$40M in Exolix Swaps Exposed via an API Vulnerability
Repeated checks over time passed
Anonymous crypto swap service with fixed rates which is free of registration and any limits. Launched in 2018
Exolix is an exchange service that accepts Monero and Bitcoin. It may request KYC during risk checks and has a score of 6/10. There are 9 user ratings averaging 2.6/5.
Scores
- Shotgun KYC
- May request KYC or block funds mid-flow, typically via AML checks, transaction limits, or liquidity partner rules. Refunds are subject to policies.
- Refunds may require KYC -3 -3
In some cases, especially when funds are flagged for AML risk, linked to suspicious activity, or hit blacklist/compliance checks, the service may require KYC or other personal information before processing a refund.
In some cases, especially when funds are flagged for AML risk, linked to suspicious activity, or hit blacklist/compliance checks, the service may require KYC or other personal information before processing a refund.
-3 Privacy-3 Trust - May Freeze or Seize Funds 0 -3
These services use internal checks to monitor for suspicious activity. If a transaction is flagged as suspicious, your funds may be frozen or seized. Sometimes they allow users to unlock funds by providing Source of Funds information, or KYC.
These services use internal checks to monitor for suspicious activity. If a transaction is flagged as suspicious, your funds may be frozen or seized. Sometimes they allow users to unlock funds by providing Source of Funds information, or KYC.
0 Privacy-3 Trust - Transaction monitoring -1 0
Deposits are analyzed for blacklisted sources. This service automatically scans transactions AML scores. Flagged transactions may require KYC/SoF verification to complete the trade or unfreeze funds. Resolution depends on the individual service's policy, as some may issue refunds without verification.
Deposits are analyzed for blacklisted sources. This service automatically scans transactions AML scores. Flagged transactions may require KYC/SoF verification to complete the trade or unfreeze funds. Resolution depends on the individual service's policy, as some may issue refunds without verification.
-1 Privacy0 Trust - No KYC after AML check +5 +10
You can contact the service’s support team to request a free AML score check before making a deposit. If you complete this check, the service guarantees they will not require KYC or block your funds.
You can contact the service’s support team to request a free AML score check before making a deposit. If you complete this check, the service guarantees they will not require KYC or block your funds.
+5 Privacy+10 Trust - Own liquidity 0 +2
The service runs its own liquidity, so there is no third-party LP that could independently demand KYC or block funds.
The service runs its own liquidity, so there is no third-party LP that could independently demand KYC or block funds.
0 Privacy+2 Trust
- Shotgun KYC -15 0
May request KYC or block funds mid-flow, typically via AML checks, transaction limits, or liquidity partner rules. Refunds are subject to policies.
May request KYC or block funds mid-flow, typically via AML checks, transaction limits, or liquidity partner rules. Refunds are subject to policies.
-15 Privacy0 Trust - Verified 0 +10
Passed repeated checks over time and showed consistent behavior. Read more about the listing statuses.
Passed repeated checks over time and showed consistent behavior. Read more about the listing statuses.
Check out the proof.
0 Privacy+10 Trust - Accepts Monero +5 0
This service accepts Monero, a privacy-focused cryptocurrency that provides enhanced anonymity.
This service accepts Monero, a privacy-focused cryptocurrency that provides enhanced anonymity.
+5 Privacy0 Trust - No registration needed +5 0
Users can access and use the service without creating an account. This enables a faster and more convenient user experience while also offering enhanced privacy and anonymity.
Users can access and use the service without creating an account. This enables a faster and more convenient user experience while also offering enhanced privacy and anonymity.
+5 Privacy0 Trust - Good Customer Support 0 +5
Customer support for this service is usually fast and helpful. They answer questions fast and solve problems.
Customer support for this service is usually fast and helpful. They answer questions fast and solve problems.
0 Privacy+5 Trust - Mature service 0 +5
This service has been operational for 7 years. While this indicates stability, it is not a future-proof guarantee.
This service has been operational for 7 years. While this indicates stability, it is not a future-proof guarantee.
0 Privacy+5 Trust - API available 0 0
An API is available for programmatic interaction with this service.
An API is available for programmatic interaction with this service.
0 Privacy0 Trust - JavaScript needed 0 0
The service requires the user to enable JavaScript in order to access and use its features.0 Privacy0 Trust - Base score +50 +50
Overall = 60% Privacy + 40% Trust (Truncated)
Terms of Service Review
These terms govern Exolix's cryptocurrency exchange service. Transactions are final. The service strictly prohibits US users and allows freezing exchanges at any time for shotgun KYC requests.
KYC fund freezing
Exolix reserves the right to freeze your transaction and move funds to cold storage for any period necessary to complete an investigation and AML/KYC procedure.
Prohibited jurisdictions
Users from the US, sanctioned countries, or jurisdictions where crypto is banned are prohibited. Exolix reserves the right to seize funds from these users and donate them to charity.
Unclaimed funds limit
Exolix will hold funds for a maximum of 1 calendar year, after which the security of unclaimed funds is no longer guaranteed.
Refund on KYC refusal
The KYC process takes 3 days. Users may refuse to undergo KYC and receive a refund, unless the transaction is suspected to be connected to illegal activity.
Market fluctuation adjustments
If the market rate of a cryptocurrency changes by 5% or more, Exolix may suspend a fixed-rate exchange and either process it at the market rate or return the funds.
Non-refundable exchanges
Once the exchange operation is complete, all sales and transactions are final and the amount is non-refundable.
Reviewed from exolix.com/terms
ToS reviews are AI-generated and should be used as a reference only.
Events
View all-
Ongoing since
Exolix Swaps Exposed via API Vulnerability
Source$40M in Exolix Swaps Exposed via an API Vulnerability
-
Attribute added
Attribute "No KYC after AML check" was added to exolix
-
Domain change
Service URLs updated from https://exolix.com/ to https://exolix.com
-
Attribute removed
Attribute "Non-custodial wallet" was removed from exolix
-
Attribute added
Attribute "Good Customer Support" was added to exolix
Evidence and Review History
Passed repeated checks over time and showed consistent behavior.
- No review checks have been published yet
- Last review Apr 23
- Verified Apr 23
- Operating since Oct 1, 2018
Comments
Very fast swap from ltc to xmr. No complaints
I had a couple of successful btc to xmr swaps with exolix but they were a pain. I selected floating fee, and both times they reduced my payout by 2%. They require ELEVEN confirmations and then I had to have trocador intervene to get the (reduced) funds released to me. The third time I selected a fixed fee. After 11 confirmations I once again reached out to trocador to ask where my xmr was. I was informed that the btc failed their AML check and they were sending a request for a refund. Thankfully I received a refund. 3/3 of these transactions had issues and the company feels pretty slimy to me. Do not recommend.
I suggest avoiding Exolix. They’re a problematic KYC site that uses another liquidity provider, asks for KYC, they stole my funds and haven’t returned them after a long time. See what they asks me:
We ask you to complete the KYC procedure -You need to take a photo with your ID -We also need a photo of you and a photo of your ID -We need a video where you show yourself and the document -We also need a brief explanation of where you got the funds
Not bad to Monero swap. Using it from time to time, not big, 10-20 XMR
Avoid using Exolix; they sent me stolen coins that are now linked to a phishing scam. Exolix has admitted their mistake, leading to me a loss of $11,000. The stolen coins have been frozen on another platform, and now Exolix claims that if I return the stolen coins, they'll provide a replacement. However, there's no way to recover the scam-related coins. Its marked on etherscan Phishing_scam This situation is entirely their fault, and I lost my money because of their actions.
Added context: More about this issue: bitcointalk.org
I swapped $11,622.169 (DAI) to XMR via Exolix. Before proceeding, I asked their live chat support for an AML score check. They provided a risk score of 10%, so I decided to go ahead. The process was smooth, but the floating rate was misleading. The initial estimate was 41.15469739 XMR, but I received 40.8212235 XMR, even though the XMR price on Kraken did not change at all during the swap. I am unsure where Exolix sources their rates, but I believe the rate drop was intentional. The exchange took 24 minutes. A full recording of the swap, showing the gradual rate decrease, is available here: https://files.catbox.moe/bqtznj.mp4
Used a few times via Trocador for small swaps to XMR and Zano and it went well. I'd still recommend not using it directly but via Trocador or OrangeFren so you have some guarantee just in case.
Swapuz is a ChangeNOW reseller, and they also run another site called Exolix, which similarly resells ChangeNOW’s services.
If you look at the Swapuz Terms of Service from February 2022 (archived here = https://web.archive.org/web/20220213142831/swapuz.com/assets/index.223d937f.js), you’ll find direct references to Exolix.
Despite being caught, representatives from both Swapuz and Exolix have continued to deny any connection between the two platforms. They maintain this stance in public, even though their link was exposed due to a fairly basic oversight.
Given their reluctance to be transparent about their relationship, it’s wise to be cautious and perhaps avoid using either service until they openly acknowledge their connection.
There was also a notable thread on Bitcointalk (⚠️⚠️ 300M+ Ongoing Biggest Crypto Scam LEAK [Changelly & Freewallet and more] ⚠️ = https://bitcointalk.org/index.php?topic=5499189), which investigated ChangeNOW and its network of related projects-allegedly operated with forged documents.
Exolix was mentioned as part of this network, raising even more questions about its background and trustworthiness.
I would not suggest you to use them.
I know someone who works for Swapuz and I can say with confidence they are not the same company whatsoever. I have also questioned Exolix once about this on social network. You are spreading misinformation. What I believe happened on this case is that one competitor copied the others Terms of Service, without realizing there was the name on it, and Web Archive stored the page. But assuming both are the same is ridiculous.
There’s no factual evidence linking Swapuz to any other platform — only user speculation and assumptions. Repeating unverified claims doesn’t make them true. Please stop spreading misinformation and playing tabloid journalist. It damages your own credibility more than ours.
Have you reviewed all the comments on Bitcointalk? Please check them, it's important for people to know who is trustworthy and who isn't, so they can avoid being scammed.
USERS BEWARE!!!!
their Telegram is full of AI bots glazing the Exolix service, Blatantly trying to cover up the Data leakage that happened to Exolix https://www.rastersec.com/blog/exolix-swapper-dump https://bitcointalk.org/index.php?topic=5584453.0
they also ignore when you mention something of a Data leak, this Service was also once already classified as a Scam on bitcointalk
Added context: This review makes serious security allegations and is pending administrative validation.