Mixin Network
Summary
Mixin Network is a Hong Kong-based layer-2 cross-chain payment protocol that suffered the largest single crypto hack of 2023 when attackers compromised its cloud service provider's database and drained approximately $200 million in ETH, BTC, and USDT. The network remains operational but has only partially compensated users, the majority of stolen funds remain unrecovered, and a dormant attacker wallet moved funds to Tornado Cash in February 2026.
Connected Entities
1 entities · 1 linked investigationConnected Through
1 shared actor · 1 investigationDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Mixin Networkorganizationalso inMixin Network·28
Timeline(9 events)
2017-11-01
Feng Xiaodong establishes the Mixin blockchain team in Hong Kong with fewer than 20 people.
2023-09-23
Attacker compromises the database of Mixin Network's cloud service provider; approximately $200 million in ETH, BTC, and USDT drained via 10,000+ unauthorized withdrawal transactions.
2023-09-25
Mixin Network publicly discloses the breach, suspends all deposits and withdrawals, and contacts SlowMist and Google for investigation support.
2023-09-25
Founder Feng Xiaodong holds live briefing; announces 50% immediate stablecoin repayment and 50% via future bond tokens (MDT).
2023-09-26
Mixin offers attacker a $20 million bug bounty for return of stolen funds. Offer is not accepted.
2023-09-26
Elliptic, Merkle Science, and Lookonchain publish on-chain analysis confirming asset breakdown: 59,807 ETH, 891 BTC, 23.57M USDT. Attacker immediately swaps USDT to DAI on Uniswap.
2024-02-01
Mixin Kernel officially launches Mixin Debt Token (MDT) in three tranches (MDTu, MDTe, MDTb) as the mechanism for the 50% deferred repayment.
2025-10-01
Mixin provides repayment update: MDTu (~$23 million) targeted for full repayment by September 2026; no timeline disclosed for MDTe or MDTb.
2026-02-12
Dormant attacker wallet moves 2,005 ETH ($3.85 million) through three newly created wallets to Tornado Cash — first movement of stolen funds in over two years. Remaining balance: approximately 57,849 ETH and 891 BTC.
Decision Log
- hash: HSkTP6mqhaGF2RihYPKU9ewmSuEboaHzgkvMWnjUPRWJ
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:38 AM
last updated: 5/20/2026, 6:22:04 PM
avoid.net — verified advice for a post-truth world