Mixin Hacker

Mixin Hacker

“Mixin Hacker” is an informal label used in cryptocurrency and cybersecurity reporting for the unidentified attacker (or attackers) associated with the Mixin Network hack in September 2023. The term does not generally refer to a publicly identified individual with a confirmed real-world name; rather, it denotes the entity controlling the on-chain addresses linked to the theft. (coindesk.com)

Background (Mixin Network hack)

Mixin Network reported that, in the early morning of September 23, 2023 (Hong Kong time), the database of its cloud service provider was attacked, leading to the loss of assets estimated at roughly US$200 million. Deposits and withdrawals were temporarily suspended while the incident was investigated. (coindesk.com)

Identity and attribution

Public reporting typically describes the “Mixin Hacker” as unknown/anonymous. Some third-party incident summaries have noted speculative attribution (e.g., suspicion of particular state-linked groups) but also acknowledge that conclusive public evidence may be unavailable. (dn.institute)

Later on-chain activity (2026 reports)

In February 2026, multiple outlets reported renewed movement from an address widely tracked as being linked to the 2023 exploit, including a transfer of 2,005 ETH routed through Tornado Cash (a cryptocurrency mixer), with subsequent related wallet activity interpreted as possible selling/cash-out behavior. (gncrypto.news)

Usage of the term

In practice, “Mixin Hacker” functions as a case label (similar to “the Mt. Gox hacker” or “the Ronin hacker”) used to discuss:

• the attack event,
• the cluster of blockchain addresses, and
• the movement of stolen funds,
  without implying a verified personal identity. (coindesk.com)