Mixin Safe: A Convenient and Decentralized Multisig + MPC + Timelock solution

[Rruchi man]

How does "we're hacked, you can't withdraw" reduce worries?

It will not eliminate worry, but people can know what is happening instead of remaining in the dark.

[1714557964]

1714557964

[1714557964]

1714557964

[1714557964]

1714557964

[1714557964]

1714557964

[1714557964]

1714557964

[1714557964]

1714557964

[o_e_l_e_o]

The whole point of this "Mixin Safe" was that the recovery key held by Mixin themselves was only usable after a 90 day timelock, and that the owner of the safe could use the 2 keys available to them to move their funds at any time. Therefore this hack, loss of funds, and suspension of withdrawals and deposits should not affect Mixin Safe in any way. If it does, then someone has been lying at some point. Can anyone who is actually using Mixin Safe verify they can still access their coins?

Also, does someone want to explain how a "decentralized network" can have a single centralized database stored on Google's servers? I did point out earlier in this thread how basing this whole thing on a centralized altcoin was a bad idea, but no one seemed to care: https://bitcointalk.org/index.php?topic=5459401.msg62581204#msg62581204

Looks like they are going to launch another centralized shitcoin in order to cover the losses: https://www.theblock.co/post/252716/mixin-network-founder-says-just-half-users-assets-are-safe-after-200-million-hack

[LoyceV]

Also, does someone want to explain how a "decentralized network" can have a single centralized database stored on Google's servers?

Isn't "decentralized" just a buzz word for 99% of the companies that use it? I generally take it with a grain of salt.

[o_e_l_e_o]

Isn't "decentralized" just a buzz word for 99% of the companies that use it? I generally take it with a grain of salt.

Yup. I've been saying this for years:

There is a problem with a lot of exchanges using the word "decentralized" as a marketing tool and gimmick, when in reality they are not decentralized at all. Sites like LocalBitcoins and IDEX which claim to be decentralized, and yet users have to deposit coins to their custodial wallets and complete KYC. Complete nonsense.

This is also true of other terms such as "trustless" and "private/anonymous", and very worryingly now apparently "open source" as well. My point was more that even when you directly point out how services are in fact none of the things they claim to be, people just don't seem to care that they are being lied to their face and will continue to use those services, often ending in disaster.

[noormcs5]

Is the 200 million customers’ money? Are people serious about saving all this service?

That surprises me that people are using this Mixin Safe to store their cryptocurrencies and 200 million is not a small amount.

How does "we're hacked, you can't withdraw" reduce worries?

It will not eliminate worry, but people can know what is happening instead of remaining in the dark.

It is a usual thing that if any exchange/wallet is hacked, they may immediately block the withdrawal services to prevent further loss or people trying to withdraw everything that is left.

However, this is not an exchange and i thought this is a decentralized wallet and hence there should be practically no chance of hacking the funds/wallets unless the private keys of the wallets are stored with them.

[BlackHatCoiner]

It was a matter of time until this happened. Mixin is (or was?) one the worst Bitcoin companies when it comes to security. Everything was so much complicated without any reasoning given. At the time I used it to write a review, I just knew this wasn't going to work good, but it turned out that they were having about $400 million? How come they.

The whole point of this "Mixin Safe" was that the recovery key held by Mixin themselves was only usable after a 90 day timelock, and that the owner of the safe could use the 2 keys available to them to move their funds at any time.

Yeah... We are talking about a company that used 10 domain names for their services. I doubt the multi-sig feature existed on every single of them. I was able to spend bitcoin once, in one of their apps without any approval IIRC.


Edit:

Here we don't argue about the choice. Just focus on the project itself. No perfect security.

FTFY.

[LoyceV]

Is the 200 million customers’ money? Are people serious about saving all this service?

That surprises me that people are using this Mixin Safe to store their cryptocurrencies and 200 million is not a small amount.

I don't think the 200 million dollars came from "Mixin Safe", it's the "Mixin Network" that lost $200 million. According to https://safe.mixin.zone/, they're managing more than a billion dollars. That puts the losses around 20%, and my guess is that includes customer funds.

We build open source software that always puts security, privacy and decentralization first.

That didn't age well.

[Woodie]

Is the 200 million customers’ money? Are people serious about saving all this service?

That surprises me that people are using this Mixin Safe to store their cryptocurrencies and 200 million is not a small amount.

200 million gone, jeez the last couple of months has been rough on our crypto companies...

Talking of Mixin Safe, I want to believe this is an air-tight product especially since it's built around multisig and looking at the processes involved in getting to our coins...a hacker needs enough keys to be granted access i.e OWNER key/ MEMBERS key..

But seeing the discussion here alleging  Mixin Safe is safe, but why hasn't the mixin ecosystem adopted/integrated the multisig features all round to guarantee security?? Perhaps this is only for the end-users but inhouse its a different on this...

[examplens]

Is the 200 million customers’ money? Are people serious about saving all this service?

That surprises me that people are using this Mixin Safe to store their cryptocurrencies and 200 million is not a small amount.

I don't think the 200 million dollars came from "Mixin Safe", it's the "Mixin Network" that lost $200 million. According to https://safe.mixin.zone/, they're managing more than a billion dollars. That puts the losses around 20%, and my guess is that includes customer funds.

It is certainly the user's money, although real facts can be manipulated here.
In fact, I am most interested in whether these funds were time-locked. If they are, this hack completely devalues their service's meaning and the whole story.

[logfiles]

Is the 200 million customers’ money? Are people serious about saving all this service?

The 200 million is definitely partly or all customers' money, otherwise they wouldn't have paused the withdrawals and yeah, it's 2023 and people are still too foolish to keep all their money and life savings in custodial centralized exchanges/services. They never totally learned anything from evens as recent as the FTX or Celsius network scandals

I hope the mixin safe team took notes when a lot of members were not comfortable with how the services operated. Registering using phone numbers, the mixin messenger app centralized nature etc. maybe the hack will be an eye opener.

[serveria.com]

Is the 200 million customers’ money? Are people serious about saving all this service?

That surprises me that people are using this Mixin Safe to store their cryptocurrencies and 200 million is not a small amount.

I don't think the 200 million dollars came from "Mixin Safe", it's the "Mixin Network" that lost $200 million. According to https://safe.mixin.zone/, they're managing more than a billion dollars. That puts the losses around 20%, and my guess is that includes customer funds.

We build open source software that always puts security, privacy and decentralization first.

That didn't age well.

This, btw is the biggest crypto theft of 2023 up to date! What really happened? Perhaps someone from Mixin Safe can comment and clear things up? I really hope that's not money laundering or management running away with funds! 

[LoyceV]

It is certainly the user's money, although real facts can be manipulated here.

So halting withdrawals and the soothing words are only meant to prevent a bank run? I'd take my money out as soon as possible, before someone else takes it and there's nothing left.

[o_e_l_e_o]

That puts the losses around 20%, and my guess is that includes customer funds.

In the article I linked to above, the CEO said that only half of users' deposits would be unaffected. So yes, users' funds have been lost, and Mixin Network are now insolvent.

In fact, I am most interested in whether these funds were time-locked. If they are, this hack completely devalues their service's meaning and the whole story.

Why would they be? I don't know of any centralized exchange or service (which Mixin Network clearly is, despite claims to the contrary) which timelocks their own funds. They need access to their funds to process withdrawals. It is user funds in Mixin Safe which are supposed to be timelocked. (I've still not seen anyone say if they can actually access their funds, though. Was nobody actually using Mixin Safe?)

You can ask of course why the funds were stored on a Google cloud server or why they weren't protected with multi-sig, but I don't think they would ever be timelocked.

[examplens]

(I've still not seen anyone say if they can actually access their funds, though. Was nobody actually using Mixin Safe?)

As far as I know, they only recently came to the forum and most of the forum users heard about them for the first time then. It is certainly still new to Bitcointalkers.
They have their own messenger applications, I believe that's where most of the discussion about the actual problem is.

You can ask of course why the funds were stored on a Google cloud server or why they weren't protected with multi-sig, but I don't think they would ever be timelocked.

Well, I was more focused on this with the question, were the hacked funds protected with multi-sig or time-locked?

[serveria.com]

That puts the losses around 20%, and my guess is that includes customer funds.

In the article I linked to above, the CEO said that only half of users' deposits would be unaffected. So yes, users' funds have been lost, and Mixin Network are now insolvent.

In fact, I am most interested in whether these funds were time-locked. If they are, this hack completely devalues their service's meaning and the whole story.

Why would they be? I don't know of any centralized exchange or service (which Mixin Network clearly is, despite claims to the contrary) which timelocks their own funds. They need access to their funds to process withdrawals. It is user funds in Mixin Safe which are supposed to be timelocked. (I've still not seen anyone say if they can actually access their funds, though. Was nobody actually using Mixin Safe?)

You can ask of course why the funds were stored on a Google cloud server or why they weren't protected with multi-sig, but I don't think they would ever be timelocked.

Ok, no reason for the coins to be timelocked I agree, but I though that such considerable amounts (1/5 or 1/2 of all funds controlled by them) are being kept in a secure cold wallet. Losing funds from hot wallets makes me feel I'm back in 2013 or something.  

[o_e_l_e_o]

As far as I know, they only recently came to the forum and most of the forum users heard about them for the first time then. It is certainly still new to Bitcointalkers.

They paid 100 users to use and review their service. Did not a single one of these users continue to use the service afterwards? That's a pretty big red flag.

Well, I was more focused on this with the question, were the hacked funds protected with multi-sig or time-locked?

If they had been, then it is highly unlikely they would have been hacked. By all accounts, they were simply in a hot wallet, and a hot wallet stored in the cloud, no less.

Losing funds from hot wallets makes me feel I'm back in 2013 or something. 

Why? It happens on a near enough weekly basis. This hack is what, not even two days old, and already we've had another hack with Huobi losing $8 million in ETH. All centralized exchanges are the same. Rather than spend time, money, and resources to implement good security protocols, they play fast and loose with the security of your coins and the security of your data because they don't give a shit if you end up losing everything, as long as they line their pockets in the process.

[LoyceV]

They paid 100 users to use and review their service. Did not a single one of these users continue to use the service afterwards? That's a pretty big red flag.

I saw no reason to use this after my review. TL;DR: The privacy policy is a nightmare, the 6 digit PIN security is questionable, the withdrawal fees are very high (50 to 8800 times the on-chain fee), the overall feeling was confusing. The claims (1 million dollar transaction volume on average from each of the 1 million users) unbelievable. Lots of buzz words, but no information on how to recover funds. I don't want social contacts for emergencies. Even normal withdrawals were very complicated, and after testing the whole thing feels custodial.

I see no reason why anyone would ever use this:

From all the reviews I've done, this one was by far the furthest out of my comfort zone. I had no idea what I was doing when I started. I can only imagine this is worse for Bitcoin newbies.

[serveria.com]

Losing funds from hot wallets makes me feel I'm back in 2013 or something.  

Why? It happens on a near enough weekly basis. This hack is what, not even two days old, and already we've had another hack with Huobi losing $8 million in ETH. All centralized exchanges are the same. Rather than spend time, money, and resources to implement good security protocols, they play fast and loose with the security of your coins and the security of your data because they don't give a shit if you end up losing everything, as long as they line their pockets in the process.

Because of the scale, the amount of coins stolen. So far this is the biggest Bitcoin theft in 2023. Of course, you can't avoid hot wallets they are necessary to operate normally (and companies are losing these relatively small amounts from time to time) but keeping 1/2 or 1/5 of entire customers' funds in a hot wallet doesn't look like a good idea (unless of course you don't want them to be stolen for some reason).  

[Igebotz]

Also, does someone want to explain how a "decentralized network" can have a single centralized database stored on Google's servers?

Isn't "decentralized" just a buzz word for 99% of the companies that use it? I generally take it with a grain of salt.

Yeah it's decentralized but we contacted google for help. Hahah

We are so decentralized but we store customers Private keys on google cloud, if this is not an inside job then I don't know what is it. Rugpull! Nothing was hacked.

[dkbit98]

I am looking to see the announcement by the mixin team. These are kind of experiences that make a project stronger

I understand you are wearing their signature and you worry only about your payment, but your comment is nothing else than a pathetic excuse

Is the 200 million customers’ money? Are people serious about saving all this service?

We don't know any details until they release it, but I remember when I was testing their service I found out that wallets that hold coins are centralized.
I am not surprised that hack like this happened, but I am really surprised with amount of money they lost, $200 million would seriously affect even the biggest centralized exchanges.

This is what I wrote in my Mixing review:

I really don't understand exact purpose for this much complications for beta software that can hold maximum $1000 with risk of losing it all because of some bugs.

https://bitcointalk.org/index.php?topic=5460259.msg62661917#msg62661917

PS
Not your keys, not your coins, and stick to good old multisig setup.