[ANN] BitMixList.org - Bitcoin Mixer List

[icopress]

I'll leave this here (regarding Ym/Cr) ^{[google translator should do a great job through the camera]}.

XSS is a kind of closed party for hackers, a forum where about 500 users are always online (on Bitcointalk it’s even less). Almost all commercial activities are insured by deposits (deposits that are kept by the forum administrators). As a result, any accusations of fraud are considered by the treasurers (I think you understand that these people have a basic understanding).

YoMix used this forum for advertising for many years and had a deposit of 1 Bitcoin. In addition, the YoMix thread was pinned in the services section. This whole conversation boils down to the fact that after the accusation of fraud was published, and after the treasurer of the forum examined the case, the deposit was confiscated and yomix was banned.

In addition, moderator  xss "bratva" notified everyone that shortly before this, the official YoMix account withdrew a deposit from another forum called "Exploit" (any mixer who wanted to conduct marketing activities had to make a deposit that would cover any claims).

Among other things, user grozdniyandy reported that the YoMix domain was on the same IP address with some other mixer domains, including digital ones (from which we can conclude that they belong to the same person). A little more than 2 weeks later, the same user reported that YoMix had changed the server.

There are some more mentions on Reddit, but I think the complaints posted on xss are enough.

In addition, delving into this case, I was able to talk to some people whose level of knowledge is colossal. And they shared information that sinbad was not confiscated by the authorities, saying that this was just a very well-developed trick to relieve tension. Which is quite logical... considering that chainalysis reported that after the closure of sinbad that YoMix's turnover increased 5 times. Secondly, this was the first time that a stub was placed in the site’s corporate style (some people appreciated LZ’s humor).

[1714483628]

1714483628

[1714483628]

1714483628

[1714483628]

1714483628

[1714483628]

1714483628

[1714483628]

1714483628

[dkbit98]

In addition, delving into this case, I was able to talk to some people whose level of knowledge is colossal. And they shared information that sinbad was not confiscated by the authorities, saying that this was just a very well-developed trick to relieve tension. Which is quite logical... considering that chainalysis reported that after the closure of sinbad that YoMix's turnover increased 5 times. Secondly, this was the first time that a stub was placed in the site’s corporate style (some people appreciated LZ’s humor).

Thanks for posting screenshots with more information, but I don't understand this last part.
I can't be certain what exactly happened and if something was staged and fake, but I looked for government sources in the time that incident happened.
There was official statement from US state department claiming they sanctioned and seized sinbad, and U think there was even a seizure number posted somewhere:

"The Federal Bureau of Investigation has seized the service in accordance with a seizure warrant pursuant to 18 U.S.C. 981 and 982 as part of a coordinated international law-enforcement operation."

https://home.treasury.gov/news/press-releases/jy1933
https://www.bleepingcomputer.com/news/security/us-seizes-sinbad-crypto-mixer-used-by-north-korean-lazarus-hackers/

But looking at this again now, and maybe it was just sanctioned, not actually seized.

[Bitcoin_Arena]

Thanks for posting screenshots with more information, but I don't understand this last part.
I can't be certain what exactly happened and if something was staged and fake, but I looked for government sources in the time that incident happened.
There was official statement from US state department claiming they sanctioned and seized sinbad, and U think there was even a seizure number posted somewhere:

"The Federal Bureau of Investigation has seized the service in accordance with a seizure warrant pursuant to 18 U.S.C. 981 and 982 as part of a coordinated international law-enforcement operation."

https://home.treasury.gov/news/press-releases/jy1933
https://www.bleepingcomputer.com/news/security/us-seizes-sinbad-crypto-mixer-used-by-north-korean-lazarus-hackers/

But looking at this again now, and maybe it was just sanctioned, not actually seized.

Now this reminds me of the account that registered here and posted about the seizure even before any member in the forum got to know about it.

Could they have premeditated the whole move? 

[bitmover]

In addition, delving into this case, I was able to talk to some people whose level of knowledge is colossal. And they shared information that sinbad was not confiscated by the authorities, saying that this was just a very well-developed trick to relieve tension. Which is quite logical... considering that chainalysis reported that after the closure of sinbad that YoMix's turnover increased 5 times. Secondly, this was the first time that a stub was placed in the site’s corporate style (some people appreciated LZ’s humor).

Thanks for posting screenshots with more information, but I don't understand this last part.
I can't be certain what exactly happened and if something was staged and fake, but I looked for government sources in the time that incident happened.
There was official statement from US state department claiming they sanctioned and seized sinbad, and U think there was even a seizure number posted somewhere:

"The Federal Bureau of Investigation has seized the service in accordance with a seizure warrant pursuant to 18 U.S.C. 981 and 982 as part of a coordinated international law-enforcement operation."

https://home.treasury.gov/news/press-releases/jy1933
https://www.bleepingcomputer.com/news/security/us-seizes-sinbad-crypto-mixer-used-by-north-korean-lazarus-hackers/

But looking at this again now, and maybe it was just sanctioned, not actually seized.

This is interesting, the US government do not mention the word "seized", they used the word sanctioned.

WASHINGTON — Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Sinbad.io (Sinbad), a virtual currency mixer that serves as a key money-laundering tool of the OFAC-designated Lazarus Group, a state-sponsored cyber hacking group of the Democratic People’s Republic of Korea (DPRK).

But I remember sinbad saying that they were still operational, even after all that, and then theymos banned the mixers.

[hugeblack]

Thanks for sharing, is the registration for XSS available?

In addition, delving into this case, I was able to talk to some people whose level of knowledge is colossal. And they shared information that sinbad was not confiscated by the authorities, saying that this was just a very well-developed trick to relieve tension. Which is quite logical... considering that chainalysis reported that after the closure of sinbad that YoMix's turnover increased 5 times. Secondly, this was the first time that a stub was placed in the site’s corporate style (some people appreciated LZ’s humor).

I tend to not agree with this, Sinbad.io(not .onion) was seized and registration data for Sinbad.io similar to what happened with Chipmixer + we have a screenshot from the @fyodnederland account



Back-End and mixer Bitcoins were not confiscated.



As it seemed, they were planning to create .onion sinbad link and turned into darket-Mixer but and after the signature campaign was included in the sanctions list, they used Yomix instead.

[examplens]

In addition, delving into this case, I was able to talk to some people whose level of knowledge is colossal. And they shared information that sinbad was not confiscated by the authorities, saying that this was just a very well-developed trick to relieve tension. Which is quite logical... considering that chainalysis reported that after the closure of sinbad that YoMix's turnover increased 5 times. Secondly, this was the first time that a stub was placed in the site’s corporate style (some people appreciated LZ’s humor).

I tend to not agree with this, Sinbad.io(not .onion) was seized and registration data for Sinbad.io similar to what happened with Chipmixer + we have a screenshot from the @fyodnederland account

I would say that what icopress claims is closer to reality than everything that was finally presented here.

Whoever is behind the @fyodnederland account knew things very well on Bitcointalk. The only address recognized as a connection to sinbad is the escrow address from the sig. campaign, with a fairly small amount of around $10k at the time.
The image used as the seizing page and also in @fyodnederland posts is from sinbad Price Prediction Challenge Used only once in this topic.
Not to mention how quickly the @fyodnederland account was registered to post all these things. I got the impression that they posted it here before the people behind sinbad found out that their site was seized.

The only similarity with chipmixer is that the index page on the clearnet site has been replaced.
Unfortunately, theymos banned them so fast, so we did not receive the promised explanation, as well as the announcement that the service will be restored.

I'm not sure if it's just a trick and in the ownership connection of these two mixers, but it certainly looks like a show for those who read Bitcointalk.

[NotATether]

I'll leave this here (regarding Ym/Cr) ^{[google translator should do a great job through the camera]}.

Unfortunately the power is currently out where I am right now but I will go through all the information including the Russian text (I don't speak Russian) and will take appropriate actions.

Once again, thank you very much for this information.

[mikeywith]

In addition, delving into this case, I was able to talk to some people whose level of knowledge is colossal. And they shared information that sinbad was not confiscated by the authorities, saying that this was just a very well-developed trick to relieve tension.

I do like the theory but there is one major thing stopping me from believing it and that is the official statement of the Dutch Financial Intelligence and Investigation Service (FIOD), their official website is www.fiod.nl, and the article regarding seizing Sinbad is found here https://www.fiod.nl/fiod-takes-large-crypto-currency-mixer-off-the-air/ which also contains the same image that was present in Sinbad's website.

The article explicitly says

The servers of Sinbad.io were seized in the Netherlands and Finland.

Dutch investigative agencies such as the FIOD will continue to crack down on this. This action aimed at Sinbad.io is a heavy blow to organized crime and also serves as an example and warning to founders and users of similar services.

Then posts the said image.

Strange enough there is no mention of it on the Finnish police website or any other place that is Finnish official.

[LoyceV]

In addition, delving into this case, I was able to talk to some people whose level of knowledge is colossal. And they shared information that sinbad was not confiscated by the authorities, saying that this was just a very well-developed trick to relieve tension.

I do like the theory but there is one major thing stopping me from believing it and that is the official statement of the Dutch Financial Intelligence and Investigation Service (FIOD), their official website is www.fiod.nl, and the article regarding seizing Sinbad is found here https://www.fiod.nl/fiod-takes-large-crypto-currency-mixer-off-the-air/ which also contains the same image that was present in Sinbad's website.
The article explicitly says

The servers of Sinbad.io were seized in the Netherlands and Finland.

I do believe the domain name and servers were seized, but at the time it did sound like the people operating it would continue. Then Admin locked their topic and banned the OP from Bitcointalk, so it ended here.

[AB de Royse777]

I discovered today that the Telegram contact I had with Yo!Mix is not active anymore, it shows me error for the username which means they removed the telegram.

In addition, delving into this case, I was able to talk to some people whose level of knowledge is colossal. And they shared information that sinbad was not confiscated by the authorities, saying that this was just a very well-developed trick to relieve tension.

FUD! This is a baseless information you received. Sinbad management was the most professional and client/customer/employee friendly management I have ever managed a campaign. They respected their clients, their signature campaign members, campaign manager, business partners with highest standard. They were transparent about the incident happened. They even made sure that they do not have any debt existed before they good bye and leave. There were no valid scam accusation has been seen yet (at least I have not seen any).

I also have no idea why you didn’t contact me about advertising, considering how long we’ve been working in the place. 

Bad luck this time. By the way, other day I noticed Duelbits is advertising on Bitcoindata.Science, may be you can ask the same to bitmover?

[dkbit98]

Now this reminds me of the account that registered here and posted about the seizure even before any member in the forum got to know about it.

This was clearly NL government controlled account, but I don't know if they had any influence on things that happened later with previously mentioned mixer.

I do believe the domain name and servers were seized, but at the time it did sound like the people operating it would continue. Then Admin locked their topic and banned the OP from Bitcointalk, so it ended here.

I tried to find some type of register or official list of cryptocurrency related websites/mixers that got seized by government, but I couldn't find anything.

@NotATether
It would be great if you could add a special page for all seized old mixers, I think it is important for us to track this and record history.

[NotATether]

I do believe the domain name and servers were seized, but at the time it did sound like the people operating it would continue. Then Admin locked their topic and banned the OP from Bitcointalk, so it ended here.

I tried to find some type of register or official list of cryptocurrency related websites/mixers that got seized by government, but I couldn't find anything.

@NotATether
It would be great if you could add a special page for all seized old mixers, I think it is important for us to track this and record history.

That's a great idea! But it can't be a separate page, as many of the sites are single-page variants. A section on the main page should do, but I will have to make it detailed.

[dkbit98]

That's a great idea! But it can't be a separate page, as many of the sites are single-page variants. A section on the main page should do, but I will have to make it detailed.

Maybe you can create a separate section in the bottom of the page to be used just for seized mixers.
Things that should be included for this is archived link (to avoid original pages getting deleted), screenshot would be nice, and information about exact authority that performed a seizure.
 

[NotATether]

In the wake of Samourai Wallet being seized (ugh), what do you guys think of me doing an investigation into the circumstances behind the seizure and posting them on the site?

It would have to be on its own page, of course, so that means only on the main domain, with the mirrors linking back to it.

It could potentially be a nuisance if the DDoS attackers come back, but AFAIK I don't believe that I have leaked the IP address this time around.

[examplens]

In the wake of Samourai Wallet being seized (ugh), what do you guys think of me doing an investigation into the circumstances behind the seizure and posting them on the site?

It would have to be on its own page, of course, so that means only on the main domain, with the mirrors linking back to it.

It could potentially be a nuisance if the DDoS attackers come back, but AFAIK I don't believe that I have leaked the IP address this time around.

I honestly do not think that such things as any investigation are the reason for a DDoS attack. For example, bitmover's website bitcoindata.science was also under attack, and there are no accusations or statements about any services on it. Just a few useful tools, mainly for Bitcointalk users.

[dkbit98]

In the wake of Samourai Wallet being seized (ugh), what do you guys think of me doing an investigation into the circumstances behind the seizure and posting them on the site?

You can do that, it would be interesting reading material, but didn't you say that you can't create separate pages?

Note that it was not only Samourai wallet website that was seized, they also removed their Gitlab page, coordinator is down, and you can't even use it via Sparrow wallet.
I think that samourai old github page is still there but this is outdated code, and all keys previously generated by Samourai should be considered unsafe now.

Sparrow wallet with Whirlpool is not working anymore, so you can consider removing it from list, or moving in separate section.

[NotATether]

In the wake of Samourai Wallet being seized (ugh), what do you guys think of me doing an investigation into the circumstances behind the seizure and posting them on the site?

You can do that, it would be interesting reading material, but didn't you say that you can't create separate pages?

That is correct, on most of the mirrors I cannot create separate pages due to their architecture, but the primary site, which is on my own metal, is currently serving simple HTML files and I could easily make it use a CMS instead.

In fact I was using Wordpress before the attack. But I think I will use another one.

Note that it was not only Samourai wallet website that was seized, they also removed their Gitlab page, coordinator is down, and you can't even use it via Sparrow wallet.
I think that samourai old github page is still there but this is outdated code, and all keys previously generated by Samourai should be considered unsafe now.

Sparrow wallet with Whirlpool is not working anymore, so you can consider removing it from list, or moving in separate section.

Good point. What a nuisance these feds are creating in the name of "AML".

[bitmover]

In the wake of Samourai Wallet being seized (ugh), what do you guys think of me doing an investigation into the circumstances behind the seizure and posting them on the site?

It would have to be on its own page, of course, so that means only on the main domain, with the mirrors linking back to it.

It could potentially be a nuisance if the DDoS attackers come back, but AFAIK I don't believe that I have leaked the IP address this time around.

I honestly do not think that such things as any investigation are the reason for a DDoS attack. For example, bitmover's website bitcoindata.science was also under attack, and there are no accusations or statements about any services on it. Just a few useful tools, mainly for Bitcointalk users.

As far as I know, every decent website in the internet suffers heavy ddos attacks.
This is why every (most of theem at least) big website has to run behind cloudflare/aws which are the most effective providers that can protect from those heavy ddos attacks...

[NotATether]

I am going to wait for a few more days to see if any more services fall before I update the website.