Operator Profile: xmrwallet.com
June 4, 2026 · View on GitHub
Classification: Investigative Intelligence Dossier Subject: Operator of xmrwallet.com — an active Monero wallet-draining service Compiled from: PhishDestroy.io investigation, the DO-NOT-USE-xmrwallet-com GitHub repository, direct email correspondence with the operator, public WHOIS/DNS records, archived victim reports, and on-chain transaction analysis. Period of investigation: 2018 – May 2026 Status: ACTIVE THREAT — xmrwallet.com remains operational as of this writing.
1. Identity
| Field | Value |
|---|---|
| Full Name | Nathalie Roy |
| GitHub | nathroy (User ID: 39167759) |
| Email (operational) | admin@xmrwallet.com |
| Email (personal) | royn5094@protonmail.com |
| u/WiseSolution — BANNED from r/Monero (2018, self-promotion of xmrwallet.com) | |
| Twitter/X | @xmrwalletcom |
2. Domain Infrastructure
The operator registered five domains across four different registrars — a deliberate strategy to slow coordinated takedown efforts. All domains share common mail and nameserver infrastructure, confirming single-operator control.
2.1 Domain Portfolio
| Domain | Registrar | Prepaid Period | IP Address | AS | Status |
|---|---|---|---|---|---|
| xmrwallet.com | NameSilo, LLC (IANA #1479) | Paid until 2031 | 186.2.165.49 | AS59692 (IQWeb FZ-LLC) | ACTIVE — NameSilo, LLC (IANA #1479) protecting |
| xmrwallet.cc | PublicDomainRegistry | 8 years | 185.129.100.248 | AS57724 (DDoS-Guard) | SUSPENDED |
| xmrwallet.biz | WebNic | 5 years | 190.115.31.40 | AS59692 (IQWeb FZ-LLC) | SUSPENDED |
| xmrwallet.net | NICENIC | 10 years | 190.115.31.40 | AS59692 (IQWeb FZ-LLC) | DNS DEAD |
| xmrwallet.me | Key-Systems GmbH | 10 years | 185.129.100.248 | AS57724 (DDoS-Guard) | ACTIVE |
Total prepaid registration across portfolio: 23+ years of advance payments, now largely wasted — 3 of 4 escape domains neutralized.
2.2 Tor Hidden Service
xmrtor3fsapuu6y26za7vpzox4vpaj6ny5viq2arbmozm7kg6jitnlid.onion
Status: ACTIVE
2.3 Shared Infrastructure Indicators
| Service | Configuration |
|---|---|
| MX Records | mx1.privateemail.com, mx2.privateemail.com (all domains) |
| Nameservers | ns1.ddos-guard.net, ns2.ddos-guard.net (all domains) |
| Google Analytics | UA-116766241-1 (all clearnet domains) |
| DDoS-Guard Cookies | __ddg8_, __ddg9_, __ddg10_, __ddg1_ |
The use of identical MX, NS, analytics tracking IDs, and DDoS-Guard cookie prefixes across all five domains constitutes definitive proof of unified operator control.
3. Hosting
Bulletproof hosting in Belize, fronted by Russian DDoS-Guard (AS57724). Estimated cost: $550+/month. The operator pays premium rates specifically to resist law enforcement cooperation and abuse takedowns. IQWeb FZ-LLC (AS59692, UAE-registered) provides additional IP space.
This is not economy hosting. This is infrastructure selected and paid for specifically because it will not cooperate with abuse reports.
4. Operator Communications (Verbatim)
Direct email correspondence with the operator reveals a pattern of lies followed by immediate contradiction, then legal threats that never materialize.
February 16, 2026
"We don't store seeds or keys, everything is done locally"
This is a lie. Technical analysis proves the session_key parameter transmits the user's viewkey to the server 40+ times per session. The wallet does not operate "locally" — it exfiltrates private key material on every interaction.
February 17, 2026
"This is the data we need"
Sent within 24 hours of the February 16 denial, directly contradicting the claim that "everything is done locally." The operator admitted the server requires user key data — the exact data he denied collecting one day earlier.
February 17, 2026
"Feel free to subpoena the domain registrar"
This statement was sent before any abuse report was filed. The operator expressed confidence that NameSilo, LLC (IANA #1479) would protect the domain — a confidence that proved justified. NameSilo, LLC (IANA #1479) has refused to act on the primary .com domain to this day.
February 23, 2026
"I've hired a lawyer and a private investigator"
Sent the same day two domains (.cc and .biz) were suspended. No lawyer ever appeared. No legal action was ever filed. No private investigator ever made contact. This was a bluff designed to intimidate researchers into silence.
5. Evidence Destruction
GitHub Issue Deletion — February 23, 2026
On the same day domains .cc and .biz were suspended, the operator deleted GitHub Issues #35 and #36 from the xmrwallet repository. These issues contained:
- Full technical analysis of the viewkey exfiltration mechanism
- Victim reports with transaction IDs
- Community discussion threads with corroborating evidence
The issues were not closed — they were deleted. Closing an issue preserves the discussion. Deletion destroys it. This is not moderation; it is evidence destruction.
All content was archived prior to deletion.
Systematic Suppression Campaign
| Platform | Action Taken |
|---|---|
| GitHub | Deleted Issues #35, #36. Filed false DMCA takedowns against repositories documenting the scam. Targeted researcher accounts. 21+ issues deleted over 8 years. |
| Trustpilot | Mass-reported negative reviews until removed by automated moderation. |
| BitcoinTalk | Coordinated reporting against warning threads to trigger removal. |
| YouTube | Reported technical analysis videos demonstrating the theft mechanism. |
| Twitter/X | Deployed puppet accounts to mass-report researchers. PhishDestroy's account was locked after rebutting NameSilo, LLC (IANA #1479) publicly. |
| Search Engines | Published 50+ paid SEO articles to bury victim complaints and negative coverage in search results. |
The operator has never, in eight years, produced a single technical rebuttal to the theft allegations. The response has been exclusively suppression, deletion, and intimidation.
6. Documented Victims
| Amount Stolen | Source | Victim Statement |
|---|---|---|
| 590 XMR (~$177,000) | Sitejabber | "deposited 590 monero — 2 days gone" |
| 17.44 XMR | Trustpilot | TxID and TX Key documented and verified |
| 20 XMR | Sitejabber | "put 20 xmr — next day 0 xmr" |
| ~$200 | Trustpilot | "stole $200, leaving me high and dry" |
| Unknown | Trustpilot | "transferred to some other wallet instead of mine" |
| Unknown | Trustpilot | "cannot verify transaction using private viewing key" |
Scale Estimate
The service has operated for 8 years (2018–2026). Given traffic analysis, SEO investment, and the number of suppressed victim reports:
- Conservative estimate: 10,000–50,000+ wallets compromised
- Estimated total stolen: 5,000–50,000+ XMR ($1.5M–$15M+ at historical prices)
The operator's standard deflection when victims report missing funds: claim it is a "sync problem." By the time a user sees this message, the funds have already been swept.
7. GitHub Commit Gap
The xmrwallet GitHub repository shows a 5.3-year gap with zero public commits:
- Last commit before gap: 2018-11-06
- First commit after gap: 2024-03-15
During this 5.3-year period, the production website continued to evolve, with theft infrastructure being developed and refined outside of the public repository. The public repo served as a facade of legitimacy while the actual operational code — including the viewkey exfiltration mechanism — was maintained privately.
8. Google Trackers in a "Privacy Wallet"
A wallet marketed as a privacy-preserving Monero tool loads the following tracking scripts on every pageview:
- Google Tag Manager (GTM)
- Google Analytics (UA) — UA-116766241-1
- Google Analytics 4 (GA4)
- DoubleClick Ad Tracker
Every user who visits xmrwallet.com has their browsing session fingerprinted by Google's advertising infrastructure. This directly contradicts all privacy claims and demonstrates the operator's fundamental indifference to user privacy — consistent with a service designed to steal, not protect.
9. Second Developer
In March 2026, a custom CAPTCHA system was deployed on xmrwallet.com featuring proof-of-work computation, a slider challenge, and mouse trajectory tracking. Code analysis revealed characteristics inconsistent with the original developer:
- Properly commented JavaScript with numbered steps
FIX:annotations indicating structured development process- Clean code organization
The original theft code contains zero comments. This CAPTCHA was written by a second developer — someone brought in specifically to harden the site against automated analysis after the PhishDestroy investigation went public.
The CAPTCHA was defeated within hours of deployment, achieving a 100% bypass rate.
10. Cover-Up Pattern Summary
Across 8 years of operation, the following pattern has repeated without variation:
- Victim reports funds missing
- Operator claims "sync problem" (funds already stolen)
- Victim escalates publicly
- Operator deletes the report
- If report persists, operator files false DMCA / mass-reports the platform
- Operator publishes paid SEO content to bury remaining traces
- No technical rebuttal is ever produced
21+ GitHub issues deleted. Zero technical rebuttals. Ever.
11. What the Operator Has Never Produced
Despite 8 years of allegations and multiple detailed technical analyses, the operator has never provided:
- A network capture proving the user's viewkey is NOT sent to the server
- Code proving signed transactions ARE broadcast to the Monero network (the
rawparameter equals0, meaning transactions are sent to the operator's server, not the blockchain) - An explanation for
session_keycontainingbase64(viewkey) - An explanation for backdoor session ID
8de50123dab32 - An explanation for the
swepttransaction type (this type does not exist in the Monero protocol) - Any technical counter-argument whatsoever
Nothing. Ever. In eight years.
12. Indicators of Compromise (IOC)
For security vendors, threat intelligence platforms, and browser/DNS blocklist operators.
Domains (Block)
xmrwallet.com
xmrwallet.cc
xmrwallet.biz
xmrwallet.net
xmrwallet.me
Tor Hidden Service (Block)
xmrtor3fsapuu6y26za7vpzox4vpaj6ny5viq2arbmozm7kg6jitnlid.onion
IP Addresses (Block)
186.2.165.49 (AS59692 IQWeb FZ-LLC)
185.129.100.248 (AS57724 DDoS-Guard)
190.115.31.40 (AS59692 IQWeb FZ-LLC)
Autonomous Systems
AS59692 IQWeb FZ-LLC (UAE — bulletproof hosting)
AS57724 DDoS-Guard Ltd (Russia — DDoS protection / CDN)
Email Addresses
admin@xmrwallet.com
royn5094@protonmail.com
Google Analytics Tracking ID
UA-116766241-1
DDoS-Guard Cookie Identifiers
__ddg8_
__ddg9_
__ddg10_
__ddg1_
Mail Infrastructure
mx1.privateemail.com
mx2.privateemail.com
DNS Infrastructure
ns1.ddos-guard.net
ns2.ddos-guard.net
Backdoor Session Identifier
8de50123dab32
GitHub Account
https://github.com/nathroy (ID: 39167759)
Social Media
Reddit: u/WiseSolution (banned from r/Monero)
Twitter/X: @xmrwalletcom
13. Classification & Recommended Actions
| Entity | Recommended Action |
|---|---|
| Browser vendors (Google Safe Browsing, Microsoft SmartScreen, Firefox/Mozilla) | Add all domains and Tor address to phishing/scam blocklists |
| DNS providers (Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9) | Block resolution for all five domains |
| Cryptocurrency exchanges | Flag and trace any deposits originating from xmrwallet-associated addresses |
| ICANN | Investigate NameSilo's refusal to act on documented phishing/fraud domain |
| NameSilo, LLC (IANA #1479) (registrar) | Suspend xmrwallet.com — the last active clearnet domain |
| DDoS-Guard | Terminate hosting services for documented fraud infrastructure |
| Law enforcement | Subpoena NameSilo, LLC (IANA #1479), Namecheap (PrivateEmail), and DDoS-Guard for subscriber records |
This document is part of the PhishDestroy public evidence archive. For the full technical analysis, see XMRWALLET_TECHNICAL.md. For the complete evidence index with SHA-256 hashes, see EVIDENCE_INDEX.md. For the master proof dossier with all verbatim communications, see PROOFS.md.
All claims in this document are supported by archived evidence. Nothing has been fabricated. Nothing has been exaggerated. The operator has had eight years to produce a technical rebuttal. He has produced nothing.