One of the Biggest Crypto Mixers, ChipMixer, Seized by German Police
Published by Ethan on Sat, Mar 18, 2023 | Tagged Cryptocurrency | 79 Comments

German and US authorities, supported by Europol, have seized ChipMixer, an unlicensed cryptocurrency mixer well-known in the cybercriminal underworld. The investigation was also supported by Belgium, Poland and Switzerland. On 15 March, national authorities took down the infrastructure for its alleged involvement in money laundering activities and seized four servers, about 1909.4 Bitcoins in 55 transactions (approx. EUR 44.2 million) and 7 TB of data.

The contents of 7 TB of data found is not specified. This data could be anything from cryptocurrency nodes, to backups containing mix data and private keys.

Europol said ChipMixer helped hide the trail of digital money for online drug traffickers, Russian military hackers and North Korean cybercriminals. In doing so, the mixer facilitated money laundering of 152,000 Bitcoins.

The Frankfurt General Prosecutor's Office, Central Office for Combating Cybercrime (ZIT), and the German Federal Criminal Police Office (BKA) were involved in the operation. In a press release, the BKA said they seized ChipMixer's server infrastructure located in Germany on Wednesday. The U.S. authorities seized two web domains that directed visitors to ChipMixer and a GitHub account that contained project code. Both their Tor and clearnet website now show a seizure notice.

After clicking "Start Mixing" a banner sweeps in

After the seizure, authorities left "easter eggs" around ChipMixer's onion site. The session token, used for tracking a mix, reads "SeIzDDbYbKAl0L", and the footer text "Want to earn an honest living in crypto? Visit our career page!" directs you to work for the German Federal Criminal Police Office.

On November 23, 2021, ChipMixer's clearnet address, which was used solely to direct people to their Tor site, was seized. The FBI served a federal search warrant to DigitalOcean for chipmixer.com:

FBI analysis of this server image revealed that it contained minimal information about the administrators, customers, or operations of ChipMixer, and it pointed traffic to a ChipMixer Tor server.

Authorities didn't specify how they located the onion site. Although, both the clearnet and onion sites where hosted with Hetzner. The FBI's vague statement about locating the onion server:

Through the course of the investigation, and working in partnership with foreign law enforcement, the FBI identified that another ChipMixer server resolved to IP address 138.201.227.85, hereinafter the “V3 Server.” Open-source research conducted on IP address 138.201.227.85 revealed the IP address resolved to Hetzner Online GmbH (Hetzner) in Germany.

How Minh Quoc Nguyen was Identified

The US Justice (DOJ) announced it had indicted Minh Quoc Nguyen, a Vietnamese national from Hanoi. The alleged 49-year-old owner is charged with commercial money laundering, operating an unlicensed money transfer business, and also identity theft in connection with the operation of ChipMixer. He is currently wanted by the FBI.

Beginning in and around August 2017, Nguyen allegedly created and operated the online infrastructure used by ChipMixer. In addition, it's said that he advertised ChipMixer's services online, registered domain names, procured hosting services, and paid for them.

He disguised his identity by using other identities, pseudonyms, and email providers.

How Nguyen's identities were linked together by the FBI

Nguyen was linked to ChipMixer in multiple ways. He used many clearnet email providers and indirectly used his own PayPal account to pay for the servers.

PayPal accounts linked to the account that was paying for the servers:

PayPal accounts associated with paying for ChipMixer's Servers
Open-source research conducted on the above accounts revealed the identifying information associated with the accounts are primarily United States-based persons, approximately 60-70 years old, except for the account associated with MINH NGUYEN. Commercial database research revealed that some of these persons are deceased.
According to PayPal records for the V3 PayPal Account (the account paying for the server), on December 27, 2022, there was a credit card payment received from MINH NGUYEN, email address nqminh73@yahoo.com for $150.00 with the comment “Thanks.”

The FBI found transactions with 70 different PayPal accounts using ProtonMail addresses when they dug deeper into the PayPal accounts above. They then submitted international records requests for subscriber data for these ProtonMail accounts. Of these accounts, 24 of them listed jamessmithhelp@gmail.com as a recovery email address and nine listed minhoba@ymail.com as a recovery email address.

Records from Google for the account jamessmithhelp@gmail.com revealed location history data. From September 2016 through March 2022, there were 149,027 data points associated to the account that resolved in and around Ha Noi, Vietnam. The location history data is a combination of different sources to include cell, GPS, and Wi-Fi, showing that NGUYEN was physically in Vietnam during these data points.
Location data from the Google account jamessmithhelp@gmail.com

Search warrant returns from Google for jamessmithhelp@gmail.com revealed searches by Nguyen for ways to buy personally identifiable information. The following Google searches were conducted:

Binance provided records relating to jamessmithhelp@gmail.com, which revealed an account registered with Nguyen's own name and ID. Transaction data from Binance showed Nguyen cashing out using Remitano, a P2P Bitcoin marketplace, where he also used his ID.

His anonymous email accounts ended up being linked to accounts from Dropbox, Apple, BlackHatWorld, ResearchGate, Reddit, Microsoft, Google, PayPal, BitcoinTalk, ProtonMail, LinkedIn, Twitter and Investing.com.

About Nguyen

Nguyen often expressed his views stating that "Money laundering is a crime made-up by governments that spy on their citizens" and advised people "not to use AML/KYC services". Eventually he became victim of his own words as he repeatedly used Binance and PayPal which lead to his identity.

If currently residing in Vietnam, Mr. Nguyen might be a lucky guy. Vietnam does not extradite its citizens and last time the US tried to apprehend a Vietnamese cyber criminal, they went as far as luring him to Guam to capture him. If otherwise convicted, he faces a maximum sentence of 40 years in prison.

Some people think that Nguyen is not the mastermind behind ChipMixer, due to his "basic training in cryptographic engineering" and mistakes in concealing his identity.

ChipMixer's official BitcoinTalk profile was last active on 14th March

Court documents.

scroll to the bottom or reply to comment
d69a9fa46c
d69a9fa46c
Fri, Mar 17, 2023

Did anyone ever explain OPSEC to this guy?

New comments are disabled for this page.
7bb8048d7b
101010101010101
Fri, Mar 17, 2023

that's why he couldn't of been the brains of the operation. too dumb

761addf231
761addf231
Sat, Mar 18, 2023

That's the point, his opsec wasn't too bad... though theres IP of vietnam which the US didn't even bother to ask the Viet authorities, and then there's the gmail. Location data? What the fuck. It gets even stranger, why would he randomly just trade $100 (bitcoin->paypal) or look up 'ssn dob shop' on google? maybe too much of alcohol in the late evenings huh

83d48b9d71
83d48b9d71
Sat, Mar 18, 2023

@761addf231 yeah he had to be on drugs to make these choices

0694418555
protonpussy
Fri, Mar 17, 2023

Reason 1685 not to use ProtonMail

New comments are disabled for this page.
f58e0509fd
Get Smart
Sat, Mar 18, 2023

Reason 1685 not to use ProtonMail any clearnet email provider.

517d88716a
517d88716a
Sat, Mar 18, 2023

Reason 1685 not to use any clearnet email provider email. Fixed it

aea90df02e
Ramdaram
Fri, Mar 17, 2023

Thank you!

New comments are disabled for this page.
4dd77ad720
Fuck infinity
Fri, Mar 17, 2023

infinity exchange is next

New comments are disabled for this page.
9e5eef5cd2
9e5eef5cd2
Sat, Mar 18, 2023

name found in darknet name generator

60e7b181e3
60e7b181e3
Sat, Mar 18, 2023

Why does infinity get so much hate?

c45cee42a4
c45cee42a4
Sat, Mar 18, 2023

Because they are Jewish and run squid market and like 8 other scam markets. Just ask hugbunter on dread.

acb54ed5f8
acb54ed5f8
Sat, Mar 18, 2023

Get away from Infinity! this is the best swap I've ever had.

Try promoting your coin swap instead of shilling others.

c1087507d3
c1087507d3
Fri, Mar 24, 2023

Infinity exchange is nowhere near squid market, I know parchezzi runs infinity exchange, he translates and doesnt speak english, go to squid and see how a real English speaking person writes. some times little details matters. stop the fuds

bc9742fed2
Meep
Fri, Mar 17, 2023

Here is the chatter on the fallout from daily users of ChipMixer on the only forum I know where ChipMixer admin had an active thread. It starts here: https://bitcointalk.org/index.php?topic=1935098.msg61916953#msg61916953

New comments are disabled for this page.
d24247f2fc
d24247f2fc
Sat, Mar 18, 2023

It's not the admin, just an active BTC talk member paid to manage the campaign

5b64507312
5b64507312
Sat, Mar 18, 2023

DeSanek?

New comments are disabled for this page.
52262b0be7
52262b0be7
Sat, Mar 18, 2023

Not every admin on the darkweb is DeSnake. Lay off the drugs and use your brain for once.

c5486a622d
52262b0be7
Sat, Mar 18, 2023

It's Hug for all we know, rite? /s

be8ca7b1e3
be8ca7b1e3
Sat, Mar 18, 2023

How much did hugbunter get from Dicksnakes exit?

88fe974025
88fe974025
Thu, Jun 15, 2023

hey

a0194dca33
24736518712
Sat, Mar 18, 2023

How tf do you register 24 different accounts using the same recovery email? Either ProtonMail has worst-in-industry account registration abuse prevention, or this is one of the most embarrassingly failed attempts to covertly parallel construct evidence I can remember. Why they even put effort into pretending like their moves represent something other than the conspiracy/cash grab it was feels like an insult. Greasy ass fucking clowns

New comments are disabled for this page.
e99b8f380e
8833333333333
Sat, Mar 18, 2023

The dude was opsec retarded. They have him on everything except the crypto, they didn't need to parallel construct evidence

c1071b0431
c1071b0431
Sat, Mar 18, 2023

There's difference between recovery email and verification email. Verification emails are not stored, only hash (of the domain?) or something like that. Recovery on the other hand have to be supplied manually as a next step. So stupid. Using 1 recovery email all over links them all together.

4210df507a
4210df507a
Sat, Mar 18, 2023

@c1071b0431

Shut the fuck up protonmail shill "Verification emails are not stored"

Yeah sure, how tf would you know motherfucker

c2c884d6a6
c2c884d6a6
Sat, Mar 18, 2023

@4210df507a a hash of the email is stored. Nothing else

1e96dcc67d
1e96dcc67d
Sat, Mar 18, 2023

@c2c884d6a6

How would you know that? Are you willing to stake your freedom on them not storing the email?

And even if they are only storing the hash, it's trivial for them to compare, query, or crack it if needed.

1c8e1b8416
1c8e1b8416
Sat, Mar 18, 2023

@1e96dcc67d it says that on the Proton site

c24dd62c6f
c24dd62c6f
Mon, Mar 20, 2023

Snowden was helping ProtonMail get setup when he was in Switzerland. Look it up.

e28b8702c3
pseudonym
Sat, Mar 18, 2023

👍 interesting article

New comments are disabled for this page.
1b11588919
desnape
Sat, Mar 18, 2023

Fucking DeSnake. I hope he rots in hell.

New comments are disabled for this page.
b2f4a9ee9c
exit scam
Sat, Mar 18, 2023

Hugbunter = desnake

10aa5a46df
10aa5a46df
Sat, Mar 18, 2023

I mean hes right, no? 'Money laundering is a crime made-up ' same thing like "war on drugs" or 'protect the children' and all the other crap. The govt should just relax. No stupid license. No stupid that. Lets just everyone live in peace.

New comments are disabled for this page.
76b89eadea
shutup
Sat, Mar 18, 2023

I mean hes right, no? 'child molesting is a crime made-up ' same thing like "war on drugs" or 'protect the children' and all the other crap. The govt should just relax. No stupid license. No stupid that. Lets just everyone live in peace.

4d8c634296
IQ
Sat, Mar 18, 2023

@shutup IQ 1000.

Mixing coins without KYC and using drugs = molesting children

6b94a9606a
glowingsohard
Sat, Mar 18, 2023

thats excuse also even if child molesters used the service, it will fix nothing.

34712ee817
34712ee817
Mon, Mar 20, 2023

Money is property so "money laundering" is unconstitutional and US Dollars aren't even controlled by the government, they are from a private company called The Federal Reserve. Basically, if the government can't conduct warrantless searches on the source of the private certificates of debt you use for money, they will steal it from you also without a warrant. It's blatantly unconstitutional on so many levels but so is warrantless mass surveillance and other things.

f6fccfb8a1
MINH NGUYEN
Sat, Mar 18, 2023

HOW DO YOU FUCK UP THIS BAD?

New comments are disabled for this page.
1bcf726baa
1bcf726baa
Sat, Mar 18, 2023

>7 TB of data

??? i hope he wasn't logging every single mix nnnnnnnnn

>Although, both the clearnet and onion sites where hosted with Hetzner.

Then why is the onion still up??? chipmixorflykuxu56uxy7gf5o6ggig7xru7dnihc4fm4cxqsc63e6id.onion

>international records requests for subscriber data for these ProtonMail accounts

wow who could have thought that the privacy email service protonmail would store and provide data to LE

>jamessmithhelp@gmail.com revealed location history data

AAAAAAAAAAHHH aint now way!!

.

It's mistake after mistake with this guy maybe he it's parallel construction, or maybe he wasn't the brain, or maybe he just dumb like that!

Don't rely on centralized services and fuck the feds!!!

New comments are disabled for this page.
8980815d3b
8980815d3b
Sat, Mar 18, 2023

Onion already seized by the german feds, look at the footer.

db85fb4065
db85fb4065
Sat, Mar 18, 2023

After clicking "Start Mixing" a banner sweeps in

a1d8425399
JOIN Bundeskriminalamt
Sat, Mar 18, 2023

LOL what the fuck is that

can any german explain?

From the onion (still no big seizure notice) chipmixorflykuxu56uxy7gf5o6ggig7xru7dnihc4fm4cxqsc63e6id.onion:

About (links to article about seizure https://bka.de/chipmixer) | Want to earn an honest living in crypto? Visit our career page! (https://www.karriere.bka.de/Karriereportal/DE/Startseite/startseite_node.html)

German feds desperate to recruit "criminals" or WTF is this?

New comments are disabled for this page.
906c39ac98
906c39ac98
Sat, Mar 18, 2023

It's German officers making a joke.

580639c56c
580639c56c
Sat, Mar 18, 2023

It's not a joke. The Europol, UK's NCA and all other BS organizations are all actively hiring through various of programs. Including kids. Check it out: cybersecuritychallenge.org.uk

Well, I guess you could call it desperate. It's the truth that nobody WITH SKILL wants to do that shit. Because you half of the time you want to do something, you can't, you have to follow their bullshit protocols and procedures. And you are also paid ridiculous low salaries, because that's how it works in Europe. You are often less than the average or median wage is, which is just ridiculous.

So people who do it have to do it with passion.

On the other hand... Asia, Israel, Russia... They do it right. There they have special military schools for "cyber hacking". That is a little more interesting, thus thats why there is way too many hackers from these places.

1f409334f6
580639c56c
Sat, Mar 18, 2023

The police uses "benefit of doubt" you will hardly ever see the police boast about how many crimes they solved or how many people escaped them. They will only ever brag about success. The truth is, on average less than 15-50% of criminal offenses are solved. This includes murder, cyber crimes, theft, extortion, sexual assaults, drugs. The moment you realize that, life becomes just slightly scarier. It's like religion. It's meant to have people under control.

27da7fab32
580639c56c
Sat, Mar 18, 2023

Israel: https://darknetdiaries.com/episode/28/

But it's not exclusive to them either. It's just, we are all only served the Western Propaganda. So you have APT 32 hacker group and shit like that, but the Western also has shit ton of hacking groups, they just sweep it under the rug. Also ALL countries that Extradites their own citizens, is just another US's puppet state. For example Romania. They'll happy let go of their citizens en route to USA if they wish, same cannot be said about Austria for example. It's inside the constitutions. Which YES, often contradicts laws like EAW (european arrest warrant). But constitution is above all.

66f22df495
66f22df495
Mon, Mar 20, 2023

I know of a top level hacker who was recruited by the government at a hacker convention and they were sent to a shit country where their entire job was helping CIA agents use Outlook and connect to Facebook, while living in the freezing cold, taking cold showers, and eating prison style food. Eventually they were fired for "being a hacker" after asking to do a job related to computer security. It took them five months to get home because they were flown into the shit country on a CIA plane with no passport and abandoned. They were flown back on a plane organized by the embassy. The years that followed were harassment, trash being taken, pictures being taken, banks accounts being frozen, IRS audits, and membership on watch lists. Only a government would recruit someone at a hacker conference, verify their hacking abilities with testing and polygraph, then fire them for being a hacker.

a1799f808a
66f22df495
Mon, Mar 20, 2023

correct. simply nobody wants to work for the govt because it doesnt matter if you are american or russian or european, you risk your life turning to utter shit. its the worst job to ever have. it can also make you plenty, loyal to the regime, but the risk is simply too high.

65b4fad270
65b4fad270
Sat, Mar 18, 2023

"online drug traffickers, Russian military hackers and North Korean cybercriminals"

I didn't know that Germany is full of Cartel, Russian and North Korean double agents.

New comments are disabled for this page.
d39913f4ad
4354678765
Sat, Mar 18, 2023

lol the new soup

0cba0d7c49
turningJapanese
Wed, Mar 22, 2023

Look in mirror, even now you can realize, you too are Chinese agent.

e5135afa96
e5135afa96
Sat, Mar 18, 2023

Arrests will continue until Monero usage increases...

New comments are disabled for this page.
2c50523943
2c50523943
Sat, Mar 18, 2023

based

749ff4a6ed
KMFDM
Wed, Mar 22, 2023

the beatings will continue

until morale improves

d5beb4ad9b
DeSnakeDeSnakeDeSnake
Sat, Mar 18, 2023

well written out good article, nice identity graph graphic thing BUT STOP USING MIXERS YOU STUPID FAGGOTS HOW MANY TIMES DOES THIS HAVE TO HAPPEN.

centralized custodial mixer:

- have to trust the faggot running it will actually give you coins back

- have to trust the faggot won't give you terrorist coins

- have to trust the faggot is securely erasing their mix logs

trustless non-custodial coinjoin/whirlpool mixer:

- impossible to have your coins stolen

- impossible to get dirty coins because the process removes the taint on coins rather than just giving them to someone else

- impossible to get fucked by 3rd party logging as co-ordination is done over tor with new identities for each round/pool so the only logs are those on your own device

these stupid faggots should have died long ago.

New comments are disabled for this page.
da444c7b64
da444c7b64
Sat, Mar 18, 2023

where can i find a guide for this

c2fbd3f07d
c2fbd3f07d
Sun, Mar 19, 2023

bisq.network

2851fd50a4
2851fd50a4
Sun, Mar 19, 2023

use monero or get fucked you cuck

d119d21125
c0v3rt
Sun, Mar 19, 2023

tell us how you really feel

34dae29e70
34dae29e70
Mon, Mar 20, 2023

i still dont get why are people using fucking mixers XD bro thats a thing of 2012.

why would they trust a centralized entity?

b3c53a5778
b3c53a5778
Sat, Mar 18, 2023

Why the fuck were they using DigitalOcean and Hetzner? And why did they even have servers in the 14 eyes in the first place? Okay, after reading further it turns out this guy is just a fucking retard...

New comments are disabled for this page.
b6c16d5ccc
b6c16d5ccc
Sun, Mar 19, 2023

The real question is how did they survive this long.

ce5046c58f
ce5046c58f
Sun, Mar 19, 2023

This is wrong narrative pushed by many. Sure, it's not ideal. But the country nor host should not really matter. Your duty is to protect the server so that the LEA never finds it, because if they do, you are already too late. No country will save you. It doesn't matter if it's Russia, Ukraine, Bulgaria or Kazakhstan.

1a1e3037a5
1a1e3037a5
Sun, Mar 19, 2023

shielded transactions or gtfo

New comments are disabled for this page.
8f4f044b7f
8f4f044b7f
Sun, Mar 19, 2023

zcash? oh you like dick in your ass? burn in hell homosexual

dc1162135d
dc1162135d
Sun, Mar 19, 2023

Arrests will continue until Monero usage increases.

New comments are disabled for this page.
e6b1eee872
sex lord
Sun, Mar 19, 2023

just use monero instead jesus fuck

New comments are disabled for this page.
9acd6a7241
9acd6a7241
Mon, Mar 20, 2023

I'm sure this won't be mentioned on Proton's transparency report.

New comments are disabled for this page.
8c7dbe7a65
8c7dbe7a65
Mon, Mar 20, 2023

USA: "Hello Proton, one of your users in Vietnam is doing something that's not illegal in Vietnam but is illegal in our country, can we have their information?"

Proton: Is this person a citizen of your country?

USA: No, we are the world police.

Proton: OK, we are sending everything.

35e3c16a3f
35e3c16a3f
Mon, Mar 20, 2023

@8c7dbe7a65

yes fuck the US for trying to push their imperialism agenda all over the world. absolute fucking faggots.

0725fe9c3a
Satoshi Desnek
Mon, Mar 20, 2023

And he's gone... to the Russian, North Korean or Chinese embassy. 😆 Laundering 2.8 billion worth of BTC? NK is happy to hire him, nice beaches, weed is legal and the supermarkets for diplomats have everything your supermarket has. This thing is up soon again.

New comments are disabled for this page.
f8d8b5be7d
f8d8b5be7d
Mon, Mar 20, 2023

An article on BreachForums would be great. Seems the glowies have been busy this month

New comments are disabled for this page.
058a873973
058a873973
Mon, Mar 20, 2023

I fucking never understand why do the people always admit being "whatever". The FBI agent, who led the other agents in the arrest, said Fitzpatrick admitted he had used the alias “Pompompurin”

What the fuck? I normally refuse to believe. He must have shat himself. I don't know. Why would he even talk to them to begin with? Always stfu. At least he has a lawyer.

052b756266
052b756266
Mon, Mar 20, 2023

@058a873973

Even if you knew you fucked up hard, better to just stay quite. But maybe he was just prepared to face the consequences. Who knows.

229809347d
5th
Tue, Mar 21, 2023

@058a873973 He is smart, I hope he had valid reasons.

Maybe they caught him with undeniable evidence and he wanted to make the arrest more public so the second admin could take over the operation. He talked about the possibility of being arrested since day 1 of his forum.

But yes, NEVER TALK TO POLICE.

5915d82ea3
DeSnake
Mon, Mar 20, 2023

Catch me if you can :) laughs sitting on a yatch

New comments are disabled for this page.
d591365860
Minh Quoc Nguyen
Mon, Mar 20, 2023

Catch me if you can

New comments are disabled for this page.
b1ceb41cca
How it is
Thu, Mar 23, 2023

Everyone hates the police and their lies

New comments are disabled for this page.
a745e7af94
Plausible DeSnakability
Wed, Mar 29, 2023

Rest in shit centralised mixers. Rest in total, absolute and utter shit.

New comments are disabled for this page.

New comments are disabled for this page.
Comments hidden
Sponsored by you!
Donate Mirrors PGP Canary Tor I2P Bible RSS Contact