I was offered money to review b1ack exchange.
For my first attempt, I created an order to swap ETH -> BTC. I chose the value of 0.01 ETH (~$32.90) which would result in 0.00032429 BTC (~$31.05).
I sent 0.0099 ETH to test if the exchange would go through with a different value than the one I input. It worked and confirmed that you just need to send any amount above the minimum and it will swap with the current rate.
My eth transaction got the 12 confirmations needed and after a couple more minutes I received my BTC. Overall the swap took less than 10 minutes from ETH sent to BTC received.
Interestingly, I received the BTC from an address associated with Thorchain.
While I understand AML scores can vary a lot, I know some people still worry about them. I used a brand new wallet so no other coins could skew the outcome.
AML Bot gave me a score of 0.00% (low risk level):
16.01.2026 02:02
AML checking for Bitcoin address:
<redacted>
🟩🟩🟩 Low risk level 0.00%
🟢 Trusted sources:
Other: 100.00%
🟠 Suspicious sources:
🔴 Dangerous sources:
Resume: Your coins are clean. You can pay with them without the risk of blocking and loss.
Suggestion 1: The captcha system on the swap page seems to be easily bypassable if you just answer correctly once and reutilize captchaHash + captchaAnswer. You should rework the system so you can only submit each challenge once, otherwise I can just spam orders reutilizing the same answer.
Suggestion 2: Add the link to the bitcointalk escrow details to the FAQ. Right now it only says:
"We have a total deposit of 1.2 BTC on Bitcointalk and Exploit forum." -- but no link to back the claims.
Suggestion 3: Add a captcha verification or rate limit to the /CheckStatus page. While cloudflare does a good job blocking most spam requests (on clearnet), it's a bit trivial to get a clearence token and do many requests to brute force a swap ID. And with Tor there is no cloudflare to protect you, so I can just spam requests.
I made a fairly simple PoC (< 40 lines of code) to test this possibility:
At 2^32 possibilities, maybe you won't have any trouble after all... but who knows?
Suggestion 4: Provide "Letters of Guarantee", signed with your staked bitcoin address or pgp key, so customers can provide evidence if anything goes wrong. Something along the lines of "We, blexch, confirm we generated the address XXXXXX on the Bitcoin network at the date XX/XX/XXXX for the order XXXXXXXX, swapping BTC for ETH with a minimum amount of 0.0003 BTC, to be sent to the address 0xABCDEFG. Valid until XX/XX/XXXX".
Otherwise, how would I prove to the escrower that I didn't receive my coins and that I should be refunded?
Suggestion/Note 5: I see on the FAQ that a "delete session" button is already planned, but I know this feature is a must for the most privacy oriented people, so maybe priorize that for completed orders. I clicked "clear history" on my order and it vanished from my browser, of course I played around a bit and tried recovering it by saving the cookies beforehand and restoring them, but even then nothing was returned (a positive that the cookie is deleted on the server side, and not only cleared on the browser
).
Playing with the refunds...
I created another session BTC -> LTC and sent 0.001 BTC.
After your system detected the transaction (but still with not confirmations), I asked for a refund. Just 1 minute later I received the refund on my wallet from the unconfirmed parent that I sent before that. Very quick and efficient, since this leaves to space for someone trying to abuse your system by asking for a refund just to double spend the deposit.
But what happens if I double spend the tx *before* asking for a refund? Well, I tested it out.
- Order created, 0.0006 BTC -> 51.78 USDT (TRC20).
- I sent the BTC, waited for blexch to detect.
- Then I double spent the tx.
- After the double spend tx was confirmed, I requested a refund and received the message "No funds available for refund"... no luck (and good job).
edit: Another attempt gave me a 502 status code error on cloudflare when trying to refund (same session). Maybe check why it showed this error instead of the "no funds available" message.
^^
Have used their exchange since 2020 and over $5,000 worth of swaps and haven't experience any attempt to scam me from them.
Even had to intervene when they first started out here on the forum with people yelling scam site.
Yet they are still operational and active here on the forum,
Saying another site is a scam when you are just starting out does not do you any favors either.
I'll have to side with b1ack on this one. Fixedfloat is known for freezing and demanding documents from people all the time. We had to put a "not safe" tag on them on BitList because of the many cases there is online.
They can charge lower fees because they get all their coins from KYC services that are a privacy nightmare (which is why they ask for KYC) but obviously can charge lower fees. If you want to provide your own liquidity also have full privacy, it's going to cost you more and also have higher risks, meaning higher fees.
