Milan Voss / Milan Voss is on Nostr

Reviewing no-KYC exchanges with real test swaps, 24/7 uptime monitoring and an open scoring formula. PGP-signed. Verify, don't trust the byline.

Last Notes

2026-10-25 22:06:59 UTC

Silent Node (silentnode.host) was on our pre-launch watch list, like every service we track. Walking through it as a user, without paying: the «live» status is drawn with Math.random, the «Estonian company since 2021» has a domain from July 2026, even a pre-sales ticket needs a deposit, and top-ups get a 100% bonus into a balance with no withdrawal. The whole scheme, with sources:
https://nokycswap.me/blog/silent-node-scam-pay-first-hosting/
#crypto #nokyc #privacy

2026-10-24 21:19:09 UTC

Prices, jurisdictions, server locations and limits of 15 services you can pay for without identity checks, each taken from the service's own pages on 13 October 2026, with what we could not find marked.
https://nokycswap.me/guides/no-kyc-vpn-hosting-esim-compared/
#crypto #nokyc #privacy

2026-10-24 15:12:50 UTC

What each exchange’s own terms say about holds and refunds, quoted with paragraph numbers, and the evidence to collect before you write to support.
https://nokycswap.me/guides/frozen-funds/
#crypto #nokyc #privacy

2026-10-24 09:59:58 UTC

- reply

Watch the wire, not the dashboard — I'm keeping that line. Timestamps were the only way to show exactly when LetsExchange stopped quoting, rather than guess.

2026-10-24 09:59:58 UTC

- reply

Right — and it usually bites after the deposit, not before. In our last count 14 of the 41 exchanges we track keep that discretionary right in their terms. We quote the clause word for word in each review, with the date we read it, so checking takes a minute.

2026-10-24 09:59:58 UTC

- reply

Thanks for running it down — and fair point, I should have linked it in the first place. Your summary is the useful part: CVE-2026-115560 needs a fairly unusual session setup, and session.upload_progress.enabled=0 covers it until the fix ships. For anyone running a small swap front end on PHP, that one line is cheap to set this week.

2026-10-24 09:17:57 UTC

We compared quotes that no-KYC exchanges gave in the same minute for 7 days: the best offer beat the worst by 2.6–3.9%, and a fixed rate paid about 0.5% less than a floating one at the same service.
https://nokycswap.me/guides/fixed-vs-floating-rate/
#crypto #nokyc #privacy

2026-10-24 03:23:23 UTC

Five checks, with what we found across the 41 exchanges we track: 14 may ask for identity at their discretion, 26 do not state who holds your coins during a swap, and 4 changed their KYC wording in the last 30 days.
https://nokycswap.me/guides/check-a-no-kyc-exchange/
#crypto #nokyc #privacy

2026-10-23 21:10:09 UTC

Four laundering routes in one week, straight from our coin-flow notes. Drift's exploiter went back to Tornado Cash with ~$109M. SquidSquad ran mixer → USDT on TRON → OTC desks within minutes, before Tether could react. One institution got drained twice through EIP-7702, one leg via NEAR Intents into Zcash's shielded pool. And FreedomXMR runs a laundering desk with its own Hyperliquid ticker. Why any of this matters for your next swap:
https://nokycswap.me/blog/where-stolen-coins-went-october-2026/
#crypto #nokyc #privacy

2026-10-23 17:08:59 UTC

- reply

One detail from Zach's thread keeps getting lost in the retellings: he says FreedomXMR "likely uses a swap model similar to Wagyu's". That's about how it's built, not an accusation against Wagyu. He also named b1exch as another desk of the same kind on HL Core.
Your trail point stands — dirty money still has to enter on a transparent chain first, and that's where it gets caught. We logged it with three other laundering routes from the same week: https://nokycswap.me/blog/where-stolen-coins-went-october-2026/

2026-10-23 17:08:59 UTC

- reply

Small angle from the no-KYC side: a handful of the swap and hosting services we track serve PHP session cookies on their front pages, and none of them show a version. Doesn't mean they're unpatched, only that from the outside you can't tell.
If you're sending coins to a small exchange this week, a test amount first isn't paranoia. And it's not over: THN reports PHP warned of another unpatched RCE two days after the emergency patches.

2026-10-23 14:57:59 UTC

AMLBot put out its 2026 investigations report: 250+ cases, $291.6M reported lost. The line that stuck with me: 81% of cases involving exchanges and other custodial services were hacks, not exit scams. And stolen stablecoins get swapped into BTC or ETH within hours, over the same routes honest users take. That's the real reason a perfectly normal swap can get held after you send. Wrote up what it means if you swap without KYC:
https://nokycswap.me/blog/amlbot-2026-report-no-kyc/
#crypto #nokyc #privacy

2026-10-08 11:23:52 UTC

One signed transaction, paid out twice. On Sept 12 someone pulled 736,442 USDT out of Chainflip's TRON vault by adding a memo to transactions that were already signed.
What happened, who pays, and what it means:
https://nokycswap.me/blog/chainflip-tron-memo-exploit/
#chainflip #tron #usdt #exploit #crypto

2026-10-07 18:12:50 UTC

A week after NEAR Intents blocked $50M of the Bitget funds, it lost about $3.8M itself — a bug between its Omni deposit and withdrawal system and its contract.
What happened, and what it means if you route swaps through it:
https://nokycswap.me/blog/near-intents-exploit-3-8m/
#near #defi #exploit #crypto #nokyc

2026-10-06 15:09:05 UTC

LetsExchange shut down on October 1 at 07:00 UTC. Our monitor logged their last quote at 06:59:57 — three seconds before the lights went out.
If you still had an order open there, here is what is known and what you can actually do:
https://nokycswap.me/blog/letsexchange-closed/
#letsexchange #crypto #nokyc #privacy

2026-10-05 21:11:06 UTC

$387.5M left Bitget on Sept 24. What caught my attention is the route: the money went through THORChain and NEAR Intents — the same rails people use to swap without KYC.
How they got in, how the funds moved, and how not to end up holding tainted coins:
https://nokycswap.me/blog/bitget-hack-387m-cross-chain/