Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2FZyj3…fsVQSummary
FixedFloat (ff.io) is a non-custodial, no-KYC cryptocurrency swap exchange launched in 2018 that suffered two confirmed security breaches in 2024 totaling approximately $28.9 million in stolen assets. Both attacks were attributed to the same threat actor exploiting vulnerabilities in FixedFloat's third-party hosting provider, Time4VPS, and stolen funds were routed through the eXch mixer — a service subsequently shut down by German authorities for laundering proceeds from major crypto thefts. The platform resumed operations after a two-month suspension but has faced ongoing scrutiny for its anonymity-first model, opaque team structure, and inadequate incident disclosure.
Connected Entities
5 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- ZachXBT→mentioned with→Ethereum(70%)
- ZachXBT→mentioned with→Bitcoin(65%)
- Tether→mentioned with→Bitcoin(60%)
- FixedFloat→mentioned with→ZachXBT(60%)
- FixedFloat→mentioned with→Tether(70%)
- FixedFloat→mentioned with→Bitcoin(65%)
- FixedFloat→mentioned with→Ethereum(70%)
Timeline(8 events)
2018
FixedFloat launches as a non-custodial, no-KYC cryptocurrency swap exchange.
16 February 2024
First breach: 409.304 BTC and 1,728.48 ETH (approximately $26.1 million) drained in under 45 minutes across nine transactions. Platform enters maintenance mode.
18 February 2024
FixedFloat publicly confirms the hack, attributing it to 'vulnerabilities and security gaps in its infrastructure.' Stolen Ethereum funds traced to eXch mixer by PeckShield.
31 March 2024
Alleged same attacker gains unauthorized access to all FixedFloat servers still hosted at Time4VPS.
April 2024
Second breach: approximately $2.8 million drained from FixedFloat's Ethereum hot wallet. Attacker locks FixedFloat out of Time4VPS account by changing recovery email.
2 April 2024
Cyvers alerts community to suspicious FixedFloat transactions. CoinDesk and CryptoSlate report the second hack. Tether freezes approximately $400,000 in attacker-linked USDT.
30 April 2024
German authorities (BKA/ZIT) shut down eXch — the primary laundering destination for FixedFloat's stolen Ethereum — seizing approximately $38.5 million in crypto assets.
June 2024
FixedFloat resumes operations after approximately two-month suspension, claims infrastructure migrated away from Time4VPS and security improvements implemented. Attributes both hacks to Time4VPS vulnerabilities in official statement.
Decision Log
- hash: GSbKqpnRbdxz638onLHM3fbJVmNvXTjobLNJz457YMEh
This investigation is cryptographically anchored to the Solana blockchain (1 event). 17 of 18 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-5
generated: 5/4/2026, 2:54:35 AM
last updated: 9/15/2026, 8:46:37 PM
6 viewsavoid.net — verified advice for a post-truth world