Monitoring notes from nokycswap.me (weekly)

Scam alert from our registry: Silent Node (silentnode.host), a pay-first «offshore host». We walked through it as a user without paying. The «live» status page is generated with Math.random() in the browser; the «Estonian company since 2021» has a domain registered on 22 July 2026 and no trace in the Estonian register; the founder's PGP key is on no keyserver. Servers, support tickets (even pre-sales questions) and the reseller programme all require a deposit first, top-ups come with up to 100% bonus into a balance with no withdrawal, and the Terms and refund pages return 404. Two look-alike «directories» rank it #1 at 10/10. If you already paid: keep the txid and report the address on Chainabuse, and ignore anyone offering paid «recovery». Full write-up with every source: https://nokycswap.me/blog/silent-node-scam-pay-first-hosting/

Notes for 19 Oct – 26 Oct 2026, from what our monitors and the registry logged this week.

Added to our scam registry: KycNot.cc (likely, theft); Silent Node (silentnode.host) (confirmed, exit scam) — https://nokycswap.me/scams/

New in the losses ledger: KycNot.cc — withheld, ~$5,000 (ongoing)

New write-ups: What AMLBot's 2026 crime report means if you swap without KYC — https://nokycswap.me/blog/amlbot-2026-report-no-kyc/; Silent Node: how a pay-first «offshore host» fakes its way to your deposit — https://nokycswap.me/blog/silent-node-scam-pay-first-hosting/; Where stolen coins went in October 2026: four routes in one week — https://nokycswap.me/blog/where-stolen-coins-went-october-2026/

Corrections welcome — if something here is wrong, reply and I'll fix it.

Short note on the Binance incident, from the monitoring side.

Binance has paused deposits and withdrawals after the ~$6.3B incident. Its own early read: a compromised DevOps engineer's laptop reached a service container that submits withdrawals; no evidence of a wallet key leak; about $3B frozen on-chain; losses to be covered from SAFU and company funds.

What it did to the no-KYC swaps we watch: on our data, quoting and uptime looked normal. All 13 services we quote every minute kept quoting through the night, and every service in our catalog stayed reachable on clearnet over the last 18 hours. We did not compare rates here — only whether services answered and quoted.

The takeaway is custody rather than size: a balance on any exchange is a claim on coins, not coins. One laptop was enough to reach the withdrawal path of the largest exchange.

What is confirmed and what our monitor saw, with sources: https://nokycswap.me/blog/binance-hack-6-3b-what-it-means-for-no-kyc-users/

Notes for 26 Oct – 02 Nov 2026, from what our monitors and the registry logged this week.

New in the losses ledger: Binance — theft, ~$6,300,000,000 (ongoing)

New write-ups: Binance lost ~$6.3B to one compromised laptop. What it means if you swap without KYC — https://nokycswap.me/blog/binance-hack-6-3b-what-it-means-for-no-kyc-users/; State of no-KYC — October 2026: a $6.3B hack, eleven swaps with our own money, and who screens addresses — https://nokycswap.me/blog/state-of-no-kyc-october-2026/

Corrections welcome — if something here is wrong, reply and I'll fix it.

Warning for anyone who swaps through ChangeNOW: changenow.my is a full copy of the ChangeNOW website, not ChangeNOW.

We created one order on it without paying (over Tor, payout set to the public Monero General Fund address). The order was created on the clone's own server, and the BTC deposit address came from the clone's own wallet — address 14 of its HD wallet — marked to be swept to bc1pq7hc77cjsjzh64emnmv57s4kh049mx3x4ujc7vuafu32wsd537qqnksz5t. Nothing in the reply pointed to ChangeNOW.

ChangeNOW's only site is changenow.io. A quick check that works for any exchange: paste the order ID into the tracker on the real site before you send. If the real site does not know the order, stop.

As of today no funds had reached the deposit address we were given or the sweep address. The domain is in our scam registry and in our public domain list, if you maintain a blocklist.

Notes for 02 Nov – 09 Nov 2026, from what our monitors and the registry logged this week.

New write-ups: Binance theft, week one: 71 BTC through THORChain, and one address shared with the Bitget case — https://nokycswap.me/blog/binance-week-one-thorchain-bitget-link/; Wagyu's order data leaked: deposits, Monero addresses and IPs from July to October — https://nokycswap.me/blog/wagyu-data-leak-2026-10-27/

Corrections welcome — if something here is wrong, reply and I'll fix it.