A facts-only watchlist of listed providers with documented concerns. Every entry is backed by a source URL, a curator-set chip, or a logged policy-change diff. No interpretive editorial — only signals you can verify yourself. A provider being here is a caution flag, not a verdict; read the receipt and decide.
Curator lowered this provider's grade after a documented incident or posture change. The source is the receipt.
evidence B- → D — 18-day operator X silence since 2026-06-19 while remaining publicly active on Hyperliquid memecoin side; third-party swap-widget outage report on 2026-07-07 ("Failed to fetch"). Product is operationally unreliable AND operator unreachable via public channels — the exchange thesis (custodial risk bounded by attentive operator) does not hold in this state. No fund-loss evidence; the D reflects unreliability + unreachability, not fraud. source →
evidence A → A- — Two distinct trade-protocol exploits within 30 days against the Haveno surface. May 2026: arbitrator-substitution / fake-arbitrator-ACK on the arbitrator-selection step. June 2026: forced-arbitration-flow abuse — XMR releases after 30 confirmations even when BTC was never sent and the arbitrator is honest. Operators (RetoSwap and others) responded correctly — banned attackers, halted trading, broadcast PSAs — but user-facing risk is structural until a hardened trade-protocol ships. Revisit if the next ~60 days are incident-free after a structural fix.
evidence A → A- — Trust posture softened after the silent Q4 2024 jurisdictional move from Nevis to Costa Rica — no customer announcement, weaker offshore offsets, take-it-or-leave-it response from support, founder profiles dormant in the same window. Mirrors the 1984.is precedent: opacity is treated as a permanent grade input even when no malicious behaviour is documented.
evidence A → A- — Trust posture softened after the silent Q4 2024 jurisdictional move from Nevis to Costa Rica — no customer announcement, weaker offshore offsets, take-it-or-leave-it response from support, founder profiles dormant in the same window. Mirrors the 1984.is precedent: opacity is treated as a permanent grade input even when no malicious behaviour is documented.
evidence B → B- — Trust posture softened after the silent Q4 2024 jurisdictional move from Nevis to Costa Rica — no customer announcement, weaker offshore offsets, take-it-or-leave-it response from support, founder profiles dormant in the same window. Mirrors the 1984.is precedent: opacity is treated as a permanent grade input even when no malicious behaviour is documented.
evidence B → C — Repeat server compromise: ~200 XMR stolen via root/local-privilege-escalation on the main server (2026-06-08), operator confirmed total fund loss. "Hacked again" — a recurring custody failure for a fund-holding exchange. LIFT NOTE (2026-07-07): D → C on the 2026-06-28 operator recovery post — 90 XMR refunded 2026-06-24, security hardening (server rotation, new onion, wallet isolation, hidden backend IP). Full lift to B still requires public post-mortem + independent audit + 30-day no-incident window; repeat-compromise pattern is why C, not B. source →
evidence A → A- — Pattern of no-notice service suspensions. 1984.is shut down Hack Liberty — a 4+ year customer with a clearly visible abuse-reporting mechanism and explicit anti-abuse ToS — without warning or a chance to respond (Mar 31, 2026), then auto-suspended a legal Monero marketplace (XmrBazaar) on weaponized DMCA complaints (Jun 2026). XmrBazaar was restored after public pushback, but two no-notice takedowns of legal privacy projects is a permanent record. source →
Curator set a credibility flag after specific documented evidence. The chip is the receipt.
evidence Hype-aligned operator
evidence Partner-API data leak (2026)
evidence KYC forced on AML dispute
xmr.club
hype_aligned_operator, kyc_required_on_aml_dispute, denies_shotgun_kyc_as_pattern, shotgun_kyc_verified, operator_credibility_watch. Each is set only after specific documented evidence.Not on this list editorial opinions, single user complaints, predictions, or smear claims. We add only what we can defend with a link or a chip backed by curator-logged evidence.