0trace is a private, no-KYC crypto exchange that promises a signed document before you pay and another one after payout. Both promises hold. A completed USDC→USDT swap on Ethereum paid out about ten minutes after the order was created. Its PGP-signed Receipt verified against 0trace’s published key, and so did the Guarantee that 0trace issues before payment. Altered copies of both failed.
What Does 0trace Ask For Before You Pay?
0trace asks for one thing: the address that will receive the payout. The homepage puts the swap form above the fold, with a pair and the Receive amount already filled in. The site lists 30+ assets across 12 networks, from Bitcoin and Monero to USDT and Zcash.
| Step | What you see |
|---|---|
| 1. Homepage | The swap form with the pair and the Receive amount filled in |
| 2. Payout address | One field for your receiving address, the only input on the form |
| 3. After Exchange | An order page with the status “Awaiting deposit”, a countdown timer and the order ID |
| 4. Order page | A one-time deposit address with a QR code, a note on the required network confirmations and a Download guarantee button |
| 5. Order details | Rate, service fee, network fee, networks, recipient address and creation time in UTC |
No email, account, ID or terms checkbox appears. The fee is shown in the quote. The terms add that 0trace never asks for AML documents or source-of-funds paperwork. Current confirmation requirements for each network are listed at 0trace.io/confirmations.
How Fast Was the Swap?
The payout arrived about ten minutes after the order was created. From the deposit landing on Ethereum to the USDT arriving at the payout address, 0trace took under ten minutes. The timeline comes from the Receipt’s creation time and the block timestamps of the deposit and payout transactions.
How long a swap takes depends mostly on the chosen blockchain: how many confirmations the network needs and how busy it is.
Do the Guarantee and the Receipt Verify?
Yes. Both documents passed gpg against 0trace’s published key, both failed once altered, and the Guarantee also passed the in-browser verifier at 0trace.io/verify.
What Do the Two Documents Contain?
Both are clear-signed text files: you can read them as plain text and verify them like any OpenPGP signature.
- The Guarantee is issued before you pay and fixes the order’s terms: document type, order ID, assets, quoted deposit and payout amounts, rate, network fee, deposit address, payout address, creation time and expiry.
- The Receipt is issued after payout and records how the order was executed: settled deposit, final payout, rate, network fee, both addresses, the deposit and payout transaction hashes and creation time. Keep it: once 0trace deletes the order data, the Receipt is your signed record of the swap.
What Did gpg Say?
gpg reported “Good signature” for both documents, from “0trace (Public signing key for 0trace.io)”, with the primary key fingerprint C8A0 3EAF 6531 C975 561F 9FDA 1B80 0B98 D27C 5611. That is the value published at 0trace.io/pgp. gpg also warns that the key is not certified with a trusted signature. The warning appears for any key you have not signed yourself, so the fingerprint comparison is what counts.
To check your own Guarantee or Receipt:
curl https://0trace.io/0trace-pgp.asc | gpg –import
gpg –fingerprint [email protected]
gpg –verify receipt.asc
What Happens When a Document Is Altered?
It fails. Change a single digit in an amount, such as the Guarantee’s quoted payout or the Receipt’s final payout, and gpg returns BAD signature. The 0trace.io/verify page rejected the altered Guarantee too, saying the document was not issued by 0trace or had been modified.
Does the In-Browser Verifier Send Anything?
No: 0trace.io/verify made no network requests while it checked the Guarantee, which fits the site’s statement that verification runs locally. For the unaltered file the page reported a valid signature issued by 0trace, labelled the document as a Guarantee and showed the full key fingerprint. The page also points to GnuPG, Kleopatra or any other OpenPGP tool, so you are not tied to 0trace’s own page.
Does 0trace Load Third-Party Scripts or Set Cookies?
Not in our test: all 47 requests on a homepage load went to 0trace.io, and the browser held no cookies afterwards. The server header showed nginx and we found no Cloudflare headers. That matches the site’s statement that it uses no analytics or third-party scripts.
What Does Gridinsoft Say About 0trace.io?
Gridinsoft’s automated checker labels 0trace.io “Cryptocurrency Scam” and gives it a trust score of 1/100. As of the report’s last scan on October 20, 2026, the label rests on automated checks. The report cites the domain’s registration date (March 12, 2026), low traffic and two detections by security providers. It also notes that “Automated systems are not perfect.”
We could not verify the two detections or how the score is weighted, and domain age is only one of the inputs. We read the score as a signal that calls for checking, and the swap and signature checks above are that check. If the flag matters for your decision, open the report and cross-check the domain on VirusTotal.
How Do You Avoid Fake 0trace Websites?
The only official address is 0trace.io, and its About page says 0trace is not affiliated with 0-trace.cc or any similarly named service. The page adds that 0trace operates only at that domain and its Tor mirror. Before you send anything:
- Read the address bar and confirm it says 0trace.io before you paste an address or deposit.
- Check that the line gpg labels “Primary key fingerprint” reads C8A0 3EAF 6531 C975 561F 9FDA 1B80 0B98 D27C 5611, the value published on 0trace.io/pgp and 0trace.io/verify.
- Treat a document whose primary key fingerprint differs as not issued by 0trace.
- Verify the Guarantee before you send funds.
A look-alike site can copy the design, but without the private key it cannot produce a signature that verifies against that fingerprint.
What Are the Downsides of Using 0trace?
0trace has four documented downsides: it briefly holds your deposit, the rate floats, the project is young and no team is named. The Gridinsoft flag above is a fifth.
- Custody: Funds sit with 0trace between your deposit and the payout, so a Guarantee is only as good as the operator behind it.
- A floating rate: The quote is not a lock: per 0trace’s terms, the final amount follows the rate in force once the deposit reaches the required confirmations. A signed Guarantee documents a quote and terms, and the final payout can differ from it. The Receipt records what was actually paid.
- A young project: 0trace launched in March 2026, so there is little history to read.
- No public team: The site and blog sign as “the 0trace team” and the About page names no one, so accountability rests on the domain, the key and the signed documents.
What Else Can You Check Yourself?
Two more of 0trace’s claims are easy to test on your own order:
- Data deletion: 0trace says order data is deleted 72 hours after an order closes and chat after 24 hours of inactivity. Save your order link and open it after that window, or remove the order sooner with the Delete order button on the order page.
- Tor mirror: Per its terms, the onion address published on 0trace.io/about serves the same application as the clearnet site. Open it in Tor Browser and go as far as the deposit address.
Is 0trace Legit? Our Verdict
On our checks, yes: the completed swap paid out in about ten minutes, and the signed proof verifies before and after payout.
Verdict box Confirmed: a completed order paid out about ten minutes after creation. The Guarantee and the Receipt both verify against the published key, and altered copies fail. Unresolved: the Gridinsoft score and the detections behind it. Our read: a working swap with signed proof at both ends, from a seven-month-old service with no named team. Verify your Guarantee before you pay and your Receipt after payout.
FAQ
Is 0trace Legit?
On our checks, yes: a completed order paid out about ten minutes after creation, and both its Receipt and a Guarantee verified against 0trace’s published key. Anyone holding a Guarantee or Receipt can paste it into 0trace.io/verify or check it in gpg against the same fingerprint, without trusting this review.
Is 0trace Safe?
Nothing in the completed order contradicted the signed proof, but a sent transfer cannot be recalled, so verify the Guarantee before you send. Privacy has a boundary: 0trace controls what it stores about an order, and the deposit and payout transactions stay visible on their own chains.
Is 0trace Custodial?
Yes, 0trace briefly holds the deposit while it executes the swap and pays out, as its trust page says. Payouts come from its own liquidity reserves, and it says no identity profile is built around your funds.
Does 0trace Keep Logs?
0trace says it keeps no logs that tie a swap to a person, but it does store order data for 72 hours after an order reaches a final state. Its terms list what that order data contains and which server logs are not kept. Chat messages are encrypted at rest with AES-256-GCM and removed after 24 hours of inactivity. You can delete either earlier. “No logs” would overstate that.
Check a signed order yourself at 0trace.io/verify.