According to Mixin Network, attackers compromised the database of its cloud service provider in the early morning of September 23, 2023 (Hong Kong time), leading to loss of some mainnet assets reported at about US$200 million. The company said deposit and withdrawal services were temporarily suspended while transfers were not affected, and it contacted Google and SlowMist for investigation support. Blockchain trackers cited in the research identified about US$141 million moving across ETH, BTC and stablecoins, and the attacker's laundering path is partly documented, including reported use of Tornado Cash in later years.
We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.
According to Mixin's public statement, the company was hit by an attack on a database held by its cloud service provider, which led to the loss of some mainnet assets. The company disclosed the incident on September 25, 2023, after the breach occurred on September 23, 2023 (Hong Kong time).
Mixin said deposit and withdrawal services were temporarily suspended and that transfers within the network were not affected. The company said it contacted Google and SlowMist to help with the investigation.
Mixin offered a $20 million bounty to the attacker to return the funds, according to coverage cited in the research. The company later said it would reimburse 50% of user losses upfront and repay the rest through bond or debt tokens backed by future profits. These were compensation and incentive measures, not recovery of the stolen crypto itself.
The research notes that the company said it would reopen deposit and withdrawal services only after vulnerabilities were fixed, but it does not confirm when or whether that happened.
Public reporting describes the attack as a compromise of a cloud-service database, not a flaw in an on-chain smart contract. Mixin's own statement confirms only that a cloud-service database was attacked and that assets were lost.
A later incident write-up cited in the research says the attacker allegedly recovered private keys for deposit addresses and possibly hot-wallet addresses from the compromised cloud environment, then moved funds out in many transactions over several hours. This is an inference from secondary analysis, not a confirmed statement by Mixin.
The research does not describe a specific mechanism for how the database was accessed or how the attacker obtained the sensitive data.
Elliptic reported that stolen USDT was sent through Uniswap and converted to DAI. Merkle Science reported that one exploiter received about 59,807 ETH, another received about 23.5 million USDT that was swapped into about 23.5 million DAI, and 891 BTC moved from Mixin wallets to an exploiter address. Later reporting cited in the research says ETH was sent through Tornado Cash after a period of dormancy. The research does not confirm a broad freeze or recovery of the stolen assets, and does not confirm exchange freezes.
| Address | Chain | Role | Source |
|---|---|---|---|
0x52E86988bd07447C596e9B0C7765F8500113104c | Ethereum | exploiter | source |
0x3B5fb9d9da3546e9CE6E5AA3CCEca14C8D20041e | Ethereum | exploiter | source |
0xB5d631A74AD9c9efcF96d6e9e2fAbcB75C67Eafa | Ethereum | exploiter | source |
bc1qq7uefmz6nng5c4dzs9mwrxxyh9sxg5cjg85hes | Bitcoin | exploiter | source |
Every address is from a public source. Check any wallet in the dirty wallet checker.
Mixin suspended deposits and withdrawals, said transfers were unaffected, contacted Google and SlowMist for investigation support, offered a $20M bounty for return of funds, and announced a compensation plan covering 50% of user losses upfront with the remainder to be repaid via bond or debt tokens. The research does not describe a regulator action or police arrest tied directly to the hack.
The native XIN token reportedly fell sharply after the disclosure, though the exact price path is not established in the sources. Users were urged to avoid transactions on the network, and coverage describes largely negative and anxious user reaction. The compensation plan was meant to limit user losses, but the research does not confirm final reimbursement totals.
72% negative · 5% positive · the rest neutral · themes: user losses, anxiety over withdrawals, cloud-security failure, bounty offer to attacker, compensation plan, uncertain recovery
How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.
New exploit reports, major incidents and security updates from VaultX. Free. You choose below; nothing starts until you opt in.
On Telegram, press Start in the bot to subscribe. New reports are also posted on our alerts channel. Not financial advice.
VaultX