People have been using Openmonero(dot)com without any issues. We had a rocky start but we really try to give it all. You'll find far more privacy options and offers on there than paxful

Also checkout [openmonero.markets] for daily volume, popular payment methods and other statistics

You still don't understand why vendors are trusting the platform?

Vendors don't need to deposit the trading amount to publish ads. Its a unique and trust-less trading experience. Hence you can even receive a trade request for 100 xmr without locking the coins upfront, allowing for vendors to test the platform before going all in. Some vendors also just use the platform for marketing reasons, to get in touch with potential buyers, tough this is not allowed in our terms.

Why on earth would I risk my reputation for $25K. Its not even a mc donald salary, Anyways I have started refunding the top 11 vendors on July 18 (the usernames are avail on [t.me/p2p_monero_talk]

Are you aware of the fact that the author of a thread cannot delete his own thread. He can lock it up to prevent further replies, but removal is only possible by the admins. Do you have any other cards?

Yes, my own thread got deleted by the admins for some reason. It's quite a nice thread with really interesting discussion. You can find a cached version here: https://ninjastic.space/topic/5522702

What I said is confirmed by many independent sources. Are you disputing this?
https://bitcointalk.org/index.php?topic=5544046.msg65549064#msg65549064
https://monero.top/news/note1e94uvd0vx2k9mgdgnzzpqmdh0swkqmkhq6uy4c2g3pganxy96pvqlkvmsz
https://github.com/simplex-chat/simplex-chat/blob/stable/docs/SimpleX_Design_Review_2024_Summary_Report_12_08_2024.pdf

I'm doing well health-wise, keeping a balanced lifestyle with enough food, sleep, and real-life social interactions (AFK).

What about you? You mentioned feeling tired in your last message. Maybe spending more time outdoors or hanging out with friends could help, instead of spreading FUD about legit projects.

I haven't taken a single penny out of this and put everything into it. An exit scam would need a lot of planning and usually takes years. We're less than a year old and have pretty low volume

It was you who posted the negative trust entry on the forum, and then you become upset when the same individuals audit your service and identify significant privacy and trust concerns. I was not even aware of your honeypot service prior to the hack, and for the record, I have not yet posted a review on [kycnot.me]. Thank you for the reminder.

I noticed you recently posted a bunch of spammy stuff to boost your activity on Bitcointalk. Honestly, the more posts you make in a short time, the more it looks like spam. I’ll check your registration date and run a quick risk assessment. I’m pretty sure it’s low, though.

My reviews of your service are well documented and backed up with external, independent sources like [kycnot.me] and [monero.top]. Ultimately, it’s up to the community whether they choose to trust your service.

I've already admitted the BBCode mistake several times. But your claim about an exit scam is just speculation and not really factual. Also, I see you're trying to copy exch.cx writing style, which is fine, nontheless this is double standard.

There's no reason to think a legit, profitable platform like ours would run an exit scam with only around 25k USD. Maybe some folks are just trying to take us down. Honestly, we’re only doing about 350 XMR a month in volume. Compare that to Retoswap, which, according to [haveno.markets], does about 1,000 times more. So, their setup could potentially allow for an exit scam because of their deposit requirements (malicious pre-lock), while we don’t ask for any deposits at all to publish an offer. (no deposits = no risk of an exit scam) 

If you think we're pulling a rug, say so. But without proof, your accusations are pointless. Refunds are already happening, so your claims don't add up. Why would we risk our reputation for 25k? And if we were planning to steal money, why would we let you buy XMR directly with your own wallets? That makes no sense.

I've made it clear from the beginning that everyone would get their refunds. The first partial refund was sent out on Jul 18, and you can see the usernames on t.me/p2p_monero_talk. As a result, the red notification on [kycnot.me] has been taken down.

Also, please avoid saying "up 200 XMR," since that was just an initial estimate based on wallet funds from 6 months ago. The real amount is 78 XMR (~25K USD).

The red warning on the official website was taken down after we fixed the issue on Jun 16. It was up for about 10 days while we sorted everything out.

How long do you think a warning like that should stay up after the problem is fixed? It doesn’t really make sense to keep displaying a big warning once it's all sorted. Do you agree?
However there is still a mention of the hack.
1. Go to openmonero.com
2. Sroll down to "Latest News"
3. Read "OpenMonero reopening!"

Also, there's a notification at the top of every page for logged-in users showing their pending refund amount. Since the platform is non-custodial, we expect to be able to refund everyone within about 6 months. The refunds are paid out of arbiter fees. Based on the current monthly volume listed on https://openmonero.markets, we think we can process around 10 - 15 XMR in refunds each month. (78 xmr / 15 xmr = 5.2 months = best case scenario)

How has your honeypot service managed to operate this effectively despite such a low level of OPSEC? Please refrain from sharing details regarding settlement amounts and the time intervals of simpleX swaps. This information could be exploited by law enforcement agencies to track XMR transactions.

Furthermore, the administrator of kycnot.me initially approved your listing for several hours, however, this approval was soon revoked. This is likely due to the fact that Trêvoid lacks operational history, a dedicated website, and conducts all trades through insecure communication channels, which leak substantial metadata such as IP addresses, ping times, and chat contacts. All of this traffic is routed through simpleX's centralized servers, which, as a note, cooperate with law enforcement.

Why are you continuing to use simpleX for swaps, despite being informed that it tracks virtually everything? It only provides a single hop, which offers minimal anonymity. Both session and Tor networks utilize three hop. Why not leverage these instead for improved privacy?
https://bitcointalk.org/index.php?topic=5544046.msg65549064#msg65549064

You did the same OPSEC mistake in the past:
https://bitcointalk.org/index.php?topic=5544046.msg65563345#msg65563345

How Law Enforcement Tracks XMR Transactions
https://openmonero.com/knowledge/how-bad-actors-try-to-track-monero

According to kycnot.me, Trêvoid is pushing lots of fake reviews to boost reputation and trick users
https://bitcointalk.org/index.php?topic=5544046.msg65522499#msg65522499

Noticing that your first three sentences all start with "I" kind of says a lot. Basically, it seems like your thinking is a bit one-sided, focused mainly on yourself. Maybe try looking into different ways to start sentences, that could help make your writing more interesting and varied.

It's pretty confusing that your profile shows so much activity, but you still don’t seem to realize that you can’t actually delete a thread completely. You can only lock it to stop more replies, but the original author can’t totally remove it.

For example, my first thread in the "Service Announcement" section was permanently deleted by mods after I copied the exch.cx ANN code format. I quickly changed it back after a user pointed it out, but it still got taken down by a moderator.

Also, it seems like some mods might be working on different projects at the same time or even getting paid to post negative trust entries, that’s pretty obvious. If you check my profile, you’ll see plenty of bad entries, most of which are just baseless, except for the exchange code report. The rest look like FUD, which I wear like badges, showing how many people are actively fighting against openmonero.com.

About your claim that our project isn’t transparent, that’s not really true. We’ve actually released several transparency reports in the last 30 days, showing that we’re committed to being open and accountable.

1. OpenMonero launching openmonero.markets for insights and transparency (it even includes the total refund amount)

2. The hacking event was first announced on telegram, following session, reddit, official site, monero.observer, kycnot.me and other monero forums (all within 48 hours, so why do spread nonsense that we dont care or try to hide the hacking event)
   - https://bitcointalk.org/index.php?topic=5546081.msg65518087#msg65518087
   - https://monero.observer/openmonero-hacked-reports-all-funds-stolen/,
   - https://t.me/p2p_monero_talk/3303
   - https://farside.link/libreddit/r/Monero/comments/1l5jkp2/openmonerocom_got_hacked_as_reported_in_their/
   
3. The first haveno audit with brief examples wasd done by OM (rug pull issue confirmed by dread mods and trusted community members like SaberhagenTheNameless or shortwavesurfer2009)
   - https://archive.ph/JOqDC#25%
   - https://archive.ph/gSRVs#25%
   - https://monero.observer/openmonero-2/
   
4. OpenMonero just summarized the research done by three independent universities. (Why are you blaming us for that research paper?)
   - https://openmonero.com/knowledge/haveno-retoswap-smells-like-a-honeypot
   - https://arxiv.org/pdf/2505.02392
   - https://xcancel.com/RetoSwap/status/1930953817228481022#m
   
5. A minimum of five responses have been posted in response to the exit scam accusations within the BitcoinTalk thread you provided.
   - https://bitcointalk.org/index.php?topic=5546081.msg65518087#msg65518087
   - https://bitcointalk.org/index.php?topic=5546081.msg65518097#msg65518097
   - https://bitcointalk.org/index.php?topic=5546081.msg65518235#msg65518235
   - https://bitcointalk.org/index.php?topic=5546081.msg65518256#msg65518256
   - https://bitcointalk.org/index.php?topic=5546081.msg65518355#msg65518355

Please keep conversation factual and provide reference for your spamshit, otherwise you look like a spammer.

Top vendors have already been refunded (see t.me/p2p_monero_talk for proof). Only 25k USD got lost since OpenMonero does not have any pre-funding. It is very simple. You cannot avoid hacks but you can minimize the damage with non-custodial trade funding. That is exactly how openmoenro works

The OpenMonero project is still going strong and holding up pretty well against the baseless claims coming from some so-called "trusted" community members. I've noticed a few of these trusted folks on BitcoinTalk spreading misleading info, like accusations of plagiarism and exit scams. I've been open and transparent about the hack and those plagiarism claims from the start. Even with all the flags on my account, do you really think that changes anything? These accusations are completely unfounded and lack any real proof. Honestly, you can't damage my reputation because I’m all about transparency, and my vendors keep praising the support I provide.

I have no interest in exit scams. If I did, I'd be asking for pre-funding for every published offer, which I’m not. I’m also not trying to create a monopoly. If I was, I wouldn’t have open-sourced both the frontend and backend, and I've given proper credit to LocalMonero on the official site. Yet, you keep spreading false claims about a legit, independent community project. Without solid proof, your accusations mean nothing. Nobody cares about your gut feelings.

My aim is to raise awareness and teach folks that decentralized exchanges aren’t automatically more secure than regular sites. In some cases, like Haveno, they can even be more dangerous because of pre-funding and rug puller bots. More here: https://bitcointalk.org/index.php?topic=5533743.msg65114988#msg65114988

Congratulation to your new honeypot exchange! The haveno software is a sophisticated decoy and the most centralized p2p software since every offer must be pre-funded and you have to lock up coins in order to publish an offer. Users cannot post any offers without making a deposit for each offer upfront. Its setup is not trustworthy and allows for easy exit scams with just 2 rugpuller bots, centralization of xmr liquidity, and tracking of every transaction. For more info compare liquidity on openmonero.markets and haveno.markets. The last one has 1000 times more liquidity that can be seized, frozen or rugpulled. This is because of the malicious pre-lock that I mentioned.

Even worse, all transactions are logged in the plain text publicly (on-chain), allowing for chainanlysis to create even more accurate trackers. I kid you not. This is worse than kraken if you think about it, bc kraken doesn't share any trade stats publicly.

Also multi-sig does not protect open offers, bc the admin can easily get 2 keys to easily seize all funds and run away with the entire orderbook (liqudity) Its a pot full of honey. If it smells like a honeypot and works like a honeypit, it is a honeypot.

Haveno rug pull (exit scam) possible with 2 bots:
https://bitcointalk.org/index.php?topic=5533743.0

Haveno Warning – Centralization of XMR market and tracking every transaction:
https://bitcointalk.org/index.php?topic=5549663.0

Haveno (Retoswap) smells like a honeypot:
https://openmonero.com/knowledge/haveno-retoswap-smells-like-a-honeypot

I do not recommend paxful since it requires KYC and has absolutely no privacy options for buyers like noJS or onion address. It is a shame.

Unfortunately there are not much p2p platforms that really care about privacy and have good vendors.

You may check kycnotme

https://kycnot.me/?categories=exchange&verification=community&networks=onion

There are other more secure exchanges like p2p platforms without a middlemen, without kyc and even without registration for buying

https://kycnot.me/?categories=exchange&verification=community&networks=onion

I have built the first decentralized p2p monero escrow service on top of NOSTR
The first OM DEX instance will be launched this year.

Important features like a decentralized reputation system and a federated orderbook have already been added.

The project is already production ready, but not really scalable, unless you have a good dedicated server and a fast NOSTR implementation (sqlite is slow). Can you recommend one?

clone the code or contribute:

frontend: https://git.openmonero.com/om/openmonero-dex
backend: https://git.openmonero.com/om/openmonero-dex-api

No, bisq does not have the same rug pull issue since they use the bisq token and completely different multi-sig setup

You may also join discussions on the following forums:

https://monero.top/news/spasmid01368a969e405b322a01e59

http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/be82f1a0c5e0f79f6dbb

http://pitchprash4aqilfr7sbmuwve3pnkpylqwxjbj2q5o4szcfeea6d27yd.onion/p/74e93aa4

Recent research conducted by the Weizenbaum Institute, TRM Labs (San Franciso) and TU Berlin indicate that Retoswap, formerly known as Haveno-Reto, does not provide the privacy protections it advertises. Despite its marketing claims, this platform functions as a sophisticated decoy. The narrative of being non-custodial and decentralized is a carefully crafted illusion designed to attract unsuspecting users and foster a false sense of security.
https://xcancel.com/noosphere888x2/status/1922044150716715102#m

Darknet operators who assume Retoswap is suitable for laundering should reconsider. Their activities are under constant surveillance. The supposed privacy offered by Retoswap is an illusion.

Retoswap Trades Are Fully Traceable

Source: https://arxiv.org/pdf/2505.02392


It is noteworthy that some of the most active dark web exchanges, administrators, vendors, and key figures may have already utilized Retoswap to launder illicit gains or transfer substantial amounts of BTC and XMR. These individuals often believe their anonymity is safeguarded due to the platform’s purported decentralization. However, all Retoswap crypto-to-crypto transactions are inherently traceable.

Retoswap has apparently handled over 50 million dollars in transactions, which is pretty impressive considering it’s been around for less than a year. It looks like big players like hackers, darknet admins, and other underground groups are already using it to move big amounts of money.
Source: https://xcancel.com/RetoSwap/status/1930953817228481022#m

While speculative, there are reasons to suspect that recent LE actions may not be coincidental. Authorities have tracked down major operators, likely due to the on-chain trail left by Retoswap activities. According to haveno.markets, approximately 90% of liquidity involves BTC-XMR swaps, transactions that are fully traceable. Every transaction is publicly recorded on-chain with exact timestamps, amounts, and payment methods, leaving a permanent digital footprint.

Source: https://arxiv.org/pdf/2505.02392

In summary, admins of coin-swap services can easily monitor BTC to XMR trades. But usually, it’s not a big deal because users trust these providers not to share details like timestamps, amounts, or other info. On the flip side, with platforms like Retoswap, anyone can potentially track transactions, it’s not just the admins. That’s because haveno.markets openly shares trade stats, making it easier for third parties to analyze and follow the transactions.

May freeze or seize funds

Retoswap runs on Haveno, which is a decentralized, non-custodial multi-sig exchange. That’s true because your private key is generated locally, so only you have access to your funds in the Haveno wallet.

However, to publish a sell offer, a vendor must lock up coins (15% security deposit and the trade amount). These funds can potentially be frozen or seized because the admin can easily have two keys required to sign a transaction. The haveno FAQ suggests that the admin/arbiter only has one key, but in practice, anyone can become a taker, there is practically nothing preventing the admin from possessing two keys.

Some users have spoken out about this openly on platforms like Nostr, Reddit, and others, raising concerns about potential exit scams in how the system is set up. So, it’s worth being aware of these issues before jumping in.

Quote /u/jossfun:
Source: https://rl.bloat.cat/r/Monero/comments/1h4icot/is_haveno_anymore_secure_than_trading_with_a/
Cached: https://archive.ph/bB1VN

Quote shortwavesurfer2009:
Source: https://primal.net/e/nevent1qqs0h2fvwvcsg58l6xw9hwpav4kk3vry933rrm6pparrf0s7p9rel6gpz4mhxue69uhkg6t5w3hjuur4vghhyetvv9uszyrhwden5te0v5hxummn9ekx7mp0qythwumn8ghj7en9v4j8xtnwdaehgu3wvfskuep0mvpr6f
Cached: https://archive.ph/gSRVs#25%

Quote /u/WoodenInformation730:
Source: https://rl.bloat.cat/r/Monero/comments/1l5jkp2/openmonerocom_got_hacked_as_reported_in_their/mwj10k3/?context=3#mwj10k3
Cached: https://archive.ph/icuxp#45%

Exit Scam Scenario

Quote SaberhagenTheNameless:
Source: https://primal.net/e/nevent1qqsy7hmx9n2ws94x92ftvc44ylkejyg8ygw9z9pt4eswj44yqewp3jcpzamhxue69uhkvet9v3ejumn0wd68ytnzv9hxgtcppemhxue69uhkummn9ekx7mp0qy08wumn8ghj7mn0wd68yttsw43zuam9d3kx7unyv4ezumn9wshs0gztdf
Cached: https://archive.ph/JOqDC#25%
Source: http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/c2435fb29e7b9d8ab8b8

Quote: /u/monero_desk_support:
Source: http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/post/4e7e530582ff902b6903/#c-cac5570453f7fa9f42

Single Point of Failure
The Haveno software is not inherently secure due to its design, which allows multiple arbitrators under the control of a single administrator. This reliance on a central authority creates a vulnerability, as the administrator serves as a potential single point of failure. Consequently, it remains unclear why some perceive Haveno as a decentralized exchange, despite these concerns.

Also it wants you to pre-fund your offers, even though that's a security issue and not really necessary. Plus, it looks like one person, the network operator, has all the power over the liquidity, which kinda goes against the whole decentralized thing they claim.

References:
https://primal.net/e/nevent1qvzqqqqqqyqzqpg8r34v5d5z4ecxmc0c749cwjalaw4xu2ttpnh8zms0lhfepg450s7qlk
https://primal.net/e/nevent1qqsx8cs8tlq2xg25535uaxvhth49cmnflf5z0wdvu9ex7wa38w5y5xscrjjzp
https://archive.ph/GsDsn
https://simplifiedprivacy.com/openmonero-interview-with-the-dev/compared-to-reto.html

Centralization of XMR market and tracking every transaction
Retoswaps objective appears to be the centralization of XMR liquidity through their unique setup with pre-funded offers. Furthermore, Woodser (developer associated with Haveno) has not addressed the rugpuller bot issue that I initially identified six months ago. This is not due to incompetence but rather suggests a lack of independence, as the Reto guy has accepted donations from questionable sources. Such actions raise concerns about the integrity of the haveno development process.
Source: link to shortwavesurfer about donations

Quote /u/mister_monster:
Source: https://monero.town/post/5172146

Amazon used the same tactic to take over the market, operating at a loss and funded by questionable sources until competitors were pushed out. Now, this new platform is promising decentralization, non-custodial transactions, and privacy. But the reality is, none of that seems to hold up. It's all about crushing the competition and cornering the XMR market, and tracking every transaction? That's not exactly a recipe for trust. It might not be a honeypot, but it sure smells a lot like one. Proceed with extreme caution.

Its quite obvious what you are doing and why on earth are you posting xmr addresses of your users publicly and attaching the settlement amount. Jesus fuck. Never heard about timing attacks?

The way SimpleX manipulates things is honestly crazy. 

This whole thing is pretty hilarious. So, SimpleX is now bragging about being the only "fully decentralized" messaging app, right? But then they add just one centralized server option controlled by a single company as a test run. And they call themselves fully decentralized? I kid you not. You can read the article from November 2024 and then go listen to Evgeny's OptOut interview from two months later, starting around 13:30. LMAO, it’s pure comedy.

https://simplex.chat/blog/20241125-servers-operated-by-flux-true-privacy-and-decentralization-for-all-users.html
https://optoutpod.com/episodes/improving-simplex/

Honestly, SimpleX offers no real metadata protection. It doesn’t stop servers from collecting your info, but they keep saying it does in their docs and FAQs, and fans buy into it. Most users stick to default servers, so their metadata is just sitting there, unprotected.

In any normal messaging app, your IP should be hidden from the person you’re chatting with. But with SimpleX, anyone can easily grab your IP in private or public chats.

Their network is super centralized, and all that “private message routing” is just a misleading term. It’s not truly onion routing (they’re pretending it is). The reality? Even with "private message routing" on, messages come straight from servers that can log your IP and other data.

So, basically, their “2-hop onion routing” isn’t really a thing. It’s a fake claim to make it seem more secure than it actually is.

Trail of Bits mentioned some correlation attacks on the transport layer but totally missed the metadata collection stuff by SimpleX servers. I don’t think it’s a conspiracy, probably just outside their scope, which is pretty surprising and raises some questions.

Journalists or podcasters, you should ask Evgeny why the audit didn’t cover deanonymization attacks from SimpleX servers.

It’d be smart to get more audits done, especially by non-US companies.

https://github.com/simplex-chat/simplex-chat/blob/stable/docs/SimpleX_Design_Review_2024_Summary_Report_12_08_2024.pdf
https://monero.top/news/note1e94uvd0vx2k9mgdgnzzpqmdh0swkqmkhq6uy4c2g3pganxy96pvqlkvmsz

This statement is inaccurate. The onion and i2p address is not proxied through Cloudflare. Additionally, high threat-model users have the option to enable self-destructing messages immediately after a trade. This method offers a higher level of security compared to encryption, as there is nothing to decrypt if the message is destroyed. My project is listed on multiple indexes, including monerica, kycnot.me, tor.watch, and several others. Frankly, I have not heard of monero.eco. However, since it requires JavaScript, I do not consider it relevant or trustworthy.

WARNING: The admin of this service has been spreading false info about openmonero.com, an open-source, no-KYC project that’s been running smoothly and reliably for over 12 months. Meanwhile, this new service has only been around for 2-3 months, and the person behind it is just trying to push his cheap, shady offering.

A big red flag: this project isn’t open source, doesn’t even have a website, and all trades happen on simpleX (a messaging app still in beta with centralized nodes that could log all your activity)

For your safety and OPSEC, it’s best to steer clear of such sketchy services. Stick with reputable, open-source options that offer real transparency, community support, and verified vendors. Stay safe!

Best Regards
OpenMonero.com