DEV Community: Marlon Owens

Top 4 No-KYC Services

Marlon Owens — Thu, 04 Jun 2026 17:04:54 +0000

Every few weeks someone posts a "Top 10 No-KYC Exchanges" listicle that is 90% affiliate links and 10% copy-paste. As a developer, that format drives me up the wall. I don't want a hand-curated top 10 that's stale the day it ships. I want the dataset.

So I went looking for no-KYC directories that expose their data in a way I can actually consume — JSON, RSS, a documented endpoint — instead of a <div> soup I'd have to scrape. Turns out a few of them do, and once you treat them as APIs instead of blog posts, you can build genuinely useful things: a "can I pay this with Monero?" checker, a privacy-score linter for your own vendor list, a bot that warns you when a service you depend on quietly adds KYC.

This post walks through the four sources I use, the real shapes they return, and a small Node build on top of them. No scraping, no Selenium, no nonsense.

The four sources, ranked by how machine-friendly they are

1. LessKYC — a clean static JSON API. This is the one that made me write the post. LessKYC publishes a free static JSON file of every service it scores, with the full breakdown: KYC level, a 0–10 score, currencies, networks, and labelled attributes. Static JSON means no rate limits, no auth, and it's cache-friendly. Two endpoints:

GET https://lesskyc.com/api/services.json    # every service + scores
GET https://lesskyc.com/api/attributes.json  # every attribute + counts

2. XMRList — RSS + sitemap. XMRList is the Monero-specific merchant directory ("who actually accepts XMR?"). No JSON API, but it ships a clean RSS feed and an XML sitemap, both trivially parseable:

GET https://xmrlist.com/rss/feed.xml
GET https://xmrlist.com/sitemap.xml

3. KYCnot.me — a documented v1 endpoint. The veteran open-source directory. It exposes a real query endpoint for single-service lookups, which is perfect for enrichment (you have a slug, you want the full record):

POST https://kycnot.me/api/v1/service/get
body: { "slug": "..." }  |  { "id": ... }  |  { "serviceUrl": "..." }

4. Monerica — RSS + open source. Monerica is the broad "Monero circular economy" directory. RSS feed plus the whole project is on GitHub (monerica-project), so if you want the raw data model you can read the source.

Two of these (LessKYC and KYCnot.me) explicitly ask you to credit them as the data source if you build on the API. That's a fair trade for free structured data — bake the attribution string into your output and move on.

The shape that matters: LessKYC services.json

Here's a real record, untouched:

{
  "slug": "mullvad",
  "name": "Mullvad",
  "url": "https://lesskyc.com/service/mullvad/",
  "types": ["VPN"],
  "kycLevel": 0,
  "score": 9,
  "verification": "verified",
  "currencies": ["Cash", "Bitcoin", "Monero"],
  "networks": ["Clearnet", "Onion"],
  "attributes": [
    { "kind": "good", "label": "No email required" },
    { "kind": "good", "label": "Strict no-log policy" },
    { "kind": "good", "label": "Independently audited" }
  ],
  "homepage": "https://mullvad.net",
  "description": "VPN that issues a random account number instead of an email or username..."
}

kycLevel is the key field, and it's an ordinal 0–4:

0 — identity-free
1 — no KYC mentioned
2 — rare KYC
3 — "shotgun" KYC (can hit you on an automated flag)
4 — mandatory ID

attributes[].kind is either good or bad, which makes it dead simple to compute your own score or render red/green chips without parsing prose.

Build: a "no-KYC, takes Monero" finder in ~25 lines

Node 18+ has fetch built in, so there are zero dependencies here.

// findServices.js — Node 18+
const API = "https://lesskyc.com/api/services.json";

const res = await fetch(API, { headers: { "User-Agent": "nokyc-demo/1.0" } });
const { count, services, attribution } = await res.json();

const takesMoneroNoKyc = services
  .filter((s) => s.kycLevel === 0)
  .filter((s) => s.currencies.includes("Monero"))
  .sort((a, b) => b.score - a.score);

console.log(`Source: ${attribution}`);
console.log(`${takesMoneroNoKyc.length}/${count} services are KYC-level-0 AND accept Monero`);

for (const s of takesMoneroNoKyc.slice(0, 10)) {
  console.log(`${s.score.toFixed(1)}  ${s.name.padEnd(16)} ${s.types.join("/")}`);
}

Run it and you get a live, ranked list — no listicle required:

Source: Data by LessKYC — https://lesskyc.com
...
9.0  Mullvad          VPN
8.4  OVPN             VPN
8.4  Bisq             Exchange/P2P
...

Swap the filter and you've got a different tool. Want every service that's custodial and can freeze funds, so you can avoid them? Filter on attributes:

const risky = services.filter((s) =>
  s.attributes.some((a) => a.kind === "bad" && /custodial|freeze/i.test(a.label))
);

What the data actually says

Listicles never show you the distribution. The dataset does. Pulling the current services.json (108 services the day I ran it):

74 of 108 services are KYC level 0 — fully identity-free. The "no-KYC" label mostly holds up; the long tail at levels 1–2 is small, and almost nothing requires hard ID.
42 of 108 accept Monero — roughly 39%. For a single privacy coin, being payable at four in ten privacy-respecting services is a real signal about XMR's role as the settlement layer here.
The high scorers cluster around the same attributes: No registration, Strict no-log policy, Open source, Independently audited. If you're building a privacy product, that's basically a checklist of what users reward.

A five-line aggregation gives you the KYC-level histogram yourself:

const hist = services.reduce((acc, s) => {
  acc[s.kycLevel] = (acc[s.kycLevel] ?? 0) + 1;
  return acc;
}, {});
console.table(hist); // { '0': 74, '1': 27, '2': 3, ... }

This is the part the affiliate posts can't give you: you can re-run it weekly and diff it. A service dropping from level 0 to level 3 is exactly the kind of change you want a cron job to catch.

Enriching from KYCnot.me

When you want a second opinion on a specific service, hit KYCnot.me by slug. It returns its own kycLevel, verificationStatus, categories, serviceUrls, and crucially tosUrls — it tracks the Terms of Service it reviewed:

curl -X POST https://kycnot.me/api/v1/service/get \
  -H "Content-Type: application/json" \
  -d '{"slug": "mullvad"}'

Cross-referencing two independent directories is the whole game. If LessKYC says level 0 and KYCnot.me agrees, that's a much stronger signal than one site's marketing. If they disagree, that's a flag worth a human look — and a perfect thing to surface in a dashboard.

Where can I spend it? Parse XMRList's RSS

LessKYC and KYCnot.me tell you what's private. XMRList tells you who takes Monero — 300+ businesses across gift cards, hosting, VPNs, electronics, and more, each with a status (Verified / Admitted / Questionable / Scam) and real user reviews. There's no JSON, but RSS is just XML:

// Node: npm i fast-xml-parser
import { XMLParser } from "fast-xml-parser";

const xml = await (await fetch("https://xmrlist.com/rss/feed.xml")).text();
const feed = new XMLParser().parse(xml);
const items = feed.rss.channel.item;

for (const it of items.slice(0, 10)) {
  console.log(it.title, "→", it.link);
}

Point this at Monerica's feed (https://monerica.com/rss/feed.xml) too and you've got a combined "newest Monero-accepting services" stream you can pipe into Slack or a static site.

Bonus: actually accept Monero in your side project

If you're a dev, the more interesting move is being on the other side of these directories — accepting XMR yourself. You don't need a payment processor or a KYC'd merchant account. Run monero-wallet-rpc against your own wallet and poll it. The JSON-RPC is plain HTTP:

curl http://127.0.0.1:18083/json_rpc \
  -d '{"jsonrpc":"2.0","id":"0","method":"get_transfers","params":{"in":true}}' \
  -H 'Content-Type: application/json'

Give each customer a unique subaddress (create_address), watch get_transfers for an incoming payment to it, and fulfil the order when it confirms. That's the entire pattern — no chargebacks, no middleman, and the customer's identity never enters your system because Monero doesn't expose it on-chain. Once you're live, submit yourself to XMRList and you've closed the loop.

Attribution and a reality check

Two honest notes:

Credit your sources. LessKYC and KYCnot.me give away structured data and ask only for attribution. The attribution field is right there in the LessKYC payload — print it.
"No-KYC" is a spectrum, and policies change. A level-0 score today can become "we may verify you if flagged" after a terms update. That's why you query the data on a schedule instead of trusting a snapshot. And none of this is a license to ignore the law where you live — privacy and compliance aren't opposites.

If you build something with these, the directories worth knowing are LessKYC (the JSON API and scoring rubric this post leans on), XMRList (the Monero merchant data), KYCnot.me (open-source, second-opinion lookups), and Monerica (the widest economy view). Treat them as data, not gospel — diff them, cross-check them, and ship something better than another top-10 list.

What would you build on top of a no-KYC dataset? I'm tempted by a GitHub Action that opens an issue when a dependency I rely on changes its KYC level. Tell me if you beat me to it.

Buy Gold With Monero (XMR) in 2026: The Privacy Coin Investor's Guide

Marlon Owens — Sun, 17 May 2026 20:24:10 +0000

Monero is the only major cryptocurrency where privacy is the default rather than an opt-in feature.

That single technical choice, made when the protocol forked from Bytecoin in 2014, is what makes XMR the natural payment rail for the slice of the bullion market that takes privacy seriously. It is also why, in mid-2026, "buy gold with Monero" is a real product flow at a small number of dealers and not at most of them.

This guide walks through what makes XMR different, where the market sits after the 2024 wave of exchange delistings, and what the practical end-to-end process looks like for a buyer who wants to convert XMR into physical metal without leaving an on-chain trail.
Why Monero, specifically, and not Bitcoin
Bitcoin's privacy model is pseudonymous, not anonymous. Every transaction is publicly recorded, every address is permanent, and every address that ever interacted with a KYC'd exchange is, in principle, attributable to a real identity.

Chain analysis firms have spent the last decade making that attribution faster and cheaper. For most buyers, the practical privacy of a Bitcoin payment depends on how many hops separate the spending address from a regulated venue, and how cleanly those hops were executed.

Monero's design eliminates the question.

Three primitives do the work:
Ring signatures mix the real sender of a transaction with a set of decoy outputs from the blockchain, so an observer cannot tell which of the signers actually authorized the spend.
Stealth addresses generate a unique one-time receiving address for every transaction, so even if you publish your wallet's public address openly, no observer can link incoming payments to it on chain.
RingCT (Ring Confidential Transactions) hides the transaction amount.
The combined effect is that a Monero blockchain explorer can confirm a transaction occurred but cannot say who sent it, who received it, or how much moved. That is a categorically different privacy model from Bitcoin's.

The market noticed. XMR hit an all-time high of $798.91 on January 14, 2026, posting a 120% gain over the prior twelve months (ainvest.com).

That rally happened despite the privacy coin facing the heaviest regulatory pressure of any major asset in the space.
The delisting wave and what changed
In 2024, the major Western exchanges began removing Monero from their order books.

Binance delisted all XMR spot pairs in February 2024. Kraken delisted XMR for Belgian and Irish customers in June 2024, then expanded the delisting to the entire European Economic Area on October 31, 2024 (Crypto Briefing).

The trigger was MiCA in the EU and parallel pressure from US regulators, both of which made privacy-coin compliance functionally impossible for venues that needed to operate everywhere. The on-chain effect was smaller than headlines suggested.

Monero's daily transaction count and network activity held roughly steady through 2024–2025, indicating that users migrated to alternative acquisition channels rather than abandoning the coin (Finance Feeds).

Those alternative channels are now the primary way Western retail buyers acquire XMR. They include:

Non-custodial swap services like FixedFloat and ChangeNOW, which accept BTC, ETH, or stablecoins and return XMR to a wallet address without requiring an account.

Atomic swaps for BTC ↔ XMR, which execute peer-to-peer without any intermediary custody.

Decentralized exchanges like Haveno and Bisq, which run as P2P marketplaces between users.
Regional exchanges that still list XMR (varies by jurisdiction).

For a buyer planning to spend XMR rather than hold it long-term, the cleanest workflow is to swap BTC or USDT directly into XMR via a non-custodial swap and then send the XMR to the dealer in a single transaction. The intermediate XMR balance never sits on an exchange and is never linkable to the original funding source.

Why dealer support for XMR is rare and why it matters
Most bullion dealers do not accept Monero.

The reasons are practical, not principled: many payment processors (BitPay, CoinPayments, NowPayments) historically did not support XMR settlement, and dealers using those processors inherited the limitation.

The few dealers that accept XMR have built their own settlement plumbing.
That scarcity matters because the privacy of a transaction is set by the weakest layer.

A buyer who uses XMR to pay a dealer who then ships in a labeled box, asks for ID at checkout, or routes the order through a KYC'd customer relationship management system has wasted the XMR privacy. The full benefit only accrues when the dealer's policies match the payment rail.
Bitgolder's Monero page lists XMR as one of the six native chains accepted with no KYC at any order size, with the only personal data collected being the shipping address.

That combination (XMR payment + no-ID checkout + unmarked shipping) is the configuration most privacy-focused buyers are looking for.
The end-to-end flow

For a buyer in 2026 converting XMR to physical gold, the typical process looks like this:
You select the bullion products you want. For privacy-conscious holdings, the standard recommendations are 1-oz sovereign coins (Britannias, Krugerrands, Maples) and small-to-medium LBMA bars (10 g, 100 g, 250 g), which preserve divisibility and resale liquidity. The dealer's gold bar inventory typically lists products from refineries on the LBMA Good Delivery list.

You proceed to checkout and select Monero as the payment method. The dealer generates a one-time receive address and quotes an XMR price locked for a short window, usually 15 to 30 minutes.
You open your Monero wallet (Monero GUI, Cake Wallet, Feather Wallet, or any other XMR-compatible wallet you control) and send the exact amount to the receive address. The transaction is broadcast to the Monero network. There is no public sender field, no amount field, and no link back to your wallet's address.

The dealer's payment system confirms the transaction once the first block confirmation lands. On Monero, average block time is two minutes, so the wait is short. Your order is allocated against vault inventory.

The bullion ships in plain, unmarked packaging from the dealer's vault. For European orders, this is typically 3–5 business days with insured tracking. The only piece of personal data the dealer has is the shipping address, which is required by the carrier and is not in itself linked to any payment record.

The privacy economics

A few useful numbers to think about. Monero's transaction fees are typically a fraction of a cent on average, far below Bitcoin's mempool-priced fees. The privacy is "free" at the protocol level in the sense that you do not pay extra for it. The cost shows up in liquidity (XMR is harder to acquire in size than BTC, and the swap spread is wider than spot exchange pricing), and in the bullion dealer's pricing (a no-KYC dealer accepting privacy coins generally operates on slightly thicker margins than a fully-KYC competitor, because their customer base is smaller and their banking relationships are more complex).

In practice, for a $5,000–$20,000 order, the all-in friction cost of paying in XMR versus paying in BTC or USDT is usually within a percent. For a buyer whose entire reason to use a no-KYC dealer is privacy, that delta is comfortably worth it. For a buyer who is mostly there for crypto convenience, BTC or USDT is the more efficient rail.

Where Monero ends and OPSEC begins

A Monero-paid bullion purchase delivers cryptographic payment privacy and dealer-side data minimization. It does not deliver physical OPSEC. The metal still has to live somewhere, you still have to insure it (or accept the consequences of not insuring it), and you still have to decide what happens to it when you sell, gift, or die.
The buyers who get the most from this category split their privacy stack. The acquisition layer is XMR plus a no-KYC dealer. The storage layer is non-bank (a home safe, a private non-bank vault, or a small allocation in a deposit box held under conditions you control). The exit layer is either peer-to-peer or another no-KYC dealer offering buyback on the same products you purchased. For Bitgolder customers, that buyback option is offered on all precious metals sold, which closes the loop without sending the metal through a fully-KYC venue at exit (about the company).

Andreas Antonopoulos has written for years that "financial privacy underpins all of our other human rights." Monero is the most direct expression of that principle in the cryptocurrency market today, and the small subset of bullion dealers willing to accept it is the bridge from that principle to physical, sovereign wealth.
For the right kind of buyer, that bridge is exactly what they have been looking for.

How to Buy Gold Anonymously With Bitcoin in 2026: A Privacy-First Investor's Guide

Marlon Owens — Sun, 17 May 2026 11:08:23 +0000

Most articles on this topic tip-toe around the real question buyers are asking. So let's put it plainly: in 2026, you can still legally buy physical gold without surrendering a passport scan, a selfie, and your tax ID. The rules are narrower than they were a decade ago, but they are also clearer, and the few dealers that operate inside those rules have become the default for crypto-native investors who actually use their coins.
This is a working guide to how that path looks now: what the thresholds actually are, which payment rails preserve the most privacy, and where the trade-offs sit between convenience and discretion.
Why "anonymous" gold is a real category, not a workaround
Privacy and legality are not opposites. Cash transactions for bullion are reportable above defined thresholds in most jurisdictions, but transactions below those thresholds are explicitly permitted. In the United States, the cash reporting threshold remains $10,000 per transaction (triggering Form 8300), unchanged despite frequent online rumors that it had been lowered to $3,000 or $600 (CoinWeek, 2026). In Germany the anonymous cash purchase ceiling is €2,000; in Switzerland it sits around CHF 15,000 (BuyingGold.ch).
Crypto changes the picture in two ways. First, crypto is not "cash" under most regulatory definitions, so Form 8300 in the US technically does not apply to a Bitcoin-paid purchase the same way it would to a stack of $100 bills. Second, the dealer's KYC obligations come from their own AML program and licensing, not from a universal rule that follows the buyer. That is why the same coin, sold by two different dealers, can have completely different identity requirements.
As Andreas Antonopoulos has argued: "Financial privacy underpins all of our other human rights." It is not a slogan. If your bank, your tax authority, and your insurer can all see what you own, the meaningful exercise of property rights gets thinner over time.
The four privacy layers in any bullion purchase
When investors say they want "anonymous" gold, they usually mean four separate things, and getting all four matters more than getting any one perfectly.
Layer 1 — Identity at checkout. Does the dealer ask for ID? Some accept an email and a shipping address and nothing more, regardless of order size. Bitgolder, for example, states it does not request identification at any order size on any chain (Bitgolder FAQ).
Layer 2 — Payment trace. Bitcoin is pseudonymous, not anonymous. A KYC'd exchange withdrawal sent straight to a dealer's address creates a permanent on-chain link. Monero (XMR), by protocol design, leaves no public link between sender and receiver. That is the cleanest payment privacy currently available, which is part of why XMR hit an all-time high of $798.91 in January 2026 (ainvest.com) despite being delisted from several major exchanges.
Layer 3 — Shipping data. Even a no-KYC purchase requires an address. A discreet dealer ships in plain, unmarked packaging with no contents declaration on the outside and does not pass the recipient's name to third-party marketing systems. This is operational privacy, not legal privacy, and it matters more than people realize.
Layer 4 — Long-term storage. Whatever you do at purchase is undone if you later sell into a fully-KYC'd dealer, or store in a vault that reports holdings. Buying privately and selling publicly is a common mistake.
Bitcoin, Monero, and the stablecoin middle ground
For most buyers in 2026, the practical choice is between three payment models:
Bitcoin is the path of least resistance. Liquidity is deep, network fees on the base layer are predictable, and most dealers accept it. Its weakness is traceability: anything routed through a regulated exchange wallet is, in principle, attributable. The standard mitigation is to use Bitcoin you mined, purchased peer-to-peer, or held in a self-custody wallet long enough that the exchange link is several hops back.
Monero is the privacy-maximalist option. Ring signatures, stealth addresses, and confidential transactions hide sender, receiver, and amount. The trade-off is liquidity: converting fiat to XMR usually requires a non-custodial swap or a peer-to-peer market, and some jurisdictions restrict centralized trading. For buyers who treat privacy as the entire point, it is the only payment rail that meaningfully matches the privacy of the metal itself.
Stablecoins (USDT, USDC, DAI) sit between the two. They are easier to source than Monero, less volatile than Bitcoin during a price lock window, but issuer-controlled. Tether and Circle can freeze addresses, and have. For larger purchases where price stability matters more than censorship resistance, they are reasonable.
A dealer that accepts all three lets you match the rail to the purchase. Bitgolder's crypto page lists six native chains plus stablecoins on Ethereum, BNB Chain, and Solana, which is broader than most competitors.
What the actual purchase looks like in practice
The mechanics are unglamorous, which is a good sign. A typical no-KYC bullion purchase in 2026 looks like this:
You select your products (1 oz Krugerrands, a 100 g LBMA-good-delivery bar, a tube of Silver Maples) and proceed to checkout. The dealer generates a one-time receive address with a short price-lock window (usually 15–30 minutes). You send the exact amount from a wallet you control. Once the first network confirmation lands, your order is allocated against vault stock and queued for shipping. The whole interaction can be completed in one sitting and does not produce a customer file beyond an order number and a shipping address.
The two questions worth asking any dealer offering this flow are: where is the metal sourced, and what is the buyback policy?
Sourcing matters because gold that does not come from refineries on the LBMA Good Delivery list is harder to resell at full value. A bar from PAMP, Argor-Heraeus, Valcambi, Umicore, or the Royal Canadian Mint carries near-zero authentication friction at resale. A no-name bar does not.
A buyback guarantee matters because exit liquidity is what makes the purchase an investment instead of a hobby. If you cannot easily turn the metal back into cash or crypto, the privacy advantage gets eaten by the bid-ask spread.
Where the limits are honest
Anonymous bullion has real ceilings. Most discreet dealers cap fully no-ID purchases somewhere between $10,000 and $20,000 per order. Above that, even privacy-focused dealers will typically require additional information for insurance and customs reasons on cross-border shipments. Not because they want it, but because the carriers do.
There is also no anonymity at the central bank level. Despite official 2025 central bank gold purchases falling 21% from 2024 to 863 tonnes, the World Gold Council estimates roughly 57% of total central bank gold buying that year was unreported, meaning the largest "anonymous" buyers in the market are sovereigns, not individuals (World Gold Council, 2026). A 95% majority of central banks surveyed expected reserves to keep rising. Whatever the chatter about gold being "old money," the institutions with the largest information advantage in the world are quietly buying more of it.
For a retail buyer, that signal is more useful than any price forecast.
A few rules that make this work
After enough orders, the pattern is consistent. The buyers who actually preserve privacy follow three rules.
They split larger holdings across multiple smaller orders rather than one big one, which keeps every individual transaction comfortably under reporting thresholds and reduces concentrated shipping risk.
They keep the wallet used for bullion purchases separate from their main exchange-funded wallet, ideally with at least one intermediate hop or a privacy coin swap in between.
And they store the metal somewhere that does not generate its own paper trail: a home safe, a non-bank private vault, or a small allocation in a deposit box held under conditions they actually control.
If you are at the stage of converting crypto into something the credit system cannot dilute, the dealer-side mechanics matter less than the discipline of those three habits. Tools like Bitgolder's Monero checkout and the step-by-step buying guide handle the order side. The OPSEC is on you.
That is, ultimately, what private wealth has always required.