xmrwallet.com Scam: How NameSilo Became the Press Secretary for a $2M Monero Theft Operation

xmrwallet.com has been stealing Monero private keys since 2016. Fifteen documented victims. $2M+ estimated stolen. Six security vendors on VirusTotal flag it as malicious — including Fortinet ("Phishing"). Three registrars suspended the operator's domains within days.

The fourth registrar — NameSilo — contacted the scammer, accepted his story, and published a public defense calling him "the victim."

This is the technical breakdown of how the theft works, why NameSilo's response is provably false, and why their "abuse review" is either incompetent or complicit.

Full investigation by PhishDestroy Research — Evidence page · GitHub repo · Medium article

NameSilo's Public Response — Verbatim

"Our Abuse team conducted an in-depth review into this case and it seems that domain was compromised a few months ago (during which a copy of the webpage was replaced with a crypto-drainer). Prior to that, we had received no abuse reports related to this domain. After an extensive investigation, our team found evidence of the compromise not involving the registrant, and they immediately took steps to reverse it. The registrant is also working to get the website delisted from VT reports."

Seven claims. All provably false. Let's go through the technical evidence.

Technical Analysis: The Theft is the Application

NameSilo claims the domain was "compromised" — that someone hacked the site and injected a crypto-drainer. This is technically impossible. The theft mechanism is the core architecture of the application.

Private Key Exfiltration via session_key

Every login POSTs credentials to /auth.php:

POST https://www.xmrwallet.com/auth.php

address = 46EkQdF7iQ4i4Ah935SipgXbDSryh5yv76UnhsPXTaUYegCMJPqDN88...

viewkey = efba13ecb8b360660a3dcaafaf7cf99149713d064b9d64997b2454d58ee67800

The server returns a session_key — not a random token, but the victim's credentials in Base64:

session_key = [blob]:[base64(address)]:[base64(viewkey)]

Decode it yourself:

import base64



encoded = "ZWZiYTEzZWNiOGIzNjA2NjBhM2RjYWFmYWY3Y2Y5OTE0OTcxM2QwNjRiOWQ2NDk5N2IyNDU0ZDU4ZWU2NzgwMA=="

print(base64.b64decode(encoded).decode())

# efba13ecb8b360660a3dcaafaf7cf99149713d064b9d64997b2454d58ee67800

# ^^^ real private view key from live capture

This session_key is re-transmitted on every API call — 40+ times per session:

Full capture data: PhishDestroy evidence page — 109 HTTP requests documented (50 POST, 59 GET).

Transaction Hijacking: raw = 0

raw_tx_and_hash.raw = 0    // client TX discarded — never broadcast



if (type == 'swept') {     // custom theft marker — NOT in Monero protocol

    txid = 'Unknown transaction id'

}

The client builds a valid Monero transaction, then discards it. The server constructs its own transaction and redirects funds to any address. The swept type does not exist in the Monero protocol — it's a custom flag for server-initiated theft.

Hardcoded Backdoor

POST /support_login.html

session_id = 8de50123dab32

Not user-initiated. Hardcoded session ID. Endpoint not present in the public GitHub repository. Documented in cached Issue #35.

Google Trackers in a "Privacy" Wallet

No legitimate Monero wallet loads GTM. Not Monero GUI, not Feather Wallet, not Cake Wallet, not Monerujo. Zero trackers across the industry.

A hacker didn't build 8 PHP endpoints, a Base64 key exfiltration protocol, a transaction hijacking mechanism, a hardcoded backdoor, and integrate Google Tag Manager — as part of a "compromise." This is a product built over years.

The 5.3-Year Commit Gap Destroys the "Hack" Narrative

2018-05-10  First release          ← looks open-source

2018-11-06  "Bulletproof Update"   ← last real commit



            5.3 YEARS — ZERO COMMITS



2024-03-15  "2024 updates"         ← sanitized dump, PHP backend excluded

The production site uses parameters that do not exist in the public GitHub code: session_key, verification, encrypted data, /support_login.html. The Wayback Machine confirms: no session_key in 2023 archives. Present in 2025.

A "compromise a few months ago" does not create a 5.3-year code divergence.

"No Prior Abuse Reports" — A 5-Second VirusTotal Search Proves Otherwise

NameSilo claims zero reports existed before 2026. Here's what was publicly available:

Searching xmrwallet.com on VirusTotal: 5 seconds. Googling "xmrwallet.com scam": first page is all warnings. Checking Trustpilot: one click.

NameSilo's "in-depth review" didn't include any of this. Or it did — and they're lying.

An "Open-Source Client-Side Wallet" on Bulletproof Hosting

Here's what NameSilo's abuse team apparently found normal:

If the code runs client-side, the server processes nothing. GitHub Pages costs $0. Why does a "free volunteer project" pay $550/month for offshore bulletproof hosting behind a Russian anti-DDoS service known for hosting criminal infrastructure?

Because the code on GitHub is not the code on the server. The GitHub repository is an alibi.

We sincerely hope NameSilo's legal department is sharper than their abuse department — because legal will be the ones answering questions about this.

Three Registrars Acted. NameSilo Became the Scammer's Lawyer.

Same evidence. Same technical analysis. Same VirusTotal detections. Four registrars. Three results:

Three companies — India, Malaysia, China — independently concluded: fraud. One company — NameSilo, USA — concluded: the scammer is the victim, let's help him remove the warnings.

The Escape Domain Panic

The operator registered 4 escape domains across 4 registrars — before the investigation was published:

Feb 4   xmrwallet.cc registered  (8yr prepaid)    ← before publication

Feb 9   xmrwallet.biz registered (5yr prepaid)    ← before publication

Feb 13  Issue #35 published — TX hijacking exposed

Feb 18  Issue #36 published — 43 viewkey transmissions captured

Feb 23  .cc SUSPENDED · .biz SUSPENDED · operator DELETES Issues #35+#36

Feb 26  xmrwallet.net registered (10yr, same IP as .biz)

        xmrwallet.me registered  (10yr, same IP as .cc)

Mar 8   xmrwallet.net DNS DEAD

23 years of prepaid registrations burned. 3/4 escape domains neutralized. Same NS (ddos-guard.net), same MX (privateemail.com), same WOT token — one operator, five domains.

Does NameSilo believe "compromised" website owners register escape domains across 4 registrars, prepaid for decades, before the investigation is published?

"The Registrant Is Working to Get Delisted from VT"

The most damning sentence in NameSilo's response.

Fortinet — Fortune 500, $4.4B revenue, 700,000+ protected organizations — classified xmrwallet.com as "Phishing."

The operator's response: not remove the phishing code — but lobby VirusTotal to remove the detection.

And NameSilo presents this as progress.

A legitimate hacked site owner would welcome VT detections — it validates the threat. This operator wants warnings gone while the theft code remains in production. NameSilo is helping a flagged phishing domain suppress security alerts.

The Operator

Nathalie Roy, Canada. GitHub: nathroy (ID: 39167759). Reddit: u/WiseSolution — banned from r/Monero (2018). ProtonMail: [email protected]. Self-identified on xmrwallet.com/support.html.

Full operator profile: PhishDestroy analysis.

Claims "funded by donations" — zero donation wallet exists. Pays $550/mo hosting. 50+ paid SEO articles. DDoS-Guard. Android app. 100+ blog posts in 10 languages. Hired a second developer for a captcha system that was defeated in hours.

NameSilo's Liability

Before their response: negligence. After: complicity.

NameSilo contacted the operator, accepted his story, publicly declared him innocent, revealed they're helping him remove VirusTotal detections, and shifted burden of proof to the reporters.

Under ICANN RAA Section 3.18, registrars must investigate and respond appropriately to abuse. Does "appropriately" include writing a public defense of the accused?

Every dollar stolen after NameSilo's statement was stolen by an operator NameSilo publicly cleared. If you vouch for the thief — you share his bill. Victims should contact NameSilo directly: [email protected] / [email protected].

Documented Victims

Conservative estimate: $1.5M–$15M+ over 8 years. The operator responds to every victim: "You used a phishing clone."

Take Action

Report xmrwallet.com:

• 
  Google Safe Browsing — blocks in Chrome, Firefox, Safari


• 
  Netcraft — used by ISPs globally


• 
  PhishTank — community blocklist


• 
  Phish.Report — auto-reports to 6+ platforms


• 
  APWG — Anti-Phishing Working Group

File ICANN complaint against NameSilo: icann.org/complaints

Law enforcement (operator: Canada):

Canadian Anti-Fraud Centre · RCMP · FBI IC3 · Europol

Use safe wallets:

Monero GUI · Feather Wallet · Cake Wallet · Monerujo

Full Evidence Archive

NameSilo didn't ignore the evidence. They read it, contacted the scammer, believed him, declared him innocent, and are helping him suppress VirusTotal warnings. That's not negligence. That's a partnership.

Three registrars protected users. NameSilo protected the scammer — and put it in writing. Their statement will be Exhibit A in every filing from this point forward.

If you vouch for the thief, you share his bill.

PhishDestroy Research · Telegram · Twitter/X · Bot · API

Based on public evidence, live network captures, OSINT, and NameSilo's own verbatim public statement. No unauthorized access. All findings independently reproducible. Originally published on Medium.