🤡 JokerMix.to - Bitcoin Tumbler - BTC Tumbler - Dash Mixer

[examplens]

It makes sense to have a 2% fee, but I am not really sure why you also have a 60 sats fee. Isn't it so little? It's hardly going to cover even transaction fees. So why do you take this additional small fee? Can you enlighten us about that?

This is what also confuses me, what the symbolic 60 satoshis fee represents, that's why I asked. Also, many mixers did not clearly state the network fee, but it appears only at the end of the process, possibly in the letter of guarantee. In order to get such information, it is necessary to start the mixing procedure up to the part with the deposit.

[NotATether]

It makes sense to have a 2% fee, but I am not really sure why you also have a 60 sats fee. Isn't it so little? It's hardly going to cover even transaction fees. So why do you take this additional small fee? Can you enlighten us about that?

This is what also confuses me, what the symbolic 60 satoshis fee represents, that's why I asked. Also, many mixers did not clearly state the network fee, but it appears only at the end of the process, possibly in the letter of guarantee. In order to get such information, it is necessary to start the mixing procedure up to the part with the deposit.

According to data I have collected (and placed on BitMixList), the vast majority of mixers take a fixed commission, like 0.0007 or 0.0003 or something like that. Or they take no commission at all, but that is rare. This is in addition to the percentage-based commission.

Also it seems to be something added after the maintenance window. Before, it was a variable 2-8% fee.

[jokermix]

This small fee is because we use the coinjoin method several times and it requires a lot of resources.
We try to explain it the best you can also read the (help center).
--
For the link we added mirror because we have the attention to add a second domain but hey, So we will write (Clearnet) ✍🏻.

[dkbit98]

jokermix I think this is the right time for you to reveal more information about missing Royalmix team and your connection with them.
They are now accused for exit scam and one customer accused them for stealing his coins and never sending them back mixed.
I think you said something about sharing similar code, but maybe you can help this guy recover his coins.

[jokermix]

jokermix I think this is the right time for you to reveal more information about missing Royalmix team and your connection with them.
They are now accused for exit scam and one customer accused them for stealing his coins and never sending them back mixed.
I think you said something about sharing similar code, but maybe you can help this guy recover his coins.

We would like to help you, but we think that this does not help any further . Please understand that we want to keep our discussions neutral and focus entirely on our JokerMix, without addressing the specified topic.

[examplens]

We would like to help you, but we think that this does not help any further . Please understand that we want to keep our discussions neutral and focus entirely on our JokerMix, without addressing the specified topic.

Users always appreciate useful information, if there is something that can save someone's money, it is certainly desirable to hear it.
If you don't want the thread about other mixers to derail yours, but you still have some important information, you can do it in the general thread dedicated to all mixers. btw. You're listed there too
LIST - Bitcoin mixers & Tumbler services! ✅✅

[dkbit98]

Users always appreciate useful information, if there is something that can save someone's money, it is certainly desirable to hear it.

They clearly don't want to say anything about that, so that only increased my suspicion and triggered red alert for all Joker services.
I think you should add code connection warning about this in your topic.

[jokermix]

We would like to help you, but we think that this does not help any further . Please understand that we want to keep our discussions neutral and focus entirely on our JokerMix, without addressing the specified topic.

Users always appreciate useful information, if there is something that can save someone's money, it is certainly desirable to hear it.
If you don't want the thread about other mixers to derail yours, but you still have some important information, you can do it in the general thread dedicated to all mixers. btw. You're listed there too
LIST - Bitcoin mixers & Tumbler services! ✅✅

Users always appreciate useful information, if there is something that can save someone's money, it is certainly desirable to hear it.

They clearly don't want to say anything about that, so that only increased my suspicion and triggered red alert for all Joker services.
I think you should add code connection warning about this in your topic.

When we came to the forum and posted our topic for JokerMix, we didn't know at first that RoyalMix was using a small part of our JokerMix source code. It was (@Klq!@Gjqoqp./) who warned us on the forum that RoyalMix and JokerMix were using a similarity in the source code so we decided to inspect the source code to verify and after confirming that RoyalMix was indeed using a small part of our JokerMix site's source code we immediately contacted RoyalMix support via Telegram to ask for more information and how they got our source code he replied that he was just a client and he had asked a developer to create a crypto mixer site so he gave us his contact information and that's when we understood that it was someone from our team who had simply taken a small part of JokerMix's source code to make RoyalMix He was just too lazy to create another source code. In order not to destroy the projects we came back to contact RoyalMix by Telegram to find a solution to the problem and we then concluded to write a message on AltcoinsTalks to explain the situation and that we remain neutral and that we do not destroy the reputation of RoyalMix it was a question between the teams and the developers.
When he developed RoyalMix for client, he didn't use the same mixing system on RoyalMix when developing for client here, we had no resemblance with RoyalMix on mixing method since we use CoinJoin for JokerMix.

When we checked on the RoyalMix session side we came across a line of code written in green (FrogMixer), we searched and came across an AltcoinsTalks topic, so we made a backup on the (Web Archive) a bit later and wrote to (NotATether) on August 7th to inform him that no one had discovered this before... we took some time to see if others would find it but well, no one had discovered it yet... so we figured out that he had not only created RoyalMix for one client but also for another client.

We are sorry about what happened with RoyalMix but we are not involved.

As our teammate had created another crypto mixer without our agreement, we therefore carried out these 2 campaigns with (Royse777) ( 1 : Review )( 2 : Review ) we took all the time needed to listen to users and feedback to modify the source code and security flaws of JokerMix to avoid any issues.

(dkbit98) We can't share more, it's also for our safety! If you want more information, know that he is no longer part of the team since we discovered that he had developed RoyalMix for a client without asking our permission.

We have reduced the maximum deposits on JokerMix by 1 BTC and 20 Dash.
And as you can see, we are starting little by little, we have done the review campaign, we are still waiting a little bit to have more feedback from users and we will make some more adjustments for JokerMix, then we will launch a signature campaign in a few months.

We are not here to scam, we are here for our JokerMix project as well as to ensure user safety, we will fully focus on JokerMix and the future, we are here for the long term...

(examplens) Thanks for the addition :-), we hadn't seen it before ^^.

[examplens]

When we checked on the RoyalMix session side we came across a line of code written in green (FrogMixer), we searched and came across an AltcoinsTalks topic, so we made a backup on the (Web Archive) a bit later and wrote to (NotATether) on August 7th to inform him that no one had discovered this before... we took some time to see if others would find it but well, no one had discovered it yet... so we figured out that he had not only created RoyalMix for one client but also for another client.

this does not sound good if the same person was involved in the development of three different mixers, where two of those three are exit scams.

It is certainly a good thing that you shared at least part of the information here, although you could have done it much earlier.

[dkbit98]

We are not here to scam, we are here for our JokerMix project as well as to ensure user safety, we will fully focus on JokerMix and the future, we are here for the long term...

I heard that same line many times before, but let's see what happens.

It is certainly a good thing that you shared at least part of the information here, although you could have done it much earlier.

I would say exactly the same thing, and I don't understand this excuse how they didn't want to ''destroy'' suspicious copycat project and shady developer.
I do appreciate jokermix finally deciding to share a bit more information, this can help people better decide what mixers they should and shouldn't use.

[jokermix]

You can delete your session by clicking on the red button at the bottom of the session please only delete the session at the end of the mix successfully completed otherwise you risk losing everything permanently.
Yes it is normal that you cannot create another session this is to prevent the user from forgetting his previous session or to avoid creating multiple sessions.
It is possible to get around this since we do not keep a cookie if you close your page and wait or your browser you can start a new mix.
Please especially keep your PGP guarantee letter as well as the session identifier.

I get your point. You don't want users to forget about their old sessions, which is great. I appreciate that you guys worked on it so that even if someone forgets about their old sessions or closes the tab accidentally, they will be able to restore them again. But let's say I picked the wrong coin at first and want to delete my current session; in this case, I have to restore the session first to delete it.

When the pop-up window opens, say , "You have an active session. Do you want to restore it?" There is no button to close this pop-up. You could provide an option in the pop-up window to delete their old session if they want. Of course, it's just a suggestion.

Small adjustment on JokerMix :

Added the destination address on the PGP guarantee letter as well as a small Token identifier.

Added the deletion of the session from the home page, we have taken into account your remark .

[God Of Thunder]

Added the destination address on the PGP guarantee letter as well as a small Token identifier.

Added the deletion of the session from the home page, we have taken into account your remark .

Thank you very much for taking my suggestions into account and implementing it so quickly. I haven't used your service yet. I was just checking the platform and playing around with the options you have. I will surely keep your service in my mind when I will do the next mix. I have used a couple of mixers before, but I never transacted a hue volume because of obvious reason, I never know if I am the most unlucky person. You know the case of royalmix. Anyways, thanks again. As I said, I will try the service next time.

[Klq!@Gjqoqp./]

Vulnerability Report for JokerMix.to


Vulnerability Description:


A security flaw has been identified in the wallet creation process on JokerMix.to. This vulnerability allows an attacker to manipulate the letter of guarantee by injecting unverified content into the user address field.



Steps to Reproduce:

1. Generate a token for a PHPSESSID:
   - Send a POST request to /php-back/handle-capcha.php
   - Parameters: {"isChecked":1} (in JSON)
   - Note: The PHPSESSID should be set by the attacker in the header of subsequent requests.

2. Create a wallet with injected content:
   - Send a request to /php-back/create_wallet.php?
   - Use the PHPSESSID from step 1 in the request header
   - JSON parameters:
     {
       "userAddress": "1HsM2JbyKnqwcYvEm1kLMNwJtqb6uxSczd                     Vuln: I can add some content",
       "feeRate": 12
     }

3. The injected content appears in the signed letter of guarantee, demonstrating a lack of input validation.



Potential Impact:

This vulnerability could allow an attacker to:
- Inject malicious content into the letter of guarantee
- Potentially execute XSS attacks if the injected content is displayed without proper escaping
- Compromise the integrity and reliability of the mixing system



Recommendations:

1. Implement strict input validation for the user address field.
2. Use whitelists to allow only valid characters in cryptocurrency addresses.
3. Implement proper escaping when displaying generated content.
4. Review and strengthen the PGP signature verification process for the letter of guarantee.


Proof of Concept: Exploited Letter of Guarantee

The following is an example of an exploited letter of guarantee that is valid on the "Verify Letter of Guarantee" tool at bitmixlist[.]org:


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

jokermix.to
your session:
w_66d49d7fe8cc5

Payment Address:
bc1q2drz78efq5sftm0nhleallm4l0u3ff8wzpxx4m

User Address:
1HsM2JbyKnqwcYvEm1kLMNwJtqb6uxSczd                                                                                                                                                                                                                                                                             Vuln:                                                                                                        I can add some content

Additional Token:
OW0vQU1qakJ3T3d6VzVGZG94a3A3dz09OjpoYQ12kGa+HgHuTMZhrxYj

ONLY 1 TRANSACTION ALLOWED!
-----BEGIN PGP SIGNATURE-----

iQGzBAEBCgAdFiEEe6Z+7Cg5oBjn1AlyZNhbwXRysjUFAmbUnZcACgkQZNhbwXRy
sjURDgv9GH/RGgKGFgLd78A92kMH96plwzCYn9pGniT97HcPj/7LpmgdDrzZdSHt
0RYA1ncX8LJ84DhybxfItwCMxWgso2vBa1VtGhH6yYkFQWefdj9zkgbE1qFpG8nZ
8uLSg794X1G44WLzO1WiUk7qBfodan3bg2qImz/dx1eHQ0d4CkQJvlJ5MGQtPlvW
LHwOS5JUrlrTwC0PrfqabYHP2u0vhVzjV8SyukHToquZO8cHb7IHnA4k2pxdmB1q
XC+k+r5D0HDedLWI606VDDIFaJIjZcL4aqKjbmFZaqOrVJ+jVHT9gDCHsfBnngGC
ZsAMdWawpNQEBdWHkAY6yQy9bFzcO6JjeEOaG7tc3pLKWTFMypTS3E1P3EvA5832
PJa5zhSGSXEZkPov7QbdrI1Dhy0Ixbymq9tzg1bATq5PBTsrKu++uZMb48ivxVVb
z7/aX1EpPBtRgDxp1OtH6pB1HLjN4HgTJ9mnj4jvNqrqqjjSK0E+PQ9Z7JDK1PbC
ekx8e2Dj
=lvMZ
-----END PGP SIGNATURE-----

This letter of guarantee demonstrates the successful exploitation of the vulnerability, allowing arbitrary content to be injected into the user address field while maintaining a valid PGP signature.

[examplens]

A security flaw has been identified in the wallet creation process on JokerMix.to. This vulnerability allows an attacker to manipulate the letter of guarantee by injecting unverified content into the user address field.

Ugh, this is a serious oversight. I believe that the Jokermix team should react as soon as possible.
I tried it, I really got a confirmation that it is a genuine signed message.

[jokermix]

Vulnerability Report for JokerMix.to


Vulnerability Description:


A security flaw has been identified in the wallet creation process on JokerMix.to. This vulnerability allows an attacker to manipulate the letter of guarantee by injecting unverified content into the user address field.



Steps to Reproduce:

1. Generate a token for a PHPSESSID:
   - Send a POST request to /php-back/handle-capcha.php
   - Parameters: {"isChecked":1} (in JSON)
   - Note: The PHPSESSID should be set by the attacker in the header of subsequent requests.

2. Create a wallet with injected content:
   - Send a request to /php-back/create_wallet.php?
   - Use the PHPSESSID from step 1 in the request header
   - JSON parameters:
     {
       "userAddress": "1HsM2JbyKnqwcYvEm1kLMNwJtqb6uxSczd                     Vuln: I can add some content",
       "feeRate": 12
     }

3. The injected content appears in the signed letter of guarantee, demonstrating a lack of input validation.



Potential Impact:

This vulnerability could allow an attacker to:
- Inject malicious content into the letter of guarantee
- Potentially execute XSS attacks if the injected content is displayed without proper escaping
- Compromise the integrity and reliability of the mixing system



Recommendations:

1. Implement strict input validation for the user address field.
2. Use whitelists to allow only valid characters in cryptocurrency addresses.
3. Implement proper escaping when displaying generated content.
4. Review and strengthen the PGP signature verification process for the letter of guarantee.


Proof of Concept: Exploited Letter of Guarantee

The following is an example of an exploited letter of guarantee that is valid on the "Verify Letter of Guarantee" tool at bitmixlist[.]org:


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

jokermix.to
your session:
w_66d49d7fe8cc5

Payment Address:
bc1q2drz78efq5sftm0nhleallm4l0u3ff8wzpxx4m

User Address:
1HsM2JbyKnqwcYvEm1kLMNwJtqb6uxSczd                                                                                                                                                                                                                                                                             Vuln:                                                                                                        I can add some content

Additional Token:
OW0vQU1qakJ3T3d6VzVGZG94a3A3dz09OjpoYQ12kGa+HgHuTMZhrxYj

ONLY 1 TRANSACTION ALLOWED!
-----BEGIN PGP SIGNATURE-----

iQGzBAEBCgAdFiEEe6Z+7Cg5oBjn1AlyZNhbwXRysjUFAmbUnZcACgkQZNhbwXRy
sjURDgv9GH/RGgKGFgLd78A92kMH96plwzCYn9pGniT97HcPj/7LpmgdDrzZdSHt
0RYA1ncX8LJ84DhybxfItwCMxWgso2vBa1VtGhH6yYkFQWefdj9zkgbE1qFpG8nZ
8uLSg794X1G44WLzO1WiUk7qBfodan3bg2qImz/dx1eHQ0d4CkQJvlJ5MGQtPlvW
LHwOS5JUrlrTwC0PrfqabYHP2u0vhVzjV8SyukHToquZO8cHb7IHnA4k2pxdmB1q
XC+k+r5D0HDedLWI606VDDIFaJIjZcL4aqKjbmFZaqOrVJ+jVHT9gDCHsfBnngGC
ZsAMdWawpNQEBdWHkAY6yQy9bFzcO6JjeEOaG7tc3pLKWTFMypTS3E1P3EvA5832
PJa5zhSGSXEZkPov7QbdrI1Dhy0Ixbymq9tzg1bATq5PBTsrKu++uZMb48ivxVVb
z7/aX1EpPBtRgDxp1OtH6pB1HLjN4HgTJ9mnj4jvNqrqqjjSK0E+PQ9Z7JDK1PbC
ekx8e2Dj
=lvMZ
-----END PGP SIGNATURE-----

This letter of guarantee demonstrates the successful exploitation of the vulnerability, allowing arbitrary content to be injected into the user address field while maintaining a valid PGP signature.

Thank you very much (Klq!@Gjqoqp./) for sharing it is a real discovery it is on the captcha side users had already reported this flaw we corrected it but it is still possible to bypass it in another way and as we wrote we take fully into account the remarks of the users we will correct this vulnerability.

If you have other suggestions to share with us do not hesitate we will take note of them ✍🏻.

We also think that maybe you could help other crypto mixers Klq!@Gjqoqp./, to inform them about the vulnerabilities that you can be useful for on this forum .