mixin

Galaxy Research published that the attackers in the Coldcard "Wave 3" attack are still continuously transferring the stolen funds. During this phase, the attackers created 293 2-of-2 multi-signature wallets for each victim's assets. The first batch of funds was transferred across chains to Ethereum via THORChain; the latest round of transfers has begun entering the CoinJoin mixing process.Currently, the Wave 3 attackers are processing the largest amounts of stolen funds in order of the stolen amount, having sequentially transferred the funds from wallets ranked 1 to 11. The next 10 wallets that have not yet been transferred hold a total of 30.81 BTC, while wallets ranked 61 to 293 hold a total of 33.77 BTC. So far, the attackers have transferred about 45% of the stolen assets from this exploit, with funds flowing to Ethereum (via THORChain) or entering CoinJoin mixing transactions. Additionally, this fund transfer has revealed a previously unknown wallet: 58 addresses jointly spent in a 2-of-2 multi-signature format identical to that of Wave 3, and these were further transferred by the Wave 3 attackers to a jump address that funds CoinJoin.The on-chain analysis team currently marks this wallet as "cause = open," but believes it likely also belongs to Coldcard victims, which means the number of wallets involved in Wave 3 may increase to 294, raising the previously reported total amount stolen from the Coldcard vulnerability to approximately 1806 BTC. Currently, about 82% of the stolen BTC remains in addresses initially controlled by the attackers, while about 18% has been transferred, with the flow of funds indicating that it may be undergoing laundering processes.

Harmony has released two proposals to comprehensively shut down the mainnet launched in 2019, migrate the native token ONE to Ethereum, and shift towards an AI video "mashup economy" business. The team stated that the threats posed by national-level attackers and AI entities are the reasons for proposing the network shutdown plan.The migration plan proposes to take a snapshot of user wallets, staking delegations, validator rewards, smart contracts, and tokens within centralized exchanges at the last block of the network, airdropping new ONE to the same wallet addresses on Ethereum, with holders not needing to actively claim; delegated stakes and unclaimed rewards will be airdropped to their respective governance vaults. The total supply of ONE and the issuance rate will remain unchanged, with newly issued tokens intended for the new business and feedback from governors being considered.Multi-signature wallets, liquidity pools, and on-chain applications cannot be migrated. The team urges users to exit all smart contracts by September 10, 2026, and plans to publicly disclose token contracts, snapshot calculations, and airdrop scripts for auditing. Validators can stop running nodes starting from September 10 at 22:00 Beijing time. The team plans to compensate for the difference in issuance rewards between node shutdown and the final block of the network, establishing a one-time compensation pool of $1.372 million, to be paid in four quarters to validators and their delegators who timely shut down, sign agreements, retain stakes, and serve as governors of the new project.The new business will open up prompts and materials for users to create secondary content, with AI entities expanding video stories, and will recruit operators responsible for video generation, distribution, and content review. Harmony plans to subsidize GPU hardware in the first year and promote demand for video generation, with operators required to stake tokens to earn rewards based on service online time. The team plans to help operators generate up to $1 million in total revenue in the first year, provided they meet staking and online rate requirements; promoters can initially earn a 30% ongoing commission from each $10 monthly subscription they recommend. Both proposals are non-binding and the plans may still be adjusted.

Ethereum co-founder Vitalik Buterin published a new article titled "Obfuscation (Part 3): Local Mixing," which delves into a cryptographic obfuscation technique being explored—"Local Mixing." He claims it may become a new foundational cryptographic tool following elliptic curves, RSA, and lattice-based cryptography.Vitalik states that current mainstream obfuscation techniques mainly rely on complex mathematical assumptions, often resulting in extremely high computational overhead. In contrast, Local Mixing adopts a completely different approach, not relying on elliptic curves, large integer factorization, or lattice cryptography. Instead, it draws on experiences from symmetric cryptography and hash function design, continuously shuffling, reconstructing, and hiding circuit structures to eliminate information leakage while maintaining functionality.The Local Mixing technique primarily includes steps such as reversibility, hardening, mixing, splitting, crossing walk, and "gadgetization." By introducing random structures into the circuit, rearranging logic gates, and employing nonlinear hiding mechanisms, it makes it difficult for attackers to recover the original computational logic.Vitalik points out that this technology is still in its early stages, with security not yet validated over the long term and facing challenges such as random attacks and linear analysis. However, he believes that Local Mixing represents a completely new path for cryptographic exploration, aiming to construct more efficient indistinguishable obfuscation (iO) schemes.If breakthroughs in Local Mixing technology are achieved, it could lead to new quantum-resistant public key encryption schemes and promote the development of general obfuscation techniques. The field still requires years of cryptanalysis and optimization validation, but AI-assisted research may significantly accelerate this maturation process. Vitalik states that obfuscation technology is seen as the "final frontier" of cryptography because, theoretically, other cryptographic primitives can be constructed based on obfuscation and one-way functions. Local Mixing may not only reduce the costs of traditional obfuscation schemes but could also become an important direction for future cryptographic infrastructure.

According to on-chain detective Specter, the victim claims to have transferred funds from Bitcoin to Ethereum due to a hack on Coldcard. However, on-chain data shows that 73 BTC (worth $4.6 million) originally came from the Whirlpool mixer two weeks ago, with some of it crossing over to Ethereum and subsequently deposited through a phishing Tornado Cash interface.Two mixers were used during the related fund transfer process. The individual was also found to be present in Telegram groups related to private key searches and brute force cracking. On-chain detective Specter indicates that the victim may be a threat actor, and their funds may have also been stolen by another threat actor.

According to on-chain detective ZachXBT's monitoring, it was found that signs of mixing appeared in the funds stolen from the Humanity Protocol and Kelp DAO vulnerability attacks one hour ago, indicating that there may be an overlap between the attackers of these two incidents.Based on this new evidence, it can be largely ruled out that the theft case of Humanity Protocol was committed by an insider.

According to Lookonchain monitoring, the Mixin hacker has started selling 59,854 ETH, worth $117 million, after being silent for two years.15 hours ago, the hacker sent 2,005 ETH to TornadoCash. Shortly after, 3 new wallets received 2,087 ETH (4.03M) from TornadoCash and sold it at a price of $1,933. The Mixin hacker still holds 57,849 ETH ($113.4 million) and 891 BTC ($59.7 million).

The U.S. Department of Justice has officially obtained legal ownership of over $400 million in assets related to the dark web cryptocurrency mixing service Helix, including cryptocurrencies, real estate, and cash assets.U.S. District Court Judge Beryl A. Howell signed the final forfeiture order. Helix, operated by Larry Dean Harmon, processed approximately 354,468 Bitcoin transactions from 2014 to 2017, valued at $300 million at the time, primarily serving the money laundering needs of dark web drug dealers. Harmon pleaded guilty to conspiracy to commit money laundering in August 2021 and was sentenced to 36 months in prison, 3 years of supervised release, and asset forfeiture in November 2024.

According to Crowdfund Insider, TRM Labs stated that it has traced stolen crypto assets from the 2022 LastPass vulnerability incident on-chain, with on-chain indicators suggesting the involvement of Russian cybercrime groups in the laundering process.TRM noted that although hackers used mixing tools like CoinJoin, they were still able to associate the flow of funds before and after the mixing back to the same group of attackers through de-mixing and behavioral continuity analysis. The related funds ultimately flowed into high-risk Russian exchanges Cryptex and Audi6, with the total amount involved estimated to exceed $28 million.

According to The Block, Samourai Wallet co-founder William Lonergan Hill was sentenced to four years in prison by the U.S. Southern District Court of New York for assisting in the laundering of over $237 million. In addition, he was fined $250,000 and placed on three years of supervised release. He and CEO Keonne Rodriguez pleaded guilty in July, with Rodriguez being sentenced to five years in prison on November 6. The two concealed the source of funds through services like "Whirlpool" and "Ricochet," and had actively promoted their coin-mixing services on the dark web. Together, they paid a total of $6.3 million in fines.

According to Bloomberg, a federal court in New York has sentenced Samourai Wallet co-founder Keonne Rodriguez to five years in prison for conspiring to operate an unlicensed money transfer business. He had previously reached a plea agreement with prosecutors and agreed to forfeit $237 million in assets and pay a $400,000 fine along with another co-founder. The case involves using mixing services to launder funds from the dark web and scams.

ChainCatcher news, according to Cointelegraph, Samourai Wallet co-founders Keonne Rodriguez and William Lonergan Hill have pleaded guilty in the U.S. District Court for the Southern District of New York to charges related to their cryptocurrency mixing service.

ChainCatcher news, according to Decrypt, crypto advocacy groups such as the Blockchain Association, Coin Center, DeFi Education Fund, and the Bitcoin Policy Institute are calling for the dismissal of the case against the Bitcoin mixing service Samourai.These groups believe that Samourai Wallet merely helps people conduct financial transactions online without violating U.S. law. Nevertheless, a federal judge this week refused to accept these groups' amicus briefs. Previously, the U.S. government shut down Samourai Wallet and arrested its developers, accusing the application of being an "unlicensed money transmitting business" used by criminals.

ChainCatcher message, on-chain detective ZachXBT posted that the "Silk Road" founder Ross Ulbricht's donation wallet received 300 BTC, which appears to have been sent from Jambler (a rough centralized mixing service).

ChainCatcher news, a Russian court has sentenced the founder of the online black market and cryptocurrency mixing service Hydra, Stanislav Moiseev, to life imprisonment. The service processed over $5 billion worth of cryptocurrency during its operation.According to a statement from the Moscow Prosecutor's Office on December 2, the Moscow Regional Court found Moiseev and his 15 accomplices guilty of organized crime and illegal production and sale of psychoactive substances and drugs. The sentences for Moiseev's 15 accomplices ranged from 8 to 23 years. Moiseev was also fined $38,100 (4 million rubles), while his 15 accomplices were ordered to pay a total of $152,400 (16 million rubles). As part of the sentencing order, properties and vehicles related to the convicted individuals were also seized.According to Russian state media TASS, they will serve their sentences in a "strict regime" penal colony.

ChainCatcher news, according to Bloomberg, the founder of the cryptocurrency mixing service Bitcoin Fog has been sentenced to 12 and a half years in prison for laundering tens of millions of dollars from the sale of illegal drugs on dark web markets.U.S. District Judge Randolph Moss sentenced 36-year-old Roman Sterlingov to 150 months in prison at the federal court in Washington. Prosecutors stated that Bitcoin Fog handled hundreds of millions of dollars in untraceable transactions, some of which came from known dark web markets. Roman Sterlingov was convicted of conspiracy to launder money, money laundering, and two counts related to operating an unregistered money transfer service.

ChainCatcher news, according to The Block, the co-founder of the cryptocurrency mixing service Samourai Wallet has been arrested. Prosecutors stated that they are suspected of laundering $100 million from Silk Road and other illegal markets. On Wednesday, Samourai CEO Keonne Rodriguez and CTO William Lonergan Hill were charged with operating Samourai Wallet.Prosecutors indicated that Samourai is an unlicensed remittance company involved in "over $2 billion in illegal transactions and facilitated over $100 million in laundering transactions for illegal dark web markets, including Silk Road." Rodriguez was arrested on Wednesday morning and will face a judge in Pennsylvania.It is reported that Hill was arrested in Portugal, and the U.S. is seeking extradition. Prosecutors stated that Samourai's web servers and domain name have also been seized, and the application can no longer be downloaded from the Google Play Store in the U.S. Rodriguez and Hill are charged with money laundering and unlicensed money transmission, with maximum sentences of 20 years and 5 years, respectively.

ChainCatcher news, according to The Block, Coinbase stated in comments submitted to the Financial Crimes Enforcement Network (FinCEN) on Monday that the U.S. Treasury's proposed rulemaking on cryptocurrency mixing fails to adequately address regulatory gaps while requiring crypto platforms to provide unnecessary data and resources. Coinbase stated that regulated crypto platforms are already obligated to record and report suspicious activities and illegal crypto mixing rules, but requiring crypto platforms to report all cryptocurrency mixing activities, including those with legitimate purposes, is not an effective use of company resources. The document also questioned the lack of a monetary threshold for record-keeping and reporting. Coinbase's Chief Legal Officer Paul Grewal wrote in an X post that the absence of a monetary threshold "will only lead to a large number of reports of non-suspicious transactions." Grewal stated, "Congress has indicated that this data dump is a waste of time and resources."Grewal stated in an X post, "If the Treasury wants to focus on this issue, they should help exchanges fulfill their existing obligations to report suspicious activities involving mixing. This is what the Treasury has done elsewhere, and specific guidance is more effective than mandatory bulk reporting rules." In light of these issues, Coinbase suggested that FinCEN should introduce a threshold to eliminate bulk reporting of small transactions. Coinbase also recommended that only record-keeping should be required, rather than reporting, to mitigate privacy and security risks.Coinbase's comments are a response to FinCEN's proposed rulemaking aimed at increasing the transparency of cryptocurrency mixing activities, which was introduced last October. Many illicit actors, such as North Korean hackers and Russian ransomware attackers, use crypto mixers for money laundering activities. While FinCEN stated in its proposal that such mixers may facilitate money laundering, it acknowledged that cryptocurrency mixing can be used for "legitimate and innovative purposes."

ChainCatcher news, according to Arkham monitoring, the hacker group Lazarus Group extracted $1 million worth of Bitcoin from its mixing pool and sent $150,000 worth of Bitcoin to a previously inactive address.