How xmr.club's grade-change & incident ledger works (+ monthly digest template)

Why a living ledger beats a static “best of” list

The cryptocurrency directory landscape is plagued by information decay.

A tech blog publishes an article titled “Top 10 No-KYC Exchanges of 2024”. The post receives high rankings in search engines. Over the subsequent eighteen months:

• Two of the exchanges quietly implement mandatory passport verification.
• One platform is acquired by a regulated entity and begins blocking privacy coin withdrawals.
• Another exchange suffers an exit scam, stealing user deposits.

Yet the original blog post remains unchanged, continuously funneling unsuspecting users into predatory traps.

At xmr.club, we treat directory maintenance as an active intelligence and verification operation. Services in the privacy ecosystem do not possess static, permanent trust; they possess current operational track records. To reflect this reality, our platform operates a dual-layer auditing system: long-term letter grades (A through F) paired with a living, dated incident ledger.

Grade vs. Incident: Read this first

To read xmr.club accurately, you must understand the distinction between a Grade and an Incident:

[ Long-Term Posture: THE GRADE (A – F) ]
  • Evaluates baseline architecture, privacy terms, and legal jurisdiction
  • Governed by our public methodology rubric
  • Answers: "Is this service fundamentally designed to respect privacy?"

                          VS.

[ Point-in-Time Event: THE INCIDENT (Critical – Low) ]
  • Documents a specific, dated operational event (exploit, hold, or outage)
  • Includes timestamp, affected orders, and immediate curator advice
  • Answers: "What broke recently, and what should users do right now?"

An Incident Does Not Automatically Mean Grade F

A common misconception is that any open incident on a provider’s page should drop them to Grade F. That is incorrect.

Consider two contrasting real-world examples:

1. Protocol Bug with Responsible Disclosure (Haveno): In May 2026, an exploit involving forged arbitrator acknowledgement messages was detected across Haveno instances. The core developers broadcasted emergency warnings, operators paused trade engines, and patches were released within hours. The operators did not steal user funds, and the non-custodial architecture remained sound. Haveno retained its Grade A status while an active High Severity Incident was logged to warn users to update their desktop clients.
2. Selective Non-Delivery and Extortion (SplitNow): When an instant swap desk selectively sweeps customer deposits, fails to deliver the purchased Monero, and demands extortionate KYC without offering refunds, that is an intentional structural failure. SplitNow was immediately downgraded to Grade F and added to our public shamelist.

How grade changes happen: The four evidence tiers

We receive dozens of user reports each month via our submission portal. To prevent our ledger from being weaponized by competitors or disgruntled trolls, reports are categorized into four strict evidence tiers:

The Editorial Firewall: Sponsorship Never Buys Grades

We state this unequivocally: grades on xmr.club are never for sale.

Commercial sponsors can purchase designated visual placement chips on our homepage and category indexes. However, paid placement is completely firewalled from our grading rubric:

• A sponsor cannot buy an upgrade from Grade B to Grade A.
• A sponsor that freezes user deposits or introduces mandatory identity verification will be downgraded immediately.
• If a sponsor commits an exit scam, they are labeled Grade F without refund.

Our financial credibility depends on our readers trusting that an A-grade listing is earned through technical rigor, not ad spend.

How to read the /incidents board

When reviewing an entry in our public incident ledger, examine three specific data fields:

1. Severity Levels

• CRITICAL: Active loss of user funds, ongoing zero-day protocol exploits, or unannounced custodial exit scams. Action: Halt all platform usage immediately.
• HIGH: Widespread shotgun-KYC holds on transparent deposits, breaking API changes, or severe legal/regulatory enforcement actions. Action: Do not deposit unless using specialized defensive routes.
• MEDIUM: Temporary payment gateway downtime, brief wallet maintenance, or elevated transaction latency. Action: Proceed with caution; expect delays.
• LOW: Minor front-end display bugs, cosmetic quote calculation errors, or minor policy documentation updates.

2. The “Curator Advice” Field

Every incident entry includes plain-English operational guidance written by our curation team. This field gives you immediate, unambiguous instructions: e.g., “Do not submit passport photos to unlock this order; demand an on-chain refund to your origin BTC address immediately.”

3. Historical Retention (Why Resolved Incidents Stay Public)

When an operator resolves an incident (for instance, releasing stuck funds or shipping a security patch), we mark the incident as Resolved.

However, we do not delete the incident record.

A provider’s historical incident log is vital for calculating their long-term reliability. An exchange that has suffered three major shotgun-KYC freezes over two years carries a fundamentally higher risk profile than a provider with an unblemished multi-year operating history.

The Monthly Digest Template (For Operators & Readers)

Each month, our curation desk compiles all grade changes, incident logs, and audit notes into a structured monthly digest.

Below is the official, standardized markdown template utilized by our editorial team:

# xmr.club Monthly Grade-Change & Incident Digest — [YYYY-MM]
**Published:** [YYYY-MM-01] · Asia/Shanghai (UTC+8)  
**Reporting Scope:** 30-Day Rolling Audit across ~18 Categories  
**Directory Source:** https://xmr.club/incidents  

---

## 1. Executive Summary & Market Climate
[2-3 paragraphs summarizing the primary regulatory pressures, protocol exploits, 
or payment gateway regressions observed across the privacy ecosystem this month.]

---

## 2. Critical & High Severity Incidents
| Provider | Category | Initial Grade | New Grade | Incident Summary | Current Status |
| :--- | :--- | :--- | :--- | :--- | :--- |
| [Provider Name] | [Category] | [e.g. A] | [e.g. F] | [Summary of exploit or non-delivery] | [Active / Resolved] |

---

## 3. Notable Grade Adjustments & Policy Regressions
- **[Provider A] (Grade A → B):** [Explanation of policy regression, e.g. added mandatory Cloudflare captcha].
- **[Provider B] (Grade B → C):** [Explanation of hold pattern, e.g. recurring KYC triggers on UTXOs].

---

## 4. Resolutions, Restorations & Recoveries
- **[Provider C]:** [Description of patch deployment, funds restored to users, or infrastructure recovery].

---

## 5. Immediate Action Items for Privacy Operators
1. **Software Updates:** [List of required client version upgrades, e.g. Haveno v1.x.x].
2. **Deprecation Warnings:** [List of domains or desks to cease using immediately].
3. **Recommended Routes:** [Current top-graded alternatives for fiat and crypto swaps].

---

## 6. Audit Integrity & Disclosures
All grades are calculated strictly against xmr.club's public methodology. 
Sponsorship buys placement chips only, never grades. 
Report new incidents or submit dispute evidence at: https://xmr.club/submit

Worked example: Anatomy of a grade downgrade

To understand how this operates in practice, examine how our ledger documented the transition of a high-speed instant desk when automated compliance triggers escalated:

Incident Snapshot: FixedFloat

• Historical Baseline: Grade A (Fast instant swaps, slick UI, long tenure).
• The Trigger: Documented instances of automated risk scoring halting trades on the payout leg (such as the 2026-05-16 TRX→BTC incident where compliance documentation was demanded).
• The Curator Evaluation: FixedFloat’s infrastructure remained online and reliable for 95% of routine clean retail trades. However, the contractual risk of automated mid-swap freezes became undeniable.
• The Action Taken: Rather than delisting the provider, our curators lowered FixedFloat to Grade B and added an explicit shotgun_kyc_verified caveat to their directory card.
• The Outcome: Users visiting the directory can still choose to use FixedFloat for fast, small swaps, but they do so with full awareness of the AML hold risks.

Frequently Asked Questions

Can an operator appeal an incident or grade downgrade?

Yes. Operators can submit verified cryptographic evidence, patch notes, or proof of customer refunds through our submission portal. If the evidence demonstrates that the root cause was resolved and affected users were made whole, our curation team reviews the appeal and updates the incident status to Resolved.

Where can I find real-time machine-readable incident data?

You can query our live incident feed via JSON at /api/v1/incidents. Autonomous trading bots, AI agents, and third-party dashboards can poll this endpoint to programmatically disable routes when a high-severity incident is triggered.

Why doesn’t xmr.club remove Grade F providers entirely?

Removing an exit-scamming or fraudulent provider from the directory makes them invisible, allowing them to continue defrauding new users who search for their name online. Keeping them listed with a prominent Grade F and an entry on our shamelist ensures that search engine queries for their brand lead directly to verified warnings.