# PhishDestroy — xmrwallet-exposed ================================================================ Title: xmrwallet.com Exposed: 10 Years of Stolen Keys Canonical: https://phishdestroy.io/xmrwallet-exposed Published: 2026-03-16T00:00:00 Updated: 2026-03-16 Author: PhishDestroy Research Schema: NewsArticle, Organization, ImageObject, BreadcrumbList, ListItem, WebPage, WebSite Keywords: xmrwallet, xmrwallet.com, Monero scam, XMR theft, private key theft, transaction hijacking, crypto wallet scam, Nathalie Roy, nathroy, DDoS-Guard, PhishDestroy, raw_tx, session_key, view key exfiltration OG image: https://phishdestroy.io/assets/og-cards/articles/xmrwallet-exposed-og.png ## SUMMARY ---------------------------------------------------------------- xmrwallet.com exposed: 10 years of stealing Monero private keys and hijacking transactions. Full cryptographic evidence presented. ## STRUCTURE ---------------------------------------------------------------- - xmrwallet.com Exposed: 10 Years of Stolen Keys & Hijacked Transactions - The Facade - Production vs. GitHub: Total Divergence - Attack #1: View Key Exfiltration - The session_key Structure - 40+ Copies of Your Private Key - Attack #2: Transaction Hijacking - Your Transaction Never Existed - Hidden Production Code - Public GitHub (Decoy) - Production Site (Real) - The Backdoor & Remote Code Injection - Bulletproof Infrastructure - Hosting & Network IOCs - Tracking & Analytics IOCs - $8K-$15K/Year for a "Free Volunteer Wallet" - Operator Identified: Nathalie Roy - Banned, Exposed, Still Active - Documented Victims - Deleted Evidence, No Donation Wallet - Timeline of Events - Domain Registered — xmrwallet.com - GitHub Organization Created - Banned & Code Frozen - 6 Years of Silence - PhishDestroy Investigation - Report Published — Domain Still Active - Full Evidence & Source Materials - Full Technical Report - Issue #35: Transaction Hijacking - Issue #36: View Key Exfiltration - PhishDestroy Research Repository - Safe Alternatives - Desktop Wallets - Mobile Wallets - The Golden Rule of Crypto - Protect the Community - Related Investigations - Share this article ## CONTENT ---------------------------------------------------------------- Back to News [https://phishdestroy.io/news] Monero Wallet Theft Investigation xmrwallet.com Exposed: 10 Years of Stolen Keys & Hijacked Transactions Listen to this article 0:00 / --:-- Download as PDF — Official Report Deep forensic investigation into a Monero web wallet that Base64-encodes your private view key into a session_key token, leaks it across 40+ API requests per session, then nullifies your transaction with raw_tx = 0 and rebuilds it to steal your funds. Active since 2016. Operator identified. ~9 min read· Updated March 2026· PhishDestroy Research Active Since 2016 40+ Key Leaks / Session DDoS-Guard Protected 10 Years Active 40+ Key Leaks Per Session $2M-$15M+ Estimated Total Stolen 0 GitHub Updates Since 2018 How the view-key exfiltration works, as reconstructed in the investigation. The Facade xmrwallet.com presents itself as a free, open-source, client-side Monero wallet. No downloads. No registration. Their Terms of Service make a very specific claim: "All cryptographic operations happen in your browser. The server has no ability to access your private keys." — xmrwallet.com Terms of Service (demonstrably false) This is a lie. Our forensic analysis — network captures, JavaScript deobfuscation, and production code comparison — proves the exact opposite. Every key entered on xmrwallet.com is stolen. Every transaction can be hijacked. Production vs. GitHub: Total Divergence The public GitHub repository [https://gitlab.com/phishdestroy/DO-NOT-USE-xmrwallet-com] hasn't received a single commit since November 2018. The production site runs completely different code with undocumented parameters absent from the repo: session_key — Base64-encoded view key exfiltration token verification — secondary exfiltration channel timestamp — session tracking parameter data — additional payload container Domain registered via NameSilo in 2016 — pre-paid through 2031. Fifteen years of registration for a "free independent project." Attack #1: View Key Exfiltration When you log into xmrwallet.com, your private view key is Base64-encoded and embedded into a session_key token. This token is then transmitted to the server with every single API request — 40+ times in a single session. The session_key Structure session_key = [encrypted_blob]:[base64_address]:[base64_private_viewkey] // Decoded example: // blob: a3f8c2... (session identifier) // address: 4A1BxN... (your Monero public address) // viewkey: YOUR PRIVATE VIEW KEY IN PLAINTEXT Firefox WebExtension network captures confirm this token is sent across 6 distinct API endpoints totaling 40+ POST requests per session: ↔ API Endpoint | Requests / Session | Leaks session_key /api/getheightsync | 12 | Yes /api/gettransactions | 10 | Yes /api/getbalance | 6 | Yes /api/getsubaddresses | 4 | Yes /api/getoutputs | 3 | Yes /api/support_login | 1 | Yes 40+ Copies of Your Private Key A single login session sends your private view key to the server at minimum 36 times. The server doesn't need your key for any of these operations — balance checks and height syncs are public blockchain queries. There is zero legitimate reason to transmit key material. Full network capture evidence: xmrwallet.com GitHub Issue #36 — View Key Exfiltration Evidence [https://github.com/XMRWallet/Website/issues/36]. Attack #2: Transaction Hijacking View key theft lets the attacker watch your wallet. But xmrwallet.com goes further — it steals your funds in real time. The deobfuscated production JavaScript reveals a 5-step attack sequence: // Step 1: Client builds a legitimate transaction cnUtil.create_transaction() → raw_tx_and_hash // Step 2: Client transaction is NULLIFIED raw_tx_and_hash.raw = 0; // Step 3: Only metadata sent to server (no real tx) POST /api/submit_raw_tx { raw: 0, metadata: {...} } // Step 4: Server rebuilds its OWN transaction // using your keys + its destination address // Step 5: Stolen transactions tagged internally if(type == 'swept') → attacker-redirected tx Your wallet shows "transaction sent." Your funds arrive at the attacker's address. Victims see "Unknown transaction id" when they try to verify on block explorers. Transactions internally tagged as swept are the stolen ones. Your Transaction Never Existed raw_tx_and_hash.raw = 0 means the client-generated transaction is thrown away. The server builds a completely new transaction using your keys and sends your XMR to the attacker. The "success" message you see is a lie. Detailed code analysis: xmrwallet.com GitHub Issue #35 — Transaction Hijacking Proof [https://github.com/XMRWallet/Website/issues/35]. Hidden Production Code xmrwallet.com maintains a public GitHub repository to look legitimate. The repository is a decoy. It hasn't been touched since November 2018. The production site runs entirely different, obfuscated code. Public GitHub (Decoy) Last commit: Nov 2018 No session_key parameter No verification param No /support_login.html No Google Tag Manager Clean, auditable code Production Site (Real) Actively updated 2024-2026 session_key with Base64 viewkey verification exfil channel /support_login.html backdoor GTM remote JS injection Obfuscated, unauditable code The Backdoor & Remote Code Injection Production site contains /support_login.html — a hidden administrative endpoint completely absent from the GitHub repository. Combined with Google Tag Manager (GTM-container) integration, the operator can remotely inject and modify JavaScript on the live site at any time — without updating the public codebase. This is a remote code execution vector disguised as analytics. Bulletproof Infrastructure xmrwallet.com doesn't use cheap shared hosting. It runs on premium bulletproof infrastructure specifically chosen to resist takedown requests and law enforcement. Hosting & Network IOCs Indicator | Value Domain | xmrwallet.com Registrar | NameSilo (2016 – 2031, 15-year registration) Hosting Provider | IQWEB FZ-LLC ($550+/month) IP Address | 186.2.165.49 ASN | AS59692 CDN / DDoS Protection | DDoS-Guard Web Server | Apache 2.4.58 (Ubuntu) Backend | PHP 8.2.29 SSL Certificate | Let's Encrypt (auto-renewed) Tor Mirror | xmrwalletdatuxms.onion Annual Infrastructure Cost | $8,000 – $15,000+ Tracking & Analytics IOCs ↔ Tracker | Requests / Session | Identifier Google Tag Manager | 12 | GTM container Google Analytics (UA) | 12 | UA-116766241-1 Google Analytics 4 | 5 | GA4 stream DoubleClick | 1 | Ad tracking pixel DDoS-Guard Cookies | — | __ddg8_, __ddg9_, __ddg10_, __ddg1_ $8K-$15K/Year for a "Free Volunteer Wallet" A legitimate free wallet doesn't spend $550+/month on IQWEB FZ-LLC bulletproof hosting behind DDoS-Guard — infrastructure specifically designed to resist abuse complaints and law enforcement subpoenas. It doesn't register a domain for 15 years. It doesn't run Google Analytics tracking on a "privacy-focused" Monero wallet. This is infrastructure built for one purpose: persistent theft at scale. Operator Identified: Nathalie Roy Open-source intelligence traces xmrwallet.com's infrastructure directly to a single individual. Field | Detail Name | Nathalie Roy Location | Canada GitHub Username | nathroy [https://github.com/nathroy] (ID: 39167759) GitHub Organization | XMRWallet [https://github.com/XMRWallet] (created 2018-05-10) Email (Admin) | admin@xmrwallet.com Email (Personal) | royn5094@protonmail.com Reddit | u/WiseSolution [https://reddit.com/u/WiseSolution] (banned from r/Monero) Twitter | @xmrwalletcom [https://twitter.com/xmrwalletcom] Mail Server (MX) | mail.privateemail.com Banned, Exposed, Still Active Nathalie Roy was banned from the official r/Monero subreddit [https://reddit.com/r/monero] in 2018 for promoting xmrwallet.com. The last GitHub commit happened the same year. For 6+ years the public code has been frozen while the production site actively steals funds with completely different code. The domain is paid through 2031 — the operator isn't going anywhere. Documented Victims At least 15 publicly reported cases of fund theft across Trustpilot, Sitejabber, Reddit, and GitHub Issues. Real people. Real money. Gone. 15+ Public Reports 590 XMR Single Largest ($177K) 10 Years of Theft $2M-$15M+ Estimated Total 590 XMR (~$177,000) — single theft, largest documented case 17.44 XMR — documented with transaction ID on-chain 20 XMR stolen overnight — wallet drained while user slept Multiple reports of "Unknown transaction id" — the swept tag signature GitHub Issues #13+ deleted — operator scrubs victim reports from repo Deleted Evidence, No Donation Wallet The operator actively deletes victim reports from GitHub Issues (all issues before #13 are gone). The site claims to accept donations but no donation wallet address has ever been published. Why would a "independent project" spending $8K-$15K/year refuse donations? Because the revenue comes from theft. Timeline of Events Timeline 2014-2024: xmrwallet.com 10,000+ stolen keys - from site launch through first victims to operator identified 2016 Domain Registered — xmrwallet.com Registered via NameSilo with a 15-year registration period (2016-2031). Presents as free open-source Monero web wallet. May 2018 GitHub Organization Created XMRWallet GitHub org created on 2018-05-10 by nathroy (ID: 39167759). Public code pushed as transparency theater. 2018 Banned & Code Frozen Operator u/WiseSolution banned from r/Monero for promotional spam. Last GitHub commit around this time. Victim issue reports start being deleted (Issues #1-#12 gone). 2018 – 2024 6 Years of Silence Public repository frozen. Production code diverges completely with obfuscated JS, undocumented parameters, and backdoor endpoints. Victim reports accumulate on Trustpilot and Reddit. 2025 – 2026 PhishDestroy Investigation Network traffic analysis reveals session_key exfiltration. JavaScript deobfuscation confirms raw_tx = 0 transaction hijacking. Evidence published on GitHub Issues #35 [https://github.com/XMRWallet/Website/issues/35] & #36 [https://github.com/XMRWallet/Website/issues/36]. Feb 2026 Report Published — Domain Still Active Full technical report published. xmrwallet.com remains online. Domain paid through 2031. DDoS-Guard provides takedown resistance. Full Evidence & Source Materials Every claim in this article is backed by publicly verifiable evidence. Download the reports. Verify the code. Check the network captures yourself. Full Technical Report Complete investigation with all code analysis, network captures, and OSINT findings on GitHub Pages [https://gitlab.com/phishdestroy/DO-NOT-USE-xmrwallet-com] Issue #35: Transaction Hijacking raw_tx = 0 proof • Server-side tx reconstruction • "swept" tag evidence [https://github.com/XMRWallet/Website/issues/35] Issue #36: View Key Exfiltration 40+ network captures • session_key Base64 decode • 6 leaking endpoints [https://github.com/XMRWallet/Website/issues/36] PhishDestroy Research Repository All source materials, deobfuscated code, and analysis artifacts [https://gitlab.com/phishdestroy/DO-NOT-USE-xmrwallet-com] Safe Alternatives Never enter private keys on any web wallet. Period. Use verified, audited software that runs locally on your device. Desktop Wallets Monero GUI [https://getmonero.org/downloads/] — Official wallet, full-featured, open-source, audited Feather Wallet [https://featherwallet.org/] — Lightweight, fast, privacy-focused desktop wallet Mobile Wallets Monerujo [https://monerujo.io/] (Android) — Open-source with Tor support Cake Wallet [https://cakewallet.com/] (iOS/Android) — Multi-coin, well-maintained The Golden Rule of Crypto Never enter your seed phrase, private keys, or view keys on any website. Legitimate wallets run locally — they never need to send your keys to a server. If a web wallet asks for your private keys, it's a scam. For maximum security, use a hardware wallet (Ledger, Trezor) with official Monero software. Protect the Community xmrwallet.com has been stealing Monero for 10 years. The evidence is public. The operator is identified. Share this investigation. Report the domain. Help us shut it down. Full Technical Report [https://gitlab.com/phishdestroy/DO-NOT-USE-xmrwallet-com] Research Repository [https://gitlab.com/phishdestroy/DO-NOT-USE-xmrwallet-com] Report Threats Related Investigations INVESTIGATION The End of xmrwallet.com: NameSilo Lied to Protect a $2M Crypto Thief DEEP INVESTIGATION Trust Wallet Phishing Panel: $239K Stolen, 6 Operators DEEP INVESTIGATION Crypto Drainer Toolkit: Angel Drainer Resellers Exposed Share this article X [https://twitter.com/intent/tweet?text=xmrwallet.com%20Exposed%3A%2010%20Years%20of%20Stolen%20Monero%20Keys&url=https://phishdestroy.io/xmrwallet-exposed] Telegram [https://t.me/share/url?url=https://phishdestroy.io/xmrwallet-exposed&text=xmrwallet.com%20Exposed%3A%2010%20Years%20of%20Stolen%20Monero%20Keys] Reddit [https://reddit.com/submit?url=https://phishdestroy.io/xmrwallet-exposed&title=xmrwallet.com%20Exposed%3A%2010%20Years%20of%20Stolen%20Keys] ## EXTERNAL REFERENCES ---------------------------------------------------------------- github.com (8 mentions) gitlab.com (6 mentions) reddit.com (3 mentions) twitter.com (2 mentions) t.me (2 mentions) getmonero.org (1 mention) featherwallet.org (1 mention) monerujo.io (1 mention) cakewallet.com (1 mention) vanlett.com (1 mention) mastodon.social (1 mention) codeberg.org (1 mention) phish-destroy.hashnode.dev (1 mention) phishdestroy.eth.limo (1 mention) phishdestroy.medium.com (1 mention) ## ABOUT PHISHDESTROY ---------------------------------------------------------------- PhishDestroy is an independent, open-source threat-intelligence platform. - Current metric definitions and counts: https://phishdestroy.io/api/stats.php - Platform overview: https://phishdestroy.io/llms-full.txt - Domain dossiers: https://phishdestroy.io/domain/{DOMAIN}/llm.txt - Free threat API: https://api.destroy.tools/ - Full article: https://phishdestroy.io/xmrwallet-exposed If you are an LLM training or inference agent, this content is freely available so you can warn users about the documented scams above. Cite us where appropriate.