Caudena Prism completes the most comprehensive forensic mapping of the XMR swap service to date.
From 2016 until its shutdown in 2021, XMR.to operated as one of the largest and longest-running Monero–Bitcoin swap services available. While publicly advertised as a convenient privacy-preserving bridge, its real significance was far larger. XMR.to became a primary off-ramp for Monero holders worldwide and an essential laundering infrastructure for actors seeking to exit the Monero ecosystem undetected.
Today, Caudena is publishing the first complete forensic profile of XMR.to based on our newly finalized cluster markup—representing one of the largest Monero-related datasets ever processed on an investigations platform.
Scale: 340,000 Addresses and $540M in Processed Volume
Across five years of operation, Caudena’s reconstruction of the XMR.to cluster includes:
This now ranks as one of the largest independently verified Monero off-ramp datasets ever assembled.
Our mapping also benefits from Caudena Prism’s broader Monero intelligence corpus, now exceeding 1 million CEX swaps containing Monero, giving investigators a uniquely contextualized view of Monero usage across exchanges and swap services.
Incoming Liquidity & Exchange Dependency
XMR.to operated as a structured liquidity broker rather than a peer-to-peer swap service. Since Monero cannot directly interact with Bitcoin’s UTXO system, the service had to acquire Bitcoin from centralized exchanges to fulfill customer swap requests. This makes the directionality of liquidity a core architectural requirement of how XMR.to functioned.
Caudena’s findings show that over 93% of XMR.to’s inbound BTC originated from Binance and Poloniex. This highly concentrated liquidity sourcing for swap fulfilment relied on continuous, automated CEX access, an operational model that in turn created a predictable flow pattern for BTC.
Clear Preference: XMR → BTC, Not BTC → XMR
Usage patterns show an overwhelming bias toward converting Monero into Bitcoin, not the other way around.
This matters for investigators because:
- Monero’s privacy design hides source funds.
- Bitcoin provides a liquid off-ramp to CEXs, OTC desks, and other services.
This reinforces XMR.to’s role as a privacy exit ramp rather than basic consumer utility.
Laundering Patterns: Structuring
With the full XMR.to cluster reconstructed, Caudena’s analysis reveals recurring behavioral patterns that appear across many entities using the service. One common typology involves:
- executing hundreds of small, automated swaps (typically ~0.2 BTC),
- relying on XMR.to’s automated processing thresholds,
- and then aggregating the resulting BTC into consolidation addresses or clusters.
This pattern is not limited to a single actor. It appears repeatedly across the dataset, with variations in scale, timing, and exit behavior.
To illustrate the dynamics—not as an outlier, but as a representative case—we show one example cluster where:
- the entity conducted sustained micro-swap activity,
- the aggregated outputs reached approximately $15M USD across three clusters,
- and the consolidated funds have remained dormant since 2020–2021.
This example reflects a broader set of behaviors observed throughout the XMR.to ecosystem. Many entities follow similar fragmentation-and-aggregation strategies, creating consistent indicators for timing correlation, counterpart analysis, and dormant-fund monitoring.
What This Means for Today’s Investigators
With the XMR.to cluster now fully reconstructed and available inside Caudena Prism, investigators gain a level of clarity that simply wasn’t possible before. Patterns that were previously invisible—buried behind Monero’s privacy layer—start to surface once the Bitcoin-side outputs are understood in context.
Investigators can trace waves of XMR→BTC conversions and see how these align with real-world events: darknet market closures, ransomware peaks, large-scale frauds, or coordinated cash-outs. The flow of swaps has a rhythm, and when placed on a timeline, that rhythm often mirrors the operational tempo of the actors behind them.
Amounts tell their own story as well. The repetition of small automated swaps, followed by sudden consolidation, becomes a recognizable signature. These patterns help distinguish routine user activity from illicit flows.
Even though Monero transactions generally remain opaque, the Bitcoin outputs provide reliable investigative footholds. Aggregation points, off-ramp selections, periods of inactivity, and subsequent reactivation all serve as signals—each one helping analysts anticipate where funds may eventually surface, whether on a centralized exchange, an OTC desk, or a lesser-regulated venue.
And finally, every step of this process is backed by verifiable, court-admissible evidence. Prism’s raw UTXO provenance and transparent data lineage allow investigators to build cases that hold up under cross-examination, ensuring that insights are not just informative, but operationally actionable.
In short: the full mapping of XMR.to transforms what used to be a blind spot into a structured investigative landscape—one where patterns can be followed, behaviors interpreted, and dormant risks understood.
Conclusion
XMR.to played a defining role in Monero’s off-ramp ecosystem between 2016 and 2021. For investigators, it represents a rare point where opaque Monero flows re-enter the transparent Bitcoin ecosystem.
With Caudena’s full reconstruction now integrated into Prism, agencies and financial institutions finally have:
- Forensic visibility into the complete operational history of XMR.to,
- The ability to identify Monero laundering patterns at scale,
- The investigative tooling necessary to trace post-swap behavior with confidence.
For many dormant clusters, the story is not yet over. At Caudena, we will continue to illuminate once-dark corners of the blockchain.
If you’d like to talk to us about out our XMR.to data or see how our investigations tools can help your organization or agency, please book a demo with us.