Warning Hide.cash SCAM | 49.35 SOL (Full investigation)

[Trêvoid]

The Incident on July 17, 2026, a user deposited 49.3489 SOL (~$4,000) into hide.cash for a Monero swap. The funds were sent to the address provided by the site, but the user received nothing. When confronted, hide.cash operators publicly denied the existence of the order and claimed the deposit address did not belong to them.



https://kycnot.me/service/hide-cash

Victim Order HC-6BP0D6NL3 | (https://kycnot.me/case-media/6/e5bb6aadd7.png)
Order HC-6BSV1G2AM (6ZnB8mg) | (https://kycnot.me/case-media/6/5e8a02825e.png)
Order HC-6BSURBZ5R (5R2EUST) | (https://kycnot.me/case-media/6/b788a91a59.png)
DNS Records (dnsview.info) | (https://kycnot.me/case-media/6/442d5dddaf.png)

Findings
By analyzing the Solana blockchain and interacting with the hide.cash order system, we identified the following:

Verified Ownership: The user proved ownership of the sending wallet by signing a unique message, confirming they are the legitimate victim.
Direct Link to hide.cash: We generated new swap orders on the hide.cash website. The deposit addresses provided by their server lead directly to the same wallets that received the victim's funds.
Centralized Control: The wallets involved in the theft BxYcm and AVm7qC9C share a common signing key (EbsUZEFAU) and follow an identical automated "sweeping" pattern used by the service.
False Denials: The operator's claim that the deposit address was not theirs is demonstrably false; their own server issued identical addresses during our tests.

Summary of Evidence
Blockchain Data : 98% of the victim's 52 SOL deposit moved into wallets linked to the service's deposit pool.
Server Logs: Captured screenshots verify hide.cash issued these specific deposit addresses to users.
DNSSEC: Cryptographic proof confirms the denials originated from the verified hide.cash operator.

Conclusion

Hide.cash has falsely denied processing this transaction. The evidence confirms that the user's funds were routed into wallets controlled by the service. Whether the theft was an intentional exit scam or an internal failure, the service is responsible for the lost funds and is currently providing misleading information to the public.

Do not use hide.cash. The service show clear indicators of fraudulent activity, including the systematic redirection of user deposits to operator-controlled wallets.

Full investigation contains full evidence: https://kycnot.me/service/hide-cash/case/o5a43vn6yb88tu5an6his8pj

[Trêvoid]

Another user has also been scammed by them, so I strongly urge the community to avoid this service and make sure everyone is aware of this scam.

[albon]

Do not use hide.cash. The service show clear indicators of fraudulent activity, including the systematic redirection of user deposits to operator-controlled wallets.

Thank you for sharing this warning. . I couldn't find an ANN thread for their service, so I don't think they have anyone here to reply to these claims.

From what I read in this thread and in the report published on kycnot.me, the evidence is strong and shows the service is responsible for what happened. It confirms that the funds ended up in wallets linked to their service and that they falsely claimed the deposit address did not belong to them.

Right now, this service is responsible for the lost funds and for failing to complete the swap and they should resolve this issue if they want to protect their reputation. Until then, I'd avoid using it.

[Trêvoid]

Do not use hide.cash. The service show clear indicators of fraudulent activity, including the systematic redirection of user deposits to operator-controlled wallets.

Thank you for sharing this warning. . I couldn't find an ANN thread for their service, so I don't think they have anyone here to reply to these claims.

From what I read in this thread and in the report published on kycnot.me, the evidence is strong and shows the service is responsible for what happened. It confirms that the funds ended up in wallets linked to their service and that they falsely claimed the deposit address did not belong to them.

Right now, this service is responsible for the lost funds and for failing to complete the swap and they should resolve this issue if they want to protect their reputation. Until then, I'd avoid using it.

They have been approved on a listing platform, but unfortunately some people seen it and have been scammed. They’re using this as their plan: scam some people with the current service, then create a new one.

[logfiles]

Now that was one thorough investigation and I don't think can even try to convincingly refute the accusations.

https://kycnot.me/service/hide-cash

Victim Order HC-6BP0D6NL3 | (https://kycnot.me/files/cases/6/e5bb6aadd7.png)
Order HC-6BSV1G2AM (6ZnB8mg) | (https://kycnot.me/files/cases/6/5e8a02825e.png)
Order HC-6BSURBZ5R (5R2EUST) | (https://kycnot.me/files/cases/6/b788a91a59.png)
DNS Records (dnsview.info) | (https://kycnot.me/files/cases/6/442d5dddaf.png)

I don't know what is with these links, but it appears they no longer have any content. Perhaps the images have been deleted or something like that. It's good to archive such links when reporting for future reference.

[Trêvoid]

Now that was one thorough investigation and I don't think can even try to convincingly refute the accusations.

https://kycnot.me/service/hide-cash

Victim Order HC-6BP0D6NL3 | (https://kycnot.me/files/cases/6/e5bb6aadd7.png)
Order HC-6BSV1G2AM (6ZnB8mg) | (https://kycnot.me/files/cases/6/5e8a02825e.png)
Order HC-6BSURBZ5R (5R2EUST) | (https://kycnot.me/files/cases/6/b788a91a59.png)
DNS Records (dnsview.info) | (https://kycnot.me/files/cases/6/442d5dddaf.png)

I don't know what is with these links, but it appears they no longer have any content. Perhaps the images have been deleted or something like that. It's good to archive such links when reporting for future reference.

Victim Order HC-6BP0D6NL3 | (https://kycnot.me/case-media/6/e5bb6aadd7.png)
Order HC-6BSV1G2AM (6ZnB8mg) | (https://kycnot.me/case-media/6/5e8a02825e.png)
Order HC-6BSURBZ5R (5R2EUST) | (https://kycnot.me/case-media/6/b788a91a59.png)
DNS Records (dnsview.info) | (https://kycnot.me/case-media/6/442d5dddaf.png)

Hi, it’s already been archived; however, the link structure has changed in the new version.