# Mixin Network: Mixin Network says ~$200M lost after cloud-database breach; deposits and withdrawals suspended (Sept 2023)
Source page: https://vaultx.llc/hacks/mixin-network-hack-2023 · VaultX incident report by Sentinel · first published 2026-10-31, updated 2026-10-31
- Date: 2023-09-23
- Reported loss: $200M (Mixin reported approximately US$200M in assets involved; blockchain analysis cited in the research identified about US$141M at that stage. Both figures are reported, not independently verified.)
- Attribution: unknown. The research says reporting and forensic write-ups did not produce an official attribution to a named person or group.
- Chains: Bitcoin, Ethereum
- Status: contained
- Severity: 72/100
- Response score: 70/100 (Disclosure came within about two days and services were suspended, with outside investigators engaged and a compensation plan announced; transparency on the attack details and final reimbursement remained limited.)
According to Mixin Network, attackers compromised the database of its cloud service provider in the early morning of September 23, 2023 (Hong Kong time), leading to loss of some mainnet assets reported at about US$200 million. The company said deposit and withdrawal services were temporarily suspended while transfers were not affected, and it contacted Google and SlowMist for investigation support. Blockchain trackers cited in the research identified about US$141 million moving across ETH, BTC and stablecoins, and the attacker's laundering path is partly documented, including reported use of Tornado Cash in later years.

**What happened**
According to Mixin's public statement, the company was hit by an attack on a database held by its cloud service provider, which led to the loss of some mainnet assets. The company disclosed the incident on September 25, 2023, after the breach occurred on September 23, 2023 (Hong Kong time).
Mixin said deposit and withdrawal services were temporarily suspended and that transfers within the network were not affected. The company said it contacted Google and SlowMist to help with the investigation.
Mixin offered a $20 million bounty to the attacker to return the funds, according to coverage cited in the research. The company later said it would reimburse 50% of user losses upfront and repay the rest through bond or debt tokens backed by future profits. These were compensation and incentive measures, not recovery of the stolen crypto itself.
The research notes that the company said it would reopen deposit and withdrawal services only after vulnerabilities were fixed, but it does not confirm when or whether that happened.

**How it worked**
Public reporting describes the attack as a compromise of a cloud-service database, not a flaw in an on-chain smart contract. Mixin's own statement confirms only that a cloud-service database was attacked and that assets were lost.
A later incident write-up cited in the research says the attacker allegedly recovered private keys for deposit addresses and possibly hot-wallet addresses from the compromised cloud environment, then moved funds out in many transactions over several hours. This is an inference from secondary analysis, not a confirmed statement by Mixin.
The research does not describe a specific mechanism for how the database was accessed or how the attacker obtained the sensitive data.

**Where the money went**
Elliptic reported that stolen USDT was sent through Uniswap and converted to DAI. Merkle Science reported that one exploiter received about 59,807 ETH, another received about 23.5 million USDT that was swapped into about 23.5 million DAI, and 891 BTC moved from Mixin wallets to an exploiter address. Later reporting cited in the research says ETH was sent through Tornado Cash after a period of dormancy. The research does not confirm a broad freeze or recovery of the stolen assets, and does not confirm exchange freezes.

**The response**
Mixin suspended deposits and withdrawals, said transfers were unaffected, contacted Google and SlowMist for investigation support, offered a $20M bounty for return of funds, and announced a compensation plan covering 50% of user losses upfront with the remainder to be repaid via bond or debt tokens. The research does not describe a regulator action or police arrest tied directly to the hack.

**Impact**
The native XIN token reportedly fell sharply after the disclosure, though the exact price path is not established in the sources. Users were urged to avoid transactions on the network, and coverage describes largely negative and anxious user reaction. The compensation plan was meant to limit user losses, but the research does not confirm final reimbursement totals.

**Wallets linked to this case**
- 0x52E86988bd07447C596e9B0C7765F8500113104c (Ethereum, exploiter) source: https://www.binance.com/en/square/post/2196880277001
- 0x3B5fb9d9da3546e9CE6E5AA3CCEca14C8D20041e (Ethereum, exploiter) source: https://www.binance.com/en/square/post/2196880277001
- 0xB5d631A74AD9c9efcF96d6e9e2fAbcB75C67Eafa (Ethereum, exploiter) source: https://www.binance.com/en/square/post/2196880277001
- bc1qq7uefmz6nng5c4dzs9mwrxxyh9sxg5cjg85hes (Bitcoin, exploiter) source: https://www.binance.com/en/square/post/2196880277001

**Timeline**
- 2023-09-23 Attack on Mixin's cloud-service database occurs in the early morning (Hong Kong time); mainnet assets are lost.
- 2023-09-25 Mixin publicly discloses the breach, reports about US$200M in assets involved, and suspends deposits and withdrawals. Reuters, TechCrunch and others report on it.
- 2023-09-27 Mixin reportedly offers the attacker a $20 million bug-bounty-style reward for return of the funds.
- 2023-09-29 Bitcoin Suisse weekly wrap covers the incident; the research cites it for the stated state of the funds at that time (not yet laundered in the analyses it cites).
- 2026-02-13 According to The Block, a wallet tied to the Mixin hack moves ETH after more than two years of dormancy.

**How to protect yourself**
- Custodial and hot-wallet security depends on third-party cloud infrastructure; a database breach at a vendor can expose private keys, so key management and segregation matter.
- Users should not assume that a project's stated compensation plan will be fully honored; partial reimbursement or debt-style tokens carry counterparty risk.
- Watch for projects that suspend deposits and withdrawals; this is a signal to pause new exposure until the company gives clear, verifiable details.
- Track on-chain flows after a breach: funds moved through DEXs and mixers can resurface years later, as the research notes for this case.

**Still unknown**
- Exact amount lost: $200M (company figure) versus about $141M identified on-chain differ, and the research does not reconcile them.
- Stablecoin breakdown conflicts across sources (USDT via Uniswap to DAI per Elliptic, versus DAI and BTC figures per another breakdown).
- Whether and when deposits and withdrawals were fully restored.
- Whether the bounty was accepted, and whether any funds were returned.
- The identity or group behind the attack; no official attribution was found in the research.
- Actual reimbursement completion rate and whether the bond/debt tokens were issued and honored.
- The specific attack path inside the cloud database, and whether the key-exposure explanation is accurate, since it comes from secondary analysis.
- Amounts and details of the later Tornado Cash transfers, which are not verified in the research.

**Sources**
- Hackers steal $200 million from crypto company Mixin (TechCrunch) https://techcrunch.com/2023/09/25/hackers-steal-200-million-from-crypto-company-mixin/
- Hong Kong crypto firm hit by $200 million hack (Reuters) https://www.reuters.com/technology/hong-kong-crypto-firm-hit-by-200-million-hack-2023-09-25/
- Mixin Network hacked for $200 million (Elliptic) https://www.elliptic.co/insights/mixin-network-hacked-for-200-million/

---
VaultX: free crypto news and intelligence, https://vaultx.llc