{"investigation":{"slug":"mixin-network","entity_name":"Mixin Network","trust_score":10,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Mixin Network is a Hong Kong-based layer-2 cross-chain payment protocol that suffered the largest single crypto hack of 2023 when attackers compromised its cloud service provider's database and drained approximately $200 million in ETH, BTC, and USDT. The network remains operational but has only partially compensated users, the majority of stolen funds remain unrecovered, and a dormant attacker wallet moved funds to Tornado Cash in February 2026.","sections":[{"content":"Mixin Network is an open-source, peer-to-peer transactional network for digital assets, incorporated and operating out of Hong Kong. Founded in November 2017 by Feng Xiaodong, a former early Android developer in China and ex-chief architect of the BigONE exchange, Mixin launched its mainnet alongside a native token, XIN, which is required for full-node collateral, decentralized application creation, and API calls. The network is built on an asynchronous Byzantine Fault-Tolerant Directed Acyclic Graph (DAG) at its core layer, called the Mixin Kernel, with a second layer of domain nodes enabling cross-chain asset transfers across Bitcoin, Ethereum, EOS, and other networks. Mixin has described itself as a layer-2 solution conceptually analogous to the Lightning Network, extended to multiple blockchains. The network claimed over one million users and more than $1 billion in assets under management prior to the September 2023 incident. Feng Xiaodong previously dropped out of computer science at Shandong University in 2009, became a prominent early Android developer in China through the Vitamio multimedia framework, and later founded Fig Adventure before pivoting to blockchain.","heading":"Background","sources":[{"url":"https://cryptopotato.com/mixin-a-multi-layer-decentralized-network-that-offers-cross-chain-solutions-lightning-fast-transactions/","name":"","type":"other","credibility":3},{"url":"https://www.aicoin.com/en/article/367445","name":"","type":"other","credibility":3},{"url":"https://tokeninsight.com/en/news/mixin-founder-feng-xiaodong-will-compensate-up-to-50-of-losses","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"In the early morning hours of September 23, 2023 (Hong Kong time), an attacker compromised the database of the third-party cloud service provider relied upon by Mixin Network for withdrawal processing. The breach exposed private keys associated with Mixin's hot wallet deposit and withdrawal addresses. Leveraging these credentials, the attacker submitted over 10,000 unauthorized withdrawal transactions across multiple blockchains over the course of several hours, draining wallets in descending order of balance. Elliptic's on-chain analysis confirmed the attacker extracted approximately $95.3 million in Ether, $23.7 million in Bitcoin, and $23.6 million in USDT, for a total loss of approximately $200 million — the largest single crypto exploit of 2023. The USDT portion was immediately swapped through the Uniswap decentralized exchange for DAI stablecoin, a common laundering technique to convert freezable assets into non-freezable alternatives, since Tether (USDT) can be blacklisted by the issuer. Mixin Network officially suspended deposits and withdrawals on September 25, 2023, and publicly disclosed the breach the same day. Founder Feng Xiaodong confirmed in a live briefing that the breach was not a smart contract exploit but an infrastructure failure attributable to the cloud provider. Mixin contacted blockchain security firm SlowMist and Google to assist with the investigation. The attack vector — reliance on a centralized cloud database for hot wallet key management — represents a fundamental custodial architecture risk rather than a protocol-level vulnerability. Lazarus Group, the North Korean state-sponsored threat actor, has been alleged as a possible perpetrator based on tactics and prior patterns, but no public attribution with verified evidence had been issued by SlowMist or any government authority as of the time of reporting.","heading":"The $200M Cloud Database Hack","sources":[{"url":"https://www.elliptic.co/blog/mixin-network-hacked-for-200-million","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2023/09/25/mixin-network-losses-nearly-200m-in-hack","name":"","type":"other","credibility":3},{"url":"https://www.bleepingcomputer.com/news/security/mixin-network-suspends-operations-following-200-million-hack/","name":"","type":"other","credibility":3},{"url":"https://techcrunch.com/2023/09/25/hackers-steal-200-million-from-crypto-company-mixin/","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-mixin-network-hack-september-2023","name":"","type":"other","credibility":3},{"url":"https://www.securityweek.com/200-million-in-cryptocurrency-stolen-in-mixin-network-hack/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Blockchain analytics firms Merkle Science, Elliptic, and Lookonchain produced detailed on-chain tracing of the stolen assets shortly after the hack. Merkle Science identified three primary exploiter addresses: one receiving 59,807 ETH across more than 10,000 transactions from over 11,400 ETH wallets, a second receiving 23.5 million USDT which was promptly swapped for approximately 23.5 million DAI via a decentralized exchange, and a third accumulating 891 BTC across three transactions from 127 Bitcoin wallets. Elliptic noted that the attacker's haul represented approximately 71% of Mixin's total ETH holdings, 9% of its Bitcoin reserves, and 93% of its USDT at the time of extraction — indicating deep access to hot wallet infrastructure. An independent investigation by Web3 analytics platform 0xScope identified a pre-hack relationship: an address linked to the attacker had received 5 ETH from Mixin's platform prior to the incident and subsequently deposited 5.9 ETH on Binance, suggesting reconnaissance activity. Following the hack, the primary attacker wallets lay dormant for approximately two and a half years. On February 12, 2026, Lookonchain flagged movement from a wallet linked to the hack: 2,005 ETH (approximately $3.85 million) was transferred to Tornado Cash, the sanctioned crypto mixer, via three newly created wallets. As of that date, the original attacker wallet still held an estimated 57,849 ETH and 891 BTC — representing the large majority of the original theft, valued at over $170 million based on then-current prices.","heading":"On-Chain Evidence","sources":[{"url":"https://www.merklescience.com/blog/hack-track-mixin-flow-of-funds-analysis","name":"","type":"other","credibility":3},{"url":"https://www.elliptic.co/blog/mixin-network-hacked-for-200-million","name":"","type":"other","credibility":3},{"url":"https://decrypt.co/358032/3-million-ethereum-mixin-network-hack-tornado-cash","name":"","type":"other","credibility":3},{"url":"https://financefeeds.com/mixin-network-hacker-moves-2005-eth-to-tornado-cash-after-2-years-of-silence/","name":"","type":"other","credibility":3},{"url":"https://finance.yahoo.com/news/3-85-million-ethereum-mixin-175053959.html","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"In a live public briefing on September 25, 2023, founder Feng Xiaodong announced an initial compensation framework: affected users would receive 50% of their lost assets immediately in stablecoin equivalents, with the remaining 50% issued as Mixin Debt Tokens (MDT) — a new instrument representing a claim on future repayment funded by Mixin's operating profits. Three categories of MDT were created: MDTu (pegged to USDT), MDTe (pegged to ETH), and MDTb (pegged to BTC). Mixin simultaneously offered the attacker a $20 million bug bounty in exchange for the return of the remaining stolen funds — an offer that was not taken up. Mixin launched the MDT mechanism in February 2024. As of October 2025, the network provided an update indicating that MDTu, representing approximately $23 million in debt, was on track to be fully repaid by September 2026. No firm repayment schedule was publicly disclosed for MDTe or MDTb, meaning the substantial majority of the loss — denominated in ETH and BTC — lacks a committed timeline. The network did not shut down following the hack and continued to operate, claiming over $1 billion in assets under management and more than one million active users in subsequent months. The structural risk inherent in the hack — centralized hot wallet key management via a cloud service provider — had not been publicly addressed with a detailed remediation disclosure as of reporting.","heading":"Recovery","sources":[{"url":"https://www.theblock.co/post/252716/mixin-network-founder-says-just-half-users-assets-are-safe-after-200-million-hack","name":"","type":"other","credibility":3},{"url":"https://bitcoinist.com/mixin-network-offers-hacker-20-million-bug-bounty/","name":"","type":"other","credibility":3},{"url":"https://www.bitget.com/news/detail/12560603893640","name":"","type":"other","credibility":3},{"url":"https://support.mixin.one/en/article/what-is-mdt-token-77n05i/","name":"","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/defi/questions-swirl-around-hack-at-hong-kong-network-mixin/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Mixin Network is incorporated and operates out of Hong Kong. As of reporting, no specific enforcement action had been identified from the Hong Kong Securities and Futures Commission (SFC) or the United States Securities and Exchange Commission (SEC) directly targeting Mixin Network in connection with the 2023 hack or its subsequent debt-token compensation scheme. Mixin's compliance page references an MSB (Money Services Business) registration supervised by FinCEN (the U.S. Financial Crimes Enforcement Network), a relatively minimal regulatory designation that does not constitute a broker-dealer, exchange, or custodian license. Hong Kong's regulatory framework for virtual asset service providers was still evolving during and after the 2023 incident; the SFC's Virtual Asset Service Provider licensing regime became mandatory in June 2023, though its applicability to layer-2 infrastructure networks like Mixin — as distinct from exchanges or custodians — was not clearly defined. No criminal charges or civil regulatory actions against Mixin Network, Feng Xiaodong, or associated entities appeared in the reviewed sources. The attacker's use of Tornado Cash in February 2026 to launder a portion of the stolen funds implicates OFAC-sanctioned infrastructure, which could affect any future recovery efforts or legal proceedings.","heading":"Regulatory","sources":[{"url":"https://mixin.one/features/compliance","name":"","type":"other","credibility":3},{"url":"https://www.bankinfosecurity.com/cryptohack-roundup-200m-mixin-network-hack-a-23185","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/policy/2025/12/25/hong-kong-regulators-target-2026-legislation-for-virtual-asset-dealer-and-custodian-rules","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Mixin Network carries an extreme risk profile for retail users. The September 2023 cloud database breach demonstrated that the platform relied on a centralized custodial architecture — specifically, hot wallet private keys managed via a third-party cloud provider — creating a single point of failure incompatible with the trust model users would expect from a peer-to-peer network. This is not a smart contract vulnerability but a custodial infrastructure failure, meaning that users who trusted Mixin with digital assets effectively bore third-party cloud security risk without disclosure. The compensation plan, while partially executed, leaves the ETH and BTC tranches of debt (MDTe and MDTb) without a firm repayment schedule. The attacker retains the overwhelming majority of stolen funds — approximately $170 million-plus in ETH and BTC as of February 2026 — and has begun moving assets through sanctioned mixing infrastructure, materially reducing the probability of recovery. No independent security audit of the post-hack infrastructure has been publicly disclosed. The Lazarus Group attribution allegation, while plausible given tactics (cloud credential theft, large-scale hot wallet drainage, DEX-based laundering), remains unconfirmed by any authoritative source. Users holding MDT debt tokens face uncertainty over full repayment of the ETH and BTC tranches, as Mixin's future profits are the sole backing mechanism. The platform's continued operation with the same founder and no disclosed architecture remediation should be treated as a material ongoing risk signal.","heading":"Risk Assessment","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-mixin-network-hack-september-2023","name":"","type":"other","credibility":3},{"url":"https://www.elliptic.co/blog/mixin-network-hacked-for-200-million","name":"","type":"other","credibility":3},{"url":"https://financefeeds.com/mixin-network-hacker-moves-2005-eth-to-tornado-cash-after-2-years-of-silence/","name":"","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/defi/questions-swirl-around-hack-at-hong-kong-network-mixin/","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2017-11","event":"Feng Xiaodong establishes the Mixin blockchain team in Hong Kong with fewer than 20 people.","source":"","date_original":"2017-11-01"},{"date":"2023-09-23","event":"Attacker compromises the database of Mixin Network's cloud service provider; approximately $200 million in ETH, BTC, and USDT drained via 10,000+ unauthorized withdrawal transactions.","source":""},{"date":"2023-09-25","event":"Mixin Network publicly discloses the breach, suspends all deposits and withdrawals, and contacts SlowMist and Google for investigation support.","source":""},{"date":"2023-09-25","event":"Founder Feng Xiaodong holds live briefing; announces 50% immediate stablecoin repayment and 50% via future bond tokens (MDT).","source":""},{"date":"2023-09-26","event":"Mixin offers attacker a $20 million bug bounty for return of stolen funds. Offer is not accepted.","source":""},{"date":"2023-09-26","event":"Elliptic, Merkle Science, and Lookonchain publish on-chain analysis confirming asset breakdown: 59,807 ETH, 891 BTC, 23.57M USDT. Attacker immediately swaps USDT to DAI on Uniswap.","source":""},{"date":"2024-02","event":"Mixin Kernel officially launches Mixin Debt Token (MDT) in three tranches (MDTu, MDTe, MDTb) as the mechanism for the 50% deferred repayment.","source":"","date_original":"2024-02-01"},{"date":"2025-10","event":"Mixin provides repayment update: MDTu (~$23 million) targeted for full repayment by September 2026; no timeline disclosed for MDTe or MDTb.","source":"","date_original":"2025-10-01"},{"date":"2026-02-12","event":"Dormant attacker wallet moves 2,005 ETH ($3.85 million) through three newly created wallets to Tornado Cash — first movement of stolen funds in over two years. Remaining balance: approximately 57,849 ETH and 891 BTC.","source":""}],"sources_used":[{"url":"https://cryptopotato.com/mixin-a-multi-layer-decentralized-network-that-offers-cross-chain-solutions-lightning-fast-transactions/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251117000506/https://cryptopotato.com/mixin-a-multi-layer-decentralized-network-that-offers-cross-chain-solutions-lightning-fast-transactions/","credibility":3,"archive_timestamp":"2025-11-17T00:05:06+00:00"},{"url":"https://www.aicoin.com/en/article/367445","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829143417/https://www.aicoin.com/en/article/367445","credibility":3,"archive_timestamp":"2026-08-29T14:34:17+00:00"},{"url":"https://tokeninsight.com/en/news/mixin-founder-feng-xiaodong-will-compensate-up-to-50-of-losses","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.elliptic.co/blog/mixin-network-hacked-for-200-million","name":"","type":"other","archive_url":"http://web.archive.org/web/20260519155023/https://www.elliptic.co/blog/mixin-network-hacked-for-200-million","credibility":3,"archive_timestamp":"2026-05-19T15:50:23+00:00"},{"url":"https://www.coindesk.com/tech/2023/09/25/mixin-network-losses-nearly-200m-in-hack","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.bleepingcomputer.com/news/security/mixin-network-suspends-operations-following-200-million-hack/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829144337/https://www.bleepingcomputer.com/news/security/mixin-network-suspends-operations-following-200-million-hack/","credibility":3,"archive_timestamp":"2026-08-29T14:43:37+00:00"},{"url":"https://techcrunch.com/2023/09/25/hackers-steal-200-million-from-crypto-company-mixin/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260530165408/https://techcrunch.com/2023/09/25/hackers-steal-200-million-from-crypto-company-mixin/","credibility":3,"archive_timestamp":"2026-05-30T16:54:08+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-mixin-network-hack-september-2023","name":"","type":"other","archive_url":"http://web.archive.org/web/20260516234954/https://www.halborn.com/blog/post/explained-the-mixin-network-hack-september-2023","credibility":3,"archive_timestamp":"2026-05-16T23:49:54+00:00"},{"url":"https://www.securityweek.com/200-million-in-cryptocurrency-stolen-in-mixin-network-hack/","name":"","type":"other","archive_url":"http://web.archive.org/web/20250916013257/https://www.securityweek.com/200-million-in-cryptocurrency-stolen-in-mixin-network-hack/","credibility":3,"archive_timestamp":"2025-09-16T01:32:57+00:00"},{"url":"https://www.merklescience.com/blog/hack-track-mixin-flow-of-funds-analysis","name":"","type":"other","archive_url":"http://web.archive.org/web/20260423025410/https://www.merklescience.com/blog/hack-track-mixin-flow-of-funds-analysis","credibility":3,"archive_timestamp":"2026-04-23T02:54:10+00:00"},{"url":"https://decrypt.co/358032/3-million-ethereum-mixin-network-hack-tornado-cash","name":"","type":"other","archive_url":"http://web.archive.org/web/20260612021406/https://decrypt.co/358032/3-million-ethereum-mixin-network-hack-tornado-cash","credibility":3,"archive_timestamp":"2026-06-12T02:14:06+00:00"},{"url":"https://financefeeds.com/mixin-network-hacker-moves-2005-eth-to-tornado-cash-after-2-years-of-silence/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830000854/https://financefeeds.com/mixin-network-hacker-moves-2005-eth-to-tornado-cash-after-2-years-of-silence/","credibility":3,"archive_timestamp":"2026-08-30T00:08:54+00:00"},{"url":"https://finance.yahoo.com/news/3-85-million-ethereum-mixin-175053959.html","name":"","type":"other","archive_url":"http://web.archive.org/web/20260214110504/https://finance.yahoo.com/news/3-85-million-ethereum-mixin-175053959.html","credibility":3,"archive_timestamp":"2026-02-14T11:05:04+00:00"},{"url":"https://www.theblock.co/post/252716/mixin-network-founder-says-just-half-users-assets-are-safe-after-200-million-hack","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://bitcoinist.com/mixin-network-offers-hacker-20-million-bug-bounty/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260114031844/https://bitcoinist.com/mixin-network-offers-hacker-20-million-bug-bounty/","credibility":3,"archive_timestamp":"2026-01-14T03:18:44+00:00"},{"url":"https://www.bitget.com/news/detail/12560603893640","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://support.mixin.one/en/article/what-is-mdt-token-77n05i/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260520010217/https://support.mixin.one/en/article/what-is-mdt-token-77n05i/","credibility":3,"archive_timestamp":"2026-05-20T01:02:17+00:00"},{"url":"https://www.dlnews.com/articles/defi/questions-swirl-around-hack-at-hong-kong-network-mixin/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260617162543/https://www.dlnews.com/articles/defi/questions-swirl-around-hack-at-hong-kong-network-mixin/","credibility":3,"archive_timestamp":"2026-06-17T16:25:43+00:00"},{"url":"https://mixin.one/features/compliance","name":"","type":"other","archive_url":"http://web.archive.org/web/20260516053913/https://mixin.one/features/compliance/","credibility":3,"archive_timestamp":"2026-05-16T05:39:13+00:00"},{"url":"https://www.bankinfosecurity.com/cryptohack-roundup-200m-mixin-network-hack-a-23185","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830003231/https://www.bankinfosecurity.com/cryptohack-roundup-200m-mixin-network-hack-a-23185","credibility":3,"archive_timestamp":"2026-08-30T00:32:31+00:00"},{"url":"https://www.coindesk.com/policy/2025/12/25/hong-kong-regulators-target-2026-legislation-for-virtual-asset-dealer-and-custodian-rules","name":"","type":"other","archive_url":"http://web.archive.org/web/20260110180127/https://www.coindesk.com/policy/2025/12/25/hong-kong-regulators-target-2026-legislation-for-virtual-asset-dealer-and-custodian-rules?","credibility":3,"archive_timestamp":"2026-01-10T18:01:27+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:38.051199+00:00","updated_at":"2026-08-30T05:14:09.724321+00:00"}}