Mixin Network lost $200M in a cloud-database breach — users were told to eat half

In the early hours of September 23, 2023, attackers breached the database of Mixin Network's cloud service provider and made off with about $200 million in mainnet assets. Mixin — a cross-chain transfer network claiming a million users, roughly $1 billion in custodied assets and support for 48 blockchains — suspended all deposits and withdrawals and called in Google and the security firm SlowMist.

The response mapped the company's real structure. An on-chain message offered the thief a $20 million bounty to hand the loot back, and founder Feng Xiaodong told users in a Mandarin livestream that Mixin would restore up to 50% of the stolen funds while the remainder would be converted into bond tokens the company promised to buy back later. Critics noted the irony of "decentralized" infrastructure failing at a single cloud database.

The breach landed in the worst stretch of 2023 for third-party crypto compromises: days earlier Elliptic had blamed North Korea's Lazarus Group for the $54 million CoinEx theft, and Mixin was the third crypto firm in a week hit through a vendor, after OpenSea and Nansen. Mixin's balance sheet could not absorb a loss worth a fifth of its capital the way a large exchange's could — so half of it was moved onto users' ledgers as paper.

About $200M in user crypto — roughly 20% of the firm's capital; deposits and withdrawals frozen; users offered half their money back, half in IOUs

Keeping custody behind a single cloud-service-provider database recreated the exact central point a decentralized protocol exists to remove.

A $20 million bounty on $200 million of loot conceded the firm could not recover the funds technically and hoped the thief would negotiate.

The 50% restoration pledge plus bond tokens converted an operational failure into user-borne debt while keeping the company alive.

Vendor breaches at OpenSea, Nansen and CoinEx the same month showed third-party infrastructure is part of the attack surface, not outside it.

A protocol can call itself decentralized while its users' money sits behind one cloud database. When custody is centralized, losses land on whoever has the weakest claim — usually the users.

Deposits and withdrawals remained suspended while Mixin worked on the vulnerability fixes, with the founder's livestream and the on-chain bounty message as the company's public accounting. The 50%-restoration-plus-bond-token plan put the missing half of users' money on their own ledgers until Mixin could buy the IOUs back. The breach closed a brutal quarter for third-party crypto infrastructure: OpenSea and Nansen breached through vendors, CoinEx drained of $54 million in a raid Elliptic attributed to Lazarus, and almost $240 million taken from five hacks in the 104 days before Mixin fell.