ChipMixer

~ the eulogy ~

This one is recent enough that I cannot claim the wrong era, only the wrong orbit. In 2023 I was a computer engineer in Ankara working on cameras and models, and tor-only bitcoin tumblers were not a category I ever had reason to open. What I can read is the design, and the design is the reason this grave exists at all. Most dead services on this site died of neglect. This one was engineered specifically to be unfindable and then found anyway.

ChipMixer opened in August 2017, operated out of Vietnam on servers rented in Germany, and ran a site on the open web alongside one on tor. There were no accounts and no identity checks. It never registered with any American financial regulator, and by design it kept nothing that could describe who had used it. The pitch was simple enough to fit on the front page: put bitcoin in, take different bitcoin out, and leave no line between the two.

The customer list is what got it noticed. North Korean state hackers pushed proceeds from the Axie Infinity Ronin bridge and Harmony Horizon bridge thefts through it. Ransomware crews used it as ordinary plumbing, with LockBit and REvil and Zeppelin and SunCrypt all named. Investigators also traced bitcoin used by Russian military intelligence in 2020 to buy the hosting for a piece of malware called Drovorub.

~ the dossier ~

~ how the chips worked ~

Ordinary mixers pool everybody's coins and pay you back out of the pool, which leaves a payment from the mixer to you sitting on the chain for anyone to look at later. ChipMixer did not do that. You deposited bitcoin and received chips, tokens in fixed denominations that doubled upward from a thousandth of a bitcoin, and the addresses behind those chips had been funded in advance, sometimes days before your money ever arrived.

When you withdrew, the service handed you the private key to an address that already held the value. You imported it into your own wallet and the coins were yours. There was never a transaction from ChipMixer to a customer, because ownership changed without the chain being told. Sessions were restored by quoting a deposit address or a voucher code instead of logging in. The whole thing is a clean piece of work by somebody who had thought carefully about what a subpoena can actually reach.

~ the seizure ~

On 15 March 2023 German federal police took four servers, with the FBI and Homeland Security Investigations working the American side and Europol coordinating three more countries into the operation. They carried off 1,909.4 bitcoin, worth about 44.2 million euros at the time, and 7 TB of data. The site came back up wearing a seizure banner.

The American complaint was filed in the Eastern District of Pennsylvania and named Minh Quoc Nguyen of Hanoi. The charges were money laundering and identity theft, on top of running a money transmitting business without a license. The Justice Department put more than three billion dollars through the service since 2017. Europol counted in coins instead and reached 152,000 bitcoin, roughly 2.73 billion euros by the estimates of the day.

~ the long tail ~

The seven terabytes are the part worth sitting with. A service whose entire promise was that it kept nothing still left seven terabytes behind, because a running system needs state even when its operator does not want any. The coins were the headline and the disks were the actual damage, and everything downstream of that takedown came off the disks.

Blender.io had been sanctioned the year before and Tornado Cash the same summer, so 2022 and 2023 were the window when mixing stopped being treated as a privacy tool and started being treated as infrastructure to be dismantled. ChipMixer is the one where the technical trick was genuinely novel, and it bought about five and a half years. Meanwhile a dozen domains with names one character away from chipmixer.com are still up today, selling the same service to people who do not know the original is a crime scene.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »