This report is based on a forum discussion initiated by user Trêvoid on July 19, 2026, and describes the activities of a fraudulent cryptocurrency exchange network operating under the domains xhash.cash, jud-ex, darkmap, byware, and nokyc-noaml.

According to user Trêvoid, the scammers use a targeted scam scheme aimed at stealing large sums. The main trick involves offering a low commission percentage to encourage users to make large exchanges. According to user Trêvoid, the service can successfully process small transactions to imitate legitimate operations, but when a large deposit arrives, the funds are misappropriated. An example cited is a user losing 1 BTC. The author also conducted their own test transaction and noted that the platform uses the NEAR intents/1Click API, but sends Monero manually, waiting for a large victim. Furthermore, according to user Trêvoid, the service uses fake guarantee letters and manipulates reviews on aggregators.

Discussion participants supported the investigation's conclusions and revealed additional nuances of the scheme. According to user albon, the exchange's pricing tier looks like an incentive program that makes no economic sense and serves merely as a "carrot" to lure greedy users. He emphasized that the platform has existed for less than three months, has no reputation, and trusting it with large amounts is extremely reckless.

According to user tabas, to minimize risks when dealing with new services, it is advisable to split large amounts into batches of small transactions. He also drew attention to the manipulation of public opinion: according to user tabas, the reviews on KYCNotList look fake, particularly the comment about a successful $30,000 transaction.

Also, in his opinion, the lack of response from aggregators and the similarity in methods may indicate a connection to another previously exposed fraudulent platform — hide.cash.