 Show Posts
|
|
Pages: [1] 2 3 »
|
|
Hello,
Back online for good. We have implemented a lot better DDOS protection.
|
|
|
|
Hello,
Last days we have suffered multiple DDOS and ransom attacks and spent most of the time securing our frontend infrastructure.
As we were working on it Bitcoin node failed to synchronize around a few hundred blocks and that's something we have unfortunately missed.
All transactions along with this one have been successfully sent now.
We will probably launch the TOR version today while we upgrade our clearnet DDOS protection.
We will post updates on when our service is live again in this thread as soon as possible. |
|
|
|
|
Hello,
Last days we have suffered multiple DDOS and ransom attacks and spent most of the time securing our frontend infrastructure.
As we were working on it Bitcoin node failed to synchronize around a few hundred blocks and that's something we have unfortunately missed.
All transactions along with this one have been successfully sent now.
We will probably launch the TOR version today while we upgrade our clearnet DDOS protection.
|
|
|
|
Now it's been moved above the calculator so they're clearly tweaking it as they're reading this thread. Sketchy AF.
You wrote this an hour after my post above, in which I explained how the text was moved according to LoyceV suggestion. You even quoted the post...? The note was added a while back because of a few incidents involving people failing to comply with the minimum deposit and BTC price spiking really high. It was not there a year ago when the article was published. They should refund you, pay the TX fees out of pocket, and apologize profusely.
At this point it is getting quite frustrating how people whose posts are paid for by the competition keep telling me how to run the service. Throwing dirt left and right without a single valid proof nor even reason. The visuals of MCM have been updated to reflect the constructive feedback received. If your input can be brought down to "sketchy AF... Edit: Oh, I did not notice... Still sketchy [proof based on a year old article]", please refrain from posting. To be clear, the same goes for anyone defending MCM. Seems this text was added after our short discussion. A refund would be fair in this case, this MCM address is already exposed anyway.
You are right. I got too involved with LoyceV post and did not read the dates carefully. I was not expecting such post so long after the incident. I was considering adding such note after the price of BTC nearly quadrupled in a single month - making 0.003 BTC worth significantly more. There are other reasons past address exposure for not issuing the refund - it takes my effort to fix your mistake; any interaction with the wallet puts not only 0.003 BTC but all XX BTC at risk - but in this one instance I am willing to award you a *bug bounty* as you ultimately helped the site to get better. Please send me an email with an address you want the 0.0032 BTC to be transferred to. @LoyceV, @suchmoon Please do a little more research before posting your conclusions. The fact you accuse MCM of deliberately stealing $90 (at the time, only because BTC price just spiked) is a bit embarrassing... |
|
|
|
A minimum deposit has not been reached, the transaction has not been processed. Those are the rules of mixing which have not been followed and haven't changed since the inception of our service. I have acknowledged the incident and made effort towards making sure this does not happen often. As LoyceV noticed, there is a note in Incoming Transactions table. I agree it may not be in the best spot, I am not a designer. For what I know though, putting it next to other already ignored information, the minimum deposit, is unlikely be a better choice. The current spot was selected as it is very close to the place where user finds out their transaction is too low. The goal is to prevent them from sending more money. In response to the comments, I decided to duplicate the note next to the address field and color the old one red when small transaction arrives. I hope this gets the attention. The calculator have also been updated to note minimum deposit, because the red outline (visible on LoyceV screen) apparently was not enough - to the point of accusing MCM of deliberately designing it to scam people. Interesting how that didn't stop them from using the amounts to send to another address. Yes, it is inconvenient to process such order, but this does not mean we should throw the money away. There are multiple issues with processing small transactions - the one I care about the most is exposing MCM addresses, a huge security risk.
If there were no limit, it would be trivial to expose multiple MCM addresses with many small transactions. Worst case, the attacker could scan entire MCM wallet. This is why we do not accept small deposits and if we receive one, such transactions are only combined with other almost depleted addresses whenever possible. MCM has a lot of internal addresses with less than 0.003 BTC. Those are mostly created by people mixing close to the minimum amount. Consider two mixes of 0.005 BTC and 0.003 BTC - we are left with 0.002 BTC lying on the change address. A much better solution would be to charge a minimum amount (say 0.00025 BTC) for each incoming deposit to cover consolidation fees, and just get rid of the 0.003 BTC minimum entirely. Continuing on the point above, we want to avoid small transactions as much as possible. Taxing the customers because a small group fails to follow the rules is not something I consider. |
|
|
|
I've been advertising MyCryptoMixer for a long time, but I never tried their services until this week. I'll be honest with my review, because I think it'd be better if we had more mixers than just one monopolizing the forum. The more mixers means the more privacy. Once I firstly visited mycryptomixer.com, I saw a well-made and neat website. Especially, when you prepare your deposit, the owners have made a really good job. I find it cool that "Funds distribution", it clearly proves that the mixing experience is simple, but with a lot of options! Although, I had an issue once I broadcasted the transaction: #msg56448980. Fortunately, I got the money I mixed, so I'm okay now, problem solved. These are my suggestions: - Be more active on forum or email. You have no idea how soothing it'd be if you just had reply on the thread instead of having me wait. I know that you wouldn't scam me, it's pretty clear that your services are legit, but you can't just let your customers wait without a sign of support. I deposited the minimum amount. I wonder how anxious I'd be if I wanted to mix 1 bitcoin.
- Add bech32 depositing addresses. It'll reduce the fee. Slightly, but it will. (Or let your customer choose the address type)
- I personally find it redundant to have both LoG and MyCryptoCode. What's the point? For example, I hadn't downloaded the LoG, because I thought that MyCryptoCode and order id were enough. I do have the order's password, so I can prove that I'm the one. No need for LoG. Not to mention that if you share your LoG (as I saw on the ANN thread) mixing is losing its point.
- This one is optional, but I'd find it really cool if you had a submission form, where everyone can provide you a signature from an address to prove their ownership. No need for order id and MyCryptoCode.
- Let's say that I'm a little "obsessive" and I noticed that "Nothing yett" below the Outgoing Transactions. Remove that extra "t".
My conclusion is that MyCryptoMixer is a pretty satisfactory mixer. Their main purpose is to make mixing simpler, and I can confirm that they've achieved it. And one last thing to say, to all of the mixers out there on the scamming paradise known as "Internet": If you're not on bitcointalk, then you've lost my trust.  Hello, Thanks for the review! If your transaction was processed correctly it probably means you have used a lower than average fee Make sure to keep an eye on it, the network is highly contested because of the BItcoin price fluctuating. that combined with the delay you set could mean a longer delay. The difference between Order ID and MyCryptocode is really simple: - Your order ID is just a temporary value you can use to go back to your order while it's active, it doesn't give us any information about your Order. - MyCryptoCode is a hashed value which ensures you don't get back your own coins from the pool in sequential mixes We are trying to be as actve as possible on Bitcointalk, you would get a lot faster response by sending us an email or filling the contact form first instead of posting  |
|
|
|
Ok. Can you confirm if this address belongs to MCM? bc1qaamrxr0s469970e9m9tea4d9ssa7vfd7uq9cqk
It's strange because the fees were accurately distributed to a separate address as well.
Do you (or does anyone) have any ideas how this could have happened -- this could potentially really help other users not face the same issue.
I confirm the address bc1qaamrxr0s469970e9m9tea4d9ssa7vfd7uq9cqk does NOT belong to MCM. Some recommendations to avoid situations like this: - Always make sure you visit either HTTPS or better, Onion address. HTTP is NOT safe, especially when using Tor; - Compare the PGP key on Tor website with HTTPS. It is very unlikely for both to be compromised; - Save and verify Letter of Guarantee with the PGP key. It is common practice for fake websites to replace only the deposit address in LoG, making the signature invalid, but keeping the look and feel; Those 3 steps GUARANTEE you the success. Unlike services which do not offer a LoG for technical or other reasons, MCM is obligated to process all orders. |
|
|
|
Hi! I have already addressed multiple points raised here in your previous thread, link here: https://bitcointalk.org/index.php?topic=5319713Unless you are willing to provide additional evidence, I will not be repeating myself on the same topics over and over again. As stated in my previous reply, I can not afford to simplify things further and further until you can spot a single mistake and pull it over. As for whether the "backend being shut down" affected your transaction, according to the details you provided, no. As you can read in the post I made, the shutdown took place prior to your transaction. Furthermore, during the shutdown it was impossible to create any mixing order. The shutdown have not affected any transactions made prior or after it. There was ONE output delayed compared to the expected time. It was properly processed as soon as the backend was started back up. |
|
|
|
|
Dear @Cowboy310, here is the answer to concerns you have expressed in the posts above, including some of the posts which are now deleted or edited. I take my time with response because, besides being quite busy IRL, I can not afford to post messages and later delete them when they do not fit my narrative anymore.
> Please just reply to my email dude
I am assuming you were writing from email address which SHA256 fingerprint is: 4f545b25334cf7f0c9c903788423e31f209e858168e7d04f5ae41fc31650f7dc. I read them prior to posting the reply here. You moved the discussion to the public forum, so I answer here.
> What kind of process do you have to verify your addresses
MCM stores private keys for addresses it operates. This is necessary to make transactions. It is possible to determine the bitcoin address which belongs to private key. Using this knowledge, I can match any address against the database to see whether the address belongs to MCM or not. The private keys and the addresses operated by MCM are not disclosed, as it would compromise their anonymity.
> can you please check your logs and website on the 23rd of feb to see if you are able to find the transaction?
As I said in previous reply, the receiving address of your transaction does not belong to MCM. Bitcoin blockchain is a public ledger, unless there is another transaction you want to ask about, there is nothing more I can do.
> Its odd that you say that in this case the address does not match up because I have. not. provided it?
I based the reply on the bitcoin address you provided in the email, it's SHA256 fingerprint is: 5e5f0a9452e183c7b95ef08fe6ea2b8833bd80e7fc24f4a366c610447b4f8b7f
> I am happy to email you proof of me sending the 13 Btc
As mentioned above, bitcoin blockchain is a public ledger. I have no reasons to doubt you have made the transaction.
> I am not acting maliciously and I quite frankly am shocked that you would assume that
To my best knowledge no orders were facing issues around the time of your transfer. As per previous post, MCM gives the user a very powerful tool in form of Letter of Guarantee. It is indisputable. Earlier in the thread TryNinja sent you a direct link to the LoG of your order. According to the claims you made, the "server crashed" but you "checked the PGP".
> Perhaps you can show me a log or something to verify what you are saying
There is no log. Not only because the logs are not stored or the information were deleted. There is no log because the transaction was never tracked by MCM. MCM tracks only the transactions belonging to its own addresses.
> It's a bit strange to be that you're getting defensive here
I am not getting defensive, but answering a very serious threat to MCM reputation with very sane and down to earth arguments.
> why not just reply directly to my many emails and at least attempt to help me figure this out? I sent an email detailing what happened and find it funny that MCM is only responding in this thread and not to the email address provided on the website.
I will reply to the emails shortly with exactly the same information posted here. The information you provided or offer to provide is only sufficient to determine you made a bitcoin transaction. Had the funds landed in one of MCMs addresses and were not processed for any reason, I would contact you asking for a message signed with sender address describing where the funds should be sent. They have not.
> Has your server processed such a high amount of btc before?
Yes.
> When I processed the payment through MCM the wifi stopped working for a moment
MCM does not have the ability to control your wifi. The rest of the story matches what would have happened if you sent the funds to a malicious website. You should ALWAYS verify the LoG - not only download but also verify against the PGP key. The malicious websites oftentimes give you the LoG with the deposit address changed. Looks the same and is still signed by MCM, but the signature is invalid.
> If someone lost 13 btc through a malware on my site or a cloned version of my site I would respond to their emails at the least.
I will now answer your emails. I am prioritizing responding to the accusation on public forum. Using bitcoin means taking the security and privacy in your own hands. If the funds left your address there is nothing you or a 3rd party can do.
|
|
|
|
|
There are two methods to prove a transaction:
- The Letter of Guarantee. A digitally signed proof of your transaction, which indisputably guarantees the funds sent to the deposit address are going to be transferred to specified destinations, according to the settings. Even if MCM made the mistake and lost the PKs to the deposit address, it would be forced to process the order as per LoG. It is a guarantee and a very powerful tool in user's hands.
- The address belonging to MCM. It is possible for me to confirm whether the address belongs to MCM or not. In the past there were cases when the order was not processed properly and after confirming the deposit address is owned by MCM, as well as the ownership of input address used for the transaction, I was able to return coins safely.
In this case, the address does not belong to MCM, nor the user is able to present valid Letter of Guarantee. They claim the "server crashed" when trying to download LoG, yet they have "verified the PGP" on the "secure incognito mode of google chrome" and still proceeded to send substantial sum of money nonetheless. This is at the very least very strange.
There are several attacks on MCM users I am aware of, it is possible the victim fell for one of them:
- fake websites using MCM look
- tor exit nodes changing deposit addresses and the address in LoG when accessing clearnet address through HTTP
- browser addons changing the deposit address on real website
- compute programs changing the deposit address when in clipboard
It is also possible it is the malicious actor who wants to harm MCM reputation. This concerns me especially since we just had another case when the user claimed the funds were transferred to different address. Very shortly after my explanation on how it is possible to find the outgoing transaction from MCM using the disclosed information and knowing that addresses belong to MCM, they posted the txid without demonstrating any prior technical knowledge required for such blockchain analysis. Perhaps the attacker wanted to double down using the FUD created by TryNinja post, which debunked their first attempt.
|
|
|
|
|
Hello,
Due to the recent network load, I decided to switch the order time from 24 hours to 72 hours. A lot of users wrote over the email about their transactions not being processed, as they arrived after 24 hours from order creation. All the reported cases were resolved either thanks to the LoG or by checking whether the deposit address belonged to MCM and doing the analysis described above.
To prevent this from happening, on 05.02.2021 13:53 UTC, I decided to update order validity time from 24 hours to 72 hours, 3 days. Answering multiple emails about transactions lost due to order termination was not something I have time to do. The change was not yet propagated to the frontend, as I was not sure whether it is a temporary or permanent solution. The LoG is generated independently of the frontend, this is why it was available for full 72 hours instead of the 24 hours the frontend page was available for.
After reading the TryNinja post, not having much time at the moment, I decided to shut down the backend immediately in case something serious have happened. The backend was effectively offline from 22.02.2021 06:33 UTC to 23.02.2021 14:05 UTC, when I made sure no leaks are present.
No security was compromised. Each order is assigned unique id, it consists of 18 alpha-numeric lowercase characters, this gives us 36 ^ 18 possible combinations, roughly 1 and 28 zeros so you can imagine the number. This is enormous value, even when compensating for multiple orders being available at any time and considering finding the order id of single of them as a success, the chances of guessing and testing the order id is almost nonexistent.
The LoG generated by TryNinja is valid and confirms the transaction was successful.
As for @Cowboy310 I will post a response in his thread directly.
|
|
|
|
|
Hello,
I confirm the disclosed receiving address 3Q441kMPSEzPvw3Z7Eex4LM6USi3w8XK43 belongs the MCM.
I am sorry for the misunderstanding in email conversation, you are right and the minimum is 0.003 BTC, not 0.03 BTC. The numbers are very similar and I had a few other messages from users sending 0.0027 BTC and replied on muscle memory. Your transaction SHOULD BE and WAS processed - more on this below.
Because OP have not provided the LoG, I can rely only on the limited information to perform the analysis:
1. MCM received the 0.02699279 BTC on address 3Q441kMPSEzPvw3Z7Eex4LM6USi3w8XK43
2. OP claims the fee was set to 3%
3. OP claims there was ONE output address receiving 100% of the funds
4. Calculated output value for these parameters is 0.02593300 BTC ((0.02699279 * 97%) - 0.00025)
5. OP claim the delay was "default", about 2h 30m
6. MCM do not have a fixed "default" delay, rather randomize it from 2h 1m to 2h 16m
7. MCM knows the input transaction was confirmed in block 670969, at 10:40 UTC
8. MCM expects the output transaction to be confirmed no earlier than 12:40 UTC
Knowing the exact transaction amount, as well as an estimate time, we can search for the outgoing transaction.
I found the outgoing transaction matching all the criteria above:
- output amount is EXACTLY 0.02593300 BTC
- is confirmed not long after 17.02.2021 12:40 UTC
- the input address belongs to MCM
This proves MCM processed the transaction according to the settings disclosed by OP. The destination address in found transaction differs from the one OP sent vie email. I do not know the reason for this, had we have LoG we could confirm whether it was an user error, or a malicious actor's doing. Either way, MCM processed it as requested.
As I hope everyone can see, using the information provided by the OP I was able to find the output transaction associated with the input. Please treat these coins as connected with the input. Such analysis can be performed by anyone with basic blockchain knowledge, using only the information available in OP.
To avoid compromising your privacy, I strongly suggest using MULTIPLE destination addresses with random fee and delay. Transactions with only one destination are fairly easy to track when the fee is disclosed by the sender.
|
|
|
|
Hello, As much as we would like to help we have provided all available information. Everything went according to the Letter of Guarantee which you have provided, any other transactions not mentioned in it were sent to other addressess not belonging to MyCryptoMixer. We're sorry but you have probably been spoofed / address swapped. |
|
|
|
Hello,
I have not received any email regading this transaction and I can see it has been processed correctly.
Our BTC node may experience some slight delay sometimes becaused of the increased volume of transactions. I'm working on a long term fix but right now the system should self restore after no more than a few hours like today.
I have some problem. And I sent i think 15 mails) but no response Hey, 4 mails in 4 hours are not 15  Responded to you now but I can see your transaction was succesfull? |
|
|
|
|
Hello,
I have not received any email regading this transaction and I can see it has been processed correctly.
Our BTC node may experience some slight delay sometimes becaused of the increased volume of transactions. I'm working on a long term fix but right now the system should self restore after no more than a few hours like today.
|
|
|
|
Hello, @Artsidim has got in touch and I have sent him the BTC along with a bonus for such a long wait. @LoyceV please verify this with the Letter of Guarantee. Great to see that they are back but that's not a good approach at all. Privacy seeking user now have to contact with the admin to get their fund back. And there are other people too who have lost their fund while they aren't available here.
@RapTarX, when saying "that is not a good approach at all", do you mean to say the money should not be returned to the owner? If you are referring to the requirement of sending us a LoG, we do not store logs of the transactions going through our platform. This directly means we have no other way to determine where the funds should be transferred to. When referring to "other people", I am sure you mean the 2 other transactions which were caught in the incident. They can send us PGP encrypted message to an email, as everyone encountering any issues should. No need for contacting us via the forum. I am well aware not having the incident would be much better, but it is too late to revert it now. MyCryptoMixer was created with multiple fail safes in mind, but the main goal was never to compromise on privacy. If the outage happens, it can only recover up to 24 hours by design. This is why our users are protected by PGP signed letter. In case of a failure, they can always hold the service accountable, just like artsidim done. More safeguards have been put in place to prevent any mishaps in the future. |
|
|
|
Please send me the LoG so I know where to send the funds. That's not mine to give, but you should have an email from artsidim already: I will gladly provide it to support service but these guys do not reply to emails. Sometimes things outside your control just happen and there is nothing you can do. That is the best possible outcome indeed, but I hope you understand a warning was/is in place too. Hey LoyceV! Artsidim indeed sent us an email on the 17.11 but he did not include his Letter of Guarantee there, only the Order ID which expired by now. Waiting for him here! It's understandable with such warning considering the downtime and other services exit scamming, fortunately we're here to stay |
|
|
|
|
