A directory only matters if its judgement matters. This page documents how we grade, tag, accept, reject, and remove listings. It's terse on purpose so it stays honest.
| Grade | What it means | Examples |
|---|---|---|
| A | Strong privacy posture. Anonymous signup or audited no-logs. Operator track record. Active maintenance. | Mullvad · Proton Mail · Njalla |
| B | Good privacy posture with one trade-off — light email at signup, smaller server fleet, less-audited claims. | IVPN · Wasabi · Tutanota |
| C | Usable but compromised — KYC at the payment edge, fork that hasn't stabilized, narrow feature set. | Windscribe |
| D | Listed for completeness or comparison only. Heavy KYC, weak privacy claims, or unproven operator. | (rarely listed) |
| F | Reserved for providers we have evidence have stolen funds, leaked customer data, or knowingly cooperated with mass deanonymization. Listed only as warnings. | (currently empty) |
Free-combine labels that describe properties of the service. Used for the click-to-filter chips on category pages.
xmr.club
open_source · non_custodial · self_hosted · cli_supportedtor_mirror · i2p_mirror · xmr_native · lightning_nativeletter_of_guarantee · signed per-order receipt (LoG) you can save before paying · open standard: NKIP-0001atomic_swap · audited · port_forwarding · ram_only_serverstransparent_fees · hidden_feesWe grade on transparency of fees, not on the absolute fee level. A 5% exchange that names the 5% upfront beats a 3% exchange that surfaces 1% in marketing and pockets the other 2% as silent spread.
transparent_fees — the quote shown before deposit equals what the user receives (minus destination-network fees, surfaced separately). No silent spread, no post-deposit slippage adjustment.hidden_fees — the visible quote understates what the provider keeps. Typical patterns: spread baked into the rate, withdrawal markup beyond actual network cost, partner slippage absorbed and not refunded. Fails the transparent_fees test and auto-caps grade at C.When a routing-style swap operator goes rogue, direct legal recourse is often impossible. Some operators post a guarantee with a peer directory (e.g. OrangeFren) — a pool of funds that pays users out if the operator misbehaves, up to a published amount.
data.guarantees.<peer>.{amount_usd, source_url}; available programmatically via /api/v1/guarantees.Casinos and prediction markets carry risks the rest of the directory doesn't: house-edge games can be rigged, and prediction-market resolutions can be disputed. We hold them to additional checks on top of the standard rubric.
/wagering/casinos)/wagering/prediction-markets)⚠ Gambling is restricted in some jurisdictions. Listing does not imply endorsement; verify your local law before participating.
last_verified. We re-test the signup + checkout flow on each entry at minimum once per year. Live status: /freshness.operating_since — the year the current operator has been continuously serving users. Operators with 5+ years (a full crypto cycle) get an implicit trust bump; fresh launches under 2 years are listed with extra caveats. Full ranking: /tenure.How an operator handles a bad day is a grade multiplier, not a tie-breaker. Custody-adjacent services (exchanges, mixers, wagering, prediction markets) sit on top of an implicit trust track that outlives any single incident, and readers extend or withdraw future benefit-of-the-doubt based on the shape of the last response, not the last uptime number. Two operator-behaviour axes carry material weight when the curator sets and moves grades.
The practical consequence: a service can hold a "flawed but honest" grade indefinitely if the response pattern is right, and a service with intact architecture can slide below its structural grade if the pattern is wrong. Grade lifts after an incident require both (a) the operational cause to be resolved AND (b) the operator response to have followed the transparency-plus-rapid-response shape. Neither alone is sufficient.
Reader-submitted reports of scam, denial-of-payout, or operator misconduct are a legitimate signal — some of the earliest exit scams get flagged by users hours before any structural evidence surfaces. But an unmoderated "anonymous report → automatic downgrade" pipeline is also an attack surface: a competitor can drop a $0 submission form and cost an operator a grade tier. This directory grades on evidence, not accusations. Four tiers govern how a report moves the grade.
The reader-facing consequence: a listing at Grade A can carry a Tier-1 note on its /audit page without the grade moving. Readers who want the raw signal see it; the grade doesn't get slot-machined by anyone with $0 and a spare minute. The trade-off is honest: we won't be the fastest to react to reader accusations, and we will occasionally be later than someone screenshot-quoting an anon complaint. That is the cost of a grade you can trust.
Spot a mistake? File via /submit or DM @xmrclub_bot. Every accepted correction lands in the public audit log with the reason. Disputes about grade or removal are documented; we don't quietly delete inconvenient context.
Reviews are moderated before they appear. The overall rating is a plain average of all approved ratings. Next to it we show two groups separately: order-verified reviews (sent by kyc.rip after a completed swap, or whose private order ID the curator checked with the operator) and community reviews from the public form. A group with fewer than 3 ratings shows its count only. Reviews left without a name, or with a name that poses as the operator or as us ("support", "official", the service's own name), are shown under a random stable pseudonym. That filter is best-effort; moderation is the backstop.
Paid reviews: kyc.rip only asks for a verified review after an order of $100 or more, so cheap floods of tiny orders can't farm verified ratings. If we find a service paying for or rewarding reviews (bounties, discounts, refunds or giveaways in exchange for a review), we pause new community reviews on its page, remove the reviews we tie to the campaign and say so on the listing. Order-verified reviews from completed trades still arrive but wait for moderation. We act on evidence of the campaign itself, such as a bounty thread or an operator offer, not on a burst of good reviews alone. Operators may ask their customers for reviews (the "Rate us" badge on every listing exists for that); they may not pay for or reward them. Paying for reviews deceives readers and can also lower the grade.
Some services only open an order when you give the deposit transaction or the address you received to. On those listings the review form asks for it, privately and optionally. We use it once to check your order, then delete it, and in any case within 30 days; it is stored encrypted and never published.
A service that is only days or weeks old has no track record we can grade, and a grade would hand an unproven site an 'xmr.club-rated' label. So new services start as interns: listed on /interns, /new and at the bottom of their category, with an INTERN badge instead of a grade, a small-amounts warning, and no place in the graded lists (search shows them flagged INTERN, below graded listings). An intern can't book the regular sponsor tiers. It can book only a New-Service Slot: a card in the separate, clearly marked “Sponsored new services” zone on /interns, which buys no grade, no checklist tick, no earlier graduation and no place in any list. It ends if the internship ends without graduating; after graduation it runs to its paid end but can't be renewed. An intern graduates to a graded listing when every item of a public checklist is ticked: online for 60 days (90 for services that hold your funds during a swap or order), a curator test passed, no credible complaint, an independent signal (two for fund-holding services: a third-party guarantee deposit, verifiable NKIP-0001 receipts at level 2 or 3, operator verification, or a listing on a directory that reviews its entries), and a working support channel (plus a PGP key for fund-holding services). A fresh graduate is graded at most C for its first 90 or 180 days. An intern that hasn't graduated by twice its period is removed; a credible scam report ends the internship at once.
A badge next to a name says how much we have verified, never how good the service is. ✓ Operator-verified: the operator proved they control the site (our badge on their domain, a /.well-known/xmr-club.txt token or a DNS record). ✓✓ Curator-tested: verified, and within the last 12 months we used the service ourselves or checked a customer's order with the operator. ★ Proven track record: curator-tested, listed on xmr.club for over a year, graded B- or better, no downgrade or incident in the past year, plus independent evidence — a third-party guarantee of at least $10,000 for services that hold your funds, or a recent independent audit or reproducible builds we verified for everything else. Badges can't be bought, sponsorship never affects them, nothing from kyc.rip (run by the same operator) counts, F listings never show one, and an open incident drops a listing back to ✓.
Some operators post a deposit or guarantee with an outside holder (OrangeFren, kycnone and others). We list each holder once, link its own statement, and show "up to" a total of the ones checked in the last 120 days. They are separate programs with their own terms, not one insurance pool, and not money we hold. A guarantee is a coverage signal, not a grade input on its own.
CURATOR-BUILT chip so the relationship is explicit. Same rubric applies — see /transparency./go/<slug>. They do not change a listing's grade or position.A = strong evidence + signup tested end-to-end in the last 12 months. No KYC at the tested volume. Onion mirror published when offered. Operator is responsive to corrections. B = mostly good but one notable caveat (e.g. KYC triggers on certain volumes). C = listed for completeness but we do not recommend it as a primary tool. D = retained for historical reference; do not use. A- / B- / C- (half-step grades) signal a listing that is one bar away from the next tier — used most often when the publishable surface looks strong but the service is too new for full tenure validation in high-loss-asymmetric categories (exchanges, casinos, custodial mixers).
No. Sponsorship moves placement (bubble-to-top within a category) and adds a SPONSORED chip. It never changes the grade, KYC tagging, or removal decisions. See the editorial firewall in /sponsor.
At minimum yearly. Entries older than 18 months are downgraded by one letter until re-tested. A daily uptime probe of each canonical URL drives the live status badges; that is separate from grade.
Affiliate links via /go/
Use /submit (form) or DM @xmrclub_bot on Telegram. Every accepted edit lands in the public /audit log with the reason.