Mixin Network loses $200 million over security flaw

0 3 w – images.unsplash.com

Mixin Network, a Hong Kong-based open-source decentralized network, has lost $200 million in crypto assets due to an attack on its cloud provider. In the wake of one of the biggest crypto heists of the year, the Mixin team halted deposits and withdrawals immediately.

The breach occurred on September 23. According to data from blockchain trackers such as PeckShield and Lookonchain, about $141 million of the stolen assets comprise $93.5 million in ETH, $23.5 million in DAI and $23.3 million in BTC.

“After discussion and consensus among all nodes, these services will be reopened once the vulnerabilities are confirmed and fixed. During this period, transfers are not affected,” the company said in a statement posted on X (formerly Twitter).

The company also announced it had secured the help of tech giant Google and blockchain security company SlowMist to further investigate the breach.

In another development, an independent investigation from Web3 SaaS analytics platform 0xScope revealed that the hacker had previously come into contact with Mixin, with the attacker receiving some amount of Ethereum from the company in 2022.

“An address connected to the recent $200M @MixinKernel #hack received 5 $ETH from the platform last year and deposited 5.9 $ETH on #Binance soon after. Also, the hacker then swapped $USDT for $DAI to avoid being frozen,” 0xScope said on X.

Founder livestream

Mixin founder Feng Xiaodong elaborated more on the incident via a public livestream on September 25. Feng explained that Mixin could only ensure half of the user assets were not affected.

“No matter what your assets are—whether it’s Bitcoin or Ethereum—we will ensure that half of them are unaffected,” Feng said. “We’re trying to find a way to recover the compromised money, but that is very difficult.”

For the lost assets, the Mixin team is considering issuing “bond tokens” for users to claim, which they plan to buy back in the future. Additionally, Feng revealed plans to establish a better system to host user assets.

Community reaction

Mixin currently hosts eight decentralized protocols, including DEXes, liquid staking providers and a perpetuals trading platform. It has passed security audits held by blockchain security companies like LowMist, IO Active and CertiK.

The scale of the breach, believed to be the largest incident in the crypto industry in 2023, sparked concerns from the community regarding the security of decentralized networks.

Prominent blockchain analyst ZachXBT highlighted the case as another nine-figure security breach where hackers succeeded in getting away with all liquid assets. Meanwhile, Mikko Ohtamaa, a prominent figure in the sector, maintained that the attack stemmed from a breach on the cloud provider responsible for key storage.

Others speculated the possibilities of a North Korean attack or inside manipulation behind the breach.

Many have noticed that these attacks are becoming more common. Last month, CertiK reported that the crypto space had lost $26 million to exit scams, $6.4 million to flash loan attacks and $13.5 million to exploits.

In the aftermath of the breach, XIN, Mixin’s native token, fell 8.6 percent in value. It is currently trading at $194, a substantial decline from its all-time high of $2,095.

Data from DeFiLlama, a DeFi TVL aggregator, indicated that the total value of assets locked on the protocol had declined sharply, with Mixin’s TVL falling from $383.54 million to $351.9 million.