News Feed
  • DrugHub has agreed to fully refund all users who lost money in the SuperMarket exit scam.  
  • Retro Market has gone offline. Circumstances of the closure unknown.  
  • SuperMarket has closed following an exit scam by one of the admins.  
  • The admin of Incognito Market, Pharoah, has been arrested by the FBI several months after exit scamming.  
  • Silk RoadTorhoo mini logo
  • darknet markets list
  • Popular P2P exchange LocalMonero has announced it is closing.  

Centralization of XMR market and tracking every transaction : Monero | Torhoo darknet markets

Recent research conducted by the Weizenbaum Institute, TRM Labs (San Franciso) and TU Berlin indicate that Retoswap, formerly known as Haveno-Reto, does not provide the privacy protections it advertises. Despite its marketing claims, this platform functions as a sophisticated decoy. The narrative of being non-custodial and decentralized is a carefully crafted illusion designed to attract unsuspecting users and foster a false sense of security.
Reference: https://xcancel.com/noosphere888x2/status/1922044150716715102#m

Darknet operators who assume Retoswap is suitable for laundering should reconsider. Their activities are under constant surveillance. The supposed privacy offered by Retoswap is an illusion.


Retoswap Trades Are Fully Traceable
/u/xmrglobal P
3 points
1 week ago
No swap aggregator is truly secure! Every transaction gets logged and stored forever! We’ve seen it firsthand and stopped working with many liquidity providers because of this!

Darknet users who trust these platforms are walking into a trap, a honeypot designed to expose them.

This isn’t privacy. It’s a prison. Use extreme caution!
/u/OpenMonero 📢
0 points
1 week ago*
Honestly, I find it ironic that you criticize liquidity providers when, in reality, even the worst ones are still safer than a blockchain service that logs all your swaps on-chain. The thing is, those centralized swap services might not keep backend logs forever, but when a haveno or retoswap transaction is recorded unencrypted on the blockchain, it’s permanent and accessible to anyone. (it cannot be deleted easily) That’s pretty terrible!

And let’s not forget, you wouldn’t even be able to use your own liquidity without those liquidity providers you’re now trashing. It’s obvious you’ve made enough fees from your 81 swaps and now suddenly call them honeypots. Are you seriously implying that your own service used to be a honeypot? Since you relied on those liquidity providers yourself, you’re essentially admitting you were complicit all along.
/u/xmrglobal P
1 points
1 week ago
Yes, liquidity providers and aggregator swaps are part of the ecosystem and sometimes necessary, but they come with real risks, they hold your funds, keep permanent records, and open the door to surveillance or even fund seizures. We don’t trust those centralized setups and always stay transparent about their downsides.

Calling us complicit misses the point, our system cuts down on data retention and custody risks, which means fewer ways for anyone to track or attack users. When we say “honeypot,” we’re talking about structural vulnerabilities, not how many fees someone’s made.

On top of that, the community should really question those thousands of trades shown on your site that never actually happened on your platform. That’s a red flag for data accuracy and user privacy.

Anyway, at the end of the day, our focus is on protecting privacy and offering truly secure peer-to-peer trades.
/u/OpenMonero 📢
1 points
1 week ago
OpenMonero has not yet reached 1000 trades but it will probably happen this month.
Visit openmonero.markets for trade stats
/u/xmrglobal P
1 points
1 week ago
You claim OpenMonero hasn’t hit 1,000 trades yet, but your users’ profiles show thousands of completed transactions and ratings far beyond that. That’s a glaring inconsistency that can’t be ignored.

If those trades didn’t happen on your platform, what exactly are you showing?

dumpliwoard5qsrrsroni7bdiishealhky4snigbzfmzcquwo3kml4id onion/image/84840887e580c836.png
dumpliwoard5qsrrsroni7bdiishealhky4snigbzfmzcquwo3kml4id onion/image/81d5cfd2f004b9c1.png
dumpliwoard5qsrrsroni7bdiishealhky4snigbzfmzcquwo3kml4id onion/image/18aab946f9876d55.png
dumpliwoard5qsrrsroni7bdiishealhky4snigbzfmzcquwo3kml4id onion/image/9a885a44a18902cd.png
dumpliwoard5qsrrsroni7bdiishealhky4snigbzfmzcquwo3kml4id onion/image/f89c3c61e57a115b.png
/u/OpenMonero 📢
1 points
1 week ago
The site show external trades as well. How can you not see such an obvious fact?
/u/xmrglobal P
1 points
1 week ago
http://dumpliwoard5qsrrsroni7bdiishealhky4snigbzfmzcquwo3kml4id onion/image/84840887e580c836.png

If your site “shows external trades as well” then explain this:

Total Trades: 22,794
External Trades: 3,587

Simple math says 19,207 trades are “non-external”, meaning they’re claimed as happening on your platform. Yet you just stated OpenMonero hasn’t even reached 1,000 trades.

So which is it?

This isn’t a small oversight. It’s a deliberate design to mislead users into believing there’s high trust and activity. And this isn’t an isolated case. In the rest of the user profiles in screenshots I’ve taken, the same pattern appears, some even worse than this one. In many cases the math doesn’t just fail, it completely exposes how misleading these stats really are.
Care to clarify?
/u/OpenMonero 📢
1 points
1 week ago*
NOTE: "Total trades" on public profile mean the sum of LM and OM trades

There are 3 ways to see the internal trades:

frontpage
if you hover on the username, you will see all stats for each domain/platform

openmonero.markets
go to section "Top 20 Vendors" to see internal trades for each vendor

public profile
total trades - LM trades (see container for reputation imports) = internal trades

NOTE: It is not possible to register an OM username, that is already taken on localmonero since both platforms are syncronized, you have to add import key to LM pub profile
/u/xmrglobal P
2 points
1 week ago
So you expect users to crawl through a maze of hover menus, cross-check domains, subtract reputation imports, and reverse-engineer your numbers, just to see the real trades? Meanwhile, your front page and public profiles loudly flaunt inflated totals and ratings as if they were earned on your platform.

This isn’t transparency, it’s deception by design. You’re padding user reputations with trades and feedback that never happened on OpenMonero, creating a fake sense of trust and liquidity.

Call it clever marketing if you want, but the community sees it for what it really is: classic FUD shilling.
/u/OpenMonero 📢
1 points
1 week ago*
Yes, I expect users to hover over usernames to review feedback before requesting a trade, as this is standard practice. Plus, notifications only show internal trades with trading partners, which is sufficient for transparency.

Why should reputation be locked into just one platform? As long as transparency is maintained, which it is, there's nothing suspicious about this approach. Platforms like LocalMonero and LocalBitcoins have operated similarly. You can also see a star symbol for imports like LCS, paxful, noones, etc, indicating that the reputation encompasses both internal and external trading stats.

Your kind of thinking seems to come from someone with very limited freedom. It's amusing that you often talk about freedom as if it’s your hallmark, yet your comments suggest that feedback and reputation stats should be confined to a single centralized platform. Why do you want to restrict vendors’ freedom? Their reputation is earned through their efforts, and it should be portable, importable and exportable, so vendors don't lose years of accumulated reputation if a platform closes.
/u/xmrglobal P
1 points
1 week ago
Freedom? Don’t insult the word. Freedom doesn’t mean padding profiles with external trades to fabricate trust. It doesn’t mean showing inflated numbers on your front page while burying the truth behind hover menus and cryptic icons. That’s not transparency, it’s sleight of hand.

Portability of reputation is only ethical when it’s clearly and unmistakably separated. What you’re doing is blending internal and external stats so seamlessly that casual users are misled into believing all those trades happened on your platform. That’s not empowering vendors, it’s deceiving buyers.

LocalMonero and LocalBitcoins never had to resort to this. They earned trust with clarity and integrity, not smoke and mirrors. You’re not giving freedom, you’re giving users a false sense of security.
/u/OpenMonero 📢
1 points
1 week ago*
Have you reviewed the front page of LocalMonero? It employs a reputation structure identical to that of openmonero, which we simply replicated. This was not an original idea of mine, and frankly, you are the first to raise concerns about it. Do you have any other criticisms of openmonero?

It is worth noting that the openmonero platform is fully open source, whereas yours is not. The OM platform comprises four repositories, three for the frontend and one for the backend.

Why do you think openmonero is approaching 1,000 trades so rapidly? It is due to established trust, a seamless user experience, and exceptional support, factors that demand significant effort. I sincerely wish your service the best, however, it might be better for you to consider transitioning to an openmonero instance.

Have you ever thought running an OpenMoenro instance? You can clone openmonero-dex and openmonero-dex-api on my git instance.

An OM instance could enhance trust and user experience within your community, since the reputation system is decentralized and the order book is federated across all OM instances. Nevertheless, such improvements will be insufficient without 24/7 support to assist your users.
/u/monero_desk_support
1 points
1 week ago
Sorry I'm quoting without any specific order

https://arxiv.org/pdf/2505.02392


Quote from woodser (dev of Haveno):
thinking to address this paper, increasing trade statistic randomization to +-10%, and adding a random delay to when trade stats are published. using higher fees to discern trades is already addressed


But usually, it’s not a big deal because users trust these providers not to share details like timestamps, amounts, or other info


You should not trust coinswap services to not disclose to anyone.



Authorities have tracked down major operators, likely due to the on-chain trail left by Retoswap activities.


I call FUD. Name one case where the tracking of monero tx was the cause and not an opsec error.

[qote] If an arbitrator acts maliciously, they could take an offer and essentially steal the funds by signing the 2/3 multisig transaction, [/quote]

If so, people will set up another haveno network. There is no other haveno network currently other than reto because they are doing a good job for now.

> This is not due to incompetence but rather suggests a lack of independence, as the Reto guy has accepted donations from questionable sources.

That's not something you can fix except finding another system for escrow (rewrite most of the trade logic)) or having more independent arbitrators to prevent being the one attributed to the same trade.

Proceed with extreme caution.


Depending on your threat model, yes.
/u/OpenMonero 📢
1 points
1 week ago*
Hey, first off, I appreciate that you are allowing free speech and open discussion without censorship, especially when it comes to harm reduction. That is really important.

That said, I am a bit confused why Woodser or Retoswap have not posted any warnings on their official websites since the paper came out two months ago (back in May 12). Seems kinda shady and not very transparent, especially since they promote their platform as privacy-focused.

Retoswap transaction details are not really secure because they can be easily deobfuscated, which means Chainalysis (running malicious monero nodes) could perform even more accurate timing attacks. As for haveno.markets, their timestamp obfuscation (just a 0-24h window) and the small amount variation (+/- 5%) are pretty much pointless since they use the same high fee for BTC/XMR and broadcast the trade completion right away on their P2P network (see diagram on page 11 of the PDF). Plus, the exchange rate stays accurate, so someone could basically extract all Bitcoin transactions.

Quote from the paper on page 11:
Haveno by default uses the same high fee for both transactions, obfuscates the reported trade amount, but broadcasts the completion of the trade immediately via the P2P network.
during the obfuscation the exchange rate stays accurate. Therefore, by reversing the heuristic, we can extract every Bitcoin transaction that fits into the range of the obfuscation time window. As the Haveno interface allows the XMR to include a decimal number with a maximum of four digits after the point the number of potential Bitcoin transactions is already greatly reduced.
TradeLogger: A second obfuscation in the trade statistics happens on the trade timestamp. The timestamp is shifted by some time between zero and 24 hours. However, the Haveno application immediately broadcasts the trade to the statistics once the trade is successfully completed. There might be delays in the network which unintentionally obfuscate the timestamp but typically, this notification in the network gives us the time when a trade has been completed.
Combined with our trade protocol, this gives us roughly the timestamp of the XMR spend transaction, the payout. Therefore, we can narrow down external transactions from a 24 hours window to the time frame we get of the observed on-chain pattern.

4.2 Results
To test our findings, we logged Haveno trades for two weeks and executed five test trades within the observation period. For all five transactions, we successfully identified all XMR transactions. Furthermore, our analysis correctly isolated a subset of BTC transactions including the real BTC payment transaction.

Quote from woodser (dev of Haveno):
thinking to address this paper, increasing trade statistic randomization to +-10%, and adding a random delay to when trade stats are published. using higher fees to discern trades is already addressed


Do you have an official link to the woodser reponse? Is there an official issue discussion on github?

You should not trust coinswap services to not disclose to anyone.

I believe trusting one person or admin with my transaction details is better than leaving them on-chain on a public node network for anyone to access.

That's not something you can fix except finding another system for escrow (rewrite most of the trade logic)) or having more independent arbitrators to prevent being the one attributed to the same trade.

Independent arbiters do not matter at all, since the network operator will ban all human arbiters and replace them with arbiter bots before they carry out the exit scam attack. There is no doubt that centralized noKYC swappers like exch.cx have provided more privacy since they never publicly shared the latest on-chain trades unencrypted, in plain text on a p2p network.

There is still no official warning (on haveno.exchange or retoswap.com) that transaction details can be easily deobfuscated by anyone? That is a serious transparency gap. Anyone can track these transactions (no need to even run malicious nodes like Chainalysis) and even worse, if Chainalysis can already log IP addresses from deposits made into haveno, they can still follow transactions eventough haveno is routing them with tor, simply because they can deobfuscate all crypto transactions on haveno.markets. So, using Tor for routing on haveno/retoswap does not really help. It is a huge privacy flaw, and honestly, it is unacceptable for a platform that claims to be privacy-focused.
/u/OpenMonero 📢
1 points
1 week ago
Why obfuscation is useless?

- during the obfuscation the retoswap exchange rate stays accurate
- retoswap by default uses the same high fee for both transactions
- retoswap broadcasts the completion of the trade immediately via the haveno P2P network (see diagram in pdf on page 11)
- the XMR amount with a decimal number of 4 digits is shared on haveno.markets
/u/monero_desk_support
1 points
1 week ago
> - retoswap by default uses the same high fee for both transactions

That's not true anymore.
/u/OpenMonero 📢
1 points
5 days ago*
I don't see any commit update referencing the fee structure privacy update. Source: github.com/haveno-dex/haveno/commits/master/

Commits on Jul 11, 2025

- widen offer details window for confirm and cancel buttons
- remove 'revert tx' column from transactions view

Commits on Jul 9, 2025

- always show tx withdraw window
- fix error loading interac e-transfer offers
- instruct to build v1.1.2

Commits on Jul 8, 2025

- transfer open offer's challenge when upgraded
- adjust payment accounts list height dynamically
- provide trade start time, duration, and deadline in grpc api
- fix vertical alignment of fixed price swap arrows
- widen currency text box when creating offer

Commits on Jul 7, 2025

- use stackpane for currency icons
- use logo for fiat currencies

Commits on Jul 5, 2025

- remove unused progress bar below network info
- always use 'currency name (code)' format
- fix alignment of market price pct when taking offer
- fix opening matrix.to link under support button by escaping

Commits on Jul 3, 2025

- Add translation guide to CONTRIBUTING.md
- fix vertical alignment of text field with icon
- wallet poll requests connection changes off thread to avoid deadlock

Commits on Jul 2, 2025

- add payment methods to trade statistics PaymentMethodMapper
- fix vertical alignment of price column in offer book view
- support US postal money order accounts over grpc api
- support interac e-transfer payment accounts over grpc api
- support ach transfer payment account over grpc api
- support amazon e-gift card payment account over grpc api
- support wise usd payment account over grpc api
- support swish payment account over grpc api
- support alipay grpc api
- support wechat pay grpc api

Commits on Jul 1, 2025

- use BigInteger for average chart calculations
- fix average calculation in trade charts view

Commits on Jun 28, 2025

- do not color currency code in offer book volume column

Commits on Jun 23, 2025

- fix donation permalink

Commits on Jun 22, 2025

- fix error on export table columns

Commits on Jun 19, 2025

- fix translations by automatically escaping single quotes, remove escapes
/u/monero_desk_support
1 points
2 days ago
https://github.com/haveno-dex/haveno/pull/1590
/u/OpenMonero 📢
1 points
2 days ago
High priority transactions only hurt user privacy. I have used high priority transactions on OM in the beginning as well, but a user recommend to switch to normal transactions priority to have better privacy. Actually it wouldn't be an issue on OM, since we dont publish trade amounts and timestamps.

The paper was released in May but the commit is published on Feb, How was the commit released before the research paper? I thought the commit is an reaction to the paper. It isn't.

The question remains, weather this commit is significantly reducing the chance of tracking or not? I really doubt, since there are more tracking factors and this little change might not have a big effect.

Other tracking mechanisms are:

- during the obfuscation the retoswap exchange rate stays accurate
- retoswap broadcasts the completion of the trade immediately via the haveno P2P network (see diagram in pdf on page 11)
- the XMR amount with a decimal number of 4 digits is shared on haveno.markets
/u/monero_desk_support
1 points
1 day ago
How was the commit released before the research paper? I thought the commit is an reaction to the paper. It isn't.


It just means the paper was outdated even on the day it was published.

weather this commit is significantly reducing the chance of tracking or not? I really doubt,


Stop doubting and do the math if you want to be useful.