nYou trust two independent secure-element chips (a defense-in-depth design so a break in one does not expose the seed), the source-available firmware, and Coinkite's track record. The air-gap modes let you minimize trust in your connected machine entirely — PSBTs move on a microSD card or, on the Q, by QR.\n\n**Operational specs**\nBitcoin-only. Dual secure elements; PIN with anti-phishing words that prove the device hasn't been swapped; optional \"duress\" PINs that open a decoy wallet, and a \"brick-me\" PIN that destroys the secure element. Trick PINs, BIP39 passphrases, and multisig are all supported. The Q model adds a full keyboard, larger screen, and built-in QR scanner; the Mk4 favors microSD and NFC. Fully functional in a permanently air-gapped workflow with Sparrow, Electrum, and others.\n\n**Philosophy**\nColdCard's design philosophy is adversarial: assume the supply chain, the connected computer, and even the physical custody of the device may be compromised, and engineer countermeasures for each. The duress and brick-me PINs are an explicit acknowledgment that the threat is sometimes a person, not just malware.\n\n**Grade rationale**\nGrade A. A mature, defense-in-depth signer with genuine air-gap capability and the deepest anti-coercion feature set in the category. The Bitcoin-only scope and the source-available (rather than fully free) firmware license are the only marks against an otherwise exemplary security posture.\n\n**Useful when**\nYou hold meaningful Bitcoin and want a battle-tested, air-gappable signer; you need duress/decoy features for plausible deniability; you are building multisig and want a coordinator-agnostic device; you prefer microSD/QR transfer over USB trust.\n\n**Caveats**\nBitcoin-only — not a Monero device. Firmware is source-available, not fully open-source/free, which some purists weigh against it. The breadth of security features has a learning curve; misconfigured duress or passphrase setups can lock you out as effectively as an attacker. Buy only from Coinkite or authorized resellers to limit supply-chain risk.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "non_custodial", "open_source", "multisig_supported", "audited" ], "highlight_tags": [ "HARDWARE", "BTC-ONLY", "PSBT" ], "fees": { "summary": "$120 hardware · Bitcoin-only · PSBT-via-SD" }, "fees_summary": "$120 hardware · Bitcoin-only · PSBT-via-SD", "last_verified": "2026-05-13", "operating_since": "2017", "tenure_note": "Coinkite (parent) founded 2012; Coldcard hardware wallet product launched ~2017-2018. Domain WHOIS 2003 is premium-domain.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://coldcard.com", "outbound_slug": "coldcard", "twitter": "https://x.com/nvk", "telegram": "https://t.me/coldcard" } }, { "id": "edge", "category": "wallets", "subcategory": "Multi-Chain", "name": "Edge Wallet", "url": "https://xmr.club/wallets/edge", "twin": "https://xmr.club/llm/wallets/edge.txt", "tagline": "Multi-chain mobile wallet — XMR + BTC + USDT (multi-chain) + 100+ assets.", "review": "Mobile-first, multi-chain, with a usable XMR implementation. Picks for users who want one app for everything but still want self-custody.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "xmr_native", "multi_chain", "2fa_supported", "thin_client" ], "highlight_tags": [ "MOBILE", "MULTI-CHAIN" ], "fees": { "summary": "Free · Network fees only · third-party swap fees on in-app exchanges" }, "fees_summary": "Free · Network fees only · third-party swap fees on in-app exchanges", "last_verified": "2026-05-11", "operating_since": "2018", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://edge.app", "outbound_slug": "edge", "contact_email": "info@edge.app", "twitter": "https://x.com/EdgeWallet", "discord": "https://discord.com/invite/hntBJXpu9e" }, "also_listed_at": { "web3privacy": true, "privacyguides": true } }, { "id": "eigenwallet", "category": "wallets", "subcategory": "Atomic Swap", "name": "EigenWallet", "url": "https://xmr.club/wallets/eigenwallet", "twin": "https://xmr.club/llm/wallets/eigenwallet.txt", "tagline": "Atomic-swap BTC ↔ XMR DEX wallet — non-custodial, GPL, Tor-aware. Fork of UnstoppableSwap / xmr-btc-swap.", "review": "**Battle-tested Monero ↔ Bitcoin atomic-swap DEX wallet** — non-custodial, GPL-3.0, Tor-aware, with a desktop GUI (Tauri) and a CLI/server pair for running your own market-making node. Formerly known as **UnstoppableSwap**, forked from the original `comit-network/xmr-btc-swap` reference implementation, eigenwallet has been live for ~3 years and ships under the `eigenwallet/core` repo. Listed at **Grade B** because the underlying atomic-swap protocol is the canonical no-third-party path between BTC and XMR — fully self-custodial, no operator on the data path, no account anywhere — but the operator surface is sparse (single-page landing on GitHub Pages with no separate /about, /privacy, or /terms page) and there is an **active maker-side vulnerability advisory as of 2026-05-25** (see incident banner above).\n\n**What it is.** EigenWallet is a desktop wallet + atomic-swap DEX in one binary. You hold BTC and XMR keys locally; when you want to swap, the wallet pairs you peer-to-peer with a **market-maker** running an ASB (Atomic Swap Backend) over Tor, executes the trustless cross-chain protocol on-chain, and settles directly between your wallets. There is no order book on eigenwallet's servers, no custody intermediate, no KYC layer, and no recoverable counterparty risk — if the maker disappears mid-swap, the protocol's refund timelocks return your funds. **GUI** ships for Linux / macOS / Windows; mobile is on the roadmap. The CLI + ASB are how a maker provides liquidity and earns a spread on every fill.\n\n**Background.** Forked in 2023 from `comit-network/xmr-btc-swap` (the original Bitcoin ↔ Monero atomic-swap reference written by Coblox / CoinSwap researchers) and shipped as **UnstoppableSwap** by an independent maintainer team. **Rebranded to eigenwallet in 2025** with an explicit founder statement; the rebrand kept the codebase, the Matrix room, and the maker community intact. ~118 releases shipped, 3,750+ commits, Rust + TypeScript stack. Funding came partly from **Monero Community Crowdfunding (CCS)** proposals for protocol-maturity work.\n\n**What you trust.**\n\n- **Self-custody.** Your seed never leaves your machine. The wallet uses standard `monero-wallet-rpc` and Bitcoin libraries; you can verify balances against your own monerod / Bitcoin Core if desired.\n- **GPL-3.0 source.** Codebase at `github.com/eigenwallet/core` is fully auditable. Forkable under the GPL if the project ever stops being maintained.\n- **No account at any stage.** Download binary → verify signatures → run. No eigenwallet account exists.\n- **Tor-integrated.** Both the GUI and the ASB speak Tor natively; makers expose ASB onion services and takers connect via Tor by default. This is the only Bitcoin ↔ Monero direct swap path that's Tor-native end-to-end.\n- **No platform commission.** Eigenwallet itself takes nothing per swap. The only spread is what each market-maker quotes; you can compare makers in-wallet and pick the tightest.\n- **Signed releases.** Binaries published on GitHub Releases with maintainer signatures.\n\n**Operational specs.**\n\n- **Install.** Download from `eigenwallet.org/download` (Linux / macOS / Windows), verify the signature, run. Mobile is on the roadmap. Source build: `git clone github.com/eigenwallet/core && cargo build --release`.\n- **Coin coverage.** Bitcoin ↔ Monero only. No other pairs supported — the protocol is BTC ↔ XMR-specific.\n- **Maker side (ASB).** Separate CLI binary (`asb`) that takers connect to. Run on a VPS with Tor; takes funds from your BTC and XMR wallets, sets a spread, fills incoming requests. **Currently advised to shut down — see incident.**\n- **SEPA on-ramp.** EU users can buy XMR via a SEPA fiat path linked from the landing page (EU only).\n- **Repositories.** `github.com/eigenwallet/core` (main monorepo: swap binaries, GUI, libraries). `docs.eigenwallet.org` for user + maker documentation (work-in-progress).\n- **Community.** Matrix room linked from the homepage; a separate `eigenwallet-makers` Matrix room coordinates ASB operators (this is where the 2026-05-25 vulnerability advisory was posted).\n- **Updates.** Manual — pull a new release from GitHub, replace the binary, restart. Currently shipping ~weekly during active development.\n\n**Operator philosophy.** The project framing on `eigenwallet.org` is uncompromising: *\"Swap Bitcoin → Monero with protocol-guaranteed safety (no frozen funds, no fraud, no scams, no KYC ever).\"* The rebrand statement on the GitHub org positions eigenwallet as a **maintained continuation of the BTC ↔ XMR atomic-swap effort** — distinct from the original `comit-network` repo (which is no longer actively maintained) and from the wider Haveno / Bisq P2P-trade lineage (which use different protocols and have had their own 2026 exploits — see the haveno + bisq incident entries). The team treats the **ASB ecosystem as a first-class citizen** rather than just shipping a taker GUI: every release tests maker workflows, and the maintainers actively coordinate operator-side communication via Matrix.\n\n**Grade rationale.** Listed at **Grade B** rather than A because: (1) the operator surface is sparse — eigenwallet.org is a single GitHub Pages landing with no separate privacy policy, terms, or contact page; the documentation lives elsewhere (docs.eigenwallet.org, work-in-progress); (2) there is an **active maker-side vulnerability advisory** as of 2026-05-25; (3) reproducible builds are not yet documented (binaries are signed but build determinism is unverified). The grade ceiling here is held by **operator transparency**, not the protocol — the underlying atomic-swap mechanism is mathematically trustless and the codebase is GPL-auditable. If the maintainers ship a post-mortem + patched release + clean reproducible-build pipeline + a public privacy/contact page, this is an A candidate.\n\n**Useful when:**\n\n- You want to swap BTC → XMR (or XMR → BTC) **without any intermediary** ever holding your funds — no custodial exchange, no swap aggregator, no KYC.\n- You're a Monero or Bitcoin holder who prefers **on-chain settlement with cryptographic safety guarantees** over the speed of a custodial swap.\n- You run a VPS and want to **earn a spread as a market-maker** on the BTC ↔ XMR pair (currently advised to halt — see incident).\n- You're operationally Tor-first and want the only **end-to-end Tor-native** BTC ↔ XMR atomic-swap stack.\n- You're an EU user who wants a direct **SEPA → XMR** path inside a self-custodial wallet (no exchange account needed).\n- You're researching atomic-swap protocols and want a **production-grade Rust reference implementation** to study.\n\n**Caveats:**\n\n- **Active vulnerability advisory (2026-05-25).** See incident banner. Don't run an ASB until a patched release ships. Taker-side use is technically possible but maker liquidity has thinned out — verify the maker you pair with is on a current build.\n- **Operator surface is sparse.** Single-page landing on GitHub Pages, no separate privacy policy, terms, contact page, or AML statement. Documentation is split between the homepage, `docs.eigenwallet.org` (work-in-progress), and the GitHub README.\n- **Reproducible builds not documented.** Binaries are signed but build determinism (per the standard Monero / Bitcoin Core Guix pattern) is not yet established. For high-threat-model use, build from source.\n- **BTC ↔ XMR only.** No other pairs. If you need XMR → fiat or XMR → another altcoin, you'll need a separate path (see exchanges).\n- **Speed and minimum trade size depend on the maker.** The protocol takes one BTC confirmation + XMR finality to settle; expect ~30-60 min end-to-end. Makers set their own minimums (typically 0.001+ BTC).\n- **Mobile not yet shipped.** Roadmap item; for now this is a desktop-only experience.\n- **Project history.** Forked + rebranded twice (comit-network → UnstoppableSwap → eigenwallet) — the codebase is the same lineage but the brand continuity is worth knowing if you're auditing historical commits.\n- **Single maintainer team.** Like the broader xmr-btc-swap lineage, eigenwallet has a small (~5-10) active contributor base. If the team loses interest, the protocol still works (anyone can run the binaries) but feature development would slow.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "xmr_native", "tor_mirror", "atomic_swap", "self_hosted" ], "highlight_tags": [ "ATOMIC SWAP", "GPL", "TOR" ], "fees": { "summary": "Per-swap maker spread (set by each market-maker) + on-chain BTC/XMR network fees. No platform commission — the protocol is permissionless and the eigenwallet team takes nothing per trade." }, "fees_summary": "Per-swap maker spread (set by each market-maker) + on-chain BTC/XMR network fees. No platform commission — the protocol is permissionless and the eigenwallet team takes nothing per trade.", "last_verified": "2026-05-27", "operating_since": "2025", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://eigenwallet.org", "outbound_slug": "eigenwallet", "twitter": "https://x.com/eigenwallet", "matrix": "https://matrix.to/#/unstoppableswap-space:matrix.org", "discord": "https://discord.gg/aqSyyJ35UW" }, "incident": { "date": "2026-05-25", "severity": "high", "summary": "Maintainers advised market-makers (eigenwallet-makers Matrix) to shut down their ASB (Atomic Swap Backend) on 2026-05-25 due to an actively-exploitable vulnerability. A 2026-05-29 developer correction states the impact is worse than first reported: a malicious swap can net the attacker the full XMR while the maker recovers only ~10% of their BTC. Mitigation has since shipped — v4.7.9 (2026-05-29) makes the ASB refuse cooperative XMR-redeem requests when the BTC received is <75% of the BTC sent into the swap; the latest release is 4.7.10 (2026-06-02). Still no public CVE or formal post-mortem.", "curator_advice": "Don't run an ASB / market-maker right now. Taker-side swaps may still be possible against makers who are online, but trade volume has dried up while operators wait for the patch. We'll update this entry the moment a fixed release ships or the maintainers publish a post-mortem. Track github.com/eigenwallet/core/releases and the Matrix room linked from eigenwallet.org.", "source_url": "https://github.com/eigenwallet/core/releases", "i18n": { "zh": { "summary": "維護者於 eigenwallet-makers Matrix 聊天室中建議做市商立即關閉其 ASB（原子交換後端），原因是一個可能正在被活躍利用的漏洞。截至 2026-05-27，尚未發布公開的 CVE、事後分析或修復版本（最新版本為 4.6.5，2026-05-26）— 運營者公告僅透過 Matrix 發布。", "curator_advice": "目前不要執行 ASB / 做市商。針對仍在線的做市商，接受者端交換可能仍可進行，但交易量在做市商等待修補程式的期間已經枯竭。我們將在修復版本發布或維護者發布事後分析的那一刻更新此條目。請追蹤 github.com/eigenwallet/core/releases 和從 eigenwallet.org 連結的 Matrix 聊天室。" }, "es": { "summary": "Los mantenedores aconsejaron a los creadores de mercado en la sala Matrix eigenwallet-makers que apagaran su ASB (Atomic Swap Backend) inmediatamente debido a una vulnerabilidad que podría estar siendo explotada activamente. A fecha 2026-05-27 no se ha publicado ningún CVE público, post-mortem o lanzamiento corregido (el último es 4.6.5, 2026-05-26) — el aviso del operador fue solo por Matrix.", "curator_advice": "No ejecutes un ASB / creador de mercado en este momento. Los swaps del lado tomador aún pueden ser posibles contra creadores que estén en línea, pero el volumen de operaciones se ha secado mientras los operadores esperan el parche. Actualizaremos esta entrada en el momento en que se publique un lanzamiento corregido o los mantenedores publiquen un post-mortem. Sigue github.com/eigenwallet/core/releases y la sala Matrix enlazada desde eigenwallet.org." }, "ru": { "summary": "Мейнтейнеры посоветовали маркет-мейкерам в комнате Matrix eigenwallet-makers немедленно отключить свои ASB (Atomic Swap Backend) из-за уязвимости, которая может активно эксплуатироваться. По состоянию на 2026-05-27 не опубликовано ни публичного CVE, ни пост-мортема, ни исправленного релиза (последний — 4.6.5, 2026-05-26) — предупреждение оператора было только в Matrix.", "curator_advice": "Не запускайте ASB / маркет-мейкера прямо сейчас. Свопы на стороне тейкера всё ещё могут быть возможны против мейкеров, находящихся в сети, но объём торгов иссяк, пока операторы ждут патча. Мы обновим эту запись в тот момент, когда выйдет исправленный релиз или мейнтейнеры опубликуют пост-мортем. Отслеживайте github.com/eigenwallet/core/releases и комнату Matrix, ссылка на которую есть на eigenwallet.org." } }, "timeline": [ { "date": "2026-05-25", "note": "Maintainers advised market-makers (eigenwallet-makers Matrix) to shut down their ASB (Atomic Swap Backend) due to an actively-exploitable vulnerability." }, { "date": "2026-06-11", "note": "No new public developments per the weekly incident-watch scan; advisory stands until an all-clear / patched-ASB confirmation is published." } ] }, "also_listed_at": { "kycnot": true, "monerica": true, "web3privacy": true } }, { "id": "feather", "category": "wallets", "subcategory": "Desktop", "name": "Feather Wallet", "url": "https://xmr.club/wallets/feather", "twin": "https://xmr.club/llm/wallets/feather.txt", "tagline": "Lightweight XMR desktop wallet — fast sync via remote node, Tor/Onion friendly.", "review": "Feather Wallet is the privacy-focused desktop Monero wallet — community-built, fully open source, reproducibly buildable, with built-in Tor + I2P transports, multisig support, hardware wallet integration, and full-node-capable architecture. Listed at **Grade A · editor's pick** because it is the most privacy-aligned desktop wallet in the Monero ecosystem: no telemetry, no integrated swap that could siphon data, no opt-out tracking, Tails-friendly first-class build, and a desktop-grade GUI that surfaces most of the official Monero CLI feature set for users who want the depth.\n\n**Background.** Started by `dsc` / `tobtoht` (handle @tobtoht on X), Feather has been actively developed since 2020-2021 and is now the maintainer's full-time work — funded via Monero Community Crowdfunding System (CCS) proposals approved by the community. Source code at github.com/feather-wallet/feather. Cross-platform: Linux (glibc ≥ 2.31), Tails / Whonix, Windows 10+, macOS 12+, plus ARM32 / ARM64 / RISC-V builds. Latest release at the time of this review: 2.8.1 (2025-04-14). Active changelog with monthly-ish release cadence and a stated philosophy of \"test-bed for experimental features that may later be adopted in the reference wallets\" — meaning Feather often ships UX or privacy refinements ahead of the official Monero GUI.\n\n**What you trust.** Non-custodial — your wallet keys never leave your machine. The seed is generated locally (25-word mnemonic or polyseed), wallet files are encrypted on disk with a passphrase, and signed releases are published via GPG with a signing key available in the public Git repo. Reproducible builds let independent reviewers verify the binary matches the source. No phone-home telemetry, no integrated swap module that could correlate user identities with transactions, no third-party API calls beyond the user-selected remote node + Tor / I2P circuits. The \"trust the operator\" surface is effectively zero — what you trust is the GPG signing key + the reproducibility of the build.\n\n**Operational specs.** Storage: local wallet file (encrypted), single-account or multi-account, optional Trezor / Ledger hardware wallet integration. Network: connects to a user-chosen remote Monero node by default (skips the multi-day initial chain sync), but can also run as a full-node-capable wallet for users who run their own monerod. Transport: native Tor support (bundled Tor binary, automatic routing), I2P support, clearnet. Privacy features: subaddress generation, coin-control with output freezing, transaction QR scanner, payment URI / OpenAlias, CSV transaction export with date-range filtering. Advanced: multisig wallets, hardware-wallet pairing, paper wallet generation. Onion mirror operator-published: featherdvtpi7ckdbkb2yxjfwx3oyvr3xjz3oo4rszylfzjdg6pbm3id.onion.\n\n**Philosophy.** Feather's editorial differentiator is the **deliberate absence of monetization surfaces**. The wallet has no integrated swap (which would expose pair + amount + timing to a third party), no embedded marketplace, no built-in payment-processor onboarding, no fiat ramp module. The trade-off — fewer in-wallet conveniences — is the point: every embedded service is a privacy concession, and Feather chose to ship none. Pair this with the test-bed philosophy and you get a wallet that's both more conservative (privacy-wise) and more experimental (UX-wise) than the official Monero GUI.\n\n**Grade rationale.** Grade A and editor's pick reflect: full open-source + reproducible builds + signed releases (verifiable trust chain); deliberate no-telemetry / no-third-party-integration posture; native Tor + I2P transport without external proxy setup; hardware wallet + multisig support (covers high-threat users); active full-time maintainer with CCS-funded continuity; first-class Tails / Whonix builds; absence of any security incidents, CVEs, or supply-chain concerns in the last 24+ months; consistent community positioning as the default privacy-oriented desktop wallet alongside or ahead of monero-gui. Last verified 2026-05-11.\n\n**Useful when.** You want a Monero desktop wallet that gives you the official-CLI feature set with a usable GUI on top. You're running Tails / Whonix or a similarly hardened OS and need a wallet that doesn't fight the threat model. You want to use a hardware wallet (Ledger / Trezor) for cold-storage signing without giving up Tor routing. You want a wallet that **doesn't** include an integrated swap (which is a privacy concession). You're new to Monero and want a wallet that ships with sane defaults but lets you ratchet up later.\n\n**Caveats.** Desktop only — no official mobile build (use Monerujo or Cake Wallet for Android; Cake Wallet for iOS). The \"no integrated swap\" stance means you'll route swaps through external aggregators (Trocador, the kyc.rip aggregator, etc.) — a feature for privacy, a friction for users who want one-app convenience. Remote-node default exposes your tx queries to whichever node operator you choose; for adversarial-threat use, point Feather at your own monerod over Tor. macOS 11 dropped support in 2.8.0 — Apple dropped macOS 11 as a build target for the toolchain Feather depends on. No formal third-party security audit has been publicly documented — the trust chain rests on reproducible builds + community code review rather than a paid audit. For users in the highest-threat tier, that's worth weighing against the alternative (running monero-gui or the CLI directly).", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A", "trust": "Community-built, fully open-source and reproducibly buildable — the most privacy-aligned desktop Monero wallet. No telemetry, no opt-out tracking. Non-custodial. Editor's pick.", "privacy": "Built-in Tor + I2P transports, no telemetry, no integrated data-siphoning swap, Tails-friendly first-class build. Multisig + hardware-wallet support. Nothing about your usage leaves the machine unless you pick a remote node.", "ux": "Lightweight desktop GUI, fast sync via remote node (or run your own), Tor/onion-friendly. Aimed at privacy-conscious desktop users, not first-timers." }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "xmr_native", "tor_mirror", "multisig_supported", "full_node_capable" ], "highlight_tags": [ "XMR NATIVE", "TOR" ], "fees": { "summary": "Free · Monero network fees only" }, "fees_summary": "Free · Monero network fees only", "last_verified": "2026-05-11", "operating_since": "2020", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://featherwallet.org", "tor": "http://featherdvtpi7ckdbkb2yxjfwx3oyvr3xjz3oo4rszylfzjdg6pbm3id.onion", "outbound_slug": "feather" }, "also_listed_at": { "web3privacy": true } }, { "id": "fedimint", "category": "wallets", "subcategory": "eCash", "name": "Fedimint", "url": "https://xmr.club/wallets/fedimint", "twin": "https://xmr.club/llm/wallets/fedimint.txt", "tagline": "Federated Chaumian e-cash. Trust split across a federation instead of a single mint operator.", "review": "Fedimint reimagines custody as a community problem rather than a binary between risky self-custody and trusting a single exchange: a federation of guardians collectively runs a Chaumian e-cash mint backed by Bitcoin, giving members private, bearer-like ecash that no single party can freeze or surveil.\n\n**Background**\nFedimint is an open-source protocol (not a single app) for federated community custody. A group of trusted-but-distributed guardians runs the mint under threshold cryptography, so no one guardian holds the keys or can act alone. Members deposit Bitcoin and receive ecash tokens they can spend privately within the federation or bridge out over Lightning.\n\n**What you trust**\nYou trust a federation — a quorum of guardians — rather than one custodian, and the open protocol that bounds what any guardian can do. The privacy comes from Chaumian blind signatures: the mint issues and redeems ecash without being able to link tokens to users, so spending is private even from the guardians themselves.\n\n**Operational specs**\nThreshold-controlled mint (e.g. requiring a supermajority of guardians) backed by on-chain Bitcoin. Chaumian ecash for private, instant, offline-capable transfers within the federation. A Lightning gateway bridges ecash to the wider Bitcoin/Lightning network. Modular architecture; the ecosystem (wallets, gateways) is maturing rapidly.\n\n**Philosophy**\nFedimint targets the millions for whom solo self-custody is impractical and a single custodian is unacceptable. By distributing trust across a community's guardians and adding Chaumian privacy, it offers a middle path — \"trust-minimized community custody\" — that keeps Bitcoin private and censorship-resistant at human scale.\n\n**Grade rationale**\nGrade A. A genuinely novel, privacy-first custody model with strong cryptographic foundations and an active open-source community. It is graded on its design and trajectory; the caveat is maturity — federations and tooling are still early, and the trust model is only as good as the guardians chosen.\n\n**Useful when**\nSolo self-custody is impractical for you or your community; you want Bitcoin held without a single custodian; you value Chaumian transaction privacy; you're part of a community (mutual, region, group) that can run or join a federation.\n\n**Caveats**\nYou are trusting the federation's guardians — vet who runs your mint; a malicious or compromised quorum is the failure mode. The ecosystem is young, so expect rough edges and evolving software. Ecash is a bearer asset — lose your wallet's tokens and there is no recovery. Not a Monero tool; privacy is Chaumian within the federation, not network-level anonymity.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "custodial", "open_source", "lightning_native", "multisig_supported" ], "highlight_tags": [ "E-CASH", "FEDERATED", "LIGHTNING" ], "fees": { "summary": "Federation-fee varies · threshold guardians · Lightning" }, "fees_summary": "Federation-fee varies · threshold guardians · Lightning", "last_verified": "2026-05-13", "operating_since": "2021", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://fedimint.org", "outbound_slug": "fedimint", "twitter": "https://x.com/obi", "telegram": "https://t.me/fedimint" }, "also_listed_at": { "web3privacy": true } }, { "id": "guarda", "category": "wallets", "subcategory": "Multi-Chain", "name": "Guarda", "url": "https://xmr.club/wallets/guarda", "twin": "https://xmr.club/llm/wallets/guarda.txt", "tagline": "Multi-chain non-custodial wallet, first-class XMR since 2017 — a convenience-focused light wallet; in-app buy/swap routes through partner KYC.", "review": "Guarda is a **multi-chain non-custodial wallet** that has carried first-class Monero support since 2017 — a dedicated XMR wallet across web, browser extension, desktop (Windows/macOS/Linux), and mobile (iOS/Android). Keys stay on your device, Guarda never holds your funds, and creating a wallet needs no account or email.\n\nTwo things keep this at the convenience end of the shelf rather than the privacy end. First, the **core app is proprietary** — you are trusting Guarda's binaries, not auditable source, which is the line that separates it from open-source wallets like [Cake](/wallets/cake-wallet) or [Stack](/wallets/stack-wallet). Second, Guarda's Monero support is a **generic light wallet** — XMR is one of 400+ assets, talking to a remote node with less Monero-specific depth than a Monero-native wallet ([Cake](/wallets/cake-wallet), [Feather](/wallets/feather), [Monerujo](/wallets/monerujo)) that can point at your own node. Its in-app Buy / Sell / Exchange does route through KYC partners — but so does most multichain software, including A-rated Cake, so that's a shared trait, not what holds the grade here.\n\nThe Monero wallet itself is a **light wallet**: it talks to a remote node rather than syncing the full chain, which is convenient but weaker on privacy and trust-minimization than a dedicated Monero wallet ([Feather](/wallets/feather), [Cake](/wallets/cake-wallet), [Monerujo](/wallets/monerujo)) pointed at your own node. Guarda runs a public Monero bug-bounty, a point in its favour on the security-process side.\n\nBottom line: a legitimate, long-running, genuinely non-custodial place to hold XMR alongside other assets — fine as a convenience / multichain wallet, not the tool you reach for when Monero privacy is the priority.", "translation_locale": "en", "rating": { "grade": "C", "trust": "Guarda — publicly-registered legal entity (Portugal, entity ID 516458965, registered office in Lisbon), operating since 2017. Core wallet app is proprietary (closed-source); runs a public Monero bug-bounty (github.com/guardaco).", "privacy": "Non-custodial — keys stay on device, operator holds no funds; no account or email to create a wallet. XMR is a light wallet (remote node). In-app Buy/Sell/Exchange route through third-party partners that apply their own KYC.", "ux": "Cross-platform: web, browser extension, desktop (Windows/macOS/Linux), iOS, Android. Multi-chain; buy/sell/swap built in via partners." }, "grade": "C", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial" ], "highlight_tags": [ "NON-CUSTODIAL", "MULTI-CHAIN", "XMR SINCE 2017", "LIGHT WALLET" ], "fees": null, "fees_summary": null, "last_verified": "2026-08-27", "operating_since": 2017, "tenure_note": "~9 years operating (since 2017). Publicly-registered legal entity (Portugal, ID 516458965).", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://guarda.com", "outbound_slug": "guarda" } }, { "id": "ledger-xmr", "category": "wallets", "subcategory": "Hardware", "name": "Ledger Nano", "url": "https://xmr.club/wallets/ledger-xmr", "twin": "https://xmr.club/llm/wallets/ledger-xmr.txt", "tagline": "Hardware wallet for Monero — secret stays on the device.", "review": "Hardware-key custody for XMR. Pairs with Monero GUI or Feather. The XMR app is a separate install from the default Ledger Live flow.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "non_custodial", "xmr_native" ], "highlight_tags": [ "HARDWARE" ], "fees": { "summary": "Hardware device $79+ · Network fees only" }, "fees_summary": "Hardware device $79+ · Network fees only", "last_verified": "2026-05-11", "operating_since": "2014", "tenure_note": "Ledger SAS founded 2014 (Ledger Nano hardware wallet). ledger.com WHOIS 1994 is premium-domain acquisition.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.ledger.com", "outbound_slug": "ledger-xmr", "twitter": "https://x.com/Ledger", "discord": "https://discord.com/invite/ledger" } }, { "id": "monero-com", "category": "wallets", "subcategory": "Mobile", "name": "Monero.com", "url": "https://xmr.club/wallets/monero-com", "twin": "https://xmr.club/llm/wallets/monero-com.txt", "tagline": "XMR-only fork of Cake — stripped down to just Monero, no chain bloat.", "review": "Monero.com is the **XMR-only fork of Cake Wallet** — same Cake team, same audited codebase, stripped down to just Monero with none of the multi-chain bloat. Launched 2018 alongside Cake's broader app, it's been the default 'I just want a clean Monero mobile wallet, nothing else' option for almost a decade.\n\n**What it is and isn't:**\n\n- It IS a fully non-custodial XMR wallet — your seed phrase is generated on-device, lives in encrypted local storage, never touches the server. View key, spend key, all standard. The app is a remote-node client by default (you pick a node) but supports embedded Wownero-style daemons for true self-hosting.\n- It IS NOT a multi-chain wallet, an exchange, a yield product, or a Web3 anything. Just Monero. By design.\n\n**Why this matters:** most 'crypto wallets' have drifted into ecosystem hubs — multi-chain support, in-app swaps, NFT viewers, Web3 browsers. Each addition is an attack surface + a privacy leak (asset balances visible cross-chain, in-app swap providers tracking pairs you query, fiat ramps adding KYC). Monero.com refuses all of it. The app does Monero, well, and stops there. For an XMR-maxi, that minimalism IS the feature.\n\n**What you trust:** Cake Labs LLC (US-incorporated, doxxed team led by Vik Sharma), the codebase at `github.com/cake-tech/cake_wallet` (BSD-3-Clause), the Monero remote nodes you connect to. The app itself has been third-party audited (Cure53, multiple rounds). Cake's track record over ~8 years is one of the cleanest in Monero — no incidents involving user funds, transparent operator, active engagement with the Monero Research Lab community.\n\n**Operational specs:**\n\n- iOS, Android, macOS, Linux (.deb, .rpm, AppImage), Windows\n- Tor support for both remote-node connection and OS-level routing\n- Standard XMR features: subaddresses, view-only mode (multisig-ish), transaction key export/verify, OpenAlias integration\n- Built-in fiat-pricing display (CoinGecko) that runs only when you open the app\n- No 'rewards', no in-app advertising, no in-app swap (those live in the bigger Cake app)\n- Optional XMR address book stored locally only\n\n**Privacy posture:** anonymous signup (no account creation flow at all — the wallet is the account, like a Bitcoin Core wallet), no analytics, no telemetry, no in-app KYC funnels. The only network calls the app makes by default are: (1) Monero remote node for blockchain sync, (2) fiat price feed (can be disabled). Both are Tor-routable.\n\n**Why we list at A:** non-custodial, open-source, anonymous signup, Tor-supported, audited, doxxed-yet-trustworthy operator, the longest operating track record of any XMR-only mobile wallet, no scope creep into KYC/multi-chain. Standard XMR-native wallet rubric — Monero.com hits every box. The grade has held since first listing.\n\n**Useful when** you want a 'just Monero' mobile experience without any of the multi-chain noise the bigger Cake Wallet ships with, OR you're new to XMR and want the most-conservative mobile entry point, OR you're recommending a wallet to a non-technical friend and don't want to explain why the app shows them Ethereum or NFTs.\n\n**Compared to alternatives in xmr-native:**\n\n- vs **Cake Wallet (full)** — same code, same audits, same team. Cake adds BTC + LTC + USDT + a Trocador-powered in-app swap. Pick Monero.com if you want zero non-XMR surface; pick Cake if you'll use those features.\n- vs **Monerujo (Android)** — Monerujo is the canonical 'power user' Android XMR wallet with deep features (SideKick offline signing, OpenAlias, Yat). Monero.com is more conservative + cross-platform.\n- vs **Feather Wallet (desktop)** — Feather is the desktop-native heavy-feature wallet (TX construction transparency, offline signing). Monero.com is mobile-first.\n\n**Caveats:**\n\n- Default remote-node selection rotates through community nodes; for max privacy run your own node + point Monero.com at it.\n- iOS-specific: App Store sandboxing means the app can't background-sync as aggressively as the Android version; sync time after a long offline gap is longer.\n- The fork relationship with Cake means feature parity occasionally lags (e.g. when Cake ships a new XMR feature, Monero.com gets it within days but not always same-day).\n\n**Verdict:** if your threat model is 'I want XMR on my phone with the least amount of multi-chain surface area', Monero.com is the answer. The Cake team's longevity + audit history + doxxed operations make it as trustworthy as any non-self-built mobile XMR wallet gets.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "xmr_native", "thin_client", "tor_supported", "audited", "doxxed_team", "multi_platform" ], "highlight_tags": [ "NON-CUSTODIAL", "XMR-ONLY", "TOR", "AUDITED" ], "fees": { "summary": "Free · Monero network fees only" }, "fees_summary": "Free · Monero network fees only", "last_verified": "2026-06-01", "operating_since": "2018", "tenure_note": "monero.com is Cake Wallet team's branded portal (~2018). Monero protocol itself launched April 2014 but this listing is the Cake Wallet front, not the protocol.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://monero.com", "outbound_slug": "monero-com", "twitter": "https://x.com/MoneroCom", "telegram": "https://t.me/cakewallet_bot", "github": "https://github.com/cake-tech/cake_wallet" } }, { "id": "monero-gui", "category": "wallets", "subcategory": "Desktop", "name": "Monero GUI", "url": "https://xmr.club/wallets/monero-gui", "twin": "https://xmr.club/llm/wallets/monero-gui.txt", "tagline": "Reference XMR desktop wallet — full node, hardware wallet support, multisig.", "review": "Monero GUI is the **official reference desktop wallet** — distributed by the Monero Project at getmonero.org, packaged with the `monerod` daemon, and the canonical implementation that other Monero wallets (Cake, Monerujo, Feather) variously fork from, extend, or interoperate with. Listed at **Grade A · editor's pick** because it is the canonical reference: when you want to verify \"is this how Monero is supposed to work?\", the GUI is the answer. **Best for desktop users who want the most-conservative wallet posture** — run your own node, store keys locally, sign transactions offline if needed, no convenience layer between you and the protocol.\n\n**Background.** Monero GUI has been maintained by the Monero Project since the early days of the Monero codebase (2014-onward). Built on the same C++ core that powers `monerod` and the CLI wallet — the GUI is essentially a Qt-based frontend over the same wallet RPC interface. Distributed exclusively via **getmonero.org** with signed releases (PGP signatures from named Monero contributors, hash file with developer signatures, reproducible builds documented). Available for **macOS, Windows, Linux** — packaged as installable binaries or standalone .tar archives. The GUI bundles `monerod` so a fresh install can sync the entire blockchain locally (200+ GB and growing); for users who don't want the full-node sync, the GUI also supports **remote node** mode where you connect to a community-run public node or your own remote `monerod`. Open source under the BSD 3-clause license; source code at github.com/monero-project/monero-gui (the GUI specifically) and github.com/monero-project/monero (the core daemon + CLI).\n\n**What you trust.** **Reference implementation** — the Monero Project's contributors who maintain the GUI are the same people who maintain `monerod`, the core protocol, and the cryptographic primitives; there's no \"wallet team vs. protocol team\" disconnect. **Reproducible builds** — official binaries are reproducible from source, meaning anyone with the source can verify that a downloaded binary matches what the published source compiles to. **Signed releases** — every release is signed by named contributors with PGP keys published on getmonero.org and on the Monero Project's well-known release-signing workflow. **Local node by default** — the wallet's most-conservative mode runs your own `monerod` locally so wallet queries don't leak your address graph to any third-party node. **Remote node fallback** — when running your own `monerod` isn't practical (Android, low-storage devices, fresh install before the chain syncs), the wallet supports community-run public nodes; the node sees query timing and IP but cannot see the wallet's keys or amounts. **Cold wallet support** — the GUI has first-class support for **air-gapped signing** workflows: create the wallet on an offline machine, export view-only data, sign transactions offline, broadcast via a separate online machine.\n\n**Operational specs.** **Platforms**: macOS (Intel + Apple Silicon), Windows (x86_64), Linux (multiple distros). **Wallet modes**: full-node (bundles `monerod`, syncs ~200 GB chain locally), remote-node (connects to public or self-hosted `monerod`), watch-only (view-only wallet that can see balance + history but cannot sign), cold-signing (air-gapped offline-signing workflow). **Key derivation**: 25-word mnemonic seed (the canonical Monero seed format) or polyseed (newer 16-word format). **Subaddresses**: full support — generate unlimited subaddresses per account, label them, and use them for incoming payment isolation. **Transaction features**: ring signature size = 16 (Monero protocol default), automatic fee selection with manual override, optional payment IDs (legacy, deprecated for new transactions), transaction proof generation for receipts. **Integrated exchange**: the GUI ships with **Lihui/Cake Wallet partner integrations** for in-wallet swap (XMR↔BTC, etc.) — optional, disabled by default; routes through Cake Wallet's swap aggregator. **Hardware wallet support**: Ledger Nano S/X/Plus and Trezor Model T integration for keys-on-hardware operation. **Tor/I2P proxy**: configurable SOCKS proxy in settings; pair with a local Tor or I2P proxy for network-layer privacy. **Languages**: 30+ UI translations from the Monero translation working group.\n\n**Philosophy.** Monero GUI's editorial differentiator is the **most-conservative-canonical-posture** — it's not the prettiest UI in the Monero ecosystem (Cake and Feather are more polished), it's not the lightest (Cake on mobile is the convenience pick), it's not the most feature-rich third-party (Monerujo has Android-specific features). What the GUI *is*: the reference implementation, with no third-party operator in the trust path, no integrated services you didn't opt into, no telemetry, no convenience layer making decisions for you. For users who want \"verify everything yourself, full-node optional, air-gapped signing supported, every release signed by named protocol contributors,\" the GUI is the canonical pick. The trade-off: UX is functional rather than polished; first-time users coming from polished commercial wallets may find the experience more \"engineering-aesthetic\" than \"consumer product.\"\n\n**Grade rationale.** Grade A and editor's pick reflect: maintained by the Monero Project itself (the canonical operator); open-source BSD-3 codebase; reproducible builds documented; signed releases with PGP keys from named contributors; full-node + remote-node + cold-signing wallet modes; first-class hardware wallet support (Ledger, Trezor); subaddresses, view-only, watch-only feature parity with the protocol; no telemetry, no analytics SDK; 30+ language UI translations; over a decade of operational continuity; cross-listed in essentially every Monero wallet reference. Last verified 2026-05-13.\n\n**Useful when.** You want the canonical Monero wallet — the reference implementation, no third-party operator in the trust path. You want to run your own `monerod` and the GUI's full-node mode handles bundle-and-sync. You're doing **cold-signing** (air-gapped offline-signing) — the GUI's first-class workflow is the canonical option in the Monero ecosystem. You're using a **hardware wallet** (Ledger or Trezor) for keys-on-hardware operation. You want to verify the binary against reproducible builds before installing — the GUI's release workflow supports this end-to-end. You're a Monero developer or contributor and want the same wallet the protocol team uses. You want a wallet that's reasonably feature-rich on macOS / Windows / Linux desktop without the convenience-layer additions of Cake.\n\n**Caveats.** **Desktop only** — no first-party iOS or Android build; mobile users should use Cake Wallet (iOS + Android) or Monerujo (Android). **Full-node mode requires 200+ GB of disk** — growing with the chain; remote-node mode is the practical alternative for laptops or low-storage machines, but trades local-node privacy for remote-node convenience. **Initial sync is slow** — first-time full-node sync can take a day or more depending on hardware and network; the GUI shows progress but doesn't make it faster. **UX is functional-not-polished** — coming from a consumer-finance polish (Cake, Exodus), the GUI feels more like an engineering tool. This is on purpose, but it's a real friction for non-technical users. **Integrated swap is via Cake Wallet's aggregator** — optional and opt-in, but if enabled it routes through a third-party operator; for the most conservative posture, disable the integrated swap and use this directory's aggregator UI separately. **Remote-node trust** — when not running your own `monerod`, the public node sees query timing + IP (not keys or amounts), so high-threat users should run their own node or route the wallet through Tor. **Hardware wallet UX has Monero-specific quirks** — Monero's ring-signature signing flow is more complex on hardware than Bitcoin's; first-time hardware wallet users should expect a learning curve and verify hardware-wallet firmware compatibility against the GUI version. **Tor/I2P routing requires manual setup** — the GUI supports SOCKS proxy configuration but doesn't bundle Tor; you run Tor or i2pd separately and point the GUI at it. For the most-private setup, this is the canonical recipe; for users who want one-click Tor like Feather offers, the GUI is more involved.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "xmr_native", "self_hosted", "multisig_supported", "no_js_supported", "full_node_capable" ], "highlight_tags": [ "OFFICIAL", "XMR NATIVE", "FULL NODE" ], "fees": { "summary": "Free · Monero network fees only" }, "fees_summary": "Free · Monero network fees only", "last_verified": "2026-05-13", "operating_since": "2014", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://www.getmonero.org/downloads/", "tor": "http://monerotoruzizulg5ttgat2emf4d6fbmiea25detrmmy7erypseyteyd.onion", "outbound_slug": "monero-gui" }, "also_listed_at": { "web3privacy": true } }, { "id": "monero-one", "category": "wallets", "subcategory": "Mobile", "name": "Monero.one", "url": "https://xmr.club/wallets/monero-one", "twin": "https://xmr.club/llm/wallets/monero-one.txt", "tagline": "Monero-native mobile wallet by Joe. Clean UX, full chain features, no custodian.", "review": "Monero.one is the rare thing in mobile crypto: a Monero-only wallet built by one developer who clearly uses Monero the way its community intends — non-custodial, full-featured, and answerable to no exchange or token treasury.\n\n**Background**\nMonero.one is an independent mobile wallet from a solo developer known as Joe. It is deliberately single-asset: no token list, no swap-aggregator upsell, no custodial \"earn\" tab — just Monero, done properly. It runs as a native client rather than a thin front-end to someone else's hosted backend.\n\n**What you trust**\nYou trust your own device and the developer's code, not a custodian. Keys are generated and held on the phone; the wallet never takes possession of funds. As with any solo-dev wallet, the deeper trust question is the code itself — so the meaningful diligence is whether builds are open and verifiable, not whether a company is reputable.\n\n**Operational specs**\nSupports the full Monero feature set most multi-coin wallets cut: subaddresses, integrated-payment IDs, view-only (watch) wallets, and multisig. You point it at a remote node of your choice (or a default), so you control which node sees your traffic — pair with a Tor-reachable or your-own node for IP privacy. Clean, focused UX aimed at people who already understand Monero.\n\n**Philosophy**\nMonero.one is a statement against the multi-coin, custodial-feature-creep direction of mainstream wallets. By staying Monero-only and non-custodial, it keeps the threat model simple and the incentives aligned with the user rather than with listing fees or yield products.\n\n**Grade rationale**\nGrade A. Non-custodial, full-feature, single-asset, and independent — exactly the profile Monero users ask for in a mobile wallet. The solo-developer bus factor and the need to verify build openness are the honest caveats, not disqualifiers.\n\n**Useful when**\nYou want a Monero-only mobile wallet without multi-coin bloat; you need subaddresses / integrated payments / view-only / multisig on the go; you prefer pointing at your own node; you value an independent dev over a VC-backed multi-coin app.\n\n**Caveats**\nSolo-developer project — confirm the source is public and builds are verifiable, and weigh the bus factor for long-term reliance. It's a mobile hot wallet: fine for spending balances, not for cold storage of a stake (pair with a hardware/airgapped setup for that). Choose your remote node deliberately — the wallet's privacy is only as good as the node + network path you select.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "xmr_native", "thin_client" ], "highlight_tags": [ "MOBILE", "XMR-NATIVE" ], "fees": { "summary": "Free · mobile · XMR-native" }, "fees_summary": "Free · mobile · XMR-native", "last_verified": "2026-05-13", "operating_since": "2025", "tenure_note": "WHOIS 2025 predates archive.org first snapshot 2018; treated as current-entity year (domain may have been re-registered)", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://monero.one", "outbound_slug": "monero-one", "contact_email": "support@monero.one", "twitter": "https://x.com/joe_io", "telegram": "https://t.me/monero_one" } }, { "id": "monerujo", "category": "wallets", "subcategory": "Mobile", "name": "Monerujo", "url": "https://xmr.club/wallets/monerujo", "twin": "https://xmr.club/llm/wallets/monerujo.txt", "tagline": "Reference Android Monero wallet. F-Droid, open-source, point at your own node or trusted remote.", "review": "Monerujo is the reference Monero-only Android wallet — the privacy-first mobile XMR wallet that Android users gravitate toward when they want an XMR-maximalist option (vs the multi-coin Cake Wallet). Distributed via **F-Droid + Google Play + APK**, open-source from the start, supports Tor + I2P proxies natively, lets you point at your own remote node or run a community node, and has been shipping since the Android-XMR-wallet category effectively didn't exist. Listed at **Grade A · editor's pick** because it's the no-compromise pick for Android users who want a wallet that's structurally Monero-aligned rather than Monero-as-one-of-many-coins.\n\n**Background.** Monerujo has been in active development since 2017, originally led by **m2049r** with a wider contributor community over time. Source code at github.com/m2049r/xmrwallet under the Apache-2.0 license. Funded by community donations (XMR address published in-app + on monerujo.io) plus occasional sponsorship from Monero Community Crowdfunding System (CCS) for specific feature deliverables. Available on **F-Droid** (community-trusted Android free-software store) as the canonical distribution channel, plus Google Play Store (signed identical APK for users who prefer Google's update channel), plus direct APK download from monerujo.io for users avoiding both stores. The wallet is **Monero-only** — no multi-coin sprawl, no integrated swap to other chains, no token-list UI; the editorial choice is to do one thing well.\n\n**What you trust.** Non-custodial — keys generated and stored locally, encrypted with a passphrase, never transmitted to Monerujo servers (there *are* no Monerujo servers in the wallet path). **No telemetry** — the wallet doesn't phone home, doesn't have a \"help us improve\" opt-in that collects usage data, doesn't include analytics SDKs. **Remote node trust**: Monerujo connects to a Monero remote node by default (skipping the multi-week initial chain sync that a full node would require on Android); the user picks which node — community-run public nodes, your own monerod, or a Tor onion node URL. The node sees the wallet's IP and the timing of address queries, but cannot see the keys or amounts (Monero's protocol design protects content from the node). For maximum privacy, point at your own monerod over Tor. **Tor + I2P proxies**: native support — paste an .onion node URL and the wallet routes through Tor automatically; same for I2P.\n\n**Operational specs.** Platform: Android only (no iOS — Apple's App Store policies and Monero's CCS-funded development model haven't aligned for an official Monerujo iOS build). **Distribution**: F-Droid (canonical), Google Play, APK direct download — all signed by the same key, all reproducible from the public GitHub source. **Features**: full XMR send/receive, view-only wallets (key share with bookkeepers without spend authority), watch-only wallets, multi-account + subaddress generation, integrated TX (paying a Monero address that resolves to multiple actual recipients), configurable transaction confirmation thresholds, optional third-party exchange integrations (disabled by default; enable only if you want in-wallet conversion), backup + restore from 25-word seed or polyseed. Node configuration: paste any monerod RPC URL — clearnet, Tor, I2P. Default uses community-vetted public nodes.\n\n**Philosophy.** Monerujo's editorial differentiator is the **Monero-maximalist mobile posture**. Cake Wallet covers multi-coin + integrated swap + Cake Pay; Monerujo deliberately doesn't. The trade-off: less convenience for users who hold BTC + LTC + ETH alongside XMR, but a smaller attack surface and a smaller \"what does this wallet talk to externally\" footprint. For users who only hold Monero and want the wallet to reflect that focus, Monerujo is the structural fit. The F-Droid-first distribution model reinforces the editorial story — F-Droid is community-trusted, reproducible-builds-friendly, and doesn't require a Google account to install. The Google Play presence is a convenience for users who want auto-updates through Google's channel, not a primary distribution.\n\n**Grade rationale.** Grade A and editor's pick reflect: 8+ years of operational continuity (since 2017); open-source Apache-2.0 codebase; F-Droid + Google Play + APK distribution (multi-channel for trust diversification); native Tor + I2P proxy support; non-custodial wallet keys stored locally; no telemetry, no analytics SDK; remote-node + own-node configuration with onion URL support; view-only / watch-only / multi-account / subaddress feature parity with the official Monero GUI; consistent community recommendation as the default Android XMR wallet for users who want Monero-only; absence of major security incidents or fund-loss reports in the last 24 months. Last verified 2026-05-13.\n\n**Useful when.** You're Monero-maximalist and want a mobile wallet that reflects that — no multi-coin sprawl, no integrated swap, no extra surfaces. You're running your own monerod and want a mobile wallet that connects to it over Tor (paste your onion node URL and it just works). You want F-Droid as your primary app distribution channel (Android-Open-Source-Project pure, no Google account required). You want view-only wallet capability for bookkeeping / accountant scenarios without granting spend authority. You're on a budget Android phone where Cake Wallet's heavier feature surface is overkill.\n\n**Caveats.** **Android only** — no iOS build, no desktop, no web. iOS users should use Cake Wallet for Monero on iPhone. **Remote-node trust is the user's responsibility** — Monerujo defaults to a vetted public node list, but pointing at a malicious node would let that node observe your wallet IP + query timing patterns (not amounts/keys). For high-threat use, run your own monerod or use a trusted operator's onion node. **Less polished UX** than Cake Wallet — Monerujo's UI is functional and mature but less marketing-polished. Users coming from iOS or from polished commercial wallets may find the UX more \"Android-developer-aesthetic\" than \"polished consumer product.\" **No first-party hardware wallet integration** — Ledger / Trezor support is community-developed and less seamlessly integrated than Cake Wallet or Feather. **CCS-funded development means feature timing depends on community votes** — Monerujo's roadmap is community-driven, which is great for alignment but means specific feature requests (e.g., a particular hardware wallet integration) can take longer than commercial-team development. **No background sync on iOS-style \"always running\"** — Android battery-management heuristics may pause the wallet's syncing when the app is backgrounded; expect to open the app briefly to catch up on transactions.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "xmr_native", "thin_client", "tor_supported" ], "highlight_tags": [ "MOBILE", "XMR-NATIVE", "F-DROID" ], "fees": { "summary": "Free · GPLv3 · F-Droid + Play" }, "fees_summary": "Free · GPLv3 · F-Droid + Play", "last_verified": "2026-05-13", "operating_since": "2018", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2018", "locales_available": null, "first_party": false, "editors_pick": true, "links": { "web": "https://monerujo.io", "outbound_slug": "monerujo", "contact_email": "help@monerujo.io", "twitter": "https://x.com/monerujowallet" }, "also_listed_at": { "web3privacy": true } }, { "id": "monfluo", "category": "wallets", "subcategory": "Mobile", "name": "Monfluo", "url": "https://xmr.club/wallets/monfluo", "twin": "https://xmr.club/llm/wallets/monfluo.txt", "tagline": "Pure-Monero Android wallet — fork of Mysu/MyNero (originally Monerujo lineage). F-Droid only, no Google Play, no telemetry.", "review": "**Pure-Monero Android wallet** — fork of **Mysu** (previously **MyNero** by pokkst), which itself was a fork of **Monerujo** (m2049r). Three generations of Monero-only Android wallets distilled into the same lineage; Monfluo (by acx) is the current actively-maintained branch under the pure-Monero-only product philosophy. Listed at **Grade B** on first pass — codebase is on Codeberg (open source, auditable), F-Droid distribution path is operator-published, no Google Play presence (intentional). Upgrade-to-A path is conditioned on operator-published Tor onion + reproducible-build pipeline + at least one curator end-to-end install + send + receive verification.\n\n**What it is.** Native Android wallet. Pure Monero (no BTC, no other coins). Connects to a remote `monerod` node (your own or a public one). You hold the seed locally; the wallet is non-custodial. Distributed via **F-Droid** at `fdroid.monfluo.org/fdroid/repo/` (the operator's own F-Droid repo, not the main F-Droid catalog) and via APK direct download from Codeberg releases. **No Google Play** — operator framing is that Play Store's review process + bundled telemetry add a custodial-flavoured surface they explicitly reject.\n\n**Background.** Direct fork lineage: **Monerujo** (m2049r, ~2017+) → **MyNero** (pokkst, fork of Monerujo) → **Mysu** (rename of MyNero) → **Monfluo** (acx, current fork). Each fork stayed strictly Monero-only and rejected multi-coin / fiat-onramp / Play-store-distributed variants. Repo at `codeberg.org/acx/monfluo`. Active development as of 2026.\n\n**What you trust.**\n\n- **Open-source Codeberg repo.** Build from source if you want byte-level certainty. The lineage from Monerujo means the core wallet primitives have ~9 years of public audit history.\n- **F-Droid distribution.** Operator's own F-Droid repo is the canonical install path — no Play Store gating, no Google account requirement, but you ARE trusting the operator's APK signature (verify the F-Droid signing key matches the project's publication).\n- **Non-custodial.** Seed lives on your device; the wallet is just a `monerod`-aware client.\n- **No telemetry.** Operator framing on the Codeberg readme + matching the broader pokkst/Monerujo design philosophy.\n- **Remote-node mode.** Point at your own `monerod` for full sovereignty, or a public node for convenience. The trade-off is documented on the Monero project's wallet-config docs.\n\n**Operational specs.**\n\n- **Install.** F-Droid (preferred): add `fdroid.monfluo.org/fdroid/repo/` to your F-Droid client's repos. Or direct APK from `codeberg.org/acx/monfluo/releases`. **No Google Play.**\n- **Platform.** Android only.\n- **Coin coverage.** Monero (XMR) only. No BTC, no fiat onramp, no swap.\n- **Backend.** Talks to a `monerod` node over RPC. Public-node list shipped or supply your own.\n- **Updates.** Manual — pull from F-Droid or check Codeberg releases. Operator publishes signed APK + signed F-Droid index.\n- **License.** Inherits the Monerujo lineage (GPL — confirm against the LICENSE file in the repo).\n- **No Tor mirror published** at submission time. Site at codeberg.org loads under Tor Browser; no operator-published `.onion` of the wallet's own site (because the wallet is distributed via F-Droid repo + Codeberg, not a hosted web app).\n\n**Operator philosophy.** Same as Monerujo + MyNero before it: **Monero-only, Android-native, no telemetry, no Play Store, no fiat-onramp coupling.** Each fork in the lineage rejected feature-bloat suggestions in favour of staying pure-XMR. acx (the Monfluo maintainer) explicitly forked from Mysu when that line stalled, to keep the pure-Monero-only stack moving.\n\n**Grade rationale.** **Grade B** because: (1) **no operator-published Tor onion** for the wallet's own site (codeberg.org is the de-facto homepage); (2) **reproducible-build pipeline not documented** (operator publishes signed APKs but not a Guix-style reproducible toolchain); (3) **no curator end-to-end test** on file yet (send + receive verification pending); (4) **maintainer name (acx) is pseudonymous** — anonymous-operator tier, fine for this category but flagged. Upgrade-to-A path: reproducible-build pipeline + curator test pass + operator-published onion or canonical site.\n\n**Useful when:**\n\n- You want a **pure-Monero Android wallet** with no Play Store + no Google account requirement.\n- You're already comfortable with **F-Droid as a distribution channel** and prefer it to the Play Store.\n- You're tracking the **Monerujo lineage** specifically and want the current actively-maintained fork.\n- You operate a **personal `monerod`** node and want a mobile wallet that talks to it natively.\n\n**Caveats:**\n\n- **F-Droid + Codeberg only.** No Play Store — intentional but means you need to know F-Droid's install pattern (add repo, accept signing key, install). Not friction-free for non-technical users.\n- **Android only.** No iOS, no desktop, no Linux.\n- **No operator-published Tor onion** for the wallet's site — codeberg is the de-facto homepage; site loads under Tor but is not Tor-native.\n- **Reproducible builds not yet documented.** Signed APKs are good but byte-level reproducibility (Guix-style) is the higher bar.\n- **Maintainer pseudonymous.** acx is the named identity; no real-world attribution. Common for this tier; not blocking.\n- **No curator test pass yet.** First-pass listing — Grade B default per playbook.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "xmr_native", "no_account_required" ], "highlight_tags": [ "XMR NATIVE", "F-DROID", "OPEN SOURCE" ], "fees": { "summary": "Free wallet · XMR network fees only (you choose the fee tier per transaction)." }, "fees_summary": "Free wallet · XMR network fees only (you choose the fee tier per transaction).", "last_verified": "2026-05-28", "operating_since": "2025", "tenure_note": "Monfluo (Android Monero wallet) released 2025 per Grok X verification. Two prior stamps (2017 from codeberg WHOIS, then 2022 manual estimate) both wrong — codeberg.org WHOIS predates the host itself launching in 2019. Now in fresh bucket.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://codeberg.org/acx/monfluo", "fdroid": "https://fdroid.monfluo.org/fdroid/repo/", "repo": "https://codeberg.org/acx/monfluo", "outbound_slug": "monfluo" }, "also_listed_at": { "kycnot": true, "web3privacy": true, "monerica": true } }, { "id": "mysu-mobile", "category": "wallets", "subcategory": "XMR-Native", "name": "Mysu", "url": "https://xmr.club/wallets/mysu-mobile", "twin": "https://xmr.club/llm/wallets/mysu-mobile.txt", "tagline": "XMR mobile wallet with remote-node defaults and minimal UI.", "review": null, "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "xmr_native", "thin_client" ], "highlight_tags": [ "XMR NATIVE", "MOBILE" ], "fees": { "summary": "Free · Network fees only" }, "fees_summary": "Free · Network fees only", "last_verified": "2026-05-13", "operating_since": "2025", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://mysu.app", "outbound_slug": "mysu-mobile" } }, { "id": "passport-bitcoin", "category": "wallets", "subcategory": "Hardware", "name": "Foundation Passport", "url": "https://xmr.club/wallets/passport-bitcoin", "twin": "https://xmr.club/llm/wallets/passport-bitcoin.txt", "tagline": "Air-gapped BTC hardware wallet. Camera-only QR signing, US-manufactured, open-source firmware.", "review": "Foundation Passport is a *premium air-gapped Bitcoin hardware wallet* — built in the US by Foundation Devices, it signs transactions entirely over QR codes (no USB cable ever touches a computer), with open firmware and a published security audit.\n\n**Background.** Shipping since 2020 from *Foundation Devices*, Passport is a Bitcoin-only signing device aimed at users who want strong air-gap security without the steep usability of more spartan competitors. It pairs with Foundation's *Envoy* mobile app or desktop tools like *Sparrow*, and positions itself as a higher-build-quality, better-UX alternative to the Coldcard at a premium price. The combination of *open firmware*, a *published audit*, and full air-gapping is why it earns an A in /wallets: the security claims are inspectable, not marketing.\n\n**What you trust.** The device is built so you have to trust it *less*. *Air-gapped by design*: it has no USB data-signing path — every interaction with a watch-only wallet happens via the *camera and QR codes*, so the private keys are on a device that never makes a data connection to an internet-connected machine. *Open firmware* means the code running on the device can be reviewed and verified rather than taken on faith, and Foundation has *published a security audit* of the hardware/firmware. Keys are generated and held on the device; the paired app (Envoy/Sparrow) is watch-only. That's the right trust posture for cold storage: minimize the attack surface (no USB), make the code auditable, and prove it with a third-party audit.\n\n**Operational specs.** *Bitcoin-only* signing device with a *QR-only air-gap workflow* — you scan unsigned PSBTs in and signed ones out, no cable. It pairs with *Envoy* (Foundation's mobile companion) and integrates with *Sparrow* and other PSBT-capable desktop wallets for multisig and advanced setups. Build quality and UX are a deliberate step up from bare-bones competitors (physical keypad, screen, considered industrial design). It's *more expensive than a Coldcard* but trades that for ergonomics. Firmware is open and updates are verifiable.\n\n**Philosophy.** Cold storage security fails on two fronts: attack surface (every cable and connection is a vector) and *usability* (a wallet so painful that people misuse it or fall back to hot wallets isn't secure in practice). Passport's thesis is that you can have *both* — eliminate the USB attack surface entirely with a camera/QR air-gap, and make the device pleasant enough that people actually follow good practices. Open firmware + a public audit complete the philosophy: a security device you're asked to trust with your savings should let you (or researchers) verify it.\n\n**Grade rationale.** A in /wallets. The grade reflects genuine air-gapping (no USB signing), open and auditable firmware, a published third-party security audit, clean multisig support via Sparrow/PSBT, and a UX that lowers the chance of user error. It's a top-tier cold-storage option. The caveats — Bitcoin-only, price, and the unavoidable supply-chain considerations of any hardware wallet — are scope notes, not security flaws.\n\n**Useful when.** Choose Passport for *serious Bitcoin cold storage* — long-term holdings, multisig vaults (it pairs cleanly with Sparrow), or anyone who wants air-gapped security but found Coldcard's UX too austere. It's especially apt if you value build quality and a smoother signing flow and are willing to pay for it. For a privacy-conscious holder it keeps keys fully offline while letting a watch-only app track balances.\n\n**Caveats.** It's *Bitcoin-only* — no Monero or other-chain support, so in an XMR-centric toolkit it's the BTC-leg device, not an all-coin solution. It costs *more than a Coldcard*; the premium buys UX and build, not extra cryptographic security. As with *every* hardware wallet, you're trusting the supply chain (buy direct from Foundation, verify firmware on setup) and your own backup hygiene — the device protects keys, but a lost or unsecured seed phrase still loses funds. And air-gap/QR workflows, while safer, are a step slower than plug-in signing. None of these dent the A: for auditable, air-gapped Bitcoin custody with humane UX, Passport is among the best, with the honest limit that it's Bitcoin-only.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "non_custodial", "open_source", "audited" ], "highlight_tags": [ "HARDWARE", "AIR-GAP", "OPEN-FIRMWARE" ], "fees": { "summary": "$199 hardware · open firmware · QR-only signing" }, "fees_summary": "$199 hardware · open firmware · QR-only signing", "last_verified": "2026-06-03", "operating_since": "2020", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://foundationdevices.com", "outbound_slug": "passport-bitcoin", "twitter": "https://x.com/foundationdvcs" }, "also_listed_at": { "web3privacy": true } }, { "id": "phoenix", "category": "wallets", "subcategory": "Lightning", "name": "Phoenix", "url": "https://xmr.club/wallets/phoenix", "twin": "https://xmr.club/llm/wallets/phoenix.txt", "tagline": "Self-custodial mobile Bitcoin Lightning wallet by ACINQ — single dynamic channel, splicing, trampoline payments. Apache-2.0. No KYC.", "review": "**Self-custodial mobile Bitcoin Lightning wallet** — Apache-2.0, iOS + Android, built and operated by **ACINQ** (the team behind Eclair, one of the three reference Lightning Network implementations alongside LND and Core Lightning). Phoenix is the wallet ACINQ ships to demonstrate that Lightning self-custody can be friction-free for non-technical users — no channels to manually open, no inbound-liquidity 1% tax, no operator holding your funds between hops. Listed at **Grade A** because Phoenix is the canonical answer to *\"I want self-custodial Lightning without becoming a node operator\"* — every architectural decision (single dynamic channel, splicing, trampoline payments) is designed to keep the user model simple while preserving the self-custody guarantee.\n\n**What it is.** Native mobile app (iOS + Android, plus a desktop preview). On first launch the app provisions a **single Lightning channel** with ACINQ's LSP (Lightning Service Provider) node and stores your seed locally. From the user's POV there's no channel-management UI — you receive, you spend, the channel resizes itself via **splicing** when liquidity changes. Under the hood it's Lightning + on-chain primitives orchestrated automatically.\n\nThe seed phrase is yours. ACINQ runs the LSP that's the other end of your channel but **cannot move your funds** — Phoenix is non-custodial in the standard Lightning sense (you hold the keys; the LSP is just a routing counterparty). If ACINQ disappeared tomorrow you could force-close the channel on-chain and reclaim your funds via your seed.\n\n**Background.** ACINQ has been building Lightning Network infrastructure since 2017 — **Eclair** (Scala-based reference LN node, used by businesses + the original Eclair Mobile wallet), and ACINQ-the-LSP (one of the larger Lightning routing nodes by capacity). Phoenix succeeded Eclair Mobile in 2019 with a redesigned user model: instead of treating channels as a thing the user manages, treat them as an implementation detail and surface only the wallet/send/receive primitives. The 2024 redesign (\"new Phoenix\") moved to a **single dynamic channel + splicing model**, eliminating the prior 1% inbound-liquidity service fee and making channel re-sizing native.\n\n**What you trust.**\n\n- **Apache-2.0 open source** at `github.com/ACINQ/phoenix`. Code is auditable; the build is reproducible from source. License is permissive so forks/repackages are legal.\n- **ACINQ as a public commercial entity.** ACINQ SAS is a French-registered company (since 2014) with named principals (Pierre-Marie Padiou, Fabrice Drouin, others) and a multi-year delivery history. Distinct from the anonymous-operator tier — there's a real legal entity + identifiable people behind it.\n- **You hold the seed.** Standard 12/24-word BIP39 seed; if you lose your phone, restore from seed on a fresh install and the channel state syncs back from chain + ACINQ's LSP (which sees your channel commitments but not your keys).\n- **Force-close-on-chain escape hatch.** If ACINQ ever stopped operating their LSP, you could force-close your channel via a chain transaction and recover your funds. The Lightning protocol guarantees this; Phoenix's UX makes it visible.\n- **Tor support.** App connects to its LSP over Tor when the device's system VPN/Tor is enabled. No operator-published `.onion` for Phoenix-the-app (mobile apps don't have onions); the LSP backend has Tor reachability.\n- **No KYC.** No signup, no email, no government-ID upload. Download from F-Droid / App Store / Play / direct APK, restore from seed or generate a new one, send/receive.\n\n**Operational specs.**\n\n- **Install.** iOS App Store, Google Play, F-Droid (community-built mirror; check the build matches ACINQ's signed APK), direct APK from GitHub releases. **No Play-Services-mandatory features** so it runs on de-Google'd Android (GrapheneOS, CalyxOS, /e/OS).\n- **Platform.** iOS, Android. Desktop is in preview.\n- **Lightning specifics.** Single dynamic channel with ACINQ's LSP. **Splicing** (channel resize without close + reopen) for inbound liquidity. **Trampoline payments** (offload route-finding to the LSP, reduce mobile compute cost). **On-the-fly funding** (the LSP funds inbound liquidity on first receive). **No 1% inbound-liquidity tax** as of the 2024 redesign.\n- **On-chain primitives.** Splice transactions are real on-chain Bitcoin transactions with normal mempool fee dynamics — you pay sat/vB at the prevailing rate when splicing in/out, no surcharge.\n- **Fees.** No platform commission on payments. **Service fee on splices** disclosed before commitment (typically a small basis-point cut on the splice-in amount + the on-chain fee). LN routing fees pay the network of intermediate nodes (usually <1% end-to-end).\n- **Backup.** Seed phrase is the canonical backup. Channel state lives on-chain + replicated by the LSP; reinstall + restore-from-seed pulls everything back.\n- **No fiat onramp inside the app.** Phoenix is wallet-only; buying Bitcoin happens elsewhere (kyc.rip, KYCnot.me-listed exchanges, P2P, etc.).\n- **Tor reachability.** App routes through system VPN/Tor when configured. Direct in-app Tor toggle: not yet (relies on system-level routing).\n- **Updates.** Frequent release cycle. ACINQ ships signed APKs on GitHub + the standard app-store channels.\n\n**Operator philosophy.** ACINQ's stated framing across blog posts + their conference talks is that **\"self-custodial Lightning needs to look like a wallet, not a node-management dashboard.\"** The 2024 splicing redesign was the practical realization of that — Phoenix went from \"open channel / close channel / inbound capacity\" surfacing to \"you have N sats, you can send and receive, the wallet handles the rest.\" The bet is that **most users never want to be node operators**, and the only thing standing between Lightning and mass self-custody adoption is the manual channel-management UX baggage.\n\nACINQ also operates a substantial Lightning routing node (top-N by capacity globally) — that's the LSP backing Phoenix wallets. Distinct from the wallet business but the same team; if you trust ACINQ-the-routing-node you can trust ACINQ-the-LSP, and Phoenix's design treats the LSP as a swappable counterparty (in principle a different LSP could be plugged in via a fork; in practice ACINQ's LSP is the default).\n\n**Grade rationale.** **Grade A** because: (1) **fully open-source under permissive licence** (Apache-2.0, auditable, forkable); (2) **named-entity operator accountability** — ACINQ SAS is a real legal entity with public principals + a 10+ year LN-infrastructure track record; (3) **canonical Lightning self-custody UX** — no realistic competitor delivers the same friction-free experience without sacrificing the self-custody property; (4) **no KYC anywhere in the flow** (no signup, no email, no ID); (5) **chain-recoverable** — force-close-on-chain escape hatch is preserved by the Lightning protocol itself; (6) **F-Droid distribution path + Play-Services-free build** so de-Google'd Android works; (7) **no security incident attributable to Phoenix-specific code** in 5+ years of releases.\n\nThe Grade-A ceiling is held by **Lightning's general trust model** (LSPs and counterparty nodes see your channel commitments, even though they can't touch your funds), which is a Lightning thing, not a Phoenix thing — every self-custodial LN wallet inherits this trade-off. Phoenix mitigates it by being the LSP itself (so you trust one entity, not two), being permissively-licensed (so an alternate-LSP fork is legally viable), and surfacing the chain-recovery path clearly.\n\n**Useful when:**\n\n- You want **self-custodial Bitcoin Lightning on mobile** without becoming a node operator.\n- You're already on **Sparrow / Bitcoin Knots / Wasabi for on-chain** and need the matching Lightning mobile companion.\n- You're a **journalist / activist / aid recipient** who needs fast, low-fee, no-KYC Bitcoin payments without trusting a custodial wallet.\n- You're **donating to or receiving micropayments from** projects (xmr.club itself accepts Lightning) and want the lowest-friction self-custodial path.\n- You're **teaching Lightning** to a non-technical user and want to show \"this is what self-custody can actually feel like.\"\n- You're a **merchant** accepting Lightning over BTCPay Server or similar and want a mobile companion wallet for personal spends from your own funds.\n\n**Caveats:**\n\n- **Mobile-only (iOS + Android).** Desktop preview exists but isn't yet a primary surface. Power users running a personal node + multi-platform wallet stack will still want LND/CLN + Sparrow/Zeus.\n- **ACINQ-LSP-dependent.** Your single channel terminates at ACINQ's LSP. If ACINQ-the-routing-node went down, you could force-close and recover on-chain — but until then, your day-to-day routing depends on their uptime.\n- **No in-app Tor toggle.** Routes via system VPN/Tor if configured; no Phoenix-specific Tor toggle yet. iOS doesn't trivially support system-Tor without Orbot-equivalents.\n- **Splice fees are real on-chain transactions.** When you splice-in or splice-out, you pay the prevailing Bitcoin mempool sat/vB rate. Not always cheap during fee spikes.\n- **Single-channel model means single-counterparty.** Most Lightning wallets multiplex across channels with multiple LSPs; Phoenix bet on one (ACINQ's). Trade-off: simpler UX, narrower routing topology. ACINQ's mitigation is being the most reliable LSP.\n- **No fiat onramp in the app.** Wallet only; pair with a no-KYC exchange (kyc.rip, the KYCnot-listed engines, P2P) for fiat ramp.\n- **Lightning generic caveats apply.** Backups beyond the seed phrase aren't really a thing — losing the seed means losing the wallet. Channel state recovery requires the LSP to still be operating; the force-close-on-chain escape hatch works regardless but takes longer.\n- **Play Store + App Store reviews are not the same as a Guix-style reproducible-build trail.** ACINQ publishes signed APKs on GitHub so verification is possible, but the formal reproducible-build pipeline that Bitcoin Core ships isn't yet on file for Phoenix. Build from source if you want the highest assurance.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "tor_supported", "lightning_native" ], "highlight_tags": [ "LIGHTNING", "MOBILE", "SPLICING", "OPEN SOURCE" ], "fees": { "summary": "Service-fee model: Phoenix charges a flat fee on liquidity splices (channel resize) — no per-payment markup, no fee on inbound liquidity. Plus the underlying Lightning routing fee (typically <1%) + on-chain network fee on splices. Full schedule disclosed in-app before any fee-bearing action." }, "fees_summary": "Service-fee model: Phoenix charges a flat fee on liquidity splices (channel resize) — no per-payment markup, no fee on inbound liquidity. Plus the underlying Lightning routing fee (typically <1%) + on-chain network fee on splices. Full schedule disclosed in-app before any fee-bearing action.", "last_verified": "2026-05-28", "operating_since": "2019", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2019", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://phoenix.acinq.co", "repo": "https://github.com/ACINQ/phoenix", "outbound_slug": "phoenix" }, "also_listed_at": { "web3privacy": true } }, { "id": "ripley-terminal", "category": "wallets", "subcategory": "Desktop", "name": "Ripley Terminal", "url": "https://xmr.club/wallets/ripley-terminal", "twin": "https://xmr.club/llm/wallets/ripley-terminal.txt", "tagline": "Terminal-style desktop Monero wallet with AI-agent support built in. Privacy-first ops UX for everyday use.", "review": "Desktop wallet with a terminal/CLI-style interface — keyboard-driven, scriptable, optimised for daily Monero use. Built-in AI-agent support lets you script wallet operations from natural language. Maintained alongside the kyc-rip ecosystem.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "xmr_native", "thin_client" ], "highlight_tags": [ "DESKTOP", "AI-AGENT", "XMR-NATIVE" ], "fees": { "summary": "Free · desktop · terminal-style UX" }, "fees_summary": "Free · desktop · terminal-style UX", "last_verified": "2026-05-13", "operating_since": "2026", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://ripley.run/terminal", "outbound_slug": "ripley-terminal" } }, { "id": "safepal", "category": "wallets", "subcategory": null, "name": "SafePal", "url": "https://xmr.club/wallets/safepal", "twin": "https://xmr.club/llm/wallets/safepal.txt", "tagline": "Multi-chain hardware wallet with Monero support via Monero GUI. Grade C. Live incident: 2026-08-16 order-tracking plug-in breach exposed ~39,798 customers' full PII (name + email + shipping address + phone + purchase details) across a 13-month window (2025-03-02 → 2026-04-11). Physical-safety risk, not phishing risk. Read the incident block before ordering.", "review": "**Live incident (2026-08-16).** SafePal's own disclosure ([`safepal.com/scam-protection`](https://safepal.com/scam-protection)): a flaw in their **order-tracking plug-in** led to unauthorized access to customer order information for approximately **39,798 customers** who placed orders between **2025-03-02 and 2026-04-11** — a **13-month window**. Exposed data: full names, email addresses, shipping addresses, phone numbers, purchase details. Wallets, seed phrases, private keys, wallet passwords are unaffected — the breach is entirely on the fulfillment / order-tracking supply chain. SafePal's public framing leads with the standard *\"wallets are secure\"* / phishing-risk warning — technically true and beside the point. The reader-facing risk is not phishing; it is physical: 39,798 confirmed crypto-holder home addresses on the black market is home-invasion / stalking / $5-wrench-attack territory. See [`/guides/old-iphone-cold-storage`](/guides/old-iphone-cold-storage) for the shipping-address-opsec reframe + a step-by-step alternative that closes this class of exposure entirely.\n\n**What this is in category context.** SafePal is the second major hardware-wallet vendor to expose customer PII via supply-chain breach in **5 days**. Trezor (2026-08-13) exposed 11,742 customers over a 90-day window; SafePal (2026-08-16) exposes ~39,798 customers over a 13-month window — combined **51,540 hardware-wallet customer records with full home-address PII on the black market in five days**. Add Coldcard's 2026-07-30 firmware-RNG incident (~594 BTC drained across ~500 wallets from a 5-year-latent weak-entropy bug — see [`/guides/hardware-wallets-for-monero-after-coldcard`](/guides/hardware-wallets-for-monero-after-coldcard)) and the hardware-wallet trust surface has taken three distinct hits in 18 days: device firmware trust, supply-chain PII (Trezor), and supply-chain PII again with 3.4× the count and 13× the window (SafePal). The pattern is category-wide, not vendor-specific.\n\n**What SafePal is.** Multi-chain hardware wallet family (S1, X1, X1 Pro, Cypher) with support for Bitcoin, Ethereum, Solana, and (via Monero GUI integration for select models) Monero. Vendor: SafePal Inc. (Singapore, founded 2018 per public record; verify on their /about surface).\n\n**What you trust.** The device itself (Secure Element architecture; firmware model per model varies). Wallet cryptography and signing paths appear standard for the multi-chain HW category.\n\n**What you don't.** SafePal's fulfillment supply chain — specifically the order-tracking plug-in that was breached over a 13-month window and only detected after phishing emails started reaching customers in May 2026 (per SafePal's FAQ: *\"I received phishing emails in May. Why did it take until August to confirm the cause?\"*). Mitigations: PO box, drop shipper, mail-forwarding service, or the separate-iPhone pattern in the linked guide.\n\n**Alternatives.** For the airgap use case specifically: **Cupcake Wallet** (by the Cake Wallet team) on an old iPhone / Android — purpose-built for the airgap-signer role, avoids the shipping-address surface entirely. For a hardware wallet without changing the pattern: rotate through a shipping-privacy layer before your next order.\n\n**Cross-refs.** Parent guide: [`/guides/monero-cold-storage`](/guides/monero-cold-storage). Alternative pattern: [`/guides/old-iphone-cold-storage`](/guides/old-iphone-cold-storage). After-Coldcard trust model: [`/guides/hardware-wallets-for-monero-after-coldcard`](/guides/hardware-wallets-for-monero-after-coldcard). Verify-your-binary: [`/guides/verify-wallet-binary`](/guides/verify-wallet-binary).", "translation_locale": "en", "rating": { "grade": "C" }, "grade": "C", "kyc_tags": [], "feature_tags": [ "multi_chain", "monero_support" ], "highlight_tags": [ "INCIDENT-2026-08", "MULTI-CHAIN", "MONERO-CAPABLE" ], "fees": { "summary": "Hardware wallet purchase price varies by model (S1 / X1 / X1 Pro / Cypher). Free companion app. Fee schedule for on-app swaps varies by integration; verify at purchase time." }, "fees_summary": "Hardware wallet purchase price varies by model (S1 / X1 / X1 Pro / Cypher). Free companion app. Fee schedule for on-app swaps varies by integration; verify at purchase time.", "last_verified": null, "operating_since": null, "tenure_note": "SafePal Inc. is an established hardware-wallet vendor with multi-year presence. Founded date not verified in this listing pass; the listing was opened primarily to capture the 2026-08-16 incident — refresh with full tenure sweep on the next curation cycle.", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://safepal.com/", "scam_protection": "https://safepal.com/scam-protection", "blog": "https://safepal.com/blog/", "outbound_slug": "safepal" }, "incident": { "severity": "high", "date": "2026-08-16", "headline": "Order-tracking plug-in breach exposed ~39,798 customers full PII (2025-03-02 to 2026-04-11)", "summary": "SafePal disclosed on 2026-08-16 (blog: \"Unauthorized Access To A Subset Of Customer Order Information\") that a flaw in their order-tracking plug-in led to unauthorized access to customer information for approximately 39,798 customers who placed orders between 2025-03-02 and 2026-04-11 — a 13-month window. Exposed data: full names, email addresses, shipping addresses, phone numbers, and purchase details. Wallets, seed phrases, private keys, and wallet passwords are not affected — the exposure is entirely on the fulfillment / order-tracking supply chain. The reader-facing risk is not phishing (SafePal's own framing) — it is physical: confirmed crypto-holder home addresses in the hands of any buyer of the leaked data is home-invasion / stalking / $5-wrench-attack territory. Affected customers notified individually by email; verification available at safepal.com/scam-protection using order ID + shipping country. This is the second major hardware-wallet supply-chain PII exposure in 5 days (Trezor 2026-08-13 exposed 11,742 customers over a 90-day window). See /guides/old-iphone-cold-storage for the shipping-address opsec response.", "timeline": [ { "date": "2026-08-20", "note": "SafePal posted an 18 August follow-up on its 16 August incident blog acknowledging unverified claims that the ~39,798-record order dataset is being offered for sale, while restating that seed phrases, keys, and wallet credentials were not in scope. A cybercrime-forum listing matching the disclosed order window and c…", "auto": true }, { "date": "2026-08-28", "note": "SafePal posted an official X progress note on 2026-08-23: still finalizing 4 anti-phishing vendors and 3 independent auditors, still monitoring dark-web sale/publication claims, and reviewing order/shipping data held. The official blog is unchanged since its 2026-08-18 addendum; victim count (~39,798), data types, a…", "auto": true } ] } }, { "id": "seedsigner", "category": "wallets", "subcategory": "Hardware", "name": "SeedSigner", "url": "https://xmr.club/wallets/seedsigner", "twin": "https://xmr.club/llm/wallets/seedsigner.txt", "tagline": "DIY air-gapped Bitcoin hardware wallet built on Raspberry Pi Zero. No firmware secrets, no vendor lock-in.", "review": "SeedSigner turns a handful of commodity parts — a Raspberry Pi Zero, a camera module, and a tiny screen — into a stateless, air-gapped Bitcoin signing device that never persists a private key. It is less a product than a recipe: open-source firmware you flash yourself onto hardware you assemble for the price of a few coffees.\n\n**Background**\nSeedSigner began as a community project to make air-gapped, multisig-grade signing accessible to anyone, without trusting a single vendor's supply chain. There is no company, no serial number, and no proprietary secure element — the threat model is deliberately built around the assumption that you do not need to trust the manufacturer because you are the manufacturer. Firmware is developed in the open on GitHub and verified by reproducible builds.\n\n**What you trust**\nYou trust the open-source firmware (which you can read and build), the off-the-shelf parts you sourced, and the QR-code airgap between the signer and your coordinator. You do not trust persistent storage: the device is stateless by design, so a seized or lost SeedSigner reveals nothing — there is no seed on it to extract.\n\n**Operational specs**\nBitcoin-only. The signer holds no keys between sessions; you re-enter your seed (or restore from a SeedQR) each time you sign, then power-cycle to wipe it from memory. All communication with your wallet coordinator (Sparrow, Specter, Nunchuk, etc.) happens via QR codes — no USB, no Bluetooth, no network interface of any kind. Strong support for multisig and passphrase (BIP39) workflows. Entropy can be generated from dice or coin flips for the paranoid.\n\n**Philosophy**\nSeedSigner is an expression of the \"don't trust, verify — and build it yourself\" ethos. By removing the vendor from the trust equation entirely, it sidesteps an entire class of supply-chain and firmware-backdoor risks that even reputable hardware wallets cannot fully rule out. Statelessness is the point: the safest secret is the one that was never written down inside the device.\n\n**Grade rationale**\nGrade A. Fully open, reproducibly built, no persistent attack surface, and a credible answer to supply-chain distrust. The DIY assembly and Bitcoin-only scope keep it from being a universal recommendation, but for its intended use — verifiable, vendor-trustless signing — it is best-in-class.\n\n**Useful when**\nYou want air-gapped multisig without trusting a hardware vendor; you are comfortable assembling and flashing a device; you value statelessness over convenience; you are building a self-custody setup where the signer should reveal nothing if seized.\n\n**Caveats**\nBitcoin-only — no Monero or altcoin signing. Assembly and firmware verification require some technical confidence. Re-entering the seed each session is friction by design, not a bug. The screen and input are minimal; this is a tool for deliberate, careful signing, not casual daily spending.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "multisig_supported", "audited", "full_node_capable" ], "highlight_tags": [ "HARDWARE", "DIY", "OPEN-SOURCE" ], "fees": { "summary": "~$50 DIY parts · open-source · stateless" }, "fees_summary": "~$50 DIY parts · open-source · stateless", "last_verified": "2026-07-20", "operating_since": "2021", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://seedsigner.com", "outbound_slug": "seedsigner", "twitter": "https://x.com/SeedSigner", "telegram": "https://t.me/joinchat" }, "also_listed_at": { "web3privacy": true } }, { "id": "sparrow", "category": "wallets", "subcategory": "BTC-Native", "name": "Sparrow Wallet", "url": "https://xmr.club/wallets/sparrow", "twin": "https://xmr.club/llm/wallets/sparrow.txt", "tagline": "Open-source desktop Bitcoin wallet — Tor-native, PSBT-first, hardware-wallet ready, BIP47 PayNyms, full coin control.", "review": "**Desktop Bitcoin wallet built for self-sovereignty** — Apache-2.0, Tor-native, multisig + hardware-wallet ready, PSBT-first, with full coin control + BIP47 PayNym support. Maintained publicly by **Craig Raw** since 2021 and shipped through `github.com/sparrowwallet/sparrow`. Listed at **Grade A** because Sparrow is the canonical answer to \"I want a Bitcoin wallet that doesn't lie to me\" — every dependency on third parties (Electrum server, mempool data, exchange rate) is visible and swappable, every transaction can be reviewed at the input/output/script level before signing, and the binary is GPG-signed by an identifiable maintainer with verifiable releases. No telemetry, no account, no operator on the data path.\n\n**What it is.** Sparrow is a JavaFX desktop Bitcoin wallet that connects to either a **public Electrum server**, **your own Bitcoin Core node**, or a **private Electrum server** (Electrs / Fulcrum). It supports every standard Bitcoin script type (legacy, nested segwit, native segwit, Taproot), single and multi-signature wallets, every major **hardware wallet** (Ledger, Trezor, Coldcard, BitBox, Jade, Foundation, etc.) in both USB and **airgapped (PSBT-over-QR / SD-card) modes**, **PSBT** at every step (you can sign one device → save → sign on another), **coin control** with detailed UTXO selection, **BIP47 PayNyms** (reusable payment codes), a transaction editor that lets you craft and inspect raw transactions before broadcast, and a built-in mini block explorer scoped to your own wallet's UTXOs. **Tor connectivity is built in** — point it at a local Tor daemon and every server connection routes through Tor.\n\n**Background.** Sparrow was started by **Craig Raw** in 2021 to fill a specific gap in the Bitcoin wallet ecosystem: a desktop wallet that combined **Electrum's coin-control + multisig capabilities** with **Specter Desktop's hardware-wallet support** and **JoinMarket's privacy posture**, all in a single polished JavaFX app that ran on macOS, Windows, and Linux out of the box. Craig is publicly identified, signs every release with the GPG key `D4D0D3202FC06849A257B38DE94618334C674B40` (`craig@sparrowwallet.com`), and runs the project as a single-maintainer effort funded primarily by donations. The project crossed mainstream privacy-wallet awareness in 2022-2023 when **Samourai Wallet** and **JoinMarket** users adopted it as their desktop counterpart, and again in 2024 when several Bitcoin privacy-tooling shutdowns left Sparrow as the most-actively-maintained desktop option in its tier.\n\n**What you trust.**\n\n- **Apache-2.0 open source.** Codebase at `github.com/sparrowwallet/sparrow` is fully auditable. The build is JavaFX + Java; you can compile from source on your own hardware if you don't trust the binaries.\n- **Single-maintainer accountability.** Craig Raw is publicly identified, accessible via the project's Telegram / Twitter, and signs every release manifest with a long-standing GPG key. \"Single maintainer\" cuts both ways (see Caveats) but it means every code change has one accountable signature.\n- **No account, no signup.** Download the installer → verify the signature → run it. Sparrow itself collects nothing. The Electrum server you connect to sees your wallet's xpubs (more on this below); your local Bitcoin Core node sees nothing because it's yours.\n- **Reproducible-ish releases.** The release manifests are GPG-signed; the build infrastructure is published; the JavaFX dependency tree is auditable. Sparrow doesn't yet ship the formal Guix-style reproducible-build pipeline that Bitcoin Core ships, but the build is straightforward to reproduce manually.\n- **Tor built in.** The wallet's network panel exposes a Tor toggle; once enabled, every outbound connection (Electrum server fetch, mempool query, exchange rate) routes through your local Tor SOCKS proxy. No conditional fallback to clearnet for \"convenience.\"\n- **PSBT-first.** Every signing step uses the **Partially Signed Bitcoin Transaction** standard. You can sign one input on a hardware wallet, another on an airgapped machine, broadcast from a third — keys never have to live on the broadcasting machine.\n- **No custodial layer.** Sparrow holds no keys for you. The seed phrase you generate lives in your wallet file (optionally encrypted with a password) on disk.\n\n**Operational specs.**\n\n- **Install.** Download from `sparrowwallet.com/download/` — macOS (Apple Silicon + Intel, 11+), Windows (.msi installer or .zip standalone, 10+), Linux (.deb / .rpm / .tar.gz, x86_64 + ARM64). Verify the SHA256 manifest with `gpg --verify` against Craig's key fingerprint `D4D0D3202FC06849A257B38DE94618334C674B40`. From Sparrow 1.8.3+, drag-and-drop verification works inside the app itself.\n- **Server modes.** (1) **Public Electrum server** — Sparrow ships a vetted server list; you can pick any or rotate. (2) **Your own Bitcoin Core node** — direct RPC; full sovereignty. (3) **Private Electrum server** (Electrs / Fulcrum) running on your own infrastructure — best balance of full-node sovereignty + Electrum's wallet-side performance.\n- **Hardware wallets.** Ledger, Trezor, Coldcard, BitBox, Foundation Passport, Jade, Krux, SeedSigner, Specter DIY — USB and airgapped flows.\n- **Privacy features.** Built-in Tor (point at `127.0.0.1:9050`), per-wallet server selection, **mixing coordinator integrations dropped** when those upstream tools (Whirlpool, JoinMarket coordinator) became unreliable. Current privacy posture relies on PSBT + airgapped signing + your own Electrum server, not protocol-level mixing inside Sparrow.\n- **Headless server build.** A `sparrowserver` headless Linux build (same `.deb` / `.rpm` / `.tar.gz` formats) supports running Sparrow's wallet-watch + transaction-broadcast functions on a server without the JavaFX UI. Useful for treasury monitoring + automated payouts.\n- **Update cadence.** Currently 2.5.1 (May 2026). Releases historically every 2-4 months. Manual update — replace the binary, restart, wallet file format is forward-compatible.\n- **Support.** Project Telegram, GitHub Issues, and a community-run Matrix room. No commercial support tier.\n\n**Operator philosophy.** Craig Raw's stated position across Sparrow's blog posts and conference talks is **\"the wallet should make it easy to do the right thing and visible when you're not.\"** Sparrow defaults to address-rotation on receive, fee-bumping (RBF) opt-in on every spend, network connection via Tor when enabled, and full-input/output review on every signed transaction. Where the wallet has had to compromise — e.g. dropping the Whirlpool integration after Samourai's 2024 takedown, dropping certain JoinMarket flows when the coordinator's reliability dropped — Craig has documented the reasoning in release notes rather than silently removing surface area. The project explicitly resists adding **fiat on/off-ramps**, **token / NFT support**, or **chain-analysis-friendly defaults**; the bet is that Sparrow's audience wants a Bitcoin-only sovereignty wallet and other wallets (Wasabi, Cake, BlueWallet) fill the broader-feature-set niche.\n\n**Grade rationale.** Listed at **Grade A** because: (1) **fully open-source under permissive licence** (Apache-2.0, auditable, forkable); (2) **named-operator accountability** (Craig Raw, GPG-identifiable, 4+ years of consistent public signatures); (3) **no account anywhere in the flow** (download → verify → run, no Sparrow account exists); (4) **Tor-native + your-own-server capable** (no third party on the data path if you wire it that way); (5) **PSBT-first + airgapped-signing support** at the protocol level, not as a bolt-on; (6) **hardware-wallet support breadth** is the widest of any desktop wallet in this tier; (7) **no security incident attributable to Sparrow-specific code** in 4+ years of releases. The grade ceiling is **Bitcoin-only scope** — multi-chain users will need a second wallet for non-BTC assets — but for BTC the wallet earns A unconditionally.\n\n**Useful when:**\n\n- You hold Bitcoin and want a **desktop wallet that doesn't talk to anyone except the server you point it at**.\n- You run (or want to run) **your own Bitcoin Core node** and want a wallet that natively understands that setup.\n- You use **hardware wallets** and want one frontend that talks to Ledger / Trezor / Coldcard / BitBox / Jade / Foundation / etc., including **airgapped PSBT-over-QR** flows.\n- You want **multi-signature** setup (2-of-3, 3-of-5, etc.) without the friction of running Electrum + Specter Desktop side-by-side.\n- You need **fine-grained coin control** — selecting specific UTXOs to spend, marking outputs as do-not-spend, labelling for accounting + future-self.\n- You use **BIP47 PayNyms** (reusable payment codes) and want a desktop wallet that supports the standard natively.\n- You operate a **business or treasury** that needs PSBT workflows + hardware-wallet co-signing + auditable transaction history, but don't want to run a custodial provider.\n- You're a **Bitcoin-privacy advocate** writing about or teaching wallet hygiene + Tor + airgapped signing — Sparrow is the canonical reference.\n\n**Caveats:**\n\n- **Single-maintainer dependency.** Craig Raw owns the release process; the project has accepted occasional outside contributions but the maintainer hat is one person. If Craig stopped releasing, the existing binary continues to work indefinitely (Bitcoin protocol doesn't break) but security fixes + new features would slow or fork.\n- **Bitcoin only.** No Lightning, no Liquid, no altcoin support (intentional). If you need XMR alongside BTC, pair Sparrow with a separate Monero wallet (Feather, Monero GUI, Cake).\n- **JavaFX desktop only.** No mobile, no web. Phone-based Bitcoin users should look at BlueWallet / Phoenix / Mutiny / Foundation Envoy depending on their flavour.\n- **Native protocol-level mixing dropped.** Sparrow used to integrate Whirlpool (post-Samourai-shutdown maintenance burden) and JoinMarket coordinator flows; these are no longer first-class inside Sparrow as of recent releases. Privacy posture relies on PSBT + airgapped signing + your-own-server, not in-wallet coin mixing.\n- **Public-Electrum-server choice matters.** If you don't run your own Electrum server, the public one you pick learns your xpubs (and therefore can correlate your addresses + balance). Sparrow makes this trade-off visible but doesn't eliminate it — running your own server is the only complete fix.\n- **Reproducible builds not fully formalised.** Binaries are GPG-signed, but the formal Bitcoin-Core-style Guix reproducible-build pipeline that lets multiple independent builders reproduce the same byte-identical artifact is not yet in place. Build-from-source is the high-assurance path.\n- **JavaFX install size.** ~150 MB on disk; the app bundles a JVM so users don't need to install Java separately. Heavier than CLI-first wallets like Bitcoin Core's bitcoin-cli.\n- **Initial sync** depends on which server mode you pick. Public Electrum: seconds. Your own Bitcoin Core: 24-48 hours for the first chain download (one-time).", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "tor_mirror", "self_hosted", "multisig_supported", "full_node_capable" ], "highlight_tags": [ "BTC NATIVE", "TOR", "MULTISIG", "HARDWARE WALLETS" ], "fees": { "summary": "Free wallet · Bitcoin network fees only (you choose the fee rate per transaction with full coin control)." }, "fees_summary": "Free wallet · Bitcoin network fees only (you choose the fee rate per transaction with full coin control).", "last_verified": "2026-05-27", "operating_since": "2020", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://sparrowwallet.com", "outbound_slug": "sparrow", "tor": "http://sparrowa7io5pz6ud3ehqzosvepbxbxt2zphmkjsylp2zgxooko23pqd.onion", "twitter": "https://x.com/SparrowWallet", "telegram": "https://t.me/SparrowWallet" }, "also_listed_at": { "web3privacy": true } }, { "id": "specter-desktop", "category": "wallets", "subcategory": "Hardware", "name": "Specter Desktop", "url": "https://xmr.club/wallets/specter-desktop", "twin": "https://xmr.club/llm/wallets/specter-desktop.txt", "tagline": "Multi-vendor BTC multisig coordinator. Pair Ledger + Trezor + Coldcard + SeedSigner in one wallet.", "review": "Specter Desktop is the coordinator for Bitcoiners who refuse to trust anyone else's server: it pairs your hardware wallets with your own full node to run single-sig or multisig vaults, so your balance, your addresses, and your transaction history never leak to a third party.\n\n**Background**\nOpen-source and community-developed, Specter Desktop connects directly to your Bitcoin Core node and speaks fluent hardware-wallet — Coldcard, Trezor, Ledger, BitBox, SeedSigner, and more. It is built specifically for multisig and air-gapped workflows, an audience underserved by consumer wallets.\n\n**What you trust**\nYou trust your own node and open-source code, not a company's backend. Because Specter queries your Bitcoin Core directly, there is no third-party server learning which addresses are yours — a privacy property most wallets quietly surrender. PSBT-based signing keeps keys on the hardware devices.\n\n**Operational specs**\nDesktop app driving multisig (m-of-n) across mixed hardware vendors, with PSBT export/import for air-gapped signing (QR or microSD). Full Bitcoin Core integration for trustless balance/history. Supports Tor, watch-only wallets, and coin control. A power tool for self-custody rather than a one-tap mobile wallet.\n\n**Philosophy**\nSpecter's stance is that real self-custody means real self-verification: run your own node, own your privacy, and don't outsource the validation of your own money. It treats multisig — the strongest defense against single-point key loss or theft — as a first-class, approachable workflow.\n\n**Grade rationale**\nGrade A. Best-in-class node-backed multisig coordination, vendor-agnostic hardware support, and genuine privacy from running against your own Core. The full-node requirement and learning curve keep it from being a beginner pick, but for its intended advanced-custody role it excels.\n\n**Useful when**\nYou run (or will run) a Bitcoin full node and want trustless, private balance/history; you're building multisig across multiple hardware wallets; you want air-gapped PSBT signing; you reject third-party-server wallets.\n\n**Caveats**\nBitcoin-only, and it expects you to run Bitcoin Core — a real setup and maintenance commitment. The multisig and node workflow has a learning curve; misconfigured backups can lock you out. It coordinates signing, it doesn't hold keys — pair it with hardware wallets you back up carefully.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "multisig_supported", "self_hosted", "full_node_capable" ], "highlight_tags": [ "MULTISIG", "OPEN-SOURCE", "DESKTOP" ], "fees": { "summary": "Free · GPLv3 · Python · multi-vendor multisig" }, "fees_summary": "Free · GPLv3 · Python · multi-vendor multisig", "last_verified": "2026-05-13", "operating_since": "2020", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://specter.solutions", "outbound_slug": "specter-desktop", "twitter": "https://x.com/SpecterDIY", "telegram": "https://t.me/spectersupport" }, "also_listed_at": { "web3privacy": true } }, { "id": "stack-wallet", "category": "wallets", "subcategory": "Multi-Chain", "name": "Stack Wallet", "url": "https://xmr.club/wallets/stack-wallet", "twin": "https://xmr.club/llm/wallets/stack-wallet.txt", "tagline": "Open-source multi-coin wallet (XMR, BTC, LTC, Firo, etc) — Tor support built in.", "review": "From the Cypher Stack team. Open-source, Tor-aware, supports Monero and a handful of other privacy coins. Less mature than Cake but actively developed.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "xmr_native", "multi_chain", "tor_mirror", "thin_client" ], "highlight_tags": [ "MULTI-CHAIN", "TOR" ], "fees": { "summary": "Free · Network fees only" }, "fees_summary": "Free · Network fees only", "last_verified": "2026-05-11", "operating_since": "2014", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://stackwallet.com", "outbound_slug": "stack-wallet", "twitter": "https://x.com/stack_wallet", "telegram": "https://t.me/stackwallet", "discord": "https://discord.gg/mRPZuXx3At" }, "also_listed_at": { "web3privacy": true } }, { "id": "trezor-suite", "category": "wallets", "subcategory": "Hardware", "name": "Trezor Suite", "url": "https://xmr.club/wallets/trezor-suite", "twin": "https://xmr.club/llm/wallets/trezor-suite.txt", "tagline": "Desktop UI for Trezor devices. BTC native, XMR / multi-coin via plugins, runs on Tor by default.", "review": "Trezor Suite is the *official, open-source, Tor-by-default client* for Trezor hardware wallets — the desktop app SatoshiLabs builds to manage coins on its devices, with reproducible builds so you can verify the binary you run matches the public source.\n\n**Background.** Shipping since 2017 (as the successor to the original Trezor web wallet), Suite is the first-party application for the Trezor hardware line. It manages Bitcoin (with PSBT and multisig), Ethereum, and a range of altcoins, and the *desktop build routes through Tor by default*. Its standout trust property is *reproducible builds*: the released binaries can be independently rebuilt from the open source and verified to match, closing the \"is the app I downloaded the app they published?\" gap. Open-source + reproducible + Tor-default is why it earns an A in /wallets.\n\n**What you trust.** The hardware holds the keys; Suite is the watch-only/coordination layer — and it's built to be verifiable. *Open source* means the app's behaviour is auditable, and *reproducible builds* go further: you (or researchers) can rebuild the exact released binary from source and confirm no hidden changes were slipped in, which most wallet apps can't offer. *Tor by default* on desktop means Suite doesn't leak your IP/transaction-broadcasting metadata to a server by default. The private keys never leave the Trezor device; Suite assembles and displays transactions for the device to sign. So the trust is \"verifiable open client + keys-on-device,\" not \"trust the app with your coins.\"\n\n**Operational specs.** A *desktop and web client* for Trezor hardware that supports *Bitcoin (PSBT, multisig)*, Ethereum, and altcoins, with the *desktop app defaulting to Tor*. Builds are *reproducible* and the source is public. It handles account management, sending/receiving, coin control, and labeling, with the device as the signer. *Important for this audience: Suite has no native Monero support* — to use a Trezor with XMR you pair the device with the *Monero GUI or Feather wallet* instead, where Trezor acts as the hardware signer for your Monero accounts.\n\n**Philosophy.** A hardware wallet is only as trustworthy as the software you drive it with — a malicious or unverifiable companion app can show you the wrong address or leak metadata even while the device keeps your keys safe. Suite's thesis is that the client should be as *verifiable* as the device's security model implies: open the source, make the builds *reproducible* so the running binary is provably the published one, and route through *Tor* so using your wallet doesn't expose your network identity. It's defense-in-depth — the device protects keys, and the client refuses to be the weak link.\n\n**Grade rationale.** A in /wallets. The grade reflects open-source code, *reproducible builds* (a rare and meaningful verification property), Tor-by-default on desktop, first-party support for the hardware, and solid Bitcoin features (PSBT, multisig). It's a top-tier wallet client. The caveats — chiefly no native XMR, and the usual hardware-wallet supply-chain considerations — are scope notes, not security flaws.\n\n**Useful when.** Use Trezor Suite as the *verifiable client for a Trezor* managing Bitcoin (especially with PSBT/multisig) and supported altcoins, when you value an open, reproducible app that routes through Tor. For *Monero*, don't reach for Suite — pair your Trezor with the *Monero GUI or Feather* instead, which is the supported path and the right tool for XMR. In a mixed BTC+XMR setup, Suite is the BTC-side client and Feather/Monero GUI the XMR-side one.\n\n**Caveats.** The big one for this directory: *no native Monero support* in Suite — XMR users must use Feather/Monero GUI with the device, so Suite alone isn't an all-coin solution. As with *any* hardware wallet, you trust the *supply chain* (buy direct, verify the device and firmware) and your own *seed backup* hygiene — Suite and the device protect keys in use, but a compromised or lost seed still loses funds. The web version doesn't get the desktop's Tor-by-default benefit, so prefer the desktop app for the metadata protection. None of these dent the A: for a *verifiable, reproducible, Tor-routing* hardware-wallet client, Suite is among the best — with the honest caveat that Monero lives outside it.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "non_custodial", "open_source", "tor_supported" ], "highlight_tags": [ "HARDWARE", "TOR", "OPEN-SOURCE" ], "fees": { "summary": "Free software · Trezor hardware €69+ · BTC accepted" }, "fees_summary": "Free software · Trezor hardware €69+ · BTC accepted", "last_verified": "2026-06-03", "operating_since": "2017", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2017", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://trezor.io/trezor-suite", "outbound_slug": "trezor-suite", "twitter": "https://x.com/trezor" } }, { "id": "trezor-xmr", "category": "wallets", "subcategory": "Hardware", "name": "Trezor", "url": "https://xmr.club/wallets/trezor-xmr", "twin": "https://xmr.club/llm/wallets/trezor-xmr.txt", "tagline": "Open-source-firmware hardware wallet with XMR support via Monero GUI + Feather. Grade B. Live incident: 2026-08-13 shipping-provider breach exposed 11,742 customers' full PII (name + phone + shipping address) to the black market — physical-safety risk, not phishing risk. Read the incident block before ordering.", "review": "**Live incident (2026-08-13).** A Trezor shipping-provider breach exposed the full PII (name + phone + email + shipping address) of **11,742 customers** who ordered in the 90 days prior to 2026-08-08 (plus 1,947 with partial exposure). Countries: US, UK, Sweden, Colombia, Brazil, Italy, Portugal. Trezor's public framing leads with *\"our devices remain secure\"* — technically true and completely beside the point. The reader-facing risk is not phishing; it is physical: confirmed crypto-holder home addresses in the hands of any buyer of the leaked data is home-invasion / stalking / $5-wrench-attack territory. Trezor firmware and devices are unaffected. See [`/guides/old-iphone-cold-storage`](/guides/old-iphone-cold-storage) for the shipping-address-opsec reframe + a step-by-step alternative that closes this class of exposure.\n\n**What Trezor is.** Open-source-firmware hardware wallet family (Trezor One, Model T, Safe 3, Safe 5). Native Monero support via Monero GUI and Feather; the wallet holds the key, the host builds the tx, the device signs. Vendor: SatoshiLabs (Czech Republic), 12+ years of continuous operation.\n\n**Grade B rationale.** The wallets themselves work well and are among the most transparent hardware in the space (fully open-source firmware, bootloader, and schematics). The B (rather than higher) reflects the recurring supply-chain and vendor-side exposure history — the 2026-08 shipping breach is the third significant PII-adjacent incident affecting Trezor customers this cycle, on top of long-standing concerns about the Trezor Suite auto-update posture. Not a firmware trust issue; a vendor-relationship + shipping-address surface issue.\n\n**What you trust.** Firmware openness, well-audited cryptography, community-maintained fork ecosystem (Trezor firmware is the reference for several third-party hardware wallets), Monero GUI + Feather integration that Just Works.\n\n**What you don't.** SatoshiLabs's fulfillment supply chain. Ordering to a legal-name shipping address puts you on any future breach-victim list. Mitigations: PO box, drop shipper, mail-forwarding service, or the separate-iPhone pattern in the linked guide.\n\n**Alternatives.** For the airgap use case specifically: **Cupcake Wallet** (by the Cake Wallet team) on an old iPhone / Android — purpose-built for exactly the airgap-signer role, avoids the shipping-address surface entirely. For a hardware wallet without changing the pattern: rotate through a shipping-privacy layer before your next order.\n\n**Cross-refs.** Parent guide: [`/guides/monero-cold-storage`](/guides/monero-cold-storage). Alternative pattern: [`/guides/old-iphone-cold-storage`](/guides/old-iphone-cold-storage). Verify-your-binary: [`/guides/verify-wallet-binary`](/guides/verify-wallet-binary).", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "light_kyc" ], "feature_tags": [ "non_custodial", "open_source", "xmr_native" ], "highlight_tags": [ "HARDWARE", "OPEN-SOURCE FW" ], "fees": { "summary": "Hardware device $69+ · Network fees only" }, "fees_summary": "Hardware device $69+ · Network fees only", "last_verified": "2026-08-14", "operating_since": "2014", "tenure_note": "operating_since estimated from about-page heuristic; WHOIS and archive.org both returned no signal", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://trezor.io", "outbound_slug": "trezor-xmr", "twitter": "https://x.com/trezor" }, "incident": { "severity": "high", "date": "2026-08-13", "headline": "Shipping-provider breach exposed 11,742 customers full PII", "summary": "A third-party shipping provider used by Trezor was breached, exposing full names, phone numbers, email addresses, and shipping addresses of customers who ordered in the 90 days prior to 2026-08-08. Trezor's own count: 11,742 customers with full exposure + 1,947 with partial (name + city + email). Affected countries: US, UK, Sweden, Colombia, Brazil, Italy, Portugal. Trezor's public statement leads with 'our devices remain secure' and frames the risk as phishing. The reader-facing reframe is physical: shipping addresses of confirmed crypto holders in the hands of any buyer of the leaked data is home-invasion / stalking / $5-wrench-attack territory, not inbox phishing. Trezor firmware and devices are unaffected by this incident — the exposure is entirely on the fulfillment supply chain. See the curator guide for the operational response.", "timeline": [ { "date": "2026-08-20", "note": "Trezor published an official 2026-08-13 blog naming ShipMonk as the breached fulfillment partner and restating 11,742 full-address records plus 1,947 partial; devices and firmware remain unaffected. After the first post, Trezor said the 1,947 partial cohort (name/city/email only) may include older-than-90-day orders…", "auto": true } ] } }, { "id": "unstoppable-wallet", "category": "wallets", "subcategory": "Multi-Chain", "name": "Unstoppable Wallet", "url": "https://xmr.club/wallets/unstoppable-wallet", "twin": "https://xmr.club/llm/wallets/unstoppable-wallet.txt", "tagline": "Open-source non-custodial multi-chain wallet — BTC, ETH, fully-shielded ZEC, XMR support, WalletConnect + Tor built in, phishing-protection + duress mode. Endorsed by bitcoin.org and by Zooko Wilcox-O'Hearn (ECC CEO).", "review": "**What it is.** An open-source, non-custodial multi-chain wallet for iOS, Android, and desktop. Supports BTC, ETH, XMR, fully-shielded ZEC, and multiple other chains from a single seed. The wallet is self-referred as *Unstoppable*, ships with Tor toggle, WalletConnect, DEX aggregation for anonymous cross-chain swaps, address-poisoning / phishing protection, and a duress mode.\n\n**Why Grade A.** Two anchor signals do most of the work here. First, the wallet carries an on-record endorsement from **Zooko Wilcox-O'Hearn**, CEO of the Electric Coin Company (Zcash), naming it *\"the first multi-coin wallet that supports Bitcoin, Ethereum, and fully shielded Zcash… users own their own keys and their own privacy.\"* Second, **bitcoin.org lists it in its recommended-wallet set** — a curation surface with real editorial standards. Add an independent kycnot.me score of 8/10 and the operator's history of shipping releases through the app stores under the *Unstoppable* brand, and you have a wallet that has already been vetted by surfaces xmr.club treats as authoritative.\n\n**Trust story.** Non-custodial by construction — the seed lives on the user's device; the operator cannot freeze or move funds; the codebase is public. The privacy surface (Tor, no user-data collection, phishing protection, DEX-native swaps) is real and consumer-facing. Duress mode is a rare feature in the wallet market and is directly relevant to the physical-safety threat model.\n\n**Path from B to A (closed 2026-07-01).** Initially listed at B pending (a) a second peer-directory anchor beyond bitcoin.org + ECC and (b) a clean-release-cycle observation. The 2026-07-01 sentiment sweep closed both: independent verification via **F-Droid**, **WalletScrutiny** reproducible builds, an active **Immunefi** bug bounty, and an **ethereum.org** recommended-wallet listing — collectively equal or exceed the missing monerica anchor. No scam reports, no funds-loss incidents, no supply-chain concerns surfaced across Reddit / monero.town / Bitcointalk / X.\n\n**Category framing.** Multi-chain wallets are, on net, riskier than single-chain (Monero-only) wallets because each supported chain adds a surface a malicious update could attack. Unstoppable earns its listing here on architecture and reputation, not on category — readers whose threat model is XMR-only should still consider Feather or Monero GUI first as single-focus alternatives. Path there is spelled out under Wallets → Monero-only picks.\n\n**Endorsements + peer position.** kycnot.me `8/10`, bitcoin.org recommended-wallet page, on-record ECC quote. No red flags in the standard scam-investigation set (BrokerWatchDog, LostCoinRescue, etc.).\n\n**2026-07-01 sentiment sweep — additional signals.** Independent community check surfaced four peer-signals beyond the bitcoin.org + ECC anchors already in this listing: **F-Droid** distribution (the app is on F-Droid's open-source repo), **WalletScrutiny** reproducible-build verification (a category-specific audit surface that reproduces the app binaries from source), an active **Immunefi bug-bounty** program (professional-tier security posture), and an **ethereum.org** recommended-wallet listing. No scam reports, no funds-loss incidents, no supply-chain concerns found across Reddit, monero.town, Bitcointalk, or X. Explicitly confirmed distinct from Unstoppable Domains (unrelated blockchain-domain project). These signals collectively meet the two conditions we set as *Path to A* — the case for **A** is now on the table; grade left at **B** until curator approval, but the technical bar has been reached.", "translation_locale": "en", "rating": { "grade": "A" }, "grade": "A", "kyc_tags": [], "feature_tags": [], "highlight_tags": [ "OPEN-SOURCE", "NON-CUSTODIAL", "MULTI-CHAIN", "XMR", "ZEC", "TOR-BUILTIN", "WALLETCONNECT" ], "fees": null, "fees_summary": null, "last_verified": "2026-07-01", "operating_since": "listed on bitcoin.org · ECC endorsement on record", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://unstoppable.money", "twitter": "https://x.com/unstoppablebyhs", "email": "mailto:hello@horizontalsystems.io" }, "also_listed_at": { "kycnot": { "url": "https://kycnot.me/service/unstoppable-wallet", "score": 8 }, "bitcoin_org": { "url": "https://bitcoin.org/en/choose-your-wallet" }, "f_droid": { "note": "listed on F-Droid" }, "walletscrutiny": { "note": "reproducible-build verification" }, "immunefi": { "note": "active bug bounty" }, "ethereum_org": { "url": "https://ethereum.org/en/wallets/find-wallet/", "note": "recommended wallet listing" }, "monerica": { "url": "https://monerica.com/site/unstoppable" }, "web3privacy": true } }, { "id": "wasabi", "category": "wallets", "subcategory": "BTC + Privacy", "name": "Wasabi Wallet", "url": "https://xmr.club/wallets/wasabi", "twin": "https://xmr.club/llm/wallets/wasabi.txt", "tagline": "BTC wallet with built-in CoinJoin (WabiSabi protocol). Tor by default.", "review": null, "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "B" }, "grade": "B", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "tor_mirror", "multisig_supported", "full_node_capable" ], "highlight_tags": [ "BITCOIN", "COINJOIN" ], "fees": { "summary": "Free · CoinJoin coordinator fees 0.3% of mixed amount" }, "fees_summary": "Free · CoinJoin coordinator fees 0.3% of mixed amount", "last_verified": "2026-05-11", "operating_since": "2018", "tenure_note": "WHOIS redacted (likely .io or hidden TLD); operating_since estimated from archive.org first snapshot 2018", "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://wasabiwallet.io", "outbound_slug": "wasabi", "twitter": "https://x.com/wasabiwallet", "telegram": "https://t.me/WasabiWallet" }, "also_listed_at": { "web3privacy": true } }, { "id": "zeus", "category": "wallets", "subcategory": "Lightning", "name": "Zeus", "url": "https://xmr.club/wallets/zeus", "twin": "https://xmr.club/llm/wallets/zeus.txt", "tagline": "Open-source LN wallet — connect to your own LND/CLN/Eclair node or use embedded LSP.", "review": "Zeus is the **default privacy-respecting Lightning Network wallet** for users who want sovereignty over their own node. Connect to your own LND, CLN, or Eclair node remotely (over Tor or clearnet), or use the embedded LSP for a faster get-started flow. The app is **fully open-source** (MIT, `github.com/ZeusLN/zeus`), available on iOS + Android + APK, and has been the canonical 'roll your own node' Lightning wallet for self-hosters since 2021.\n\n**Architecture and the two modes:**\n\nZeus has two operating modes that map to two different threat models:\n\n1. **Remote-node mode (the original use case)** — you run your own LND / Core Lightning / Eclair node somewhere (home server, VPS, OmniBolt-style box) and Zeus is a thin remote control over that node's gRPC/REST API. The app holds no keys, no funds, no channel state — everything lives on your node. Connection is via REST + macaroon or LNC (Lightning Node Connect) for NAT traversal. Tor support is built-in. This is the sovereignty-maxing mode and what earns Zeus its A grade.\n\n2. **Embedded LSP mode (the 'just works' flow)** — added 2024+, Zeus runs a lightweight Neutrino client on-device with an embedded LND, and channels open via partnered Lightning Service Providers (Olympus Mobile, Lightspark, etc.). Custody of channel-state is on-device but liquidity provisioning + initial channel opens go through the LSP. This is the iOS-Phoenix-equivalent path for users who can't or won't run a node.\n\n**What you trust:** in remote-node mode, only your own node infrastructure (Zeus is just a UI). In embedded mode, the integrity of the LSP relationship + on-device key custody (your phone). Both paths are non-custodial in the strict sense — your seed never leaves the device, your channels are yours.\n\n**Privacy posture:** Tor-by-default for remote-node connections. **No telemetry, no analytics, no signup**, no email required. Zeus team is fully doxxed (Evan Kaloudis et al.) which is unusual in this space but a strength for a wallet — you know who built the code and who'll respond if there's a bug. The codebase has had third-party security review (Cure53 audit 2024).\n\n**Why we list at A:** open-source MIT + non-custodial in both modes + remote-node-first design + Tor support + Cure53-audited + 5-year operating history + doxxed maintainer team + the canonical option for self-hosted LN sovereignty on mobile. There's no realistic downgrade vector unless the audit findings worsen materially or the LSP model drifts custodial.\n\n**Useful when** you're running your own Lightning node and want a clean mobile UI for it, OR you want a non-custodial LN wallet for moderate sums where the on-device LSP path is acceptable, OR you want a wallet you can audit yourself before trusting with channel funds.\n\n**Compared to alternatives in the lightning subcategory:**\n\n- vs **Phoenix** — Phoenix is purpose-built for the embedded path (one-tap channel management via ACINQ). Zeus is the better choice if you want option (1) remote-node sovereignty. Phoenix wins on absolute UX simplicity for the no-node case.\n- vs **Breez** — Breez is more polished for in-app POS features (point-of-sale flows, podcast streaming sats). Zeus is more polished for node operation.\n- vs **Alby Hub + browser extension** — different threat model: Alby is browser-side WebLN, Zeus is mobile-side node-control. Compatible, not competing.\n\n**Caveats:**\n\n- Remote-node setup has a learning curve (port-forwarding, macaroon management, channel.backup hygiene). Not beginner-friendly in that mode.\n- Embedded LSP mode means LSP partner can theoretically force-close on you; mitigated by on-device channel backups but worth understanding before scaling sats parked in embedded channels.\n- No multi-sig support (no LN wallet has good multi-sig yet — protocol limitation, not Zeus).\n- iOS App Store version trails the Android release on some experimental features (Apple review delays).\n\n**Verdict:** if you care about Lightning sovereignty + Monero ecosystem alignment (the team has been vocally pro-XMR and ships features like reverse submarine swap support that bridge LN↔XMR cleanly), Zeus is the wallet to use on mobile.", "translation_locale": "en", "rating": { "stars": null, "count": 0, "grade": "A" }, "grade": "A", "kyc_tags": [ "anonymous_signup" ], "feature_tags": [ "non_custodial", "open_source", "lightning_native", "self_hosted", "thin_client", "tor_supported", "audited", "doxxed_team", "mit_license" ], "highlight_tags": [ "NON-CUSTODIAL", "OPEN-SOURCE", "TOR", "AUDITED" ], "fees": { "summary": "Free · LN routing fees only when self-hosted" }, "fees_summary": "Free · LN routing fees only when self-hosted", "last_verified": "2026-06-01", "operating_since": "2021", "tenure_note": null, "locales_available": null, "first_party": false, "editors_pick": false, "links": { "web": "https://zeusln.com", "outbound_slug": "zeus", "github": "https://github.com/ZeusLN/zeus" } } ] }