Incident Report Warning: BTC to XMR | Address Mismatch: El Capo/kyc.rip

[Trêvoid]

ORDER
ID: 340FE******* · Created 31/07/2026, 10:28 · BTC → XMR (float)
Sent: 1 BTC to bc1q**** · Quoted: 180.12325097 XMR
Victim XMR address: 47ueAvGSdFAQDJSUHE4S2UGWBeVSW3F5DNXFcsE3LdQCDNzKyPyJdS3Yw9Vm12aYbD341CG9SWcB2Ve 6w2tYNTB7DH8Cgxs
Placed via kyc.rip, routed "VIA El Capo"

• the kyc.rip order page showing the order status + destination address (the one that matched victim wallet).
• the kyc.rip order page showing the later “FINISHED” destination address (the wrong address).
• the elcapo.io track.html error (“Order ID and recipient address do not match”).

https://talkimg.com/images/2026/08/01/Uo65uJ.jpg
https://talkimg.com/images/2026/08/01/Uo6ogW.jpg
https://talkimg.com/images/2026/08/01/Uo6Bxv.jpg

Words from victim:

1. My address was in El Capo's own database
elcapo.io/pages/track.html requires BOTH order ID and recipient address to match. On 31/07 I entered the order ID + my address and it returned the order: CONFIRMING, 1 BTC → 180.12325097 XMR. Today, identical inputs: "Order ID and recipient address do not match." Their system validated my address, then stopped. This is on El Capo's side, independent of kyc.rip.

2. They never disputed the address for 24 hours
My first message on simpleX, 31/07 15:13, stated the order ID and my address explicitly. Their reply at 15:16: "Hello, allow me a moment. Checking." No objection then or at any point during the next day of discussion about this order.

3. They confirmed sending elsewhere
01/08, I asked which address they sent to. Their answer: 89YnymxutUFDcbhqBqZbkUdKhXCQ4E1EJ6Nk5QHc6RHzKe75h5PCXyK37sXf2Giec5hMDB6GvZ4bT5b RTWWMfF6uJrYKEeR — not my address. Same address that appeared on the kyc.rip page after it flipped to FINISHED.

4. The tx hash proves nothing
They provided e722083b064244d3c4f4a4331827f7af03d871968946fc4d3ae1d8fc2c431929. In Monero recipients and amounts are hidden — any transaction looks identical. tx_key or get_tx_proof is the only proof; every wallet stores it automatically, one command. Requested by me and by you. Not provided.

(update by Trêvoid, I got the keys later but it was sent to a different xmr wallet not victim wallet)

5. The stalling itself
A genuine AML hold is one sentence: "we're holding it, here's why, here's when." Instead, over 24 hours: "checking" → "funds are a bit difficult" → Because high AML → "team is working" → "there's no dead lines, once its done-its done" → a hash. Each answer bought hours and gave nothing checkable.


Note to the community from Trêvoid:
I had a user contact me today about this situation, and I’m stating it clearly one more time. Please do not swap large amounts on your own.
I strongly recommend using our designated intermediary system for any swaps.
This is a public warning. This user case may be real or fabricated, since there’s no letter of guarantee, we can only rely on the victim’s message and the screenshots. I am taking this case seriously and sharing it here to warn the community. If there is no LoG for the swaps, do not ever use that service!

I will personally contact “el capo” and “kyc.rip” and request them to issue (LoG) for the swaps in future. If they cannot provide it, I will label them as a scam. It’s enough that I was polite about these newly created services and the best UI design directories especially when it comes to advertising scam swap services and scamming users.

Don’t trust “good-looking, coded-nice UI” vibe aggregator that doesn’t actually care about the community.

Evidence: screenshots of elcapo.io/track before and after, kyc.rip CONFIRMING (xmr address) and FINISHED (theirs), full SimpleX log with El Capo and user. All available on me a and if need can send to mods.

[Elcapo_io]

Saludos, community.

We’re clarifying the situation.

We’re confident this is part of an ongoing, coordinated campaign against our service that has been running for close to a month. This time, the accusation was simply swallowed whole and stretched to fit, without any real verification.

Background. Three weeks ago, this same so-called “victim” already attempted to defraud our service. The first attempt was an order for 100 ETH using a fake smart contract that displayed a “successful” transaction hash on an address with a zero balance. After that failed, he tried to contact our partner and accuse us of swapping the deposit address - also unsuccessfully. He then deleted the chat and disappeared for three weeks.

We highlight this timeline specifically because in the new order he reused the exact same Monero receiving address from his first attempt - apparently not smart enough to even bother changing it. This time the scheme was a bit better thought out, but no - not every attack like this gets past a service with real experience.

What actually happened. The user stayed in contact throughout, funds were sent, and our partners and outside observers saw an AML report on his address — meaning anyone can see exactly what kind of activity he’s involved in and how he makes his living. After the funds were sent, he claimed he never received the Monero.

On the screenshots. Any ten-year-old knows how to open a browser’s dev tools and type whatever they want into the page. A screenshot proves nothing on its own - without independent technical confirmation (tx_key/get_tx_proof, on-chain data, server-side logs), it’s just an image. If a service you’re working with doesn’t offer a Letter of Guarantee, at the very least record your screen during the transaction. That’s real evidence - a screenshot is not.

On the evidence. Every party involved in this case - the user himself, and the partner through whom the exchange was processed - has already received a full set of confirmations from us: tx_key, internal system screenshots, transaction hashes. They had every opportunity to verify this. Instead of engaging with the facts, the decision was made to turn it into a public show.

As a matter of policy, we don’t publish transaction data in public - that’s part of our confidentiality standard, and we’re not going to break it on demand, especially under pressure. Everyone who needed this data for legitimate purposes already has it. If the author or the alleged victim disagrees, they’re welcome to state on record that they never received it - instead of building an accusation on our silence.

Our position.

 • We state, with full confidence, that this case is 100% fabricated.
 • We will not continue any form of cooperation with this “opinion leader.” We will not tolerate being placed in the position of the accused, being handed ultimatums, or having conditions dictated to us - not by him, not by anyone.
 • On our own initiative - not because anyone demanded it - we have already implemented a Letter of Guarantee (LoG) for all swaps going forward, and we continue to operate normally.

Exchangers today have essentially no protection against bad-faith accusations and smear campaigns. Sure, there are fly-by-night operations out there just to grab a quick profit. But building a service that actually works isn’t funded by amounts of 20k-30k–60k — that’s not nearly enough to justify the cost of launching, running operations, and paying a team's salaries. Torching your own reputation for that kind of money simply doesn’t add up.

This is our response to everything happening right now. Thank you for your attention.

Con respeto — El Capo team.

[Trêvoid]

Hi I also got your messages on Simplex and here, so I wanted to reply.

As I said in the message above as well.

This is a public warning. This user case may be real or fabricated, since there’s no letter of guarantee, we can only rely on the victim’s message and the screenshots. I am taking this case seriously and sharing it here to warn the community.

I’ve shared many scam reports, warnings, guides, and tactics to help the community protect themselves and avoid getting scammed.  

What happened is this: a user contacted me and told me the story mentioned above. Did i believe it? no. However, what I need to do is share it publicly so more people can be aware of it. Maybe there is something Im missing. or there could be other users who had same issue? It could be a real report or a fake one.

You calling me “opinion leader.” and saying not tolerate being placed in the position of the accused?

Where did I accuse you? I shared the report I received from a user.  It could be real or fake, but I need to take action. Since you provided me a security deposit, it doesn’t mean I’ll cover everything or hide any scam reports. I always do my best to protect the community and warn users. Most people here know this.

My role is to curate information so users can make informed decisions. If the report is fake, the truth will clear your name; if it is real, the community is protected. Transparency serves everyone.

On our own initiative - not because anyone demanded it - we have already implemented a Letter of Guarantee (LoG) for all swaps going forward, and we continue to operate normally.

After I heard this accusation, what I did was immediately ask you to issue a LoG for your service, and you implemented, Was it really your own initiative? This is for your service safety. I requested from you. It’s not a demand from me. Issue LoGs are important, and I’ve said this consistently. But why didn’t you do that in the first place? If you had done it earlier, there wouldn’t have been an accusation like this.

You can come here and respond to your accusations this won’t harm you. As a result, we may be able to see whether the other person is lying. I believe this is something easy to do, and it won’t be difficult.
This isn’t related to your service; it could be any service. If I receive scam reports, I take them seriously and do my best to warn others. If it’s fake, the truth will eventually come out.

I also invited the victim to come here and share his findings. So everyone can see his comments and report, and they can judge it.

[Elcapo_io]

On the LoG - the reason we implemented it isn’t about pressure or the label “scam.”

If they cannot provide it, I will label them as a scam. It’s enough that I was polite about these newly created services and the best UI design directories especially when it comes to advertising scam swap services and scamming users.

What happened is this: a user contacted me and told me the story mentioned above. Did i believe it? no.

You said you’d call us scam if we didn’t respond. But if you personally didn’t believe the story, what would you actually be calling us a scam for? Saying “I don’t believe this happened” and “I’ll label you scam if you don’t act on it” don’t really go together.

And to be clear, no, raising it wasn’t wrong on your part either.

On the post itself - you say you personally didn’t believe the story, but that’s not really how it reads. It’s titled “Incident Report Warning,” the person is called “victim” the whole way through, not “the user” or “the person claiming this happened.” Most of the text is written in a pretty confident tone too: “their reply was…”, “this is on El Capo’s side.”

The “may be real or fabricated” line is just one sentence at the end, it’s not really the frame the rest of it is written in.

Anyone reading this cold is going to read it as a confirmed incident, not a careful, unverified warning. That’s the actual disconnect here.