FixedFloat After the Hack: Is It Safe Again, and the Best No-KYC Alternatives

First, the Correction: FixedFloat Is Not Shut Down

If you searched for this post, you probably read somewhere that FixedFloat is gone. It is not. FixedFloat (now at ff.io) was hacked in February 2024, went dark for weeks, and then relaunched with rebuilt infrastructure and a much shorter coin list. When we checked in September 2026 the site was live, quoting rates and accepting orders.

An earlier version of this article said FixedFloat had shut down. That was wrong, and we have rewritten it. The more useful question in 2026 is not "where did FixedFloat go?" but "is it safe to use again?" The short answer: it works for small, clean-source swaps, but it now carries a KYC level 3 rating on kycnot.me and a steady stream of frozen-order reports, which is why many former users still want an alternative. If ChangeNOW was your fallback and it has started asking for ID, we also compared seven no-KYC alternatives to ChangeNOW on holds, Monero support and fixed rates.

What Happened in February 2024

Over 16–18 February 2024 an attacker drained FixedFloat's hot wallets of roughly 409 BTC and 1,728 ETH, about $26.1 million at the time. The team's first public message described "minor technical problems"; a day later it acknowledged the breach. FixedFloat attributed the theft to vulnerabilities in third-party hosting infrastructure it had not fully migrated away from, and denied that it was an inside job.

Two details matter for users. First, FixedFloat is non-custodial in the sense that it never holds account balances, so the stolen coins were the service's own liquidity rather than customer deposits sitting in accounts. Second, about 30 orders that were in flight when the site went down were later completed, according to FixedFloat's own relaunch post. Independent security trackers also report a smaller follow-on theft of roughly $3 million in April 2024, attributed to the same attacker; FixedFloat has not published a breakdown of that second incident, so treat the figure as third-party.

The site then stayed offline for weeks. Third-party reviews put the total downtime at more than two months, during which the team says it moved all servers away from the compromised host, rebuilt the infrastructure and ran security audits. That gap is when most of the "FixedFloat is dead" articles, including our own, were written.

The Relaunch: What Changed

FixedFloat came back on the ff.io domain (the old fixedfloat.com address redirects there). The relaunch post announced 23 currencies and tokens available for exchange, down from well over a hundred before the hack. The list has grown since: the homepage now shows roughly 70 coins and tokens spread across networks such as Ethereum, BNB Smart Chain, Tron, Solana, Arbitrum and Polygon, with Bitcoin, Ethereum, USDT variants and Monero pinned as "popular" pairs. Third-party reviews quote anywhere from 60 to 100+, so take any exact number as a snapshot.

Fees: fixed vs float

• Fixed rate: 1% + network fee. The quote is frozen for 10 minutes; if your deposit arrives inside that window you get exactly the amount shown.
• Float rate: 0.5% + network fee. The rate is finalised when your deposit confirms on chain, so the payout can move up or down with the market.

These are the numbers published on ff.io as of September 2026. They are competitive on paper; the catch is what happens after you send.

KYC and AML: the part that actually changed

FixedFloat still requires no registration and no ID to start a swap. But the terms of use reserve the right to place any order on hold, run KYC and source-of-funds checks, and either return the deposit minus network fees, refuse it, or keep it frozen pending investigation. In practice that screening is automated and fires on the history of the coins you send, not on you.

On 3 March 2025 FixedFloat published an AML terms update declaring that all funds arriving from one specific centralised exchange (eXch, which had refused to cooperate in blocking stolen funds) would be treated as criminal and subject to automatic suspension and freezing. That post formalised what users had been reporting since the relaunch: FixedFloat's compliance is now among the most aggressive of any no-signup swapper. kycnot.me accordingly rates it KYC level 3 ("shotgun KYC", meaning the service can demand identity documents mid-swap), and the independent notkyc.life tracker scores it 55/100 with an open case of a user waiting more than five months for a decision.

Frozen-order reports, 2025–2026

We could not find any new hack published since April 2024. What we did find, on Trustpilot (3.5/5 across roughly 2,200 reviews as of September 2026) and on a BitcoinTalk megathread, is a consistent pattern of one-star reports from 2025 through August 2026: deposits of $5,000, $6,000 and $50,000 held after "compliance review"; requests for ID videos, bank statements and proof of address before any refund; and at least two cases where FixedFloat cited the sender's US or Iranian citizenship as the reason it would neither complete the swap nor return the funds. FixedFloat disputes many of these accounts and usually replies that the deposit was linked to illicit activity. We cannot verify individual cases; the volume and consistency are the point.

Honest Verdict: Should You Use FixedFloat in 2026?

Use it if: you are swapping a modest amount of coins with a clean, direct history (for example, freshly withdrawn from your own hardware wallet), you do not need Monero specifically, and you are comfortable answering compliance questions if the automated screen fires.

Avoid it if: your coins have touched a mixer, a CoinJoin, another instant swapper, a sanctioned address or any exchange FixedFloat has blacklisted; you are moving an amount you cannot afford to have frozen for months; you are in a jurisdiction FixedFloat treats as high-risk; or the whole reason you are swapping is privacy. A privacy swap that ends with you uploading a passport video is not a privacy swap.

The 2024 hack itself is arguably the smaller risk today. The infrastructure was rebuilt, and no repeat has been reported in two and a half years. The bigger, ongoing risk is that FixedFloat's post-hack compliance posture turns a five-minute swap into a multi-month hold. That is exactly the problem the alternatives below are chosen to avoid.

The Best FixedFloat Alternatives in 2026

Every service below lets you swap without an account. Where they differ is on the thing that now matters most: whether they can freeze your order and ask for ID. For the full side-by-side of seven services, including ChangeNOW, see our ChangeNOW alternatives comparison.

1. Superswap.cx — the like-for-like replacement

Same workflow FixedFloat had before the hack: pick a pair, paste a receiving address, send, done. No account, no email, no ID at any amount, and the quote you see is the quote you get. Monero and Zcash are first-class pairs rather than an afterthought, which is where FixedFloat is weakest today. Start with BTC → XMR or browse the Monero hub. We keep a dedicated Superswap.cx vs FixedFloat comparison if you want the fee maths.

2. Trocador — compare providers before you send

Trocador is an aggregator that quotes several no-KYC swappers at once and labels each with a KYC-risk rating, so you can deliberately route around providers known for holds. It also runs a Tor mirror. The trade-off is that your swap is ultimately executed by whichever partner you pick, so read the rating. Superswap.cx vs Trocador →

3. SideShift — fast, no account, some region blocks

SideShift offers fixed and float rates, supports XMR, and does not ask for ID. Its main limitation is geography: it blocks a number of countries at the IP level, so check whether yours is on the list before relying on it. Superswap.cx vs SideShift →

4. StealthEX — the widest coin list

If FixedFloat's shrunken coin list is your problem, StealthEX lists over a thousand assets with no registration. Like most large swappers it uses risk-based screening, so the same "clean coins only" advice applies, but user reports of holds are far rarer than for FixedFloat. Superswap.cx vs StealthEX →

5. Godex — fixed rates, big list

Godex is a straightforward fixed-rate swapper with a large asset list and no account requirement. Rates are sometimes a touch wider than the float-rate competition; in exchange you know your payout in advance. Superswap.cx vs Godex →

6. THORChain native Monero swaps — no intermediary at all

Since THORChain added native XMR, you can swap BTC or ETH to Monero on-chain through liquidity pools, with no company in the middle to freeze anything. It costs more in fees and steps than an instant swapper and you need a compatible wallet, but for larger privacy swaps it removes the counterparty entirely. We walk through it in THORChain 3.20 native Monero swaps.

For a step-by-step reference with a full feature table, see the FixedFloat alternative guide.

How to Swap on Superswap.cx (Step by Step)

It takes about 90 seconds:

1. 1
   Choose your pair

   Select what you're sending (e.g. BTC) and what you want to receive (e.g. XMR) from the swap widget on the homepage.

2. 2
   Enter your receiving address

   Paste your XMR wallet address. No account, no email, no verification.

3. 3
   Send your coins

   You'll receive a deposit address. Send your BTC there.

4. 4
   Receive your swap

   XMR arrives in your wallet in 5–30 minutes. That's it.

Popular Pairs for Former FixedFloat Users

These are the most common swaps people make when moving away from FixedFloat:

Tips for Staying Safe on Any No-KYC Exchange

• Always double-check the URL — phishing clones target users of popular exchanges, and FixedFloat's domain change made this worse
• Send a small test swap before committing real volume, especially to a service you have not used since 2024
• Use a fresh wallet address for each swap, especially for XMR
• Do not feed coins straight from a mixer or another swapper into a service with risk-based screening — that is what triggers holds
• Consider using Tor Browser when accessing swap sites for additional IP privacy
• Bookmark trusted sites before you need them — avoid searching in a panic

Frequently Asked Questions

Related Reading