➡️➡️ [ANN] | [banned mixer] | BITCOIN MIXER ⬅️⬅️

[Faisal2202]

Thanks to all the testers, we've tried to resolve all possible issues, and a tremendous amount of work has been done.
We look forward to the second round of testing!
Thank you all!

I am amazed to see the work you guys have put and I can see the devotion, I am excited to use this mixer again, with all new improvements. I am very happy to hear that, my suggestions were of great help. Your feedback meant a lot, I don't think I see something like this before. You guys did great work. And keep the spirits up 

[AHOYBRAUSE]

The site definitely shows a lot of improvement now, great work.

It is also nice to see that you took all the suggestions and tried to implement them as best as possible. We also appreciate the update here.
As Faisal stated, I have also never seen so much work put into something after asking for some reviews here. That really shows your devotion.

[tumbler.io]

[banned mixer] launches the [banned mixer] Mixer Review#2!
Leave your applications and take part.
We are looking forward to confirming the list of members.
Good luck to all the applicants!

[BlackHatCoiner]

JavaScript (JS) plays a crucial role in maintaining the security and anonymity of our project. Without JS, the level of anonymity and functionality we offer could not be fully realized.

Could you please explain how front-end Javascript enhances user's anonymity? As far as I know, it can only hurt it: https://tor.stackexchange.com/a/21987. And if you don't mind, how it protects the server's anonymity?

This conclusion is incorrect. We have implemented all the necessary security headers, including the Content-Security-Policy header, since the launch of our project. You can verify this here https://securityheaders.com/

Apologies. You have indeed implemented Content Security Policy:

content-security-policy
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; object-src 'none'; media-src 'self'; img-src 'self' data: 'unsafe-inline'; frame-src 'none'; font-src 'self'; connect-src 'self'

Please note that the funds you received were from an address with a much larger sum than you requested for withdrawal. By structuring our pool into levels and using various sources of coins, we aim to protect our pool from de-anonymization, making it more costly to attack. This approach enhances the overall security and privacy of our service.

The funds I received in the second mixing were literally taken by the change of the first mixing. That is absolutely unacceptable if I'm requesting from your service to have my coins received in multiple addresses. The whole point of using multiple addresses (AKA, split mixing), is to not reveal common ownership.

[dkbit98]

[banned mixer] launches the [banned mixer] Mixer Review#2!
Leave your applications and take part.
We are looking forward to confirming the list of members.
Good luck to all the applicants!

Are there any significantly big changes and improvements with your service from last time you organized review campaign?
First review campaign was only few months ago if I remember correctly.

[hugeblack]

❎ Using the Tumbler Code is essential to avoid such issues. You can find information about it in various sections on our website.

Since it will not be removed, is there a guarantee that the lifetime discount does not affect privacy.

The problem was that I did the mixing process twice, two minutes apart. I completed the first, and after two minutes, a new mixing process began with the same value as the previous one. The problem was that I got my coins from the address of the previous mixing process. In other words, you either have a software problem or you have a problem with the reserves.


I have visited the site and there are updates, will try to test it again and I wish you success.

[AHOYBRAUSE]

[banned mixer] launches the [banned mixer] Mixer Review#2!
Leave your applications and take part.
We are looking forward to confirming the list of members.
Good luck to all the applicants!

Are there any significantly big changes and improvements with your service from last time you organized review campaign?
First review campaign was only few months ago if I remember correctly.

Actually the first review campaign was exactly 3 weeks ago, not a few months.
And yes, they made a lot of changes already, I had a quick look some days ago and many addressed problems have been given improvements.

I also applied for the 2nd review campaign, maybe I can test it again but if not that's fine.

[tumbler.io]

I apologize for the delays in responses; to be honest, project tasks take precedence at the moment.

BlackHatCoiner,
Could you please explain how front-end Javascript enhances user's anonymity? As far as I know, it can only hurt it: https://tor.stackexchange.com/a/21987. And if you don't mind, how it protects the server's anonymity?

JavaScript plays a crucial role in the operation of our service. Apart from handling backend security against DDoS attacks, complicating the creation of phishing sites, and enhancing usability, the use of JavaScript allows us to maintain a "competitive advantage in terms of security and anonymity" for both us and our clients. Security experts, upon a thorough "review" of the project, will understand the specifics of what is being discussed. It doesn't make sense to publicly disclose all the security methods of our project.

BlackHatCoiner,
The funds I received in the second mixing were literally taken by the change of the first mixing. That is absolutely unacceptable if I'm requesting from your service to have my coins received in multiple addresses. The whole point of using multiple addresses (AKA, split mixing), is to not reveal common ownership.

As mentioned earlier in the report, we have made changes to this section. Now, for a specified period, deposit funds are temporarily held for all clients.

dkbit98,
Are there any significantly big changes and improvements with your service from last time you organized review campaign?
First review campaign was only few months ago if I remember correctly.

@icopress ...

hugeblack,
Since it will not be removed, is there a guarantee that the lifetime discount does not affect privacy.

We have provided a detailed explanation of how the Tumbler code operates in previous messages. Unlike the "conventional" approach, our method is secure.

hugeblack,
The problem was that I did the mixing process twice, two minutes apart. I completed the first, and after two minutes, a new mixing process began with the same value as the previous one. The problem was that I got my coins from the address of the previous mixing process. In other words, you either have a software problem or you have a problem with the reserves.

As mentioned in the report earlier, we have made changes to this section. Now, for a specified period, your deposit funds are temporarily locked for all clients.

Before, if you didn't use the tumbler code and sent coins in a similar amount to a prior deposit, your coins could be selected for payment to another client, possibly you.
and this is perfectly reasonable, logical, and correct...

AHOYBRAUSE,
I also applied for the 2nd review campaign, maybe I can test it again but if not that's fine.

Thank you for your previous review. Like all our other contributors, you've played a part in improving our project
Now, we'd like to hear feedback from new testers.

[tumbler.io]

The questions and suggestions from the testers of the first and second Review are collected below.

Faisal2202

"Whenever I write something and want to send it I have to click on the send button, while it should also be done by clicking enter key on the keyboard, it also did not work with shift+Enter. Which means, we have to click via mouse on the send option."

✅✅✅ Added this feature.

mikeywith

Leave us a message
An error has occurred. Please refresh the page and try again.

✅✅✅ This error might occur if you try to leave a page while a form is still loading. We've added a warning to address this situation.

The (Please, download the letter of guarantee before a transfer) is hardly noticeable, it must be more visible than the deposit information.

✅✅✅ We added an icon to highlight this text

- The tumbler code is somewhere at the bottom of this page, very easy to miss if you don't scroll down and honestly I almost forgot about it since my attention was on the deposit process, the page has a ton of blank space at the top, alongside the logo and steps icons at the top, all of which are taking a lot of "wasted" space

-I think this page should be squeezed to fit a single screen without having to scroll down, where everything needed (Letter of Guarantee + Deposit status + tumbler code appears in the same height level without needing to scroll)

✅❎ We use adaptive web design to ensure pages look consistent in modern browsers our clients use. Usability tests guided information block placement. We'll keep testing new layouts, potentially modifying some blocks in the future.

No easy way of entering the order number should one close the page by mistake, if someone doesn't pay enough attention to the URL which contains the order number /order#JTPFXE5B-ABCDE then it will be hard for them to go back to the same order without contacting the support team.

✅✅✅ The full page address is repeated in the letter of guarantee. A separate page for entering the order ID seems unnecessary to us.

1. Despite receiving the transaction the timer is still running on the order page as if it's still yet to come.
2. However, the timer on the website is showing 1h.17mins (not sure why)

❎ ! Unable to reproduce this error. There may have been connection interruptions between your browser and our website.

The warning that says after the deposit is made:
If one of the outputs has a round value (like exactly 0.1 BTC) — this output can be considered as the recipient. Instead of sending 0.1 BTC, send for example 0.100124.

Is pretty useless at this point, it should show on the first page, and then again on the top of the deposit page not at the bottom, now since you can't control what the user sends, you could at least control what you send by slightly modifying your 0.0002 BTC fee to make it in a dynamic range of say 0.000015 - 0.0002

✅✅✅  We cannot and should not alter the final incoming amount.
If a user wishes to receive exactly 0.001, it is their choice. We merely provide a warning about how such a transfer will be treated.
For instance, if they need to pay for a service that requires an exact amount, altering it would cause problems.

! Additionally, the calculator is available at every mixing stage, providing a warning about the recommended transfer amount just before the transfer.

1- You consolidated 3 smaller outputs that were not needed

✅✅✅ I don't find anything suspicious. In fact:

1. I can't identify the recipient here (similar to Blockchair).
2. This isn't the usual mixer behavior; typically, it follows a 1-2 pattern.

Excellent work!

This input > bc1qkpgugjv55lp0my23m0txn0azww5rvxwyf8qh5p of 0.00022350 is clearly the change address of this transaction
https://blockchair.com/bitcoin/transaction/29cecb7abf2b2455ac842f0f2ca20bc64eeafa650244f100dc2ec248549de845
Which came from this address bc1qmtxzrvnzr3ryak5jeprz3eqqsgpq9t4hzvd2g5

✅✅✅ You know that you used a mixer, so it's likely to assume that the addresses from which the funds were received also belong to the mixer and could have been used for payouts before, possibly including you.
Still, it's very suspicious, possibly a negative experience. Noted.  

I don't like the security level options, it's complicated for the average user, and there should be only one type of mixing, a mixing that works, and the fees to be different only in regards to the outgoing transaction network fee, not that actually privacy result.

✅✅✅ We believe it's a great feature. More details are available in the FAQ section.

The website should be translated into more languages, personally, I'd like to see it support Arabic.

⌛⌛⌛ Added to the task list.

[mikeywith]

1. I can't identify the recipient here (similar to Blockchair).

You certainly can for the transactions that had these 3 small inputs, in other words, you revealed the recipient address of my first mix.

more details:

This was my first mix

https://blockchair.com/bitcoin/transaction/29cecb7abf2b2455ac842f0f2ca20bc64eeafa650244f100dc2ec248549de845

this was my address

Code:

bc1qpshee3qva79zxqllgm8z7lxtk556793c4crhkj

and this was the change address owned by you

Code:

bc1qkpgugjv55lp0my23m0txn0azww5rvxwyf8qh5p

up to this point, it's very difficult to tell which address was the change address.


And then there is this mix (not mine)

https://blockchair.com/bitcoin/transaction/6d08da9665e39843ffd02d67d544e030f8ca3e4f82910a74299debbe13bab0ae

and this (not mine)

https://blockchair.com/bitcoin/transaction/4b376658c9932523c06055facd620cfe243042bfc51e6697249467fbaf194f9f


All the way before the last transaction, we had no way of telling what the change address was for all of these 3 mixes, but now after this transaction

https://blockchair.com/bitcoin/transaction/c9a3b09f602b02c433f11fed1e5cc5c1e1207c8c71b34539b0e01445eb04f2db

We know that these 3 inputs belong to the same person, and thus in all of the 3 previous transactions the other 3 addresses were not the change addresses.

So now I know this address

bc1qpweug4vt3pqxfyrl48huppeuhy0xl59c235jxh

and this address

bc1qscpqkpclc6vrucwfmznfzpak4r8942xhvcc2w4

were the recipients of those two transactions, you revealed this piece of info to me for no apparent good reason (or at least one which I don't see).

had you not consolidate those 3 inputs in a mixed transaction that I received, I wouldn't be able to tell the change address of the other 2 addresses (which I don't own)

Obviously, I don't know of other ways to consolidate those small inputs on-chain without revealing the same thing, eventually, when they are consolidated you would reveal the change address of all the other transactions in the same manner, it would just be harder to analyze this information had you waited a little longer before consolidating.

Furthermore, the transaction behavior itself looks suspicious, a normal transaction from a normal wallet would have only included the large input which was larger than the desired output, and the 3 smaller outputs were not even enough to match that anyway.

I do understand that most mixing isn't done so that nobody can tell it's a mixer transaction, the goal is to break the connection between the coins you send and the coins you receive, which you did manage to achieve based on my analysis, I just think that if someone is digging deeper to find out all of this info, it would be wiser to make things more difficult for them even by a small degree.

 

[tumbler.io]

BlackHatCoiner,
Again, not strong anonymity.

First off, we're not a CoinJoin mixer.
We operate on a client-to-client basis.
When a user opts for the "premium" level, investor coins are added to the pool.
Let's make a note of that!

Next, I'm not quite following your suggestions regarding improving anonymity.

Our current mixer setup completely severs the connection between your coins.
You might see past transactions from the payout address, but those aren't your coins, right?

Let me let you in on a "secret": when using the Tumbler code, you're guaranteed not to receive your own coins back, even after a thousand "payout-change" iterations.
Even if your coins were partially transferred to another client, using the Tumbler code ensures you'll never get back the coins that remained in the service as change. To me, that sounds pretty fantastic, not "not strong anonymity".

You're deeply mistaken if you think you can achieve the same level of anonymity just using your own wallet. Mathematically, it's just not possible.

First off, our current mixer pool already contains hundreds of addresses with various balances. After testing, that number will soar into the thousands. Try mixing any amount different from your last transaction, and you'll see entirely different addresses. Of course, when testing with amounts like 0.001 BTC, the service won't pay you from an address with a 1 BTC balance. It adjusts according to your amount. In this context, it's plausible that without using the Tumbler code, you might come across your old address someday.

The solution is in place; for maximum anonymity, use the Tumbler code.

THE ESSENCE OF A GOOD MIXER IS TO HAVE A LARGE COIN POOL AND A SYSTEM THAT PROPERLY DISTRIBUTES COINS AMONG CLIENTS.

At present, we only use 10 BTC, but after testing, we'll SIGNIFICANTLY expand the pool. As for the system, it's fully implemented.

From what I gather, you suggest a "payout -> coinjoin -> payout" scheme? That's a pretty bad idea. Not a single verified exchange will accept your coins. The UniJoin mixer already operates on this scheme: after mixing with them, your coins will instantly be flagged with a 97% risk on the AML bot and similar systems, marked as "COINJOIN". CoinJoin schemes are easily detected, and such coins will attract undue attention. Tx.

You've got the MixTum mixer in your signature. I assume nobody forced you to promote that particular mixer, so it's a conscious choice, right? Did you test it before showcasing it in your signature? That mixer sources its payouts from the Huobi exchange, and what's more, all client payouts come from a single address with a "large balance", until it's depleted. Test it for yourself – due to the significant initial balance, you can track their payout history for several weeks! Is that what you call anonymity?

And with that, I'm directly addressing your question about the 0.0002 BTC fee for each receiving address.

In our case, to get a list of all our current addresses (to stage an attack on our pool), one would need to make hundreds of orders with different amounts, paying roughly $5+ for each payout, plus the service fee (and that wouldn't even scratch a tenth of our pool post-testing). Given that different security levels have separate coin pools, such an attack becomes extremely costly. No analytics-type organization will bother with that.
Using your mixer as an example: to de-anonymize all its users in recent weeks, it would take $10-20, right?

Trust us, we've explored all possible operational methods, scrutinized "every competitor" out there.
Our current system is the only one that truly works without any harmful side effects, and most importantly,
it's a real thorn in the side for analytic companies.

[tumbler.io]

I do understand that most mixing isn't done so that nobody can tell it's a mixer transaction, the goal is to break the connection between the coins you send and the coins you receive, which you did manage to achieve based on my analysis, I just think that if someone is digging deeper to find out all of this info, it would be wiser to make things more difficult for them even by a small degree.

Analyzing blockchain transactions becomes significantly easier once it's known that you've used a mixer . Naturally, this grants access to scrutinize past transactions. However, in most cases, after just the second iteration, it becomes challenging to distinguish between the recipient and the change.

Purely mathematically, for a more paranoid approach, using CoinJoin after each payout is tempting to ensure there's no chance of reviewing clients' past transactions.

But here, two immediate issues arise:

1. In this operation, you're immediately exposing not one client of the mixer but hundreds (Example Tx).
2. Your coins will receive a 100% risk rating in AML bots and similar systems, making them unacceptable to any verified exchange or trading platform.

An effective mixer's goal is to disconnect your old and new coins, and we achieve this fully.

[tumbler.io]

🔥👍 We've finished a significant update.
Our system now considers all the heuristics listed on the Blockchair website (100+ indicators).
This means that Blockchair (or anyone else) can no longer determine the recipient's address or where the change went when analyzing our transactions.

[BlackHatCoiner]

it's a real thorn in the side for analytic companies

We're having a disagreement in a fundamental level; you're buying the notion that coins are tainted. Every action of your service is done under the premise that the mixed coins must be treated as "non-tainted" by blockchain analysis companies. I don't buy that notion, and don't interact with services that will deem my coins as that. Usually, they're just centralized exchanges, which I avoid as I trade decentrally.

To me, the point of a mixer is to make it as hard as possible for a third party to tell which outputs correspond to which inputs. Period. "AML scores", "tainted coins" and the like, are all inaccurate, made-up nonsense that undermine Bitcoin as currency and attack our privacy.

Using your mixer as an example: to de-anonymize all its users in recent weeks, it would take $10-20, right?

Revealing which addresses belong to a mixer doesn't hurt its clients anonymization, just as revealing which inputs are coinjoined doesn't make the outputs de-anonymized. It's just making it apparent that the clients used a mixer / coinjoined, which in the eyes of chain analysis that is deemed as "tainting". Otherwise, I strongly recommend you to get rid of a competitor with just $20 in expenses.

[tumbler.io]

To me, the point of a mixer is to make it as hard as possible for a third party to tell which outputs correspond to which inputs.

In the current reality, it's no longer easy to just rely on CoinJoin. You use decentralized exchanges without KYC, which makes CoinJoin a suitable option for you. But how many share your situation? Maybe just 0.01%?

"AML scores", "tainted coins" and the like, are all inaccurate, made-up nonsense that undermine Bitcoin as currency and attack our privacy.

I agree, but that's the situation right now. Sadly, we might eventually see miners being mandated to include transactions only from verified sources in blocks

CoinJoin doesn't sever the link between your old and new coins.

For example, you have 1 BTC, and it's publicly known to belong to you. I also have 1 BTC, publicly known to be mine. After a CoinJoin transaction to 10 addresses (0.2 coins each), all 10 addresses receive the marker "Yours and Mine" (50/50), but this doesn't mean the marker disappears.
This is why CoinJoin services function without a hitch; it's just too easy to monitor them.

In our case, the connection is entirely severed.

[BlackHatCoiner]

You use decentralized exchanges without KYC, which makes CoinJoin a suitable option for you. But how many share your situation? Maybe just 0.01%?

I don't know the number. What I do know is that it's our responsibility to educate newbies about these solutions, and to not give up everything on their naivety. We should not be endorsing the usage of a service which is treating the currency as non-fungible with evidently inaccurate data.

I agree

You don't agree when you're running a business which is based under the premise that taint exists. You're supporting it.

I won't derail this further. It's just sad how some people don't appreciate the censorship resistance this network provides in such efficient and effective manner.

[tumbler.io]

It's just sad how some people don't appreciate the censorship resistance this network provides in such efficient and effective manner.

To some extent, we've implemented what you need. In reality, please test our service in one month, and you'll see that previous transactions will no longer have the same obvious 1-2 pattern. It takes time to create pools and make transactions less conspicuous. Notice that in your review, you mentioned transactions that occurred before the update. We cannot modify the blockchain.

[Synchronice]

To me, the point of a mixer is to make it as hard as possible for a third party to tell which outputs correspond to which inputs. Period. "AML scores", "tainted coins" and the like, are all inaccurate, made-up nonsense that undermine Bitcoin as currency and attack our privacy.

It's clear that AML scores are made up bullshit but that is how it is. When you play their game, you have to follow their rules. I think there are too many people that use centralized exchanges because they are fast, easy to use and offer many services that you can't find on DEX.
So, in the end, many people prefer their coins to be clean without tag that it was mixed, because, mixing sounds bad.

Revealing which addresses belong to a mixer doesn't hurt its clients anonymization, just as revealing which inputs are coinjoined doesn't make the outputs de-anonymized. It's just making it apparent that the clients used a mixer / coinjoined, which in the eyes of chain analysis that is deemed as "tainting".

It doesn't hurt your anonymity but it hurts you when you want to use centralized exchange. I know, solution is to use DEX but here we talk about people, tons of people who use CEX. You can't force people to use DEX, right? So you have to adapt your service.

[BlackHatCoiner]

Notice that in your review, you mentioned transactions that occurred before the update.

To which update are you referring to?

I know, solution is to use DEX but here we talk about people, tons of people who use CEX. You can't force people to use DEX, right? So you have to adapt your service.

Let's ignore for a moment that buying "taint" is harmful for Bitcoin, and that we should opt out using services which treat the currency in such an unfair manner. How do you adapt into something completely non-transparent?

That is a question for [banned mixer]. How do you make sure that your "AML scoring" is acceptable? From the link I mentioned above, the chairmen of chain analysis companies have clarified they won't let anyone audit their software code. You practically have no manner to confirm that they won't be flagged by the chain analysis software, as you don't even know which software is used in the first place. Binance might be using software X, Huobi software Y, Kraken Z etc. We frequently notice coins being deemed as "tainted" from one exchange, and at the same time "clean" by another.

[tumbler.io]

To which update are you referring to?

https://bitcointalk.org/index.php?topic=5467457.msg63044753#msg63044753

That is a question for [banned mixer]. How do you make sure that your "AML scoring" is acceptable?

We have already answered this question above.

✅ Our platform is not designed for satisfactory results in systems like AMLBot.
Conduct an experiment, connect 10 different addresses of yours with another 10 new addresses in your wallet in one transaction, after which each address in your wallet will have a 97% risk according to AMLBot's assessment. In this case, the AMLBot system will think that you were trying to use CoinJoin technology. Do you think this is a fair risk assessment?

We are sure (through testing) that using CoinJoin "completely" is not possible because it becomes a 100% pattern in systems like AML bot and Chainalysis. After today's update, our system uses a hybrid approach, but it will take time for you to notice the difference as new transaction chains are formed.

We're not trying to achieve a favorable AML score by giving up full CoinJoin. We're adapting to the current situation. Everyone has learned to detect it and label those transactions negatively. Why bother with that? We can take a different approach.