FixedFloat

FixedFloat is an automated swap service at ff.io, running since 2018. The name is the product: every order is either fixed (the rate is frozen for 10 minutes and you pay 1%) or float (the rate is set when your deposit confirms and you pay 0.5%). Network fees come on top. There is no registration, and orders can be tracked by email, browser cookie or on-chain.

The coin list is short, about 60 assets, but it includes Bitcoin Lightning in both directions. That makes it a common way to move between Lightning and on-chain BTC, ETH, stablecoins or Monero without opening an exchange account.

The terms of service name the operator as FFGX Group LLC, organised under Georgian law at 88 Avtomshenebeli Street, Kutaisi. Georgian law governs disputes. Oddly, residents of Georgia itself are barred, along with India, the US and UN-sanctioned countries.

On 16 February 2024 FixedFloat's hot wallets were drained of about 409 BTC and 1,728 ETH, roughly $26.1 million. Security firm BlockFence first spotted the Bitcoin address; PeckShield tracked the ETH through the eXch mixer and labelled the wallet "FixedFloat drainer". FixedFloat's first public message said it had "encountered some minor technical problems" and switched to maintenance mode. It confirmed the theft only after outside researchers had published it, saying it had delayed disclosure while it shut the service down.

On 1 April 2024 the same attackers took about another $2.8 million. Cyvers and CertiK flagged the transactions; Tether blacklisted seven addresses holding about $280,000 of the stolen USDT. FixedFloat said the thieves had taken service liquidity and that "the company's funds and user funds were not affected".

FixedFloat blamed vulnerabilities in its infrastructure and said the attack was not an inside job, but it never published a technical post-mortem. It said it would brief journalists privately instead. Nobody outside the company has confirmed how the losses were absorbed.

It has kept operating since April 2024 and we found no further losses. The case against large swaps is the record: two hot-wallet drains in seven weeks, and a first statement that played the breach down. In this model your coins sit in exactly that hot wallet for the minutes a swap takes.

For small amounts, the practical risks are ordinary ones. Send the exact amount for fixed orders, use the right network, and don't send from a flagged address.

There is no sign-up or routine ID check. The terms let FixedFloat suspend an order if the funds look linked to crime and ask for "full details of the origin of the funds sent" by email to its compliance address. If you refuse or give false information, the funds can stay frozen until law enforcement is involved.

Refunds for rule breaks, such as the wrong network or an unsupported coin, take 7 to 30 days and cost at least $10 or 10%. Amounts below the minimum or above the maximum are refunded automatically, minus network fees.