FixedFloat hosts no accounts and asks no name — until its AML system decides yours is the swap to freeze.

How it works

FixedFloat (registered as ff.io since the 2024 rebrand) operates a fully automated swap desk: a user pastes a destination wallet, the site quotes a fixed or floating rate, and a deposit address is generated for that single order. Funds arrive, the engine routes them through internal liquidity, the converted output is broadcast to the destination, and the order closes. There is no account, no balance, and no way to reuse a deposit address. Pricing is 0.5% on floating orders that follow market rate and 1% on fixed orders that lock the receive amount for a roughly ten-minute window. The minimum order is around one dollar; supported routes include BTC, BTC-Lightning, ETH, XMR, SOL, LTC and several stablecoin pairs. Lightning support, available since 2018, was the original differentiator and still settles in seconds.

KYC & privacy

There is no signup, no email by default, and no document upload at the swap form. Identity enters the loop only when the AML engine fires. Per the terms of service, FixedFloat reserves the right to suspend any order whose deposit funds appear linked to sanctioned addresses, mixers, or contracts the operator has tagged as criminal — most recently extended on 3 March 2025 to include all funds traceable to the eXch exchanger. A suspended order requires a source-of-funds dossier and, by repeated user reports, a hand-held video showing an ID and the day's date. IP addresses are collected. There is no published .onion mirror, and Tor exits have been intermittently blocked. Source code is closed and no third-party security audit has been published.

Strengths and limits

The strongest case for FixedFloat is operational: seven years of continuous service, a working Lightning route into and out of Monero, and quotes that hold long enough to actually settle. The strongest case against it is the same back end. On 16 February 2024 attackers drained roughly $26 million in BTC and ETH; on 31 March 2024 a follow-on breach via the same Time4VPS hosting vector took another $2.8 million. The operator covered the losses, migrated infrastructure to proprietary servers, and published a post-mortem — but the second breach landed weeks after the first was supposedly contained. The AML overlay is the second drag: legitimate users have lost weeks waiting on dossier review for swaps the platform later released, and there is no public appeals process.

Verdict

FixedFloat is the right tool for a small, time-sensitive Lightning-to-Monero hop where the inputs are clean and the user can absorb a freeze. It is the wrong tool for a life-savings exit or for anyone routing funds with even an arm's-length connection to a flagged source.