[ANN] ChipMixer.com - Bitcoin mixer / Bitcoin tumbler - mixing reinvented

[ranochigo]

Segwit addresses are still a minority:

Code:

33,075,249 funded Bitcoin addresses on December 17, 2020
  24,519,978 of those start with 1
  6,447,377 of those start with 3
  2,107,877 of those start with bc1q

(source)

That's disappointing. Would've loved to get an option to get Segwit on ChipMixer. The fees aren't helping with the added cost of mixing.

[ChipMixer]

There is temporary shortage of high-sized chips. Avoid doing large deposits.

[ChipMixer]

There is temporary shortage of high-sized chips. Avoid doing large deposits.

Shortage resolved. Service works as usual.

[gondel]

Website is down!

[o_e_l_e_o]

Website is down!

Both clearnet and onion sites working fine for me.

[gondel]

Website is down!

Both clearnet and onion sites working fine for me.

Yes now it is back, but the coins I sent to them are not showing in the account. Transaction is already confirmed but the deposit address changed and the coins are not visible in my session.
Anyone else experienced this?

[webtricks]

Something is indeed wrong with Chipmixer today.

I sent some funds for mixing about an hour ago. After sending the funds, site became inaccessible. Then around half an hour ago, I was able to access my session. But when I imported the private keys, the funds were already spent! All UTXOs provided to me were spent in a single transaction few minutes before the session was once again accessible to me.

I don't think I made any mistake at any step but maybe it's possible that I did something wrong. I would appreciate if others can share their insights on what could have gone wrong.

~~
Yes now it is back, but the coins I sent to them are not showing in the account. Transaction is already confirmed but the deposit address changed and the coins are not visible in my session.
Anyone else experienced this?

Yes! Same thing happened to me. I was redirected to a new session as well. But I manually visited chipmixer.com/restore/session/oldSessionID to access my old session (the one where I sent funds). It wasn't accessible for like 20-25 minutes and when I was able to access it, funds were already spent.

[gondel]

Well, there no chips at all on my side, they were not spent, but just not showing in the account. Hop this will be resolved pretty soon and they answer promptly.

[TryNinja]

I was redirected to a new session as well. But I manually visited chipmixer.com/restore/session/oldSessionID to access my old session (the one where I sent funds).

Were you using Tor?

[webtricks]

Yes! Same thing happened to me. I was redirected to a new session as well. But I manually visited chipmixer.com/restore/session/oldSessionID to access my old session (the one where I sent funds).

Were you using Tor?

Nope. Regular VPN.

[gondel]

Guys I can see the coin I sent are in that address on the blockexplorer and it was used only ones, nothing is spent from there so far.
Just no coins are showing in my account. I always use the official link .com to deal with chipmixer and never had problems until today.
Any answer from their support will be appreciated as soon as possible.
Thanks!

[ChipMixer]

Hello

Yes! Same thing happened to me.

Those are two different cases.

webtricks case
1. Visits our website, receives our deposit address
2. Does first deposit, receives chips after first confirmation
3. Half hour later sweeps chips into address
4. In the same block as sweep does another deposit to our deposit address
5. Half hour later sweeps chips into same address

gondel case
1. Visits website, receives not our deposit address
2. Does deposit but never receives chips
3. Restores session and receives another deposit address

I assume that gondel case could be
1. Use Tor
2. Access http chipmixer com
3. Malicious Tor Exit node serves website over clear text (SSL stripping) and switches deposit address to their

webtricks case is weird because there are two deposits and they say they did one. It could be that VPN does the same as Malicious Tor Exit node with SSL stripping and sweep them.

[TryNinja]

What do you think about giving the user a signed letter with the deposit address so they can confirm nothing went wrong?

edit: Now that I think about, someone could generate new sessions to create valid letters and sweep everything to match with his own (controlled) session. Maybe some brainstorming could result in a better solution.

[jackg]

What do you think about giving the user a signed letter with the deposit address so they can confirm nothing went wrong?

I know this has been mentioned before but it requires putting a private key on an online server that could compromise everything.

There's then the other prospect of how many letters will people check? A 1Chip or even 1Chipmix address would be crackable without much computation power afaik. So you'd need to find an address with another word in it imo which would probably be hard to find.

Also, if you keep a copy of your receipt, you keep a copy of what you've just tried to destroy. Deleting information you've downloaded or saved is fairly difficult to do (and make it irrecoverable) even in memory there's no guarantee that your data will delete once the session clears or after a certain amount of time on a lot of devices.

My suggestion was to publish their ssl public key whenever they update it and then someone could verify the key by looking at the site settings on their browser.

[webtricks]

webtricks case
1. Visits our website, receives our deposit address
2. Does first deposit, receives chips after first confirmation
3. Half hour later sweeps chips into address
4. In the same block as sweep does another deposit to our deposit address
5. Half hour later sweeps chips into same address

Nope, I can only see one deposit made on the deposit address i.e. the funds I sent. Also, only one sweeping transaction was made i.e. with the chips equivalent to my deposit less fees. I can't see the other deposit/withdrawal you are talking about.

webtricks case is weird because there are two deposits and they say they did one. It could be that VPN does the same as Malicious Tor Exit node with SSL stripping and sweep them.

I am not sure my VPN service would do that. Moreover, I made sure that I was accessing the encrypted website by manually checking the SSL certificate at two different occasions. It was indeed valid. By the way, I noticed one thing - the browser cookie was changing whenever I was refreshing the session page. I am talking about this one:



It has to remain same unless I close my browser session, isn't it? It maybe changing due to the use of VPN. Can this be the reason someone else got hold of my session? Does this cookie has any direct relation with session token? Is it possible that my session token got mingled with another user on site and both of us were shown same session?

The case still needs answers. @Chipmixer, do you want me to send e-mail with more extensive information like the txid I sent, etc? I need to get to the end of what actually happened because I regularly use Chipmixer and this is my common setup (VPN+browser+clearnet). It never happened before and I don't want this to happen again.

[gondel]

Hello,
Problem with me still persists. I cannot see the coins in my account and only one transaction was made to the deposit address.
I was not using VPN and entered the .com domain. Nothing different from what I was doing all the times I used the service before.

[krste5]

Same thing happened to me, so this is not an isolated situation!

Sent coins to the provided address. Waited for confirmation, once it was confirmed I went back to the website, just to see it went down (I'm used to this Chipmixer DOWN! situation).
After it got up and running again, I went to step 2 and Total Chips : 0.000
The coins were already withdraw!


I had 3 open sessions in 3 different browsers. Mozilla, Chrome and Edge.
The one in Chrome and Edge went through successfully - There were no problems, I managed to withdraw the chips!
But the one in Mozilla, were already withdrawn!

[TheQuin]

But the one in Mozilla, were already withdrawn!

Do you have any extensions installed?

[ChipMixer]

Status update

In last 7 days there were two reported issues of customer visiting .com and receiving non ChipMixer deposit address. In both cases - after deposit transaction deposit address displayed in browser changed into ChipMixer deposit address.

In last 7 days there were three reported issues of customer visiting .com and depositing to ChipMixer deposit address. After deposit .com timeouts and when it starts working again all chips are already sweeped.

Both issues are being investigated. Please be aware of issues and if possible with your privacy plan keep documenting interaction with our service (ie. check SSL certificate, do and keep  screenshots).

Nope, I can only see one deposit made on the deposit address i.e. the funds I sent. Also, only one sweeping transaction was made i.e. with the chips equivalent to my deposit less fees. I can't see the other deposit/withdrawal you are talking about.

Could you send an e-mail to chipmixer@protonmail.com to avoid discussing addresses and txid in public? After your post there was only one support email about this issue and there were two deposits with that case.

By the way, I noticed one thing - the browser cookie was changing whenever I was refreshing the session page. I am talking about this one:
It has to remain same unless I close my browser session, isn't it?

Refreshing session page should not change cookie.

It maybe changing due to the use of VPN. Can this be the reason someone else got hold of my session? Does this cookie has any direct relation with session token? Is it possible that my session token got mingled with another user on site and both of us were shown same session?

When you access .com website with correct SSL - your headers are encrypted and only you and .com server can see that. Cookie has relation with session token. It is unlikely to share session with other user in this case.

The case still needs answers. @Chipmixer, do you want me to send e-mail with more extensive information like the txid I sent, etc? I need to get to the end of what actually happened because I regularly use Chipmixer and this is my common setup (VPN+browser+clearnet). It never happened before and I don't want this to happen again.

Please do send us as much information as you are willing to. Including VPN provider.

What do you think about giving the user a signed letter with the deposit address so they can confirm nothing went wrong?

This idea was discussed in 2019:

With your proposal ChipMixer signs letter that contains address. User say they did not receive chips. They publish signed letter that address is ChipMixer address. ChipMixer says they released chips. Who is lying? Nobody knows - only known thing is that it was ChipMixer address and funds were deposited. User cannot prove they did not receive chips. ChipMixer cannot prove they released chips. What kind of guarantee is that?

We could do it anyway to provide integrity of server response ie. nobody switched deposit address but it would force users to check another thing (and they would not do that every time) and server response integrity is already guaranteed with SSL.

[gondel]

Just a quick update that my issue was resolved, still not sure from where the problem came, but most important is that my coins are not compromised. To be honest this was better support then Kraken where my 1 BTC was gone due to support neglecting my case.
Thank you