State of no-KYC — October 2026: a $6.3B hack, eleven swaps with our own money, and who screens addresses

October was the month the largest exchange in the world lost more than six billion dollars — and the month we started paying for our own tests.

At a glance

• 54 live services under observation; 35 have passed our checks, 19 are still being checked. LetsExchange stopped operating on 1 October.
• One critical incident in the niche: NEAR Intents lost about $3.8 million from its BSC hot wallet.
• Nine new entries in our scam registry; 189 changes in the terms of 51 services, ten of them material.
• Median clearnet availability 92.8 %; twelve services stayed at 99 % or above.

The month’s thefts

Binance, outside our niche but felt by everyone in it, put the damage of its 29 October incident at about $6.3 billion and said a compromised DevOps engineer’s laptop reached the service that submits withdrawals; about $3 billion was frozen, and Binance says it will cover the losses. We wrote it up separately: what it means if you swap without KYC. In the hours after it, every no-KYC swap on our monitor kept quoting.

NEAR Intents, inside the niche, had about $3.8 million drained from a hot wallet and halted services; we keep it under «caution».

Scams and withheld funds

We added nine entries to our scam registry this month: exit scams by El Capo, XMR Escrow and Silent Node (a pay-first «offshore host» with fabricated live monitoring, confirmed after our own walk-through), withheld funds at Swapter (confirmed) and GhostSwap and OctoSwap (likely), likely thefts at RuneSwap and KycNot.cc, and a disputed case at Lizex. Each entry shows what we verified and what we did not.

Eleven swaps with our own money

For the first time we funded tests ourselves: small swaps of $37–49 through Maya, THORChain, Bitania, BitcoinVN, PegasusSwap, SageSwap, Flashift, CypherGoat, Wagyu, Exolix and Relay. A few results:

• Bitania paid its fixed quote exactly; BitcoinVN paid 51 seconds after our deposit confirmed and re-priced in our favour.
• SageSwap works with no JavaScript and no trackers and paid in three minutes, 1.28 % below the market.
• PegasusSwap executed cleanly but at about 12 % below the market — and through the CypherGoat aggregator the same desk paid us 9.3 % more.
• Flashift’s recommended offer failed, and the refund address we gave was dropped from the order twice.
• Relay delivered ETH about one minute after we sent; Exolix paid 1.8 % more for the same TRX but took 23 minutes.
• Three seconds after one payout, a look-alike address sent us dust — an address-poisoning attempt. Always copy addresses from your wallet, never from your history.

Full findings go into each service’s review as a «Tested by a swap» block.

Who screens addresses

We created orders without funding them, using an address from the US OFAC sanctions list. All six instant exchanges we checked — Wagyu, SageSwap, Bitania, BitcoinVN, PegasusSwap and Exolix — accepted a sanctioned payout address at order creation. Relay refused it outright. NEAR Intents refused both a sanctioned payout and a sanctioned refund address before handing out a deposit address, and LI.FI refused a sanctioned sender or recipient before returning a route. Accepting at order creation does not show what happens on deposit — several services say they screen incoming funds, which an unfunded test cannot reveal.

Terms of service

Our archive caught 189 changes on 51 services. Ten were material: two KYC changes, two data-disclosure changes, one jurisdiction change, two major rewrites and three other substantive edits; fifteen were page noise.

Availability

The median service was reachable on clearnet 92.8 % of October; twelve stayed at 99 % or above. Our own checker failed on several days this month (most of 24–26 October after a change in our code); those checks are excluded, not counted against services, and we published the correction. Five services block automated checks on some days; they show as «not measurable», never as 0 %.

Following stolen funds

We follow public cases on chain. In the Bitget theft (about $387 million), at least $8.27 million of the funds we track reached a Binance hot wallet in three transfers — Binance is a KYC exchange that can freeze. We also follow Binance itself, Morpho, the SquidSquad BSC theft, NEAR Intents, a Chainflip-related TRON case, EagleSwap and KycNot.cc.

Method and limits

Everything here comes from our monitoring, from swaps we paid for, and from the public sources named above. We name services because of what we measured, not to accuse. Corrections are published, not hidden.