On July 17, 2026, an incident of fund theft was recorded on the hide.cash platform. A user made a deposit of 49.35 SOL (approximately $4,000) to exchange for Monero, but the funds were not credited to their account.

According to user Trêvoid, who initiated an independent investigation, the service operators publicly denied the existence of this order and claimed that the deposit address did not belong to them.

However, according to user Trêvoid, an analysis of the Solana blockchain and the site's order system proves otherwise. During test creation of new orders on hide.cash, the server issued deposit addresses leading directly to the wallets that had previously received the victim's funds. The wallets involved in the theft share a common signing key and use an identical automated fund transfer pattern characteristic of the service's internal pool.

According to user Trêvoid, the fraudulent scheme affected other clients as well. A second case was recorded involving the theft of 500 USDC on the Ethereum network during a similar attempt to exchange for XMR. The order status stalled at the "Sending XMR" stage, while the deposited funds were promptly transferred to the platform's consolidation wallet, as confirmed by transactions on the Etherscan block explorer.

To attract new victims, according to user Trêvoid, the service launched a promotional campaign offering a 1 XMR bonus for exchanges exceeding $500, which is regarded as a classic bait tactic. On August 10, 2026, the website completely ceased operations, and the scammers disappeared after the promo campaign failed to yield the expected results.

Members of the forum community supported the investigation's conclusions. According to user albon, the presented evidence conclusively proves hide.cash's guilt in misappropriating funds and providing false information. In turn, user logfiles noted that malicious actors often create exchange aggregators without KYC procedures to lure gullible users seeking to maintain their anonymity.