Since late October 2026, a story has been unfolding around the exchanger ComCash — which had been operating under a no-KYC anonymous-service signboard — involving a hack, a leak of client files, and a domain swap. The original thread on BitcoinTalk started out as a routine service announcement, but by page two it had turned into a breakdown of the incident.

What happened

Per user examplens, who posted on October 30, the exchanger's site was tampered with by outsiders: pages got plastered with messages about the service shutting down and no longer accepting orders, and client data was dumped in the open on a hacker forum. User hugeblack pinned down the incident window — the night of October 29 to 30. By that point the domains comcash.exchange and comcash.cc were no longer working as usual, and the forum announcement had been edited, with links swapped out. examplens separately noted the servers weren't fully shut down: files were still reachable at direct addresses, including a client-base dump in CSV format, an archive with the source code, a PDF manual for operators, and a text file of correspondence.

What visitors see right now

A check at the time of this writing shows comcash.cc and comcash.exchange no longer serve the exchanger — instead they return a tampered page with a mocking headline about the exchange rate, a list of the admins' personal details, and links to download those very archives (inside, 510 rows out of 32,170 in the client dump are advertised). The domain comcash.dev returns a 403. Per RDAP, comcash.cc was registered on October 10, 2025 via NameSilo, is served by Cloudflare nameservers, is in pendingTransfer status, and the last record change was logged on October 30, 2026 at 01:00 UTC — i.e., right in the night of the incident.

The team's reaction

On October 22, a service rep announced a return to the forum, after which he spent a month posting long descriptive posts about nothing in particular. Over on bits.media there's a telling detail: a whole pile of the rep's messages were edited on October 31 between 00:02 and 00:05 Moscow time. The official position was relayed on November 2 by user icopress, the manager of the signature campaign, who got it from the owner. The statement says the project came under attack, that client data was not handed over to third parties, and that everything currently being circulated is compromised and doesn't reflect reality; the only reliable communication channel is named as BitcoinTalk. The announcement's first post, meanwhile, was edited on November 2 at 14:59, and the links in it were switched to placeholder "Web 1" and "Web 2" plus a Tor mirror.

What participants are discussing

User AakZaki pointed out that the announcement and the campaign signatures still feature comcash.exchange and comcash.cc, whereas the announcement itself already lists comcash.dev and comcash.app. He also compared the pages: the old domains have no favicon, the new ones do, and the logo on the old ones has an extra letter — which looks like a tampering hand. User icopress confirmed he's waiting for the team's decision and that the campaign itself is fine. User zasad@ urged everyone to wait for official announcements and noted that the service never asked for full names, phone numbers, or emails, so part of the data could have come from a different source or just been generated.

However, the published document does contain phone numbers and bank card data collected during ruble operations, while email addresses could have lingered from registration and order notifications. User joniboini admitted he's uncomfortable downloading files left by the hacker, but noted that instant-swap services don't usually collect such detailed data.

A separate thread on bits.media

On October 30, user AntiScam claimed that Secrex.io, ComCash.cc, Roboex.cc, and Barbados-Exchange.com aren't four different exchangers but one and the same project — shared team, shared server, shared wallets — and that he found his own data in the published dump. Moderator Helber first moved the post to the flamewar section as unproven, then the topic got its own status, and the exchanger's announcement header was later changed to "Raises concerns". User ArtMaggn quoted a post from the hacker forums Ex***t and x** where some nick claimed to have published user and owner data of Comedy Cash, Barbados Exchange, and ComCash, doxed eight people involved, dumped the source code of several exchangers at once, and posted an operator manual that mentions ties between the services. Helber, for his part, isn't rushing to confirm the conclusions and hints that some of the info could have surfaced during cash-out rather than during a normal exchange. He also pointed out that several sites running the same engine doesn't by itself prove a shared owner.

Right now none of the old domains are serving exchanges, the official addresses have been swapped out, and the public pages contain other people's personal data — digging through or forwarding such files isn't worth it; it's a separate risk for whoever opens them too.