Review of the Jokermix mixer, take twoMy previous draft was unfortunately wiped by my browser, so I had to start over again. So anyway, if you remember, I had started reviewing it one time before, but decided not to continue with the mixing session since the letter of guarantee verification was not working. Well now that is working, fortunately, and so here is a list of other things that have improved since the last time I used the mixer:
- The mixing fee is now fixed to 2%. I like this rate, it makes it very competitive.
- There seems to be automatic translation support for English now. I see a large list of strings in the Developer Tools console in a file called "i18n" that supports this thesis.
- It's much harder to accidentally destroy your session, and now in fact the session id is included in the letter of guarrantee.
One thing that hasn't changed, however, is the captcha. That is a bit unfortunate, because as I had demonstrated in the previous review, it's easy for a bot to crack it. As in the previous post, I strongly recommend loading an image captcha like this one:
https://github.com/S1SYPHOS/php-simple-captcha (I did not make this tool). Image captchas can still be broken by really sophisticated bots but it is much slower to break them and/or more expensive.
So now that these preliminaries are out of the way, let's get to the actual mixing. Jokermix displays a status symbol that either says "not started", "in progress", or "finished". Pretty standard for a mixer. But also more importantly if you accidentially close the tab you can easily get back to your session by going to the history since the session ID is included in the URL.
But the more interesting thing is the fact that Jambler is using its own software and it's not relying on any third party on doing the mixing. That is inferred because the letter of guarantee is signed by a different public key identified from them.
I sent a non-round amount (you know, an amount with random digits at the end like 0.00157893 or similar) into the mixer for testing. Using only one transaction input and one transaction output to limit chain analysis.
It turns out that the mixing was completed fairly quickly, in 9 blocks actually. Or about 1 and a half hours roughly, assuming a block takes on average 10 minutes. I was a bit disappointed at this, unless I was extremely lucky to get a really fast mix, because I have the impression that a mixing session is most secure when it is done across several dozen blocks. That means more transactions for blockchain analysis to filter through, naturally. 9 blocks is not really enough IMO.
One thing that is very interesting to note is that the mixer's receiving address was spent in the same block as the one I received my coins in. the mixer's receiving address was inside a transaction with an extremely large set (120+) inputs and outputs each in what looks like a very efficient coinjoin. As for my receiving transaction, it was part of a payjoin - a smaller coinjoin with 2 inputs and 2 outputs each, both the inputs were the same size by the way. So this really works for anonymity.
All of the Jokermix UTXOs appear to be spent in very large coinjoins for moving them around between rounds (i.e. making outputs that have round amounts) and for sending coins to a person's walet they use payjoins so as to not raise any alarms in case custodial wallet software were to be the receiving address.
AML analysisI am using Bestchange's address checker, since AMLbot's prices are a rip-off for a single address ($3 per address) and don't directly accept Bitcoin or even LN.
Unfortunately it appears the algorithm could use some work, since it successfully detected that a majority of the funds came from a mixer:
Risky
●Mixer76.80% (red)
●Dark market0.30% (red)
●Exchange unlicensed 10.60% (yellow)
●Exchange licensed 12.10% (green)
Since I am familiar with Bestchange's scoring method, let me explain how these roughly translate to percentages"
Generally speaking, a low AML score will have the red and yellow no greater than 1%. The red areas being mixer, dark market, gambling, sanctions, enforcement action, and similar. The yellow areas is basically just exchange unlicensed (any exchange not forcing KYC). Green being the licenced exchanges, payment processors, miners, and anything coming from a custodial wallet from the above providers. (government seized bitcoins are for some stupid reason marked green too.)
The AML score is divided into four sections, delimited by intervals of 25%. The customer starts getting problems when the AML score is more then 50%, getting asked for documents or whatnot. In my experience, anything more than 10% of the amount sourced from red sources will trigger this. The yellow activities - ie non-kyc exchanges - do not really affect this at all. It's just that if the blockchain analysis sees that a significant (i.e. non-negligible) percentage of the funds is from red sources, the customer could get into some hassle and be required to show proof of funds and such.
My suggestions for alleviating this:
- Implement a program where you reward people who supply you with "clean" bitcoins like from exchanges and miners. It worked really well for Jambler and their coins are squeaky clean.
- You need to spread the coinjoins across many, many rounds, like Wasabi Wallet used to do. A few rounds is not going to cut it. Sure, nobody knows currently where your mixed money comes from, but they know for sure it came from a mixer.
So these two things will really help your mixer become better. And also the captcha, don't forget that!
bc1q4djl6pxt90nfs8fufdul26ufxukxxrczsfjj0h
. 
. 
. 
. 
. 
. 
Shop
Topic: [Invite only] JokerMix review campaign Round#2 | bitmover and NotATether (Read 7714 times)
Latest news: