Exolix API exposed ~$39.5M of swap history:

A security researcher found that Exolix's partner API used unscoped JWT keys with no rate limiting or IP restrictions, which let anyone dump full swap histories. The exposed data covered roughly 355,000 transactions and $39.5M in volume from January 2025 to May 2026: deposit and withdrawal addresses, on-chain hashes, amounts, rates, and timestamps.

For a no-KYC swapper, this links addresses and undoes the privacy users came for. After the disclosure, Exolix called the open access "a feature, not a bug," added WAF rules, and left the underlying flaw in place.

Go to events
Verified

Repeated checks over time passed
exolix

exolix

Anonymous crypto swap service with fixed rates which is free of registration and any limits. Launched in 2018

Exolix is an exchange service that accepts Monero and Bitcoin. It may request KYC during risk checks and has a score of 5/10. There are 12 user ratings averaging 2.7/5.

Compare rates Find the best rate across privacy-respecting exchanges.

Scores

5
Overall
Acceptable
46
Privacy
Average
54
Trust
Average
lvl. 3/4
Shotgun KYC
May request KYC or block funds mid-flow, typically via AML checks, transaction limits, or liquidity partner rules. Refunds are subject to policies.

-22 trust from active incidents. See details

KYC Policy
Privacy 46 Ă— 60% + Trust 54 Ă— 40% = Overall 5/10
Learn about scores All attributes list

Terms of Service Review

These terms govern Exolix's cryptocurrency exchange service. Transactions are final. The service strictly prohibits US users and allows freezing exchanges at any time for shotgun KYC requests.

KYC fund freezing

Exolix reserves the right to freeze your transaction and move funds to cold storage for any period necessary to complete an investigation and AML/KYC procedure.

Prohibited jurisdictions

Users from the US, sanctioned countries, or jurisdictions where crypto is banned are prohibited. Exolix reserves the right to seize funds from these users and donate them to charity.

Unclaimed funds limit

Exolix will hold funds for a maximum of 1 calendar year, after which the security of unclaimed funds is no longer guaranteed.

Refund on KYC refusal

The KYC process takes 3 days. Users may refuse to undergo KYC and receive a refund, unless the transaction is suspected to be connected to illegal activity.

Market fluctuation adjustments

If the market rate of a cryptocurrency changes by 5% or more, Exolix may suspend a fixed-rate exchange and either process it at the market rate or return the funds.

Non-refundable exchanges

Once the exchange operation is complete, all sales and transactions are final and the amount is non-refundable.

Reviewed from exolix.com/terms

ToS reviews are AI-generated and should be used as a reference only.

Security incidents

How trust is affected

Events

View all

  1. Attribute added

    Attribute "No KYC after AML check" was added to exolix

  2. Domain change

    Service URLs updated from https://exolix.com/ to https://exolix.com

  3. Attribute removed

    Attribute "Non-custodial wallet" was removed from exolix

  4. Attribute added

    Attribute "Good Customer Support" was added to exolix

Learn about events

Evidence and Review History

How statuses work Our review process
Verified

Passed repeated checks over time and showed consistent behavior.

  • No review checks have been published yet
  • Last review Apr 23
  • Verified Apr 23
  • Operating since Oct 1, 2018

Comments

About comments

  • Comments are visible after approval.
  • Moderation is light.
  • Double-check before trusting.
2.5
5
25%
4
17%
3
8%
2
0%
1
50%

AI Summary

Updated

Users report fast crypto swaps for smaller transaction amounts. However, many complain about suddenly frozen funds, unexpected KYC demands, misleading exchange rates, and allegations regarding data leaks and tainted coins.

  • fast transactions
  • small swaps
  • frozen funds
  • strict kyc
  • misleading rates
Login to comment
Newest Upvoted Lowest Highest Trusted
aimless_totalitarianism_7845
New account
Single review
0 • 4/5 10%

A standard exchange service with good terms. The request was processed without any errors.

disorganized_washstand_7040
New account
Single review
0 • 4/5 10%

Not bad swap platform, very fast exchange

smoky_mangrove_9282
Single review
1 • 1/5 90%
Order ID checked
KYC issue
Funds blocked

Terrible service that freezes transactions. My funds did not have high AML risk. 300$ swap to xmr frozen for no reason Support works over email tickets with no live chat. Be very cautious with this exchange. They are fishing for personal information in the form of email tickets. I am waiting for this to be resolved. I have never had issues with any other exchanges. DWC

Added context: The order id states a refund has been successfully made.
wavy_blacklist_5027
Active user
1 • 1/5 45%

USERS BEWARE!!!!

their Telegram is full of AI bots glazing the Exolix service, Blatantly trying to cover up the Data leakage that happened to Exolix https://www.rastersec.com/blog/exolix-swapper-dump https://bitcointalk.org/index.php?topic=5584453.0

they also ignore when you mention something of a Data leak, this Service was also once already classified as a Scam on bitcointalk

Added context: This review makes serious security allegations and is pending administrative validation.
wavy_blacklist_5027
1 •

UPDATE:

many users keep claiming their transaction is "stuck", this might be an exit scam from Exolix, Please beware

long-legged_tulle_3012
0 • 5/5 90%
Order ID checked

Very fast swap from ltc to xmr. No complaints

broad-shouldered_pocket_1545
Single review
0 • 1/5 90%
Order ID checked
KYC issue
Funds blocked

I had a couple of successful btc to xmr swaps with exolix but they were a pain. I selected floating fee, and both times they reduced my payout by 2%. They require ELEVEN confirmations and then I had to have trocador intervene to get the (reduced) funds released to me. The third time I selected a fixed fee. After 11 confirmations I once again reached out to trocador to ask where my xmr was. I was informed that the btc failed their AML check and they were sending a request for a refund. Thankfully I received a refund. 3/3 of these transactions had issues and the company feels pretty slimy to me. Do not recommend.

contingent_air_7783
Single review
0 • 1/5 90%
Order ID checked
KYC issue
Funds blocked

I suggest avoiding Exolix. They’re a problematic KYC site that uses another liquidity provider, asks for KYC, they stole my funds and haven’t returned them after a long time. See what they asks me:

We ask you to complete the KYC procedure -You need to take a photo with your ID -We also need a photo of you and a photo of your ID -We need a video where you show yourself and the document -We also need a brief explanation of where you got the funds

invading_atom_8819
Active user
0 • 5/5 45%

XMR to BTC very fast and without issues. Good price.

tumultuous_foul_2827
0 • 3/5 20%

Not bad to Monero swap. Using it from time to time, not big, 10-20 XMR

vain_acronym_8356
0 • 1/5 10%
KYC issue
Funds blocked

Avoid using Exolix; they sent me stolen coins that are now linked to a phishing scam. Exolix has admitted their mistake, leading to me a loss of $11,000. The stolen coins have been frozen on another platform, and now Exolix claims that if I return the stolen coins, they'll provide a replacement. However, there's no way to recover the scam-related coins. Its marked on etherscan Phishing_scam This situation is entirely their fault, and I lost my money because of their actions.

Added context: More about this issue: bitcointalk.org
beastly_birthplace_2263
0 •
Order ID checked

I swapped $11,622.169 (DAI) to XMR via Exolix. Before proceeding, I asked their live chat support for an AML score check. They provided a risk score of 10%, so I decided to go ahead. The process was smooth, but the floating rate was misleading. The initial estimate was 41.15469739 XMR, but I received 40.8212235 XMR, even though the XMR price on Kraken did not change at all during the swap. I am unsure where Exolix sources their rates, but I believe the rate drop was intentional. The exchange took 24 minutes. A full recording of the swap, showing the gradual rate decrease, is available here: https://files.catbox.moe/bqtznj.mp4

purplish_gland_3671
0 • 5/5 90%
Order ID checked

Used a few times via Trocador for small swaps to XMR and Zano and it went well. I'd still recommend not using it directly but via Trocador or OrangeFren so you have some guarantee just in case.

TrĂŞvoid
0 • 1/5 80%

Swapuz is a ChangeNOW reseller, and they also run another site called Exolix, which similarly resells ChangeNOW’s services.

If you look at the Swapuz Terms of Service from February 2022 (archived here = https://web.archive.org/web/20220213142831/swapuz.com/assets/index.223d937f.js), you’ll find direct references to Exolix.

Despite being caught, representatives from both Swapuz and Exolix have continued to deny any connection between the two platforms. They maintain this stance in public, even though their link was exposed due to a fairly basic oversight.

Given their reluctance to be transparent about their relationship, it’s wise to be cautious and perhaps avoid using either service until they openly acknowledge their connection.

There was also a notable thread on Bitcointalk (⚠️⚠️ 300M+ Ongoing Biggest Crypto Scam LEAK [Changelly & Freewallet and more] ⚠️ = https://bitcointalk.org/index.php?topic=5499189), which investigated ChangeNOW and its network of related projects-allegedly operated with forged documents.

Exolix was mentioned as part of this network, raising even more questions about its background and trustworthiness.

I would not suggest you to use them.

Swapuz
0 •

You're right that our February 2022 Terms of Service contained references to Exolix. The reason is mundane: when we first launched, our terms text was adapted from an existing template rather than written from scratch, and during editing a few mentions of the original source weren't removed. It was a sloppy copy-paste oversight on our part — and we corrected it a long time ago. Our current Terms contain none of that text.

To be clear: Swapuz has no corporate, ownership, or operational connection to Exolix. We're an independent service. Leftover boilerplate in an old terms file is the kind of mistake a lot of projects make, and we understand why it looked suspicious before we cleaned it up — but that's all it was.

As for the Bitcointalk thread that's cited alongside this: the broader claim — that all these brands share the same owners and were set up with forged documents — is the thread author's allegation and reconstruction, not an established fact. Swapuz only got pulled into it because of that same erroneous Terms of Service. That leftover template text is the only thing anyone has ever pointed to as "evidence" of a Swapuz–Exolix link — and once you set that copy-paste mistake aside, there's nothing actually connecting us to any of it.

pent-up_reject_407
0 •

I know someone who works for Swapuz and I can say with confidence they are not the same company whatsoever. I have also questioned Exolix once about this on social network. You are spreading misinformation. What I believe happened on this case is that one competitor copied the others Terms of Service, without realizing there was the name on it, and Web Archive stored the page. But assuming both are the same is ridiculous.

Swapuz
0 •

There’s no factual evidence linking Swapuz to any other platform — only user speculation and assumptions. Repeating unverified claims doesn’t make them true. Please stop spreading misinformation and playing tabloid journalist. It damages your own credibility more than ours.

wavy_blacklist_5027
0 •

for readers notice: this is a Ai comment btw

TrĂŞvoid
0 •

Have you reviewed all the comments on Bitcointalk? Please check them, it's important for people to know who is trustworthy and who isn't, so they can avoid being scammed.