Mixin Completes $23M MDTu Redemption After 3-Year Commitment

Author: Shenchao TechFlow

In the crypto industry, fulfilling obligations is rare, especially after a hack.

According to CertiK’s “Hack3d: The Web3 Security Report 2023,” the cryptocurrency industry experienced over 751 security incidents in 2023, including hacks, scams, and exploit attacks.

Continuously tracking these attacked projects reveals an even harsher reality:

Although project teams can issue announcements, propose solutions, and make promises within hours, very few seriously evaluate user losses and consistently fulfill their repayment obligations.

Promises are cheap; the real cost lies in the time, operations, and expenses behind fulfillment.

This is both a matter of attitude and a matter of ability.

At this point, some may have noticed: why was a set of data from 2023 chosen?

On one hand, three years is sufficient time for the project team to demonstrate their commitment to fulfilling obligations and showcase repayment results;

On the other hand, a recent project has finally delivered results, fulfilling its promises from a hacker attack three years ago.

On September 23, 2026, Mixin announced the full repayment of the $23 million represented by MDTu.

Trust broken three years ago has been gradually repaired over the past three years with real, tangible funds, sufficient to make this settlement highly newsworthy.

But if we focus solely on this $23 million payout, we might miss the truly significant aspects worthy of careful analysis.

On social media, users have gradually shared their real experiences of waiting for Mixin MDTu redemption:

There are still long-term projects in the crypto space.

After three long years of waiting, MDTu has been fully repaid.

Looking back on this three-year-long fulfillment, every milestone was clearly defined, primarily because of Mixin’s approach and attitude toward addressing issues:

Do not evade; face the consequences of the event directly;

No embellishment, honest and straightforward;

Be clear and lay out the solution and timeline explicitly.

On the evening of September 23, 2023, Mixin discovered it had been hacked, with primary losses including BTC, ETH, and USDT, amounting to approximately $150 million at prevailing market prices.

Upon discovering the attack, in addition to implementing a series of emergency measures and investigating the cause, Mixin immediately initiated a detailed loss assessment and evaluated the team’s capacity to compensate.

On September 25, 2023, Mixin announced the issuance of MDT tokens, including MDTu, MDTe, and MDTb, representing ERC20-USDT, ETH, and BTC assets respectively, and pledged to repurchase and redeem tokens for users using profits generated from continued business growth.

At the same time, the Mixin team commits that, prior to full repayment, if the hacker returns the stolen assets, holders of the corresponding MDT tokens may exchange them for the original lost assets.

Including this commitment in the token is both a statement of intent and a demonstration of resolve.

Of course, when losses have already occurred, commitments must go beyond mere announcements.

After all, it's easier to say than to do;

Moreover, in the early stages of the incident, to appease affected users, other projects also made promises of compensation—but most of them ended abruptly. Even Mixin, which made such promises, must prove its commitment through concrete actions.

Until September 23, 2026, Mixin announced the full settlement of $23 million in MDTu.

Choosing to complete the payout on the same day as the hacker attack three years later may also have been a deliberate move by Mixin: using a single financial action to close the loop of "trust reconstruction."

But what’s always more worth exploring than the outcome of “having achieved it” is the logical analysis behind “why it was possible”:

Three years of continuous operations provided funding for the full repayment of $23 million in MDTu;

How could a project that suffered a major security incident, after its trust was severely damaged, avoid dissolving, fleeing, going silent, or merely limping along—and instead manage to operate continuously for three years, gradually fulfilling its original promises?

The answer is closely related to Mixin’s initial choice of this “business of trust.”

Next-generation social network / capital network

The Mixin product strategy provides the most direct answer.

This “social + capital” approach was also carried forward at this year’s TOKEN2049 in Singapore: In addition to engaging with the community through on-site booths, Mixin partnered with BigONE to host an innovative Web3 HUNT After Dark event, transforming NFT fragment scavenging into a social interaction—participants scanned codes to collect, exchange, and combine NFT fragments to unlock final rewards.

The engaging activities spurred active participation from attendees, further validating Mixin's product strategy:

When communication, assets, and human collaboration are brought together in the same context, the product has the opportunity to evolve from a mere functional entry point into a connection hub for building relationships and enabling value flow.

Since trading connects people through capital and social connections connect people through emotion, the former enables value to flow, while the latter allows relationships to deepen. The close integration of both enables human relationships to further support the flow of value.

Therefore, since its launch in 2017, Mixel has been centered on “privacy-first encrypted messaging + multi-chain wallet,” aiming to integrate communication, payments, trading, and asset management into a single app.

In simple terms, Mixin is more than just a transaction tool—it’s a tightly connected network where users aren’t just transferring funds, but also chatting, forming groups, and collaborating. Asset flows are no longer isolated; they’re woven into everyday life.

For this logic to truly function, two key pillars are essential:

Usability: Expand entry points to allow users to easily enter the ecosystem through their connections;

Security: Laying a solid foundation so more people can confidently move their funds and social interactions here.

Along these two pillars, we can clearly see Mixin's key focus areas over the past several years:

On one hand, the team adheres to the overarching philosophy that “if a product needs a manual to get started, it’s not finished,” introducing a minimalist identity and asset control system with a 6-digit PIN for login and management, while also supporting social recovery, frictionless transfers, a bot ecosystem, and multiple service entry points—all designed to deliver a Web2-level seamless experience.

On the other hand, the product is fundamentally designed to protect user assets and social security. Network-level security is safeguarded by a PoS + BFT + DAG architecture, while proven cryptographic solutions such as MPC and multi-signature are integrated. Additionally, Mxin treats privacy as the default configuration for financial security in the digital age, with privacy-by-design built into the core infrastructure. It supports end-to-end encryption based on the Signal Protocol, privacy protection for balances and transfers, self-destructing messages, and private groups, continuously enhancing security and trust.

Since its establishment, Mixin has accumulated over 10 million users and manages self-custodied digital assets exceeding $1 billion.

This also largely explains why, after the 2023 incident, despite real financial losses and widespread user panic, Mixin was able to survive and fulfill its MDTu obligations through continued operations:

Trading relationships are fragile, while social relationships are stable; these connections won't suddenly break down entirely;

The gateway still exists and continues to onboard more blockchains and assets with low barriers to entry;

The foundation of trust remains intact and continues to strengthen.

Security incidents in 2023 further highlighted the need for decentralized management, risk isolation, and secure recovery mechanisms for large digital assets. Addressing the single-point risk of a single private key and the limitations of traditional multi-signature solutions in collaborative management and asset recovery, Mixin Safe offers a decentralized, non-custodial multi-signature cold wallet and asset management solution.

Taking the Bitcoin Vault as an example, Mixin Safe combines native chain multisig, decentralized MPC, and time-lock mechanisms to build a layered security architecture using three types of keys:

• Owner Key: Independently held by the user via a software or hardware wallet, and used to provide the final signature authorization for asset transfers.
• Members Key (Co-signer Private Key): Controlled jointly by one or more co-signers through Mixin and a decentralized MPC network. Users can set the number of co-signers and approval thresholds; a valid signature for the Members Key is generated once the M-of-N condition is met, used to create or approve transactions.
• Recovery Key: Subject to an on-chain time lock. Before the account remains inactive for the preset duration, the Recovery Key cannot participate in signing; after the time lock expires, it still requires coordination with a valid Owner Key or Members Key to restore assets to a new address and cannot transfer assets independently.

Daily transactions are completed jointly by the Owner Key and Members Key; the recovery path using the Recovery Key and the other valid key is enabled only if one type of key is lost and the time-lock condition is met.

The core design of Mixin Safe is not to grant greater control to any single party, but to prevent any individual, device, key, or institution from independently transferring assets, fully reflecting the team’s product philosophy of non-custody, asset security, recovery, and co-management.

Through this architecture, Mixin Safe combines user self-custody, multi-party collaboration, and delayed recovery mechanisms, elevating security from theoretical decentralization to a higher standard that can practically withstand infrastructure compromise, while further exploring scenarios such as high-value asset protection, decentralized recovery, and inheritance.

Meanwhile, Mixin maintains ongoing security audit processes to further ensure the safety of all its infrastructure.

More importantly, security efforts build "preemptive trust," while Mixin's demonstrated "post-incident accountability" in this settlement has created a publicly verifiable record of credibility, signaling to all potential users the platform's responsible attitude after an incident—and significantly reinforcing trust in Mixin before users even decide to join.

From this perspective, the $23 million payout represents Mixin fulfilling its commitment to existing trust, and perhaps also marks the beginning of Mixin’s journey toward generating new trust.

The most fundamental reason is scarcity.

In crypto, trust is the most valuable asset.

When a crypto project is hacked, there are many possible outcomes—but no matter the script, users who suffer real financial losses are always the ones forced to accept the consequences. Mixin’s response is a powerful rebuttal to this default outcome:

Accidents are common, promises are common, but consistent long-term performance is rare in crypto.

From the project’s perspective, the insight is equally practical:

Security incidents can undermine a project's trust, but they don't necessarily mean certain failure—if the business still has vitality, the project may still resolve past issues through continued operations.

Beyond scarcity, Mixin provides a clearer practical example for fulfilling Debt Token issuance.

Although issuing debt tokens after a hack is common, and there are positive precedents such as Bitfinex’s 100% fulfillment with the BFX token, the significance of Mixin’s current settlement lies not in being the "first to do so."

However, under more complex asset scenarios, Mixin clearly connects several key actions into a complete fulfillment path:

Issue redemption vouchers, maintain ongoing operations, advance in phases, publish a timeline, and complete phased redemptions.

For many project teams, Mixin’s structured and verifiably progressive approach provides a highly referenceable model.

And if we raise our perspective even further, the issue of redemption may prompt more people to reflect on the most fundamental questions regarding "security assessment":

In the past, when people discussed platform security, they often focused more on whether the technical architecture was secure, whether the risk control system was robust, and whether assets had ever been compromised.

These are also very important, but the focus is often on "protection."

But as the old saying goes: It's easy to steal for a thousand days, but hard to guard against theft for a thousand days.

As technology becomes increasingly complex, hackers grow more sophisticated, and attack methods become more advanced, hardly any platform can claim a guarantee of "never experiencing an incident."

Therefore, while "protection" is important, it can hardly constitute the entirety of security.

With the completion of Mixin's latest payout, the security standards previously mentioned multiple times are once again being reviewed:

Beforehand, be prepared to prevent it;

You must also be able to cover it afterward.

The former tests technology, risk management, and infrastructure;

The latter tests responsibility, operational capability, and long-term thinking.

Three years ago, Mxin was pushed to the edge of trust due to a security incident.

Over three years, with the completion of a $23 million payout, Mxin has pulled itself back from the brink—perhaps even higher than before.

In an industry that promises low costs but delivers scarce reliability, only those willing to consistently invest time, cost, and action to earn trust deserve to carry user confidence and inspire users to look forward to the future—and only then can they truly drive the industry to think, seek, and advocate for the most authentic security standards.

This may be the true aspect of this settlement worth remembering.