Mixin suspends deposits and withdrawals after $200M cryptocurrency heist
1–10 of 85 posts
Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist
#2> Mixin Network confirmd on Monday that it has "temporarily suspended" all deposit and withdrawal services after hackers broke into a database and stole about $200 million in funds from the Hong-Kong based cryptocurrency firm.
> Mixin, which is a decentralized exchange,
These 2 statements seem to contradict each other. If they are a decentralized exchange, how were funds stolen by hacking into a database?
Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist
#3> Mixin Network confirmd on Monday that it has "temporarily suspended" all deposit and withdrawal services after hackers broke into a database and stole about $200 million in funds from the Hong-Kong based cryptocurrency firm. > Mixin, which is a decentralized exchange, These 2 statements seem to contradict each other. If they are a decentralized exchange, how were funds stolen by hacking into a database?
"Decentralized" isn't a magic word. They're still an exchange, and there needs to be a way to extract funds.
The database doesn't need to contain account balances or funds so long as it contains credentials necessary to access them.
Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist
#4> Mixin Network confirmd on Monday that it has "temporarily suspended" all deposit and withdrawal services after hackers broke into a database and stole about $200 million in funds from the Hong-Kong based cryptocurrency firm. > Mixin, which is a decentralized exchange, These 2 statements seem to contradict each other. If they are a decentralized exchange, how were funds stolen by hacking into a database?
Can't spell decentralized without central
Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist
#5> Mixin Network confirmd on Monday that it has "temporarily suspended" all deposit and withdrawal services after hackers broke into a database and stole about $200 million in funds from the Hong-Kong based cryptocurrency firm. > Mixin, which is a decentralized exchange, These 2 statements seem to contradict each other. If they are a decentralized exchange, how were funds stolen by hacking into a database?
"Decentralized" isn't a magic word. They're still an exchange, and there needs to be a way to extract funds. The database doesn't need to contain account balances or funds so long as it contains credentials necessary to access them.
If they are storing credentials to access funds in a centralized database, they are by definition not "decentralized".
For example, Curve.fi meets the common definition of "decentralized exchange", and as such does not store credentials, etc in a centralized database. Their code is deployed to Ethereum and runs on Ethereum, so users are able to make trades against it, deposit funds into trading pools, etc, all without having a central actor hold credentials.
That said, Curve.fi can still cause users to lose funds if they have bugs in their code, but they do not have the risk of someone stealing passwords from their server and walking away with the money.
Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist
#6Earlier quoted context omitted.
"Decentralized" isn't a magic word. They're still an exchange, and there needs to be a way to extract funds. The database doesn't need to contain account balances or funds so long as it contains credentials necessary to access them.
If they are storing credentials to access funds in a centralized database, they are by definition not "decentralized". For example, Curve.fi meets the common definition of "decentralized exchange", and as such does not store credentials, etc in a centralized database. Their code is deployed to Ethereum and runs on Ethereum, so users are able to make trades against it, deposit funds into trading pools, etc, all withou…
> they do not have the risk of someone stealing passwords from their server and walking away with the money
So if they get hacked and the credentials to upload code get stolen, what happens? Wouldn’t the hackers be able to deploy code that steals users crypto?
Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist
#7> Mixin Network confirmd on Monday that it has "temporarily suspended" all deposit and withdrawal services after hackers broke into a database and stole about $200 million in funds from the Hong-Kong based cryptocurrency firm. > Mixin, which is a decentralized exchange, These 2 statements seem to contradict each other. If they are a decentralized exchange, how were funds stolen by hacking into a database?
> how were funds stolen by hacking into a database?
Sometimes "decentralized" really means "running on a theoretically distributed network, but practically we host all the nodes/have emergency root keys/exclusively provide the software running on them and the clients used to access them – only for now, we promise!"
This particular project also seems to heavily lean on Intel SGX, according to its most recent public whitepaper from 2018 [1] and also seems to offer wallet recovery using only a user's mobile phone number and a 6-digit PIN [2] – combine that with not too many actually administratively distributed nodes, and it's not too hard to imagine what could have gone wrong...
Edit: Actually the entire proposal sounds ridiculous, unless I'm missing something: The protocol claims to offer secure, yet recoverable device-local keys, but it all seems to boil down to a trusted and independent set of signer nodes (see above for problems), as well as users being able to store a "per-device ephemeral secret" securely and locally, with backup considerations basically left as an exercise to the reader, and the reference implementation seems to just upload that backup to a central API... [3]?!
[1] https://mixin.one/assets/Mixin-Draft-2018-07-01.pdf
[2] https://tip.id/
[3] https://github.com/MixinNetwork/ios-app/blob/9e11dd02953297f...
Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist
#8These are 99 times out of 100 an inside job.
Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist
#9> Mixin Network confirmd on Monday that it has "temporarily suspended" all deposit and withdrawal services after hackers broke into a database and stole about $200 million in funds from the Hong-Kong based cryptocurrency firm. > Mixin, which is a decentralized exchange, These 2 statements seem to contradict each other. If they are a decentralized exchange, how were funds stolen by hacking into a database?
Only few projects (like uniswap) are truly decentralized. Most projects are not, and only claim they'll eventually become decentralized once "they finish development".
Re: Mixin suspends deposits and withdrawals after $200M cryptocurrency heist
#10[deleted]