[ANN] ChipMixer.com - Bitcoin mixer / Bitcoin tumbler - mixing reinvented

[james3441]

Attacker gained access to our .com server IP at 2021-09-23. They used it to create two SSL certificate - one with Cloudflare (https://crt.sh/?id=5270080144) - second with Lets Encrypt (https://crt.sh/?id=5281011754).

How is this even possible? Do you host this on VPS or in some sort of shared environment? Was server's content accessed?
Consider changing the host

Buy a dedicated server with access to KVM (dell idrac/HP ilo) then do system installation with full disk encryption. Change all default passwords/keys
There's literally 0 ways how you can get access to server contents this way, assuming all applications running on server and your own administrative credentials are secure.

Even if they somehow social engineer hosting company to get access to dedicated server, they won't be able to access the server's content

All they can do is just format the server and put phishing/proxy version via mounting some iso in rescue mode.

Finding a hosting company which deals with social engineering attempts in decent way is another story

[1714285594]

1714285594

[1714285594]

1714285594

[1714285594]

1714285594

[pitchbend]

So what's the status? is it safe to use again? should we avoid the clearnet version?

[altcoinstradR]

@Chipmixer I sent you an email hours ago, and I have gotten no response.
Return my 0.00095897 btc value to my session token
I made a deposit some hours ago, left and came back and decided to restore my session, only to find this message:
You have donated 0.952 mBTC which is 100.0% of your deposit. Thank you!
As stated earlier, no one else uses my PC, I live a lone and the PC was on put on sleep mode, also I am certain I used the correct .TOR address, because I copied it from the first page. I did not donate a penny, PLEASE RESTORE MY coins!
This is crazy, how do you decided to take my funds as a donation on your own?

[NeuroticFish]

0.00095897 btc
[...]
This is crazy, how do you decided to take my funds as a donation on your own?

It would be nice if when you use a service - any service - you would start with reading at least the rules / faq and such, to avoid surprises.
For example Chipmixer's FAQ starts with "How does deposit work?" where one can read

Minimum deposit is 0.001 BTC - lowest chip size. If you deposit less then you have to deposit missing amount to receive a chip.
Second minimum deposit is 0.002 BTC. If you deposit between 0.001 and 0.002 BTC you will receive only 1 mBTC chip and rest will be autodonated.

If you deposit 0.1234 BTC (123.4 mBTC) you will receive 123 mBTC chips. 0.4 mBTC will be autodonated.

Since you didn't transfer the minimum chip size, for now.. I guess that the software thought that you're just being nice.
However, I am sure that you will get an official answer if you have some patience.

[BlackHatCoiner]

This is crazy, how do you decided to take my funds as a donation on your own?

It depends on how much money you wanted to mix. They describe how their mixing works in the first page of this thread;

There are chips with 0.001 BTC, 0.002 BTC, 0.004 BTC and so on till 4.096 BTC. When you deposit your Bitcoins, you receive same amount in chips.

Also, from their website:

I really, really want 1 BTC chip!

You are in luck! We have introduced commonize function which will swap your weird looking 1.024 BTC chip into 1 BTC chip and weird looking 0.512 BTC into 0.5 BTC.

Using this action will cost you the weird part of chip which is around 2% fee.

And:

Minimum deposit is 0.001 BTC - lowest chip size. If you deposit less then you have to deposit missing amount to receive a chip.
Second minimum deposit is 0.002 BTC. If you deposit between 0.001 and 0.002 BTC you will receive only 1 mBTC chip and rest will be autodonated.

If you deposit 0.1234 BTC (123.4 mBTC) you will receive 123 mBTC chips. 0.4 mBTC will be autodonated.

[LoyceV]

@Chipmixer I sent you an email hours ago, and I have gotten no response.

Support isn't online 24/7, it may take up to a few days.

This is crazy, how do you decided to take my funds as a donation on your own?

You can't withdraw less than 0.001BTC from ChipMixer. That's why, on step 1: Deposit, it shows:

Minimum amount is 0.001 BTC with 0.001 BTC increments.

From the FAQ:

What will happen if I send less than lowest chip?

Since we don't have chips lower than 0.001 BTC, your deposit will be treated as donation. Be aware that if you send 0.0015 BTC, you will receive one 0.001 BTC chip. Sending 0.0015 BTC twice will result in two 0.001 BTC chips.

[ChipMixer]

I made a deposit some hours ago, left and came back and decided to restore my session, only to find this message:
You have donated 0.952 mBTC which is 100.0% of your deposit. Thank you!

Any amount under 1 mBTC is auto donated. If you deposit another 0.048 mBTC your total deposit is 1 mBTC and you will receive 1 mBTC chip.

So what's the status? is it safe to use again? should we avoid the clearnet version?

Tor version is better protected than clearnet. We should avoid clearnet version.

Attacker gained access to our .com server IP at 2021-09-23. They used it to create two SSL certificate - one with Cloudflare (https://crt.sh/?id=5270080144) - second with Lets Encrypt (https://crt.sh/?id=5281011754).

How is this even possible? Do you host this on VPS or in some sort of shared environment? Was server's content accessed?
Consider changing the host

We assume server content was not affected. If it was then attacker would take our SSL certificate instead of creating new one.
We do not know full story. It is also possible that DNS records were attacked to point at different IP.

[altcoinstradR]

Issue resolved, thanks

[megalotz]

I deposited over $10k in chipmixer over the onion url (chipmixorflykuxu56uxy7gf5o6ggig7xru7dnihc4fm4cxqsc63e6id.onion) on a very secure PC and clicked on withdraw. I was given a list of the private keys as usual with the amounts associated with each. Then when I checked the public addresses of the private keys on the blockchain, each wallet had 0 BTC and no incoming and no outgoing transactions.

This has never happened before after using the service dozens of times.

Chipmixer, is there a problem? Where's my BTC?

[o_e_l_e_o]

-snip-

Did you check the segwit addresses?

[megalotz]

-snip-

Did you check the segwit addresses?

I checked the balance on the private key (the one with the smallest amount), 0 BTC, address never used. Then I checked it based on it's legacy public address, again 0 BTC.

I haven't checked the segwit address because I have no way to get the segwit public wallet from a private key.
To get the legacy public wallet from the private key I used the old brainwallet javascript web site. Know of any javascript sites that work offline to calculate the segwit address from the private key?

[AdolfinWolf]

-snip-

Did you check the segwit addresses?

I checked the balance on the private key (the one with the smallest amount), 0 BTC, address never used. Then I checked it based on it's legacy public address, again 0 BTC.

I haven't checked the segwit address because I have no way to get the segwit public wallet from a private key.
To get the legacy public wallet from the private key I used the old brainwallet javascript web site. Know of any javascript sites that work offline to calculate the segwit address from the private key?

Check this library maybe?

[BlackHatCoiner]

I checked the balance on the private key (the one with the smallest amount), 0 BTC, address never used. Then I checked it based on it's legacy public address, again 0 BTC.

Chipmixer has abandoned legacy addresses since July 2021, it only gives you the private keys for the SegWit native addresses.

Know of any javascript sites that work offline to calculate the segwit address from the private key?

Is there a specific reason you want it to be a javascript html page? Why don't you just import them into Electrum? If you really want them to be legacy, you can just import the private keys as p2wpkh, generate a legacy wallet and send them there, which you can then check from brainwalletx.

[dkbit98]

I checked the balance on the private key (the one with the smallest amount), 0 BTC, address never used. Then I checked it based on it's legacy public address, again 0 BTC.

I haven't checked the segwit address because I have no way to get the segwit public wallet from a private key.
To get the legacy public wallet from the private key I used the old brainwallet javascript web site. Know of any javascript sites that work offline to calculate the segwit address from the private key?

When you start mixing there is a clear notice that new Segwit is now used in Chipmixer so you can't expect to get coins on legacy anymore by default.
Easiest way is to use Electrum wallet for importing private key and I would suggest that, but I saw some people are using open source offline version of segwitaddress.org for generating segwit addresses from priv keys, however I can't vouch for this so you it at your own risk.

[LoyceV]

Easiest way is to use Electrum wallet for importing private key

For the record: this also works offline. You can also use Tails to run it from Live DVD through Tor.

Use this prefix when importing Segwit private keys into Electrum:

For P2WPKH addresses (Bech32, starting with 'bc1')
This time we'll add p2wpkh: in front of the private key.
For example

Code:

p2wpkh:5PrivateKey

This should generate the corresponding Bech32 address

[o_e_l_e_o]

Concur with the above. There are a couple of websites I know which will spit out segwit addresses if you feed them private keys, but I've not examined the code thoroughly enough on any of them to feel comfortable recommending them. Easier and safer to use Electrum.

[Lucius]

Made a payment today to chipmixer. Got a session key. It was showing a legacy address (like old version of chipmixer used to show.) 
I used tor browser + tor version of chipmixer.
I sent the btc to the deposit address. The transaction is confirmed (2 confirmations) long time ago.
But its still showing wait for the transaction to be confirmed and 0 btc in step 2.
I have mailed the support with session key and all the screenshots.

In that case, you used the fake CM site, because if you read a few posts above, you can see that CM no longer uses legacy addresses regardless of whether you used Tor or not. You can check all this if you look at the first post on this topic or click on the signatures of one of the members of their signature campaign.

Can you post the link you used, and did you use a search engine for that?

[BitMaxz]

Made a payment today to chipmixer. Got a session key. It was showing a legacy address (like old version of chipmixer used to show.)  
I used tor browser + tor version of chipmixer.

Which one the v2 or the v3 onion link?

I sent the btc to the deposit address. The transaction is confirmed (2 confirmations) long time ago.

How long? do you still remember when? what is the exact date?

Because right now you can't able to use their v2 onion link and non-segwit is currently disabled. If you start mixing they will give you a warning and lead you to v3 onion link.

[dansus021]

is chipmixer doesnt have platfrom for mixing altcoin like tornado cash have? i think would be great idea since to add some altcoin since chipmixer has already gain good reputation

[dkbit98]

Made a payment today to chipmixer. Got a session key. It was showing a legacy address (like old version of chipmixer used to show.) 
I used tor browser + tor version of chipmixer.

Have you used old Tor v2 version that is now obsolete and it's not using Segwit, or new Tor v3 with new segwit addresses?
I just checked that old version website of chipmixer is still opening with warning message that it will soon become obsolete.