Mixin Network hacked - $200 Million lost

[BABY SHOES]

Today's breaking news - that Mixin Network's cloud database has been attacked resulting in the loss of several mainnet assets and that's what the official statement on Twitter says.
[1] https://twitter.com/MixinKernel/status/1706139175018529139

It is said that the incident occurred on September 23, 2023 and only today the founder of Mixin Network held a press conference at the media in Hong Kong time to reveal this problem occurred.

SlowMist as the blockchain security advisor will continue to own this case and they will provide updates.
[2] https://twitter.com/SlowMist_Team/status/1706133260869468503

Deposit and withdrawal services on Mixin Network have been temporarily suspended.

Other sources
https://watcher.guru/news/hong-kongs-mixin-network-hack-leads-to-200-million-loss
https://www.coindesk.com/tech/2023/09/25/mixin-network-losses-nearly-200m-in-hack/

[1714482864]

1714482864

[1714482864]

1714482864

[1714482864]

1714482864

[BitcoinGirl.Club]

Today's breaking news - that Mixin Network's cloud database has been attacked resulting in the loss of several mainnet assets and that's what the official statement on Twitter says.
[1] https://twitter.com/MixinKernel/status/1706139175018529139

It is said that the incident occurred on September 23, 2023 and only today the founder of Mixin Network held a press conference at the media in Hong Kong time to reveal this problem occurred.

SlowMist as the blockchain security advisor will continue to own this case and they will provide updates.
[2] https://twitter.com/SlowMist_Team/status/1706133260869468503

Other sources
https://watcher.guru/news/hong-kongs-mixin-network-hack-leads-to-200-million-loss
https://www.coindesk.com/tech/2023/09/25/mixin-network-losses-nearly-200m-in-hack/

That's a bad news for the business. I saw them on the forum and if I am not wrong then they have an active campaign too. As far as I can remember they hold only one key, so how it's possible to lose the assets if other keys are not exposed? The hacker defiantly got the data of all these users.

[PX-Z]

This is very unfortunate, i just found out this news earlier via mixin messenger. With that figures, i assumed that's if not most, that's all of their holdings.
I remember reviewing their service, the mixin safe. Good thing it wasn't up yet, although it was run with multisig i don't know if it will be affected if it's already up by this moment.

[BABY SHOES]

That's a bad news for the business. I saw them on the forum and if I am not wrong then they have an active campaign too. As far as I can remember they hold only one key, so how it's possible to lose the assets if other keys are not exposed? The hacker defiantly got the data of all these users.

I noticed that some were wearing Mixin Network signatures.
Where in their official thread there has not been any announcement including the Mixin Network representative has been inactive for the past few days.
Their thread: https://bitcointalk.org/index.php?topic=5459401.60

I don't know how their system works, is it just one key? Or is it a platform that controls it?

According to the article the mixin network is worth $1.1 billion.
With the official report: https://mixin.network/blog/2023/mixin-network-monthly-report-no.53/

Some blame it on the fact that they rely on a cloud that is vulnerable to hacking, so all their customers' assets are stored as a third party?

[Z-tight]

I saw them on the forum and if I am not wrong then they have an active campaign too.

Yeah, there is an active signature campaign for mixin safe.

As far as I can remember they hold only one key, so how it's possible to lose the assets if other keys are not exposed? The hacker defiantly got the data of all these users.

With how mixin safe operates, it is possible to mistake them for a multisig wallet, but they are not. When making a tx on mixin safe you'll need both the owner key and member's key, and they can also help you recover your wallet, but mixin safe is a custodial service with a centralized database and you lose control of your funds once you deposit it in a safe.

Some blame it on the fact that they rely on a cloud that is vulnerable to hacking, so all their customers' assets are stored as a third party?

Blame it on the fact that they have a single point of failure, and it has been exploited here, take note that mixin safe is a custodial service, so they control customers' funds.

[Beerwizzard]

The irony is that the big bold headline in the middle of Mixin website says "Secure Digital Assets and Messages on Mixin" and apparently it turned out that the platform itself is actually not secure.
It feels like everyone who is advertising his service with the accent on security or privacy is actually trying to fuck you up.  

[Die_empty]

That's a bad news for the business. I saw them on the forum and if I am not wrong then they have an active campaign too. As far as I can remember they hold only one key, so how it's possible to lose the assets if other keys are not exposed? The hacker defiantly got the data of all these users.

They have a running campaign and conducted one of the highest review campaigns in the forum. The Mixin review employed 100 members and paid the highest amount and members were even paid upfront. They have suspended both deposits and withdrawals which means customers will wait to get more information from the management.

The irony is that the big bold headline in the middle of Mixin website says "Secure Digital Assets and Messages on Mixin" and apparently it turned out that the platform itself is actually not secure.
It feels like everyone who is advertising his service with the accent on security or privacy is actually trying to fuck you up.  

It is better to take the risk of keeping your investment than to surrender it to a centralized firm. All those privacy adverts are just marketing strategies to attract customers. I have used their services, and although it was a little bit confusing everything worked perfectly. It is always important not to keep large funds in these custodian websites regardless of how trustworthy they look.

[Z-tight]

The irony is that the big bold headline in the middle of Mixin website says "Secure Digital Assets and Messages on Mixin" and apparently it turned out that the platform itself is actually not secure.

They were not going to tell their potential customers that they would lose money if they used their service, were they? It is not just about mixin safe only, but centralized services and platforms that have a single point of failure, the management may not be malicious and they might just want to render a service to people and make profit, but once there is a single point of failure it becomes very vulnerable to hackers who can exploit it and steal either funds or personal data.

Wasabi now funds a blockchain analysis company to spy on utxo's before they are allowed to participate in their Coinjoin or not, but they advertise themselves as the ultimate privacy solution, Binance says funds are safu when they can be hacked at anytime, so yeah, it is just PR and it is left for people to do their research about whatsoever service they are using.

[Beerwizzard]

The irony is that the big bold headline in the middle of Mixin website says "Secure Digital Assets and Messages on Mixin" and apparently it turned out that the platform itself is actually not secure.

They were not going to tell their potential customers that they would lose money if they used their service, were they? It is not just about mixin safe only, but centralized services and platforms that have a single point of failure, the management may not be malicious and they might just want to render a service to people and make profit, but once there is a single point of failure it becomes very vulnerable to hackers who can exploit it and steal either funds or personal data.

Wasabi now funds a blockchain analysis company to spy on utxo's before they are allowed to participate in their Coinjoin or not, but they advertise themselves as the ultimate privacy solution, Binance says funds are safu when they can be hacked at anytime, so yeah, it is just PR and it is left for people to do their research about whatsoever service they are using.

Sure. It is always possible that centralized wallet get hacked and if it happens, the project's team will have to take all legal actions to repay their users if they can. However, the point is in kind of a "Fake it till you make it" attitude towards their marketing where the team makes a headline claiming their project is safe as fuck highlighting the highest level of security and getting hacked.

In case with Binance, funds are safu not because they say it, but because it is not possible to steal all funds (they are not so centralized) and all losses would be repaid by Binance simply because they are fucking rich and can afford doing so. There is no accent on hacking impossibility.

[Z-tight]

In case with Binance, funds are safu not because they say it, but because it is not possible to steal all funds (they are not so centralized) and all losses would be repaid by Binance simply because they are fucking rich and can afford doing so. There is no accent on hacking impossibility.

Binance is a totally centralized exchange which can and has even been hacked previously, you are right that Binance hasn't had any 'major hacking' incident on its platform, but take note that no centralized exchange is too big to fail, not even Binance, and if a severe bank run happens in Binance for whatever reason or if Binance suffers a major hack, they would find it very hard to refund their customers.

You can only be sure of the security of your funds if you have adequately secured it in your self custody wallet, you should not trust a centralized exchange that operates through fractional reserve scam. If you store your funds in Binance, you better move it into your own self custody wallet.

[ajiz138]

They have a running campaign and conducted one of the highest review campaigns in the forum. The Mixin review employed 100 members and paid the highest amount and members were even paid upfront. They have suspended both deposits and withdrawals which means customers will wait to get more information from the management.

Shocking news!

I was one of the participants who took part in this review at that time, which was fine.
In other words, deposits and withdrawals are suspended - I checked in Mixin messenger and Mixin safe there was no warning whatsoever when clicking recieved/deposit, a little confused they didn't actually completely disable deposits and withdrawals.

It is better to take the risk of keeping your investment than to surrender it to a centralized firm. All those privacy adverts are just marketing strategies to attract customers. I have used their services, and although it was a little bit confusing everything worked perfectly. It is always important not to keep large funds in these custodian websites regardless of how trustworthy they look.

Yes, it's better to HODL it yourself than to hand it over, still leave it to them, it's a third party, even if there's a hacking disaster, we can't do much even though it's a web custodian.

[Faisal2202]

I was quite impressed by the Mixin network because I tested it out, but after hearing that they have been hacked and also lost $200 million, I am quite sad and impressed too. Because I did not think that the company would have gathered that much funds in their little timespan. I do know they are now new in the market, but we came to know about them recently.

I hope this is not another strategy to make themselves famous among others, because no other strategy would have gained them this much audience or attraction.

No wonder this strategy have drawbacks but they are for temporary, like with time, things will be cover in dust and people will forget about it and in some time like 2 or 4 years after, people will start to use it as of their first priority.

[AbuBhakar]

I was quite impressed by the Mixin network because I tested it out, but after hearing that they have been hacked and also lost $200 million, I am quite sad and impressed too. Because I did not think that the company would have gathered that much funds in their little timespan. I do know they are now new in the market, but we came to know about them recently.

The Mixin Safe is their new product but the Mixin company is not new since their launch their IDO during 2017 and manage to get huge funds from VC and other investors since Network project that time is very popular. This is really a huge loss since their company valuation is just 1B while the scam amount is 20% of their total asset plus their brand will surely be tainted with criticism since they promote asset safety.

It's really sad what happened to them since they are very generous to the forum through their campaigns here. I just hope that they recover lost funds from hackers since chain analysis is good now for tracking scam tokens.

[Faisal2202]

I was quite impressed by the Mixin network because I tested it out, but after hearing that they have been hacked and also lost $200 million, I am quite sad and impressed too. Because I did not think that the company would have gathered that much funds in their little timespan. I do know they are now not new in the market, but we came to know about them recently.

The Mixin Safe is their new product but the Mixin company is not new since their launch their IDO during 2017 and manage to get huge funds from VC and other investors since Network project that time is very popular. This is really a huge loss since their company valuation is just 1B while the scam amount is 20% of their total asset plus their brand will surely be tainted with criticism since they promote asset safety.

It's really sad what happened to them since they are very generous to the forum through their campaigns here. I just hope that they recover lost funds from hackers since chain analysis is good now for tracking scam tokens.

Oops, that was a spelling mistake, I wanted to write not but it was written as now, maybe Grammarly mistakenly autocorrected it. Well, I also knew that they are now new as during their review, I got to know a lot about them. And yes that's so unfortunate that they faced this hack and lost also now they will be criticized too. But what can be done now,

[bitmover]

Today's breaking news - that Mixin Network's cloud database has been attacked resulting in the loss of several mainnet assets and that's what the official statement on Twitter says.
[1] https://twitter.com/MixinKernel/status/1706139175018529139

It is said that the incident occurred on September 23, 2023 and only today the founder of Mixin Network held a press conference at the media in Hong Kong time to reveal this problem occurred.

SlowMist as the blockchain security advisor will continue to own this case and they will provide updates.
[2] https://twitter.com/SlowMist_Team/status/1706133260869468503

Deposit and withdrawal services on Mixin Network have been temporarily suspended.

It is very sad to see something like this to happen, specially when their service was so active here in bitcointalk community

On the other hand, we can see how custodial services are risky for both parts. The administration of Mixin is now responsible for third party funds that were lost, and the users who trusted them now lost their money.

I always say: keep your bitcoin in a hardware wallet. This is by far the most tested and the safest option

[Synchronice]

Their service is not easy to use, it's pretty hard and complicated for an average user and I really wonder, how was this project so popular? According to their website, more than $1B total value is secured and if we believe that, then roughly 1/5 of funds have been stolen.
By the way, even if funds are found, I don't think anyone will continue to use this service because the platform that has been promoting how secure it is, get's hacked easily, that means, they are everything other than secure.

[KingsDen]

Today's breaking news - that Mixin Network's cloud database has been attacked resulting in the loss of several mainnet assets and that's what the official statement on Twitter says.
[1] https://twitter.com/MixinKernel/status/1706139175018529139

This is just an irony of action. If I were to predict that any platform would be hacked any moment I would never includ mixin. Mixin came to the forum with the promise of security our bitcoin and possibly make it hereditary.  They also said that their system does not store people's private keys, rather they hold one of the keys, the customer hold one while the network friends hold one and in order to authorize transaction, atleast two of the three keys holders will have to approve. This means that for there to be a successful hack, the hackers got access to the mixin data base and also the customers data base which is bad.

I know mixin has been in existence for so many years, but they recently found their way to the crypto industry and are willing to dominate. But this hack will be a major set back to their reputation while many will lose confidence even after being refunded. I wish this never happened to them.

[Z-tight]

Based on my experience (reviewed Mixin safe few months ago), it's supposed to be custom multi-signature address with custom  spend condition (2-of-3 by default and your own key after some time).

I know that to spend on mixin safe you need to 'sign' the transaction from your owner's wallet and member's wallet, but it is surely not the typical self custodial multisig wallet that you'll create in a wallet like Electrum for example. A safe in mixin safe is custodial and you do not control the keys to your safe and the announcement after the hack shows they store these keys online, in the cloud, a single point of failure and a very bad option to secure this amount of money.

[NeuroticFish]

Based on my experience (reviewed Mixin safe few months ago), it's supposed to be custom multi-signature address with custom  spend condition (2-of-3 by default and your own key after some time).

I know that to spend on mixin safe you need to 'sign' the transaction from your owner's wallet and member's wallet, but it is surely not the typical self custodial multisig wallet that you'll create in a wallet like Electrum for example. A safe in mixin safe is custodial and you do not control the keys to your safe and the announcement after the hack shows they store these keys online, in the cloud, a single point of failure and a very bad option to secure this amount of money.

I was also expecting it to be proper multisig, and the system would keep one key of many, and the system would only help with interfacing the actual/real multisig operations with the messages/confirmations from the parties.
From the way the service was presented/packaged, it should have not had a sigle point of failure, unless they've done either a mistake either something fishy under the hood.

[Stedsm]

So a decentralised network got attacked because it was working on a centralised server if I'm not wrong?
Is there a possibility for the hackers to be traced and these $200 million be retrieved by them? Or is it a gone case completely?
I believe that some internal person is definitely involved in this, else how would the hackers be able to know about the wallets and how can they attack directly? Will keep a close watch to know what happens next here.
It's like saving your private keys on telegram that works through your phone number, some day your number gets discontinued due to not having enough recharge done by you and it goes to some other person and he/she just logs into your telegram (unknowingly) and sees what in the saved messages? Your private keys. Think.