What “Privacy by Default” Actually Costs: Notes from Running a No-KYC Crypto Aggregator

Five honest observations from two years of operating privacy-preserving swap infrastructure for Monero (XMR) and 1700+ other cryptocurrencies.

The crypto privacy crowd loves slogans. “Privacy by default.” “Censorship resistant.” “Your keys, your coins.” They look good on T-shirts and pitch decks, and they’re not technically wrong — but they obscure something important.

Privacy infrastructure has costs that users almost never see. Not just dollar costs. Architectural costs. Operational costs. Costs in opportunities you have to refuse. After two years of running a no-KYC swap aggregator, the gap between what privacy means in marketing and what it requires in practice is striking enough to be worth writing down.

Here are five things we learned the hard way.

1. You don’t get to choose your worst customer

When a service requires KYC, the platform decides who it serves. When it doesn’t, the platform serves whoever shows up. In practice, that means privacy-respecting infrastructure has to handle the full distribution of human use cases — including the ones that would make any reasonable founder uncomfortable.

The honest answer isn’t “we only serve good actors.” That’s a fairy tale. The honest answer is: we built the rails neutrally, we cooperate with valid legal requests, and we don’t pretend to know what’s in every transaction. The same neutrality that protects a journalist in Tehran also serves bad actors elsewhere.

This isn’t a bug. It’s the price of designing systems that don’t surveil. If you want to build privacy infrastructure, you have to be at peace with being a road, not a doorman.

2. The “no KYC” label hides a recursion problem

When users see “no KYC required,” they assume something like “no identity verification anywhere in the funnel.” It almost never works that way for centralized services.

We’re a swap aggregator. We don’t collect KYC. But we route transactions through upstream liquidity providers — and they may apply KYC at the destination, based on the amount, the wallet history, the jurisdiction, or some opaque combination. “No KYC at the aggregator level” is technically true. “No KYC at any layer of the stack you’ll interact with” is rarely true and often impossible to guarantee.

This is why honest aggregators surface the KYC behavior of the routed provider before the user commits. It’s also why anyone using crypto for real threat-model reasons (not just convenience) eventually moves to peer-to-peer markets, atomic swaps, or non-custodial routing — paths where no centralized party has discretion to flip the switch.

If you want the same privacy guarantees no matter who’s routing your transaction, you need atomic swaps or a privacy chain that doesn’t expose intermediate state. Centralized aggregators — including us — are the convenient layer above that.

3. Hosting providers are an underrated single point of failure

Every privacy-preserving service runs on commodity infrastructure. The Tor onion, the clearnet domain, the database — they all sit on a physical machine somewhere with terms of service. Those terms of service are written by lawyers in jurisdictions that don’t share the cypherpunk worldview.

This is fine when you’re small and quiet. It becomes a problem when an automated abuse-detection system or a single email from a competitor’s compliance team triggers a domain hold, a server suspension, or a payment processor cutoff.

The defensive posture is mundane: redundant DNS, mirror domains, separate hosting providers across jurisdictions, version-controlled infrastructure-as-code, fast cutovers. Boring. But the alternative is a Tuesday morning where you wake up to a service that suddenly doesn’t exist.

If you’re a user, the lesson is uncomfortable: the centralized service you trust today may not be the same domain tomorrow. Bookmark the GitHub. Save the Tor onion. Recognize that brand continuity in this space is more aspirational than guaranteed.

4. Multilingual content is necessary; multilingual support is impossible

We publish in twenty languages. We respond to support tickets in English and Portuguese. That gap isn’t laziness — it’s economics.

Real-time customer support in twenty languages means twenty time-zone-aware operators with crypto-specific expertise and the discretion to handle high-stakes blockchain mistakes. That’s a 50+ person team minimum. For a no-KYC aggregator with zero VC funding and modest commission revenue per swap, it’s a fantasy.

The compromise is asynchronous: detailed self-service docs in every language, an email channel that handles English/Portuguese with strong AI-assisted triage in others, and a clear status page so users can self-diagnose before reaching out. This works for ~95% of cases. The other 5% is people with legitimate problems hitting language walls, and we feel that gap every day.

Anyone building privacy-first infrastructure in 2026 will face the same tradeoff. There is no version of this where you serve a global audience in their native language across every channel. You pick which surfaces are localized and accept that some users will be underserved.

5. The hardest part isn’t building it — it’s staying built

This is the meta-cost that nothing prepared us for.

You can ship a swap aggregator in three months. You can localize it in twenty languages in another two. You can wire up Tor, design the schema, write the API. The hard part is the next twenty-four months of:

• Migrating off compromised infrastructure
• Responding to subpoenas you didn’t expect
• Watching upstream providers de-list privacy coins because of pressure you can’t control
• Re-localizing after every major Monero protocol upgrade (RingCT iterations, FCMP++, view tag tooling)
• Keeping AML/sanctions compliance current while staying no-KYC
• Updating Terms of Service every time a jurisdiction redefines “VASP”
• Handling chargebacks and disputes that no provider taught you about
• Sleeping through the night during the weeks when something on the blockchain breaks

Building is a sprint. Operating is a marathon. The infrastructure you ship is a small fraction of the infrastructure you’ll maintain.

Why we still do this

You’d be forgiven for reading the above as a complaint. It isn’t. The reason we kept going is mundane: every week, real people use the service in ways the marketing copy could never describe. A journalist who can’t open a Coinbase account from her home country. A small-business owner in a sanctioned region paying a remote contractor. A privacy activist routing personal donations away from a payments stack that doesn’t tolerate her cause.

These users don’t write Medium posts. They don’t show up in our analytics in any flattering way. They just need the rails to keep working — and they need someone, somewhere, to be neutral enough to provide them.

We won’t pretend that running MoneroSwapper gives us special insight into how all of crypto should work. But after two years inside this specific corner of the ecosystem, the gap between the marketing version of “privacy” and the operational version is something we wanted to write down — partly so other operators don’t have to re-learn it, partly so users can recalibrate what they’re actually buying into.

If you build this kind of thing: get serious about infrastructure portability. If you use this kind of thing: bookmark backups. If you write about this kind of thing: be skeptical of slogans, including ours.

*MoneroSwapper is a no-KYC cryptocurrency swap aggregator with Tor onion service support and 20-language UI. Our open-source API specification and SDKs are available on GitHub.*