Binance Hackers Bombard Chipmixer to Launder at Least 4,836 BTC

[cryptoperkele]

Am i the only one who thought that mixers were build for this purpose? I mean now we suddenly DO want to know who is using money to what?

[hv_]

Am i the only one who thought that mixers were build for this purpose? I mean now we suddenly DO want to know who is using money to what?

Bitcoin was hijacked - like the Internet at ist beginning - by ppl who wanted to stay anno and go anarcho. There is a lot Money to be made ...

But Bitcoin was too transparent / even should use IP addresses for proper P2P .

[jostorres]

From what I have heard, Binance has agreed to some of the demands made by the American authorities. They are ready to exclude American users from the main platform and may restrict this group to an exclusive platform for the US users where KYC is mandatory. But as we all know, even exchanges with mandatory KYC requirement are not 100% safe.

I agree with what you said, and I don't have any doubts regarding the real intention of these people. But I think shutting down mixers such as Chipmixer may be more of a priority for them, rather than going for the exchanges such as Binance. They target exchanges only when the owners openly challenge them (for example, the case with BTC-e / Wex.nz).

As we know that when it comes to tax, the US government will never joke with that, now that they see it will be impossible to control bitcoin or make it stop, then the best way for them would be to go after these exchanges.

Honestly Binance tried to avoid them and protect its users, but if US will complicate things and make them loose the trust that their user has for them as regards their privacy protection, then I think that they have done the right thing separating the US citizens into a different platform, so it is left for the citizens to willingly submit themselves to the US by using those platform, anyway, they have no choice because they are virtually now controlling all the exchange that they probably have in their country.

[mazdafunsun]

As previously reported, a crypto mixing service, or a crypto tumbler, is an anonymity tool that claims to transform transactions of non-private coins to private ones by mixing crypto funds with others...

I have been thinking of these mixers, are they actually bullet proof?
Are those algorithms un hack-able , I mean if these hackers will go unpunished because they used this service and it can be proven that they are the owners of hacked coins?

[AdolfinWolf]

As previously reported, a crypto mixing service, or a crypto tumbler, is an anonymity tool that claims to transform transactions of non-private coins to private ones by mixing crypto funds with others...

I have been thinking of these mixers, are they actually bullet proof?
Are those algorithms un hack-able , I mean if these hackers will go unpunished because they used this service and it can be proven that they are the owners of hacked coins?

No. There has been a paper posted a while ago that deanonymized almost every mixer (except Chipmixer (perhaps due to it not being vectored properly by the researcher)). I lost the link but i'll search for it in a bit.

And of course you also have the good ol' fed's raiding you if you're hosting your servers in Europe/US. See what happend to Bestmixer. INTERPOL claims they got ALL the transaction data from that mixer.

Edit: https://bitcointalk.org/index.php?topic=5117328.0

[CoinClarity]

Regardless of whether or not ChipMixer is at "fault" of this or that, I certainly wouldn't use them for a long time to come, as pretty much every amount of BTC that goes into a "chip" for an extended period is going to be from a hacking.

to be honest this article looks to me like another chain analysis service that is trying to advertise their services and take some customers to make money. otherwise all of their statements on their website looks like pure guesswork which they give validity to by using buzzwords such as "network science" and "machine learning".

It sounds like you just skimmed over the article and hastily came to a conclusion that aligns with your own economic interests. Clain are very thorough and wouldn't publish things that aren't true, because that's not the nature of their business -- their business is knowing things with certainty and being able to prove them.

It was actually quite entertaining reading all the ChipMixer sig sporting posts in this thread. I mean, you guys occupy nearly 50% of every thread in this section anyway, but it was funny to see you all come to the defense of ChipMixer. If I were you I wouldn't say peep about this issue. But that's just me.

One thing that hasn't changed is the fact that ChipMixer IS a money laundering service. Period. Yes, there are negative connotations associated with that term, but it remains a fact.

The arguments I saw for legal use of it were a bit ridiculous. You don't want a barista to see how much BTC is in your wallet so you use a coin mixer?? Same thing with privacy concerns: you want to hide the origins of your coins for "privacy", yet you don't mind mixing them with some coins from known hacker addresses? Really doesn't make a whole lot of sense.

Sure, there may be some legal use case scenarios but as of right now the overwhelming majority of use is to obfuscate the origins of stolen funds.

All you do is to allege it is possible, but you can't even 'trace' my simple example:

1 dirty UTXO: A
1 clean UTXO: B

Transaction:
A (1 BTC)+ B (1 BTC)  -->  C (0.5 BTC) + D (0.5 BTC) + E (0.5 BTC) + F (0.5 BTC)

Now, please tell me.
Which UTXO's are clean and which are dirty after this transaction ?

Serious blockchain analytics companies hoping to provide actionable information to clients like Binance don't need to think of coins in terms of "clean" or "dirty." They are going to follow all 4 outputs and see where they go. The process is much more complicated than just deciding "clean" and "dirty." It involves making observations and identifying patterns based on larger amounts of data than simply a single transaction.

[mazdafunsun]

No. There has been a paper posted a while ago that deanonymized almost every mixer (except Chipmixer (perhaps due to it not being vectored properly by the researcher)). I lost the link but i'll search for it in a bit.

And of course you also have the good ol' fed's raiding you if you're hosting your servers in Europe/US. See what happend to Bestmixer. INTERPOL claims they got ALL the transaction data from that mixer.

Edit: https://bitcointalk.org/index.php?topic=5117328.0

Vou, that is what I was wondering. This means that crypto can not be anonymous, everything can be relatively easily tracked . And according to link you provided, trackers do not even need to have servers in their hands. Someone who has knowledge of the workings, can easily brake the " code" .

[AdolfinWolf]

No. There has been a paper posted a while ago that deanonymized almost every mixer (except Chipmixer (perhaps due to it not being vectored properly by the researcher)). I lost the link but i'll search for it in a bit.

And of course you also have the good ol' fed's raiding you if you're hosting your servers in Europe/US. See what happend to Bestmixer. INTERPOL claims they got ALL the transaction data from that mixer.

Edit: https://bitcointalk.org/index.php?topic=5117328.0

Vou, that is what I was wondering. This means that crypto can not be anonymous, everything can be relatively easily tracked . And according to link you provided, trackers do not even need to have servers in their hands. Someone who has knowledge of the workings, can easily brake the " code" .

Yep. But crypto* itself can very well be anonymous. It's just that Bitcoin isn't designed to be that way from the very beginning.

If you look at other cryptocurrencies, such as Monero. - https://getmonero.org/ this coin for example is completely untraceable by design, and can't be "Broken".

[bob123]

One thing that hasn't changed is the fact that ChipMixer IS a money laundering service. Period.

No, it is not.

It is a mixing service to increase privacy. Nothing more.
Just because some people might abuse it to launder money, it doesn't make it a money laundering service..

The arguments I saw for legal use of it were a bit ridiculous. You don't want a barista to see how much BTC is in your wallet so you use a coin mixer??

What would be an alternative to that ?
With BTC, you don't have any other alternative than using a mixer. Without proper coin control and much effort, you will always be traceable. Using a mixer is quite easy and handy for that.

Nothing wrong with that IMO.

Serious blockchain analytics companies hoping to provide actionable information to clients like Binance don't need to think of coins in terms of "clean" or "dirty." They are going to follow all 4 outputs and see where they go. The process is much more complicated than just deciding "clean" and "dirty." It involves making observations and identifying patterns based on larger amounts of data than simply a single transaction.

Yes.. and you see all 4 outputs going to an exchange, 4 different accounts. And now ?
There is nothing you can do.

If there is not much more data than just this one (or maybe a few more) transactions, there is simply nothing you can do.
Of course.. mistakes made by people decreases the privacy. But without any mistakes, there is simply no way.

And saying 'bla bla there are companies which can do that' without providing any evidence or explaining how exactly they would achieve that, just makes it sound ridiculous.

[bryant.coleman]

As we know that when it comes to tax, the US government will never joke with that, now that they see it will be impossible to control bitcoin or make it stop, then the best way for them would be to go after these exchanges.

Honestly Binance tried to avoid them and protect its users, but if US will complicate things and make them loose the trust that their user has for them as regards their privacy protection, then I think that they have done the right thing separating the US citizens into a different platform, so it is left for the citizens to willingly submit themselves to the US by using those platform, anyway, they have no choice because they are virtually now controlling all the exchange that they probably have in their country.

I don't think that the IRS will be satisfied if Binance conducts KYC for the American customers. Back in 2017, record number of people were renouncing their US citizenship and the authorities just hiked the exit tax and renouncement charges by manytimes. Also, a lot of paperwork was added to make the process more tedious and cumbersome.

If the exchanges make KYC mandatory for just the users from the United States, then it will give unfair advantage to individuals from the other countries. I don't think that the American authorities will be happy with such a scenario, although they are not losing any tax revenue in the short term. I expect the regulations to become more intrusive as well as more extensive, as the popularity of Bitcoin increases.

[Velkro]

Chipmixer is in a bad spot right now, if they give the data to authorities, they will lose some customers, both criminals and just people who don't trust governments. If they don't cooperate, they will risk getting closed, and they will have reputation of a service that launders dirty money, and some users might be scared that the coins that they get will be tainted.

Agree, whatever happens its bad for them.
Its hard to protect also from hackers to use such service because its impossible to monitor all hacked coins from all exchanges out there. So its just matter of time until any service that offer mixing getting in such situation.

[figmentofmyass]

Regardless of whether or not ChipMixer is at "fault" of this or that, I certainly wouldn't use them for a long time to come, as pretty much every amount of BTC that goes into a "chip" for an extended period is going to be from a hacking.

did you actually read the findings? only "183 BTC were identified as hacker funds" out of a pool of bitcoins 30x as large. what the hell are you talking about?

It sounds like you just skimmed over the article and hastily came to a conclusion that aligns with your own economic interests. Clain are very thorough and wouldn't publish things that aren't true, because that's not the nature of their business -- their business is knowing things with certainty and being able to prove them.

how would you know---independent verification? of course not. this company clain didn't even exist a few months ago! you have no idea who they are and no one has verified their claims.

by the very nature of blockchain analysis, their reports are almost entirely guesswork, based on a massive number of assumptions.

Serious blockchain analytics companies hoping to provide actionable information to clients like Binance don't need to think of coins in terms of "clean" or "dirty." They are going to follow all 4 outputs and see where they go. The process is much more complicated than just deciding "clean" and "dirty." It involves making observations and identifying patterns based on larger amounts of data than simply a single transaction.

could you elaborate? when all 4 outputs have been moved through many distinct wallets/addresses and become distinctly different outputs, what happens then?

[CoinClarity]

One thing that hasn't changed is the fact that ChipMixer IS a money laundering service. Period.

No, it is not.

It is a mixing service to increase privacy. Nothing more.
Just because some people might abuse it to launder money, it doesn't make it a money laundering service..

You're playing a game of semantics. "Mixing" is just a pleasant substitute for "laundering."

What would be an alternative to that ?
With BTC, you don't have any other alternative than using a mixer. Without proper coin control and much effort, you will always be traceable. Using a mixer is quite easy and handy for that.

An alternative is moving your coffee purchasing funds from your bigger wallet into a smaller one. Simple. The barista isn't going to know the bigger wallet is in your control. Neither is anybody. Does anybody use BTC to buy coffee, anyway?

Yes.. and you see all 4 outputs going to an exchange, 4 different accounts. And now ?
There is nothing you can do.

Of course there's something you can do, and that is follow all 4 outputs.

And saying 'bla bla there are companies which can do that' without providing any evidence or explaining how exactly they would achieve that, just makes it sound ridiculous.

They're only going to publish what they can without giving away their secrets. Of course you are going to fight against them, but just because you don't understand how it works doesn't mean it isn't happening.

Regardless of whether or not ChipMixer is at "fault" of this or that, I certainly wouldn't use them for a long time to come, as pretty much every amount of BTC that goes into a "chip" for an extended period is going to be from a hacking.

did you actually read the findings? only "183 BTC were identified as hacker funds" out of a pool of bitcoins 30x as large. what the hell are you talking about?

From the article:

We detected an extensive pool of Chipmixer's addresses in the course of the previous investigations and can confidently maintain that at least 4836 BTC of the hacker's monies was laundered through Chipmixer...

Chipmixer was bombarded with inflow of the hacker's funds in the magnitude it never operated before. Because of this huge volume, it is correct to assume that any outflow coming from Chipmixer these days is likely related to the same owner.

Only 814 BTC had been output from ChipMixer as of the publishing of the article. That's the difference.

how would you know---independent verification? of course not. this company clain didn't even exist a few months ago! you have no idea who they are and no one has verified their claims.

They've been in operation since 2017:

https://betalist.com/startups/clain

Not one word from anybody (except ChipMixer sig wearers) claiming - much less demonstrating - that their findings are untrue.

by the very nature of blockchain analysis, their reports are almost entirely guesswork, based on a massive number of assumptions.

You're downplaying the complexity of their endeavor. Like I said, this is a company that is in the business of knowing things. They don't publish guesswork, and whenever something is uncertain, they state so.

[bob123]

You're playing a game of semantics. "Mixing" is just a pleasant substitute for "laundering."

Ah, i see.

So anyone who wants to remain some privacy and mixes his coin is automatically laundering money.

Good to know that keeping things private is a crime in your eyes.

An alternative is moving your coffee purchasing funds from your bigger wallet into a smaller one. Simple.

Remaining private 101.

Good job 

No.. honestly.. are you serious about that statement 

Yes.. and you see all 4 outputs going to an exchange, 4 different accounts. And now ?
There is nothing you can do.

Of course there's something you can do, and that is follow all 4 outputs.

Follow where ?
They already reached their destination.. They are being exchanged into money or another currency (e.g. monero) at that point.. from 4 seperate accounts.
You can not follow it anymore.

Please elaborate how you keep following them 

[malevolent]

One thing that hasn't changed is the fact that ChipMixer IS a money laundering service. Period.

No, it is not.

It is a mixing service to increase privacy. Nothing more.
Just because some people might abuse it to launder money, it doesn't make it a money laundering service..

You're playing a game of semantics. "Mixing" is just a pleasant substitute for "laundering."

In some cases that may be true, but the primary use case of mixing is retaining privacy, what others use mixers for is up to them.

They don't publish guesswork, and whenever something is uncertain, they state so.

If blockchain analytics companies are able to identify, preferably with certainty and not probabilistically, stolen bitcoins, good for them and for the victims. But usually they can't be 100% certain unless the person they're after gives them enough hints.

[CoinClarity]

You're playing a game of semantics. "Mixing" is just a pleasant substitute for "laundering."

Ah, i see.

So anyone who wants to remain some privacy and mixes his coin is automatically laundering money.

Good to know that keeping things private is a crime in your eyes.

Hacker-owned BTC is now the vast majority of its use case volume, if it wasn't already. I'm sure a few people use it for non-criminal purposes, but they are in the minority.

An alternative is moving your coffee purchasing funds from your bigger wallet into a smaller one. Simple.

Remaining private 101.

Good job  

No.. honestly.. are you serious about that statement  

As far as opsec for interacting with a fictional coffee barista is concerned, yes. Just think about it for a second: You have a bitcoin stash that you are very concerned over. Now move 0.01 BTC of it to a different, day-to-day wallet that you use to buy your coffee. How is said barista going to know the stash wallet belongs to you? Even if they did (which they don't), what are they going to do about it?

Of course there's something you can do, and that is follow all 4 outputs.

Follow where ?
They already reached their destination.. They are being exchanged into money or another currency (e.g. monero) at that point.. from 4 seperate accounts.
You can not follow it anymore.

Please elaborate how you keep following them  

Certainly. If coins are being mixed in say, the manner of CoinJoin, certain patterns may emerge where half of the CoinJoin outputs are going. Maybe down the road the joined coins all reach the same destination, such as a common Binance deposit address or something. The thieves probably aren't that stupid, but its really not that hard to visualize a scenario where commonalities emerge between the destinations and/or movement patterns of mixed coins.

Bottom line: You are promoting a service thats overwhelming use is to help criminals launder bitcoin. No analogy to medicine or food or water changes this. ChipMixer confiscating the funds and returning them to Binance might.

[bob123]

Hacker-owned BTC is now the vast majority of its use case volume, if it wasn't already. I'm sure a few people use it for non-criminal purposes, but they are in the minority.

Do you have anything to back up these statement ?
Or is it just 'your feeling' ?

As far as opsec for interacting with a fictional coffee barista is concerned, yes. Just think about it for a second: You have a bitcoin stash that you are very concerned over. Now move 0.01 BTC of it to a different, day-to-day wallet that you use to buy your coffee. How is said barista going to know the stash wallet belongs to you? Even if they did (which they don't), what are they going to do about it?

By monitoring the address the 0.01 BTC are coming from.
With regular transactions going out to addresses which then are used to buy said coffee, it is not hard at all to combine one with the other.

Bottom line: You are promoting a service thats overwhelming use is to help criminals launder bitcoin. No analogy to medicine or food or water changes this. ChipMixer confiscating the funds and returning them to Binance might.

Again.. allegations without anything to back them up.
So.. ChipMixer scamming their customer would make them 'good' in your eyes? That's a delusional point of view.

[CoinClarity]

Hacker-owned BTC is now the vast majority of its use case volume, if it wasn't already. I'm sure a few people use it for non-criminal purposes, but they are in the minority.

Do you have anything to back up these statement ?
Or is it just 'your feeling' ?

Yes, I already quoted the segment of the article which backs this up:

Chipmixer was bombarded with inflow of the hacker's funds in the magnitude it never operated before. Because of this huge volume, it is correct to assume that any outflow coming from Chipmixer these days is likely related to the same owner.

As far as opsec for interacting with a fictional coffee barista is concerned, yes. Just think about it for a second: You have a bitcoin stash that you are very concerned over. Now move 0.01 BTC of it to a different, day-to-day wallet that you use to buy your coffee. How is said barista going to know the stash wallet belongs to you? Even if they did (which they don't), what are they going to do about it?

By monitoring the address the 0.01 BTC are coming from.
With regular transactions going out to addresses which then are used to buy said coffee, it is not hard at all to combine one with the other.

OK, so what are they going to do about it? Fictional coffee barista is also a robber and going to hold you at gunpoint for BTC they think are under your control? This is a ridiculous scenario. Can you please come up with a better one where your privacy is so important to you?

Bottom line: You are promoting a service thats overwhelming use is to help criminals launder bitcoin. No analogy to medicine or food or water changes this. ChipMixer confiscating the funds and returning them to Binance might.

Again.. allegations without anything to back them up.
So.. ChipMixer scamming their customer would make them 'good' in your eyes? That's a delusional point of view.

"Allegations" that thus far have not been disproven. Ball's in your court to logically refute Clain's article, which makes perfect sense to everybody reading it not wearing a ChipMixer signature and defending them in this thread.

I can't remember ever shedding a tear when a scammer got scammed. It would certainly mean they value ethics over money if they returned the stolen coins, would it not?

I'd find it much more compelling if somebody not promoting ChipMixer could counter Clain's claims, then perhaps it would consist of something more substantial than just casting doubt.

[Ucy]

Coin mixing services should probably consider blacklisting proven stolen coins? This could however make things hard for Bitcoin/Cryptocurrency users in the future. 
Guess there should be website that quickly list addresses with stolen coins so that Bitcoin wallets providers can investigate & blacklist them, then automatically prevent new addresses from accepting such coins.


This shouldn't affect Chipmixer ...Afterall most physical/online companies and people at one point in time receive tainted currencies (like cryptocurrencies or other kind of currencies) unknowingly. 

[figmentofmyass]

We detected an extensive pool of Chipmixer's addresses in the course of the previous investigations and can confidently maintain that at least 4836 BTC of the hacker's monies was laundered through Chipmixer...

Chipmixer was bombarded with inflow of the hacker's funds in the magnitude it never operated before. Because of this huge volume, it is correct to assume that any outflow coming from Chipmixer these days is likely related to the same owner.

Only 814 BTC had been output from ChipMixer as of the publishing of the article. That's the difference.

first of all, let's note that clain has provided precisely zero evidence for anything---you are just eating up their blog by the spoonful. nobody has verified any of this, and there are no reports of outputs being flagged by third party services.

second of all, assumptions, assumptions, assumptions:

We attempted to match the input and output addresses of Chipmixer to detect further movement of the stolen funds. We assumed the hacker would periodically need to merge segregated funds from the mixer to effectively control them. We believe there are other 814 BTC likely to share the same connection, but it needs be validated as soon as the funds start moving.

Not one word from anybody (except ChipMixer sig wearers) claiming - much less demonstrating - that their findings are untrue.

how could anyone demonstrate their findings are untrue when they have provided zero proof of anything? no verifiable data whatsoever? how does one poke holes in data that isn't public?

oh, but if you want more info about clain's consulting fees and their "capacities for crypto compliance", see the end of the blog for more info.