Mixin suspends deposits and withdrawals after $200M cryptocurrency heist

https://www.theregister.com/2023/09/25/mixin_200m_heist/

by rntn • 3 years ago

81 77 3 years ago

xur173• 3 years ago

Mixin Network confirmd on Monday that it has "temporarily suspended" all deposit and withdrawal services after hackers broke into a database and stole about $200 million in funds from the Hong-Kong based cryptocurrency firm.
Mixin, which is a decentralized exchange,

These 2 statements seem to contradict each other. If they are a decentralized exchange, how were funds stolen by hacking into a database?

Arainach• 3 years ago

"Decentralized" isn't a magic word. They're still an exchange, and there needs to be a way to extract funds.

The database doesn't need to contain account balances or funds so long as it contains credentials necessary to access them.

xur173• 3 years ago

If they are storing credentials to access funds in a centralized database, they are by definition not "decentralized".

For example, Curve.fi meets the common definition of "decentralized exchange", and as such does not store credentials, etc in a centralized database. Their code is deployed to Ethereum and runs on Ethereum, so users are able to make trades against it, deposit funds into trading pools, etc, all without having a central actor hold credentials.

That said, Curve.fi can still cause users to lose funds if they have bugs in their code, but they do not have the risk of someone stealing passwords from their server and walking away with the money.

OsrsNeedsf2P• 3 years ago

bisq.network[1] seems to be doing it fine, and non-fiat decentralized exchanges have existed longer. They just don't get the hype.

[1] https://bisq.network

pluc• 3 years ago

Can't spell decentralized without central

lxgr3• 3 years ago

how were funds stolen by hacking into a database?

Sometimes "decentralized" really means "running on a theoretically distributed network, but practically we host all the nodes/have emergency root keys/exclusively provide the software running on them and the clients used to access them – only for now, we promise!"

This particular project also seems to heavily lean on Intel SGX, according to its most recent public whitepaper from 2018 [1] and also seems to offer wallet recovery using only a user's mobile phone number and a 6-digit PIN [2] – combine that with not too many actually administratively distributed nodes, and it's not too hard to imagine what could have gone wrong...

Edit: Actually the entire proposal sounds ridiculous, unless I'm missing something: The protocol claims to offer secure, yet recoverable device-local keys, but it all seems to boil down to a trusted and independent set of signer nodes (see above for problems), as well as users being able to store a "per-device ephemeral secret" securely and locally, with backup considerations basically left as an exercise to the reader, and the reference implementation seems to just upload that backup to a central API... [3]?!

[1] https://mixin.one/assets/Mixin-Draft-2018-07-01.pdf

[2] https://tip.id/

[3] https://github.com/MixinNetwork/ios-app/blob/9e11dd02953297f...

dboreham3• 3 years ago

That white paper reads like the blockchain equivalent of a The Onion article.

cypress66• 3 years ago

Only few projects (like uniswap) are truly decentralized. Most projects are not, and only claim they'll eventually become decentralized once "they finish development".

xur173• 3 years ago

It's a spectrum, and storing credentials in a database is much closer to centralized than decentralized.

phire2• 3 years ago

Because most decentralised exchanges are "fake".

Realistically, a decentralised exchange can only operate within a single blockchain, only trading tokens on that blockchain. Works fine for trading between (for example) eth and its various tokens, but you can't do proper eth to bitcoin trades. [1]

The single-blockchain decentralised exchanges are typically real [2], but every multi-blockchain "decentralised" exchange platform cheats.

Some are literally just centralised exchanges that pretend to be decentralised with a slick software interface. The more common technique is to run their own blockchain and have valid decentralised trading on that. But you are only actually trading tokens that represent real coins. They then run a centralised holding entity that holds the real coins and implements deposits and withdrawals just like a decentralised exchange.

There are so many flaws with this scheme.

The holding company could literally run away with your funds. Bugs and exploits (and even normal blockchain behaviour like re0orgs) can result in the three seperate sources of truth (the real blockchains, the holding entity's internal database and the trading blockchain) ending up out of sync.

And just because the trading blockchain is a blockchain doesn't mean the company that controls it doesn't have the keys and power to rollback trades and otherwise change the contents.

[1] Yes, atomic swaps are a thing. But they are resource intensive and slow. I'm not aware of much decentralised trading that uses them.

[2] Though, the topic of wrapped coins complicates things.

dboreham3• 3 years ago

There are non-custodial bridge schemes that have been proposed (but afaik not yet proven). The idea being that the holding company you mention is replaced by an L1 escrow contract. This trust minimized approach is not trivial to implement but at least I think I see how it could work.

injeolmi_love2• 3 years ago

You’re correct about most of the existing cross chain apps, but there’s a wide variety of operational cross chain communication protocols that are decentralized. Chainlink CCIP & Cosmos IBC are the first that come to mind.

foobarbazetc• 3 years ago

These are 99 times out of 100 an inside job.

eschneider• 3 years ago

Probably more like 70-30. Most exchanges are a security trash fire.

ada1981• 3 years ago

"government-backed cryptocurrency thieves"

Pirates in the original sense.

vkou• 3 years ago

If they are government-backed bandits who ply their trade on the high seas, protected by a letter of marquee, they would be privateers.

triyambakam• 3 years ago

on the social media platform formerly known as Twitter

Do they not like the new name? I don't either, though. I've seen a lot of "on X (formerly Twitter)" around and that's why I don't like the new name. If it were a good and memorable name we wouldn't need to qualify it like that.

bdcravens• 3 years ago

More like there's many who don't even know about the name change.

JohnFen• 3 years ago

"X" is overloaded, so you can't really use it without an additional specifier such as "formerly Twitter" and be certain people know which X you're talking about. It's one of the reasons why X is a really stupid name.

Personally, I just skip the whole issue and call it Twitter. Everyone knows what that is.

klyrs• 3 years ago

It's still hosted at twitter.com; x.com even redirects to twitter.com -- so even twitter is gently reminding us that the rebrand is halfassed at best.

But I agree, the name itself is a huge part of the problem. If they called it EdgeLordsManor (or whatever) we'd all go along, with a brief "formerly known as" period to notify non-users of the change.

37638894breeze• 3 years ago

I like the "X, [the platform] formerly known as X" its evolution. Latest in the wild sighting was "X, formerly Twitter".

What I like about it is that it lifts the skirt on the superficial divides. Good soldiers of the information regime all toe the line here and dutifully help Elon with his illadvised brand name destruction. I mean, I go to geopolitical websites run by people who like Putin, for example, and even there, the resistance blogger/propagandists dutifully remind us the "X, formerly Twitter" just in case we forget or haven't heard the news. We know things are bad if even North Korean output is using the "formerly Twitter" insert. Anyone checked?

throwawaycities• 3 years ago

Not many global brands with multibillion dollar IP willfully rebrand.

Funny enough though, not only did Twitter do it with X recently, but Facebook rebranded recently to Meta and it’s still common Meta is referred to as “Meta formerly Facebook”, even in the wiki article that is included in opening sentence.

I don’t think it’s so much a reflection on the new brands it mor a reflection on the value of the old brands which still carry a lot of value for SEO purposes which is likely was articles/blogs probably tend to include the former brands.

hristov• 3 years ago

Facebook's parent company rebranded to meta. The site Facebook is still Facebook. The Meta rebrand was mostly for the benefit of investors. Google did a similar thing.

It is easier to rebrand for the benefit of investors. There are only hundreds of thousands of investors who matter to a company the size of facebook, or Google, and all the investors who matter spend a lot of time reading financial news, so the rebrand will not cost you too much in terms of name recognition.

But rebranding a large commercial website is a different story. There you have hundreds of millions of end users that do not have time to think too much about you neither do they care much. The fact that twitter got itself lodged in the brains of hundreds of millions of humans is a great achievement. Throwing it away is kind of dumb.

baz006• 3 years ago

Every time I see these stories I'm glad I keep all my cash in a regulated bank with regulator backed compensation rather than some startup powered by gargling bong water and hoping the fuck they don't get hacked.

siwatanejo2• 3 years ago

Every time I see these stories I'm glad I keep all my bitcoin in my own self-custodial wallet. Not your keys not your bitcoin.

You keep fiat currency in a bank? HFSP

baz006• 3 years ago

Enough to eat for a couple of years. I keep my fiat currency in property.

mschuster91• 3 years ago

The dude who's been hunting for his hard drive with his wallet keys on a dumpster yard would like to speak a word with you. Or those who had their disks seized by the government and the coins auctioned off. Or those where someone placed malware on their PCs or phones and exfiltrated keys.

raincole3• 3 years ago

I alwasy find it amusing that people on HN hate governments, big corps and banks so much... but when it comes to real money they trust these institutions full-heartedly (and downvote any alternative).

Lemmi2• 3 years ago

Hahaha cute.

Love your self management. Just have the balls later when you loose access :-)

neilv• 3 years ago

and hoping the fuck they don't get hacked.

Or some of the people operating it don't decide it's time to cash out with a fake hack.

sleepybrett• 3 years ago

lol, lmafo.

say_it_as_it_is• 3 years ago

A decentralized exchange is blaming its cloud provider?

Mixin suspends deposits and withdrawals after $200M cryptocurrency heist

Related Stories