Match Systems identifies six liquidity models behind EigenWallet’s BTC-to-XMR swaps

Cybersecurity firm Match Systems has identified at least six ways that independent liquidity providers replenish the Monero used in Bitcoin-to-Monero atomic swaps on EigenWallet, formerly known as UnstoppableSwap.

This was shared following an investigation that was published by the blockchain investigations firm.

The study found that providers use combinations of the Lightning Network, cross-chain protocols, privacy wallets, decentralized exchanges, and centralized exchanges to turn incoming Bitcoin back into the Monero needed for subsequent swaps.

How does EigenWallet’s Bitcoin-to-Monero system work?

EigenWallet describes itself as a peer-to-peer, non-custodial wallet and decentralized exchange for Bitcoin and Monero.

EigenWallet is not like the conventional exchange, as it does not act as the counterparty for every transaction. So, users select offers from independent market makers, who provide the Monero in exchange for Bitcoin.

The platform’s documentation identifies the Bitcoin (BTC) holder as the “taker” and the Monero (XMR) provider as the “maker.”

Exchange takes place through an atomic-swap protocol that is designed to prevent either side from taking the other’s funds without completing its own part of the transaction.

BTC is first locked in a two-of-two multisignature address, after which the maker locks the XMR. Once the maker redeems the BTC, the taker can use a revealed key to redeem the XMR.

Bitcoin-to-Monero atomic swaps have been available on mainnet since 2021. Monero’s project site described the technology at the time as a way to exchange the two cryptocurrencies without relying on a trusted third-party exchange.

However, Match Systems findings say that the structure creates a tracing problem. It pointed out that a BTC deposit address can show where the swap began, but not necessarily where the XMR supplied by the maker came from.

“The deposit address of an atomic swap tells you almost nothing on its own,” Ice Dorzhinov, a co-founder of Match Systems, said in the company’s report.

What are the six liquidity models identified by Match Systems?

• The first of at least six recurring methods that Match Systems identified for replenishing XMR reserves is the one where providers divide incoming BTC into smaller batches. They then route it through the Lightning Network. 

The firm’s analysis found flows passing predominantly through nodes associated with OKX and Kraken. Match Systems said the exchanges are presumably used to convert BTC and replenish XMR reserves. In one dataset, it said this model accounted for most of the EigenWallet activity it examined.

• A second method largely avoids centralized exchanges. Here, BTC is moved through MayaChain and LiFi into the Hyperliquid ecosystem, where a specialized service is used to acquire XMR.

Match Systems said that spreading the funds across multiple protocols, blockchains, and addresses makes the activity more difficult to attribute.

• For the third method, the Wasabi Wallet was used to break the direct connection between incoming and outgoing transactions. According to Match Systems, its analysis indicated, with a high degree of probability, that funds leaving the wallet reached Hyperliquid in portions of roughly 0.1 to 0.25 BTC.

The BTC was exchanged for USDT on Arbitrum, after which batches of about 10,000 to 15,000 USDT were sent to KuCoin, where the firm believes XMR was acquired.

• For the fourth route, BTC is divided into amounts that are equivalent to about $2,000 to $3,000, and it is then exchanged for Litecoin through THORChain. The funds then move through chains of more than 20 Litecoin transactions before reaching an instant exchange service used to purchase XMR.

Match Systems said providers also use Child Pays for Parent, or CPFP, to speed up confirmation, along with separate sessions, proxy IP addresses, and single-use Monero addresses.

• Funds are split between Remitano and NEAR intents in the fifth method that Match Systems highlighted. The BTC here is then converted into assets on BNB Smart Chain, including BTCB, ETH, and USDT. Those assets are then consolidated at a MEXC deposit address.
• The sixth model is simpler, using THORChain before sending the resulting assets to KuCoin, where Match Systems believes the XMR is purchased.

The company said all six models can handle individual swaps of one BTC or more, while smaller providers also operate in the network.

Match Systems did not allege wrongdoing by any of the exchanges, protocols, or services named in its research. 

The routes that were spotlighted in its findings show user-level activity that was observed on public blockchains. They do not establish that the platforms themselves participated in the transactions.

Why does the Monero replenishment point matter?

Match Systems said that the distributed nature of the liquidity network makes intervention difficult. Providers can change routes, move between blockchains, or spread their activity across several services, while single-use addresses, Tor access, proxy servers, and smaller transactions can reduce the time available for investigators to respond.

The firm’s focus is on the point where a provider acquires the Monero needed for another swap. These points can include centralized exchanges, instant-exchange services, and cross-chain protocols.

That approach is consistent with the challenges faced in tracing funds across multiple blockchains. Chainalysis has said North Korea-linked operators have used rapid asset swaps, cross-chain bridges, mixing services, and staged cashouts to move stolen cryptocurrency.

A recent academic survey of cross-chain transaction tracing also found that transfers spanning multiple ledgers can be substantially harder to analyze because evidence is distributed across different blockchains and off-chain systems.

For Match Systems, the implication is that investigators need to identify the liquidity provider behind a swap, map its operational addresses, and determine how it sources the Monero used in subsequent transactions.

Dorzhinov said, “That means moving from the analysis of individual transactions to the study of the liquidity economy behind them.”

As atomic swaps become more established, the company expects systems of this kind to appear more frequently in investigations involving sophisticated cybercrime groups.