FixedFloat Review 2026: Is It Safe After the 2024 Hack?

On 16 February 2024, blockchain investigator ZachXBT flagged a string of suspicious outflows from FixedFloat's hot wallets. Within hours the instant-exchange had drained roughly $26.1 million — about 409 BTC and 1,728 ETH — and the site flipped to a terse "maintenance" banner. The funds were later traced to laundering patterns consistent with North Korea's Lazarus Group, the same crew tied to the Ronin and Atomic Wallet thefts. Two years on, FixedFloat is back, busier than ever, and still asks for no email and no ID. So the question every privacy-minded trader is really asking in 2026 is simple: can you trust it again?

This review answers that without cheerleading. We look at what actually broke, what the team changed, how the fees and swap mechanics compare today, and where a registration-free swapper like MoneroSwapper fits if your priority is moving into Monero (XMR) with the smallest possible footprint. If you only care about the verdict, the TL;DR box above has it — but the nuance below is what keeps your coins safe.

What Actually Happened in the February 2024 Hack

FixedFloat launched in 2018 as a Czech-registered instant exchange built around one promise: swap one coin for another in minutes, no account, no KYC. That model needs hot wallets stocked with liquidity, and hot wallets are exactly what attackers want. In February 2024 someone got into them.

The exchange first blamed "external malicious actors" and "technical issues," language that did little to calm a community watching $26M walk out the door on-chain. Unlike a custodial bank, an instant swapper holds float — coins parked to fulfil orders — so the breach hit operational reserves rather than long-term cold storage. Here is what the public post-mortem and chain analysis established:

• Scale: ~409 BTC and ~1,728 ETH, valued near $26.1M at the time, moved to attacker-controlled addresses over a short window.
• Attribution: Independent analysts and later industry reports linked the laundering trail to Lazarus Group, using cross-chain bridges and mixers to obscure the path.
• User impact: Orders mid-flight during the breach window were disrupted; FixedFloat paused new swaps, entered maintenance, and relaunched weeks later as a rebuilt "v2" platform.
• Disclosure quality: Criticised as thin. The team never published a full forensic breakdown, which remains the single biggest trust gap heading into 2026.

It's worth being precise about one thing: this was a custodial-float breach, not a break in any coin's cryptography. Bitcoin's signatures and Monero's RingCT were never the weak link — server-side key management was. That distinction matters for how you protect yourself, which we'll get to.

How FixedFloat Works in 2026

Post-relaunch, FixedFloat kept its core identity: a fast, accountless exchange aggregating liquidity across hundreds of trading pairs, including BTC, ETH, USDT, the Lightning Network, and yes, Monero. You paste a destination address, send the source coin, and receive the target coin. No dashboard of personal data, because there's no account to begin with.

Fixed rate vs float rate

The name comes from its two pricing modes, and choosing correctly is where most users lose or save money:

• Fixed rate: The quote is locked at order creation. You pay a higher spread (typically around 1%+) for certainty — useful in volatile conditions or for large swaps where slippage stings.
• Float rate: The rate settles when your deposit confirms, at a lower base fee (around 0.5%). Cheaper, but you ride the market between send and confirmation — fine for liquid pairs in calm conditions.

Speed, pairs, and the Lightning angle

FixedFloat was an early adopter of the Bitcoin Lightning Network, letting users swap into and out of LN with near-instant settlement and sub-cent fees. For on-chain pairs, completion usually tracks the source chain's confirmation requirements — minutes for most, longer for Bitcoin under congestion. Monero swaps complete once the deposit reaches the required confirmation depth, after which the XMR is sent to your stealth address automatically.

The no-KYC reality check

"No KYC" does not mean "no risk monitoring." Like most instant swappers, FixedFloat runs automated AML screening on incoming deposits via third-party analytics. If your source coins trip a risk flag — say they touched a sanctioned mixer — an order can be held pending a verification request, which on a no-account platform is an awkward, opaque process. This is structural across the whole instant-swap category, not unique to FixedFloat, but it's the asterisk on every "anonymous" claim.

Fees, Limits, and the Costs People Miss

Instant exchanges rarely advertise a single headline fee, because the real cost is bundled into the spread. FixedFloat is no exception, and understanding the layers helps you compare it honestly against any competitor.

• Service fee: Roughly 0.5% on float-rate orders and around 1% on fixed-rate orders. The fixed-rate premium is the price of locking your quote against volatility.
• Spread: The exchange rate itself carries a margin versus the mid-market price. On thin or exotic pairs this margin widens, sometimes more than the explicit fee. Always compare the actual XMR you'll receive, not the advertised percentage.
• Network fees: The source-chain mining fee and the destination-chain payout fee are separate again. Bitcoin payouts during mempool congestion can quietly eat into small swaps.
• No hard account limits, but float ceilings exist: With no account, there's no per-user cap, yet very large orders can exceed available liquidity for a pair and get split or delayed.

For a small swap into Monero, the dominant cost is usually the spread plus the XMR network fee — and Monero's fees stay low thanks to Bulletproofs+ keeping transaction sizes compact. The practical rule: quote the same swap on two services minutes apart and compare the received amount, because that single number captures every hidden layer at once.

FixedFloat vs No-KYC Alternatives in 2026

No single swapper wins on every axis. The table below compares FixedFloat against the categories of alternatives a privacy-focused trader actually weighs, with MoneroSwapper representing the Monero-specialist lane.

The honest takeaway: FixedFloat's breadth is real, but its 2024 incident is a permanent line item on the risk ledger. If your goal is specifically getting into Monero with minimal exposure, a specialist route like MoneroSwapper narrows the surface area, and a true atomic swap removes custodial risk entirely at the cost of convenience.

How to Swap Safely Through Any Instant Exchange

Whether you use FixedFloat, MoneroSwapper, or another service, the same discipline protects you. Float exchanges hold your coins for minutes — treat that window as the threat model.

1. Send a small test first. Before any large swap, push a minimal amount through and confirm it lands. This catches address-paste errors and AML holds before they're expensive.
2. Use fresh receiving addresses. For Monero, your wallet generates a one-time stealth address per transaction automatically; for transparent chains, never reuse a deposit address across swaps.
3. Verify the domain and avoid mid-swap delays. Confirm the URL via the official source, and don't let coins sit on the platform after a swap completes — withdraw and self-custody immediately.
4. Check the rate mode. Pick fixed rate for large or volatile swaps; float only when you're comfortable with the settlement-window risk.
5. Mind your source coins. If you're swapping out of a transparent chain, assume the deposit is screened. Coins with a clean, simple history sail through; freshly-mixed funds may trigger review.

If an instant exchange holds your funds longer than its quoted window without a clear reason, stop sending more and document the order ID — opacity during delays is the single most common red flag in this category.

A Practical Example: Moving $2,000 Into Monero

Say you hold $2,000 in USDT and want it in Monero, held in your own non-custodial wallet, with the least metadata exposure. Here's how the choices play out in practice.

Through FixedFloat, you'd select USDT→XMR, choose fixed rate to lock the quote, paste your wallet's address, and send. The float is held for the confirmation window; once settled, RingCT and stealth addresses shield the on-chain destination so the XMR landing in your wallet isn't trivially linkable. Total time: minutes. Residual risk: the platform briefly custodies your USDT, and the deposit is AML-screened.

Through MoneroSwapper, the route is purpose-built for exactly this XMR endpoint, which keeps the flow simple and the exposure narrow. Either way, the privacy payoff lands the same: once XMR sits in your wallet, Bulletproofs+ range proofs and CLSAG ring signatures make the coins fungible — one Monero is indistinguishable from another, with no public balance or transaction graph. For a UK trader, remember HMRC still treats the eventual disposal as a taxable event; privacy on-chain is not the same as exemption from reporting, and the FCA continues to tighten rules around crypto promotions into 2026.

FAQ

Is FixedFloat safe to use in 2026?

It's operational and widely used, but the February 2024 breach — roughly $26M, linked to Lazarus Group — is unresolved in terms of public forensic disclosure. The cryptography of the coins it trades was never compromised; the failure was server-side key management of custodial float. Treat it as usable for small, fast swaps you withdraw immediately, not as a place to park funds.

Did FixedFloat refund users after the hack?

The stolen funds were operational reserves rather than user balances sitting in accounts, since FixedFloat has no accounts. Orders caught mid-swap during the breach window were disrupted; the team paused operations and relaunched a rebuilt platform rather than issuing a broad public compensation program. The lack of a detailed post-mortem remains the main criticism.

Does FixedFloat require KYC for Monero swaps?

No account or upfront ID is required, including for Monero pairs. However, incoming deposits are subject to automated AML screening, so a swap can be held pending verification if the source coins trip a risk flag. This is standard across the instant-swap category, not unique to FixedFloat.

What's the difference between fixed rate and float rate?

Fixed rate locks your quote at order creation for a higher spread, protecting you from price movement during the swap. Float rate settles at deposit confirmation for a lower fee but exposes you to market moves in the meantime. Use fixed for large or volatile swaps, float for small swaps in calm conditions.

What are the best alternatives to FixedFloat for buying Monero?

For a Monero-specific endpoint, a specialist swapper like MoneroSwapper narrows the route and keeps the flow accountless. For maximum trust-minimisation, atomic-swap tools such as Haveno remove custodial float entirely, at the cost of speed and liquidity. General-purpose aggregators offer breadth but carry the same custodial-float exposure that FixedFloat does.

Conclusion

FixedFloat in 2026 is a capable, fast, genuinely accountless exchange with a serious asterisk: a 2024 breach it never fully explained. For quick swaps you immediately self-custody, it still does the job — just respect the custodial-float window, send a test first, and never treat it as storage. The cryptography was never the weak point, your operational habits are.

If your destination is Monero specifically, narrowing the route reduces the surface you're trusting. MoneroSwapper is built for exactly that — accountless XMR swaps with the metadata footprint kept small from the start. Ready to move into private money the right way? Buy Monero anonymously and keep your coins in your own wallet, where Monero's fungibility actually means something.