Is FixedFloat Safe After the 2024 Hack?

On February 16, 2024, FixedFloat — one of the most popular no-KYC instant swap exchanges on the market — woke up to a draining wallet. By the time the team paused the platform later that day, attackers had siphoned roughly 1,728 BTC and 409 ETH, a haul worth about $26 million at the time. For an exchange whose entire pitch was "swap fast, swap private, no account needed," the breach was an existential branding problem. Two years later, traders are still asking the obvious question before clicking "exchange": is FixedFloat actually safe to use today, or is the platform a ticking time bomb? This guide walks through what really happened in February 2024, what FixedFloat changed afterward, how its custody model compares with safer alternatives such as MoneroSwapper, and what specific signals you should look for before trusting any non-custodial swap with your Monero or Bitcoin.

What actually happened on February 16, 2024

FixedFloat positions itself as an "automated cryptocurrency exchange" that lets users swap between roughly fifty assets without registration. The model is simple: you pick the input and output coin, send your funds to a one-time deposit address, and the platform routes the trade through its own liquidity, returning the swapped coin to your withdrawal address. To keep swaps instant, FixedFloat — like ChangeNow, SimpleSwap, and most rivals — pre-funds hot wallets across every supported chain. Those hot wallets are exactly what the attackers reached.

The official post-mortem published by FixedFloat described the incident as a result of "vulnerabilities in security structures," without naming the specific exploit. On-chain analysts at Arkham, ZachXBT, and SlowMist traced the outflow patterns and concluded that the attacker drained two segregated hot wallets in rapid sequence, suggesting either a compromised signing key or an insider-grade access path rather than a smart-contract flaw. The stolen funds were laundered through eXch, the now-defunct mixer, and a chain of intermediary Bitcoin addresses, with some ETH later bridged via THORChain.

• Total loss: approximately 1,728 BTC and 409 ETH, worth about $26 million on the day of the breach.
• Downtime: FixedFloat displayed a maintenance banner for several days before partially resuming swaps.
• User funds affected: the team has consistently claimed that no individual user balances were lost because the platform is non-custodial in the sense that it holds liquidity, not deposits — a nuance we will unpack below.
• No public attribution: as of mid-2026, neither the attacker nor the exact vulnerability has been publicly named.

Why "non-custodial" does not mean "safe" on FixedFloat

FixedFloat markets itself as non-custodial, and technically the description is correct: when you initiate a swap, the platform does not ask you to deposit funds in advance or store a balance under your name. You send coins for exactly one swap, and the swapped coins go straight to your withdrawal address. There is no user account, no recoverable balance, and — in theory — no honeypot for hackers to drain at the user level.

That description, however, hides where the risk actually sits. FixedFloat is non-custodial from the perspective of long-term balances, but it is fully custodial during the swap itself. The moment your Bitcoin arrives at the deposit address the platform generated for you, FixedFloat controls it until the corresponding output is sent back. If the platform's hot wallets are drained — which is exactly what happened in 2024 — any swap in flight is at risk of being permanently stuck, refunded after a delay, or, in worst-case scenarios, lost.

The hot-wallet exposure window

Every instant swap exchange has a hot-wallet exposure window measured in minutes. For FixedFloat, this window is the entire transaction time from your deposit confirmation to the moment the output transaction broadcasts. During that gap, the deposit you sent and the output liquidity the platform is about to send to you are both sitting in addresses controlled by FixedFloat's internal signing infrastructure. A breach during that window — like the one in February 2024 — directly affects in-flight swaps.

The structural difference from a real atomic swap

A true atomic swap, by contrast, uses hash time-locked contracts so that the two legs of the trade either both execute or both refund — there is no intermediate moment when a centralized party controls both sides. Tools like COMIT, BasicSwap, and Haveno apply this principle to Bitcoin–Monero trades. FixedFloat is not an atomic swap. It is a centralized matching service wearing non-custodial branding, which is fine when nothing goes wrong and disastrous when the operator is compromised.

FixedFloat vs alternatives: a 2026 snapshot

The question "is FixedFloat safe?" only makes sense in comparison with the other options on the table. Below is a side-by-side look at how FixedFloat stacks up against the most common alternatives traders mention in 2026, with a particular focus on Monero-friendly flows.

Two patterns jump out. First, the only options without operator custody at any point are peer-to-peer atomic swap tools, and those come with a liquidity and complexity trade-off. Second, aggregator routing — the model used by MoneroSwapper — reduces single-platform exposure by spreading swaps across multiple providers, which means a compromised hot wallet on any single backend does not automatically affect all routes.

If the only thing standing between your Bitcoin and an attacker is one company's hot-wallet signing key, you are trusting that company exactly as much as you would trust a custodial exchange — regardless of what the marketing page says.

How to evaluate any instant swap before sending funds

The 2024 FixedFloat breach is a useful case study because the warning signs were not unique to FixedFloat — they apply to every instant swap exchange that operates pooled hot wallets. The following checklist is the same one used by professional traders and Monero community moderators when vetting a service for the first time.

1. Read the actual post-mortem. If a platform has been breached, look for a public technical write-up. Vague language ("vulnerabilities in security structures") is a red flag; specific naming of the vulnerability, the patch, and any third-party audit that followed is a green one.
2. Check on-chain reserves where possible. Some platforms publish proof-of-reserves or expose hot-wallet addresses; if a wallet has not been refilled since a breach, that is a meaningful signal.
3. Look up the platform on ZachXBT, SlowMist, and PeckShield feeds. Recurring mentions for delayed withdrawals or stuck transactions are warning lights even if no breach has occurred.
4. Test with a small amount first. A swap of $30 will surface UX problems, refund flows, and customer support response times before you commit anything meaningful.
5. Prefer aggregators or peer-to-peer routes for larger amounts. Splitting a swap across multiple providers via an aggregator like MoneroSwapper, or using a real atomic swap for the high-value leg, reduces single-point-of-failure exposure.
6. Check refund policy in writing. What happens if the output transaction does not arrive within the SLA? Is there a refund address you can specify in advance? Platforms that hide this in support tickets rather than the terms of service usually have weaker procedures.

What FixedFloat changed after the breach

Since February 2024, FixedFloat has publicly stated that it rebuilt its signing infrastructure, rotated all hot-wallet keys, and segmented liquidity across more isolated wallets to limit blast radius in future incidents. The platform also added rate-based monitoring designed to flag anomalous outflows and pause withdrawals automatically. These are sensible measures, and most users who have continued to use FixedFloat throughout 2024–2026 report no recurring issues.

That said, the platform has not published a full third-party audit of its post-incident architecture, has not named the original vulnerability, and has not introduced any meaningful change to the custodial-during-swap model that made the breach so damaging. From a structural standpoint, the 2024 attack surface still exists; what has changed is the operational hardening around it. For traders comfortable with that trade-off, FixedFloat in 2026 is probably no riskier than it was before the breach. For traders looking for stronger guarantees, the structural absence of operator custody — provided by aggregators routing across multiple backends, or by atomic-swap DEXs — is a more durable answer than any single platform's promise to do better next time.

FAQ

Did FixedFloat users lose money in the 2024 hack?

FixedFloat stated publicly that user-side balances were not affected because the platform does not hold long-term balances for individual accounts. The ~$26 million stolen came from the platform's own operating liquidity. However, some users with swaps in flight at the moment of the breach reported delayed refunds, and a few community threads describe transactions that ultimately did require manual support intervention to resolve. The platform did not announce any reimbursement program because, on paper, no specific user funds were missing.

Has FixedFloat been hacked again since February 2024?

As of mid-2026, there have been no publicly confirmed breaches of FixedFloat since the original February 2024 incident. The team has rotated keys, restructured hot-wallet topology, and added monitoring. The absence of new public incidents is encouraging but does not prove that the architecture is secure — it only means that no successful attack has been disclosed.

Is FixedFloat KYC-free for swapping to Monero?

FixedFloat does not require account creation or upfront KYC for standard swaps. However, the platform reserves the right to request identification for transactions its AML system flags as high-risk, which sometimes triggers on large XMR-related volumes or when the deposit address has a tainted on-chain history. Users who want a structurally KYC-free path typically prefer either an aggregator that filters out providers with hard KYC triggers, or a peer-to-peer DEX such as Haveno where no operator can request identification at all.

What is a safer alternative for Bitcoin to Monero swaps?

The two structurally safer categories are aggregator routers and atomic-swap DEXs. Aggregators like MoneroSwapper distribute trades across multiple backend providers, so a breach on any single backend does not affect every route. Atomic-swap DEXs use hash time-locked contracts so that no operator ever holds both sides of the trade. For most users, an aggregator is the more practical choice; for very large amounts or maximum-privacy use cases, an atomic-swap route is worth the extra complexity.

Should I avoid all instant swap exchanges after the FixedFloat incident?

No — instant swap exchanges remain the most convenient way to move between coins, and the alternative of using a custodial KYC exchange usually exposes you to more long-term risk, not less. The lesson from FixedFloat is not "never use instant swaps" but "do not concentrate risk on a single platform, keep swaps short-lived, and verify the operator's incident history before sending funds."

Conclusion

FixedFloat in 2026 is operationally hardened compared with the version that was breached in February 2024, but the structural exposure that made the breach possible — operator-controlled hot wallets bridging every swap — has not been removed. That is the honest, two-line answer to "is FixedFloat safe?" The platform is probably fine for small, time-bounded swaps if you trust the team's post-incident hardening; it is not a structurally safer service than it was before the hack, just a more carefully operated one. For anything beyond a quick conversion, the better path is to spread routing risk across multiple backends or to use an atomic-swap DEX with no operator custody at all. If you want a Monero-focused starting point that does the routing decision for you, compare quotes through MoneroSwapper or read our breakdown of how to buy Monero anonymously before sending your next swap.