The Mixin Hack Explained: A $200M Cloud Breach
Quick answer. On September 23, 2023, hackers hit Mixin Network's cloud provider database; Mixin said about $200 million was involved. No onchain flaw was reported. The checks it points to: what a provider breach can read, and outflow alerts.
Video transcript
By Rekt's data, the Mixin hack was 2023's largest crypto theft when it happened. Yet no onchain flaw was reported.
On September 25, Mixin said its cloud provider's database had been attacked. It put the funds involved at about 200 million dollars and suspended deposits and withdrawals.
Mixin did not say how. From onchain data, BlockSec inferred the attacker breached the cloud, recovered private keys, then drained deposit addresses in more than ten thousand transactions.
It is an inference, not a confirmed root cause. If it holds, whoever could rebuild the keys could sign.
Elliptic and Rekt traced part of it in ether, bitcoin and tether. Mixin later said losses were smaller than estimated, with no revised total.
These are lessons, not findings of fault. A vendor storing key material is inside your trust boundary. A database that can rebuild keys is a hot wallet. Keep hot balances small, and alert on outflows.
Mixin's ledger ran on 35 nodes, yet one provider's breach was enough. As Changpeng Zhao put it, not everything that claims to be decentralized is.
Guardian's Infrastructure Pentest escalates through your cloud accounts like an intruder, until something signs. It checks what a provider breach can read, where secrets live, cloud posture, and vendor consoles.
Read the full article for the timeline and sources, or talk to Guardian about what a provider breach could reach.
The Mixin hack was the largest crypto theft of 2023 when it happened, by Rekt's data as TechCrunch reported.
Mixin placed the attack at a database run by its cloud service provider.
Most hack losses now come from offchain attacks like this one, as our onchain vs offchain analysis shows. Here is what Mixin and its investigators said, and what is still unknown.
What Happened
Mixin Network is a Hong Kong-based network for moving digital assets across chains, TechCrunch reported. Mixin claimed one million users as of July 2023.
It described its ledger as "collectively booked and maintained by 35 mainnet nodes."
On September 25, Mixin announced the breach on X. It said that "in the early morning of September 23, 2023 Hong Kong time, the database of Mixin Network's cloud service provider was attacked by hackers."
After initial verification, it put the funds involved at about $200 million. It did not name the provider.
Mixin suspended deposits and withdrawals, and said transfers were not affected. Both would reopen "once the vulnerabilities are confirmed and fixed."
It asked Google and the security firm SlowMist to help investigate. Google told TechCrunch that its Mandiant unit "has been engaged by Mixin in support of the incident response."
How the Attack Worked
Mixin did not disclose how the hack occurred, DL News noted.
The clearest public account comes from onchain data. On September 25, the security firm BlockSec reported:
- A large number of Mixin deposit addresses were drained.
- Funds left in order, from the highest balance to the lowest.
- The draining took 10,000+ transactions over several hours.
- It suspected a couple of the drained addresses were Mixin hot wallets.
From this, BlockSec inferred that Mixin stored deposit address private keys "in a recoverable manner." The attacker, it suggested, compromised the cloud and recovered them.
BlockSec said it was "not clear about Mixin's internal security architecture," so treat this as an inference. Rekt read it the same way: the transactions "appear to be simple transfers," which it said suggested leaked private keys.
If the inference holds, no onchain flaw was needed. Whoever could rebuild the keys could sign.
Timeline and Loss
| Date (2023, HKT) | Event | Reported by |
|---|---|---|
| Sep 23, early morning | The provider's database is attacked | Mixin |
| Sep 25 | Breach announced; deposits and withdrawals suspended | Mixin |
| Sep 25 | Founder pledges to protect half of each user's assets | The Block, DL News |
| Sep 25 | Onchain analysis of the drained addresses | BlockSec |
| Sep 27 | Onchain message offers the attacker a $20M bounty | The Block |
| Sep 27 | Mixin says losses are smaller than estimated | Mixin |
How much was taken
Mixin's own figure was about $200 million. Two analyses of the public exploiter addresses traced part of it:
| Asset | Elliptic | Rekt |
|---|---|---|
| ETH | $95.3M | 60,000 ETH, about $94M |
| BTC | $23.7M | 891 BTC, about $23M |
| USDT | $23.6M | About $23.5M, swapped to DAI |
Rekt said about $50 million was still unaccounted for when it published.
Against Mixin's July financial statement, Elliptic estimated the theft took 71% of its ETH, 9% of its BTC and 93% of its USDT.
On September 27, Mixin said "the losses are not as significant as estimated." It gave no revised total.
The attacker swapped the USDT for DAI through Uniswap. Unlike USDT, DAI cannot be frozen, Elliptic noted.
Compensation
On a September 25 livestream, founder Feng Xiaodong said Mixin would ensure that half of each user's assets were unaffected.
The rest would come as bond tokens, which Mixin would buy back later from "future profits," DL News reported.
What It Shows
The sources here name no confirmed root cause. These are lessons from the facts above, not findings of fault.
A vendor's breach is your breach
The database sat with a cloud provider, and Mixin placed the attack there. Any vendor that stores key material is inside your trust boundary.
Where keys rest sets the blast radius
If keys can be rebuilt from a database, that database is effectively a hot wallet. Its access controls become your signing controls.
Our guide to private key management covers tiering keys by what they can move.
Hot balances should be small
Jiang Zhuoer, CEO of the mining pool BTC.TOP, said the stolen bitcoin "should have never been stolen in the first place." He said it would typically have been "kept in cold storage."
Consensus is not custody
Mixin's ledger ran on 35 nodes, yet one provider's breach was enough. Binance founder Changpeng Zhao put it bluntly: "Not everything that claims to be decentralized is."
Outflows are a signal
BlockSec counted more than 10,000 draining transactions over several hours. Our hot wallet monitoring guide covers alerts on outflows nobody requested.
How Infrastructure Pentest Tests This
Guardian's Infrastructure Pentest covers this surface: "the servers, accounts, and vendors your protocol depends on."
Its service page uses Mixin as the example: "The breach was at a cloud database provider. Nothing onchain had to fail for the funds to move."
The premise is that "contracts run on infrastructure, and infrastructure runs on credentials." Guardian escalates through your cloud accounts like an intruder, until something signs.
The areas that map to Mixin's breach, as the service page describes them:
- Data at rest: database exposure, encryption and key custody, backups, and what a provider breach can read.
- Secrets handling: where keys and tokens live, who can read them, and rotation.
- Cloud posture: IAM and trust policies, exposed storage, and what one stolen key unlocks.
- Vendor consoles: SaaS accounts that can change production, and who holds admin.
It covers AWS, GCP and Azure plus platforms such as GitHub, Kubernetes, Cloudflare and Okta. Teams can scope a whole account, or narrow it to services like IAM and key management.
See the Infrastructure Pentest page, or all Guardian pentests.
Frequently Asked Questions
How much was stolen in the Mixin hack?
Mixin put the funds involved at about $200 million after initial verification. Elliptic traced about $95.3 million in ETH, $23.7 million in BTC and $23.6 million in USDT. Mixin later said the losses were smaller than first estimated.
Was the Mixin hack a smart contract exploit?
No contract exploit was reported. Mixin said the database of its cloud service provider was attacked. BlockSec inferred that the attacker recovered deposit address private keys that Mixin stored in a recoverable form.
How did Mixin plan to compensate users?
Founder Feng Xiaodong said Mixin would ensure half of each user's assets were unaffected. The rest would be paid in bond tokens that Mixin planned to buy back from future profits, DL News reported.
Who was behind the Mixin hack?
No attacker has been confirmed. Mixin named no suspect, and DL News reported that no one had claimed the hack. Mixin brought in SlowMist and Google, whose Mandiant unit supported the incident response.
Sources
- Mixin Kernel on X: Announcement of the security incident (September 25, 2023)
- Mixin Kernel on X: Update on the asset tally (September 27, 2023)
- TechCrunch: Hackers steal $200M from crypto company Mixin (September 25, 2023)
- SlowMist on X: Security alert on Mixin Network (September 25, 2023)
- BlockSec on X: Findings on the Mixin security incident (September 25, 2023)
- The Block: Mixin Network founder says just half users' assets are safe after $200 million hack (September 25, 2023)
- The Block: Mixin Network offers hacker $20 million bug bounty (September 27, 2023)
- Elliptic: Mixin Network hacked for $200 Million (September 26, 2023)
- DL News: Questions swirl around $200m hack as Mixin pledges to pay users half their lost funds (September 26, 2023)
- Cointelegraph: $200M Mixin Network hack draws controversy (September 25, 2023)
- Rekt: Mixin Network, Rekt (September 25, 2023)
- Changpeng Zhao on X: Post on the Mixin hack (September 25, 2023)
Test what a provider breach can reach
Guardian's Infrastructure Pentest escalates through your cloud accounts, databases and vendor consoles like an intruder, until something signs.