Another Scam Domain xhash.cash Connected to jud-ex, darkmap, byware, nokyc-noaml

[Trêvoid]

Hello everyone,

Let’s remember what I said in the previous scam he carried out on BitcoinTalk users and some of my clients.



Source: https://bitcointalk.org/index.php?topic=5578174.msg66551518#msg66551518

He was too afraid to come here or on kycnotme and share his service, but even if he doesn’t come, I monitor many places so he can’t run away. I won’t allow this scammer to scam any more people.

Let’s dive into this: a scam network run by Russian scammers is back with a new domain and a new service called xhash.cash, connected to earlier scam services such as jud-ex, darkmap, byware, and nokyc-noaml.

https://xhash.cash/en/order/Z14YRJJI66 | Archived (https://talkimg.com/images/2026/07/19/UhdKgl.png)

https://jud-ex.com/en/order/HEXQ4

https://byware.net/en/order/INT06


Another scam method involves targeting large cryptocurrency swaps.



Don’t send high amounts just to get a low swap rate. I’ve said this many times if need increase amount to get good rate (percentage) is one way to judge whether a service is a scam or not.
For reference, 1 BTC was lost see the links below. https://bitcointalk.org/index.php?topic=5576584.0

If Increasing the amount offering a low percentage rate is one way they scam large sums from users.
The service may work with smaller payments, but they’re targeting big victims (selectively scamming) like Tomboi did, or like the case of someone losing over 1 BTC shown above. Further, don’t trust his letter of guarantee their method is a scam aimed at large sums, and they recreate the scheme again under new services.

Read more,

https://bitcointalk.org/index.php?topic=5578174.msg66551518#msg66551518
https://bitcointalk.org/index.php?topic=5578174.msg66539244#msg66539244
https://bitcointalk.org/index.php?topic=5576584.msg66499076#msg66499076


Transaction I made:

https://xhash.cash/en/order/7SCGUE07QM | Archived (https://talkimg.com/images/2026/07/19/UhuQCj.png)

TXID:
https://explorer.near-intents.org/transactions/LdSQnTZ6EFMkDafH37yBAhzbSUTYYXjFKB

They uses NEAR intents/1Click (Swap API) for swaps. They don’t support XMR for swaps, they manually send users xmr and look for big victims.

https://kycnotlist.com/en/exchanger/xhash-cash.48 (https://talkimg.com/images/2026/07/19/UhwS71.png) service should be mark as scam.

KYCNotList should be send deposit to the previously scammed users, QI2FY and Skjadoon.

Reports:
https://bitcointalk.org/index.php?topic=5576584.0
https://bitcointalk.org/index.php?topic=5570619.0

Manually Audited No-KYC Crypto Directory:
https://kycnone.com/threads/warning-xhash-cash-related-scam-networks-targeting-large-crypto-swaps.41/

Best regards,
— Trêvoid

[Trêvoid]

If a service's fee structure looks like an incentive program for large deposits, treat it as a high-risk scam. The lower fee is a "carrot" used to lure you into a trap.

[albon]

If a service's fee structure looks like an incentive program for large deposits, treat it as a high-risk scam. The lower fee is a "carrot" used to lure you into a trap.

The fee structure is doesn't make sense. I agree with you. It's just a trap to take advantage of the greed of some people who may end up losing a lot of money because these attractive but unreasonable fees make the platform seem tempting. .

Like you said, there have already been many cases where people lost a lot of money on new scam exchanges, like xhash.cash which is only about two months old. It hasn't even been in the industry for a year and has no real reputation yet.

It's reckless to trust a new, unknown exchange with large amounts of money without first verifying its legitimacy, especially when there are exchanges with a good reputation.

[tabas]

For reference, 1 BTC was lost see the links below. https://bitcointalk.org/index.php?topic=5576584.0

Shocks! IMO when swapping, it'll also be fine to do batches of it rather than to do a whole swap in one transaction if someone is too eager to swap in unknown swap exchanges. Much better not to proceed when red flag signs are obvious.

If a service's fee structure looks like an incentive program for large deposits, treat it as a high-risk scam. The lower fee is a "carrot" used to lure you into a trap.

Certainly a trap and that scammer won't be returning back the deposit for that amount. This is why a reputable swap is the one to be picked and their fee differences are not even too much to think of. with that big amount. And thanks for today, I've learned something new about the term "carrot".

[Trêvoid]

If a service's fee structure looks like an incentive program for large deposits, treat it as a high-risk scam. The lower fee is a "carrot" used to lure you into a trap.

The fee structure is doesn't make sense. I agree with you. It's just a trap to take advantage of the greed of some people who may end up losing a lot of money because these attractive but unreasonable fees make the platform seem tempting. .

Like you said, there have already been many cases where people lost a lot of money on new scam exchanges, like xhash.cash which is only about two months old. It hasn't even been in the industry for a year and has no real reputation yet.

It's reckless to trust a new, unknown exchange with large amounts of money without first verifying its legitimacy, especially when there are exchanges with a good reputation.

This is a common tactic used to target high-value individuals for scams. Furthermore, same actor has created a new website to continue finding victims.

For reference, 1 BTC was lost see the links below. https://bitcointalk.org/index.php?topic=5576584.0

Shocks! IMO when swapping, it'll also be fine to do batches of it rather than to do a whole swap in one transaction if someone is too eager to swap in unknown swap exchanges. Much better not to proceed when red flag signs are obvious.

If a service's fee structure looks like an incentive program for large deposits, treat it as a high-risk scam. The lower fee is a "carrot" used to lure you into a trap.

Certainly a trap and that scammer won't be returning back the deposit for that amount. This is why a reputable swap is the one to be picked and their fee differences are not even too much to think of. with that big amount. And thanks for today, I've learned something new about the term "carrot".

They have a whole scam network, and I’m here to expose it. They clearly don't like what I'm doing, but I’m dedicated to protecting the community.

I’m curious what the KYCnotlist admin would say, but so far he haven’t replied.

[albon]

This is a common tactic used to target high-value individuals for scams. Furthermore, same actor has created a new website to continue finding victims.

That's true. As soon as they catch a big victim, they'll shut the site down, disappear, and come back with a new site to continue targeting greedy, impatient people who often lack enough experience in this field and become easy targets for these scammers.

I wouldn't recommend depositing large amounts on new exchange until it has proven itself trustworthy over a long period of time. Anyone who puts a large amount of crypto into an exchange that's less than three months old clearly isn't thinking it through or being careful with their money.

I’m curious what the KYCnotlist admin would say, but so far he haven’t replied.

I hope he responds soon and takes this seriously. It would be even better if he added a warning to any platform showing red flags like these.

[tabas]

They have a whole scam network, and I’m here to expose it. They clearly don't like what I'm doing, but I’m dedicated to protecting the community.

We're all in support to you for that and thanks for that continuous patronage and help you do in the community.

I’m curious what the KYCnotlist admin would say, but so far he haven’t replied.

Hopefully they will remove them, looks like the reviews written for this platform looks manipulated especially that review saying that he's done a $30k transaction.

[Trêvoid]

This is a common tactic used to target high-value individuals for scams. Furthermore, same actor has created a new website to continue finding victims.

That's true. As soon as they catch a big victim, they'll shut the site down, disappear, and come back with a new site to continue targeting greedy, impatient people who often lack enough experience in this field and become easy targets for these scammers.

I wouldn't recommend depositing large amounts on new exchange until it has proven itself trustworthy over a long period of time. Anyone who puts a large amount of crypto into an exchange that's less than three months old clearly isn't thinking it through or being careful with their money.

I’m curious what the KYCnotlist admin would say, but so far he haven’t replied.

I hope he responds soon and takes this seriously. It would be even better if he added a warning to any platform showing red flags like these.

It’s wild that people still risk large sums on sites that haven't even been around long enough to establish a basic reputation.

They have a whole scam network, and I’m here to expose it. They clearly don't like what I'm doing, but I’m dedicated to protecting the community.

We're all in support to you for that and thanks for that continuous patronage and help you do in the community.

I’m curious what the KYCnotlist admin would say, but so far he haven’t replied.

Hopefully they will remove them, looks like the reviews written for this platform looks manipulated especially that review saying that he's done a $30k transaction.

It’s almost certainly fake, just another layer of the trap. Keep up the vigilance.

[tabas]

Hopefully they will remove them, looks like the reviews written for this platform looks manipulated especially that review saying that he's done a $30k transaction.

It’s almost certainly fake, just another layer of the trap. Keep up the vigilance.

Did they reply to you already? despite that there's a reminder and note from kycnotlist, these guys have no chill.  And with the other scam that you have found with the same domain which is the hide.cash, they're possibly connected to each other.

[Trêvoid]

Hopefully they will remove them, looks like the reviews written for this platform looks manipulated especially that review saying that he's done a $30k transaction.

It’s almost certainly fake, just another layer of the trap. Keep up the vigilance.

Did they reply to you already? despite that there's a reminder and note from kycnotlist, these guys have no chill.  And with the other scam that you have found with the same domain which is the hide.cash, they're possibly connected to each other.

They can’t possibly be connected, because they’re the same Russian guy.

[Trêvoid]

i am using kycnotlist few month. Always change through top exchanges like dex and bitkarm
i was scammed yesterday by xhash.cash, one of the top of exchangers with $10k deposit.
Claims against xhash from other users started from July accorting to topic https://bitcointalk.org/index.php?topic=5588810.msg66956583#msg66956583 Problems start month ago and no reaction on this...
So i understand kycnotlist didnt take any measures so we get result so me and another user from kycnotlist got scammed in August. So sad.
Beware that kycnotlist dont properly monitor their exchangers and you will get exit scammed when making huge exchange. I am waiting for reply from kycnotlist to get more information what happened

https://kycnone.com/threads/warning-xhash-cash-related-scam-networks-targeting-large-crypto-swaps.41/

Sorry to hear that someone was recently scammed. I already tried my best to warn the community, and I knew they were scammers.

Many listing services only list services that pay them. They perform a few small BTC to ETH swaps, and if everything goes well, they claim that the service is safe and problem free.

This is misleading. They should check the service’s history, details, records, operational history, connections, monitoring deeply and much more. I have 5 page long text my private founds history of services and records of details. I keep track of trails and their fingerprints like an online detective. Do not trust exchange-listing services simply because they look professional or attractive. There will be more scams.

I do my best to protect the community, but I still see people choosing the wrong services because of advertisements.

Because of what I’m doing, I have been heavily targeted by DDoS attacks, false accusations about me, and more. However, I didn’t stop, and I won’t, because I’m committed to protecting the community and providing a secure environment.

Best regards,
— Trêvoid

[Trêvoid]

Update:

Service Temporarily Paused

XHash has temporarily suspended exchange operations and related website functionality while an operational matter is being resolved.

[examplens]

The reason they are temporarily unavailable paused may be because the Walix-Wallet security breach and money laundering through xhash.cash are being investigated.

Walix-Wallet Hack Investigation: [Xhash.cash] / NEAR Intents
We are currently investigating the Walix-Wallet security breach of July 25, 2026, which resulted in the theft of several million dollars' worth of crypto assets.

https://x.com/MatchSystems/status/2088134694101475401

https://www.ad-hoc-news.de/wissenschaft/walix-wallet-hack-1-million-dollar-ueber-xhash-cash-bewegt/69951204

[albon]

Update:

Service Temporarily Paused

XHash has temporarily suspended exchange operations and related website functionality while an operational matter is being resolved.

The reason they are temporarily unavailable paused may be because the Walix-Wallet security breach and money laundering through xhash.cash are being investigated.

Walix-Wallet Hack Investigation: [Xhash.cash] / NEAR Intents
We are currently investigating the Walix-Wallet security breach of July 25, 2026, which resulted in the theft of several million dollars' worth of crypto assets.

OP was right about warning people about this platform from the start and what happened is pretty much what we expected.

Whoever hacked the Walix-Wallet may be connected to xhash or they could be part of the fake exchange networks run by the Russian network. They may also be working with them in exchange for a cut of the stolen money and then launder it through their platform.

I think that what is happening with xhash right now is    a way to disappear and carry out an exit scam especially after Match Systems exposed them and their funds were frozen on NEAR Intents.

I don’t think they will come back and reopen the platform after all of this. Even if they weren’t the ones who hacked the wallet, their involvement in laundering money and moving stolen funds would make it very hard for them to come back.

They might come back with a different name and domain, though, just like they did before with the scam platforms mentioned in the OP.

[Trêvoid]

Update:

Service Temporarily Paused

XHash has temporarily suspended exchange operations and related website functionality while an operational matter is being resolved.

The reason they are temporarily unavailable paused may be because the Walix-Wallet security breach and money laundering through xhash.cash are being investigated.

Walix-Wallet Hack Investigation: [Xhash.cash] / NEAR Intents
We are currently investigating the Walix-Wallet security breach of July 25, 2026, which resulted in the theft of several million dollars' worth of crypto assets.

OP was right about warning people about this platform from the start and what happened is pretty much what we expected.

Whoever hacked the Walix-Wallet may be connected to xhash or they could be part of the fake exchange networks run by the Russian network. They may also be working with them in exchange for a cut of the stolen money and then launder it through their platform.

I think that what is happening with xhash right now is    a way to disappear and carry out an exit scam especially after Match Systems exposed them and their funds were frozen on NEAR Intents.

I don’t think they will come back and reopen the platform after all of this. Even if they weren’t the ones who hacked the wallet, their involvement in laundering money and moving stolen funds would make it very hard for them to come back.

They might come back with a different name and domain, though, just like they did before with the scam platforms mentioned in the OP.

The funds are transferred on the Solana network to operational addresses associated with the Xhash, including:

- 2WJ98iXf8DwBzhQeL6zsXq9Tze8VjN6zNUijHAdrPCrJ 
- BTm25S9wbLdvU64K5dGBPsAVxnPRhSJnPB3XCf6mq6bc 
- 2giAscgqYx8U5teiQ78NrmmcmYJHFGHtZofe8kBW9nhX

Also Xhash.cash’s operational infrastructure is being blocked by NEAR Intents. No matter how many new sites they create, I will continue exposing them and closely monitoring this space. I’m doing my best to protect the community as scam services continue to emerge.

[Arhad]

I found another domain they operate on. The original site looked different from its current appearance.

Now - https://web.archive.org/web/20260905060127/https://unite-change.com/en/

Then - https://web.archive.org/web/20240520033917/https://unite-change.com/en/

[Trêvoid]

I found another domain they operate on. The original site looked different from its current appearance.

Now - https://web.archive.org/web/20260905060127/https://unite-change.com/en/

Then - https://web.archive.org/web/20240520033917/https://unite-change.com/en/

Thanks. Yes, he is Russian scammer. It’s also clear that he has been around long enough to be familiar with Bitcointalk.

https://bitcointalk.org/index.php?topic=5468656.0