Security

Application security model for the Northmix Bitcoin mixer

Northmix is a no KYC Bitcoin mixer and crypto tumbler. Because the service handles nothing but public on-chain data on the client side, Northmix security model is built around a simple rule: never request, store, transmit or display wallet secrets. The same rule applies whether you are mixing BTC, ETH, USDT, USDC, LTC, SOL or BNB. The full flow is described on the how it works page.

No private credentials in the client

The Northmix application never requests, stores, transmits or displays seed phrases, private keys, recovery phrases or any other wallet secret. The only wallet-related data Northmix handles is the public wallet address returned by an explicit connection request through the wallet adapter, and the public payout address you enter yourself.

If the transaction-hash field receives input that matches the shape of a seed phrase or private key, Northmix refuses it and shows a clear warning.

Strict Content Security Policy

The deployment ships with a strict CSP compatible with the eventual wallet connector. In deployment the following headers are recommended (also mirrored in _headers):

Content-Security-Policy:
  default-src 'self';
  script-src 'self';
  style-src 'self';
  img-src 'self' data:;
  font-src 'self';
  connect-src 'self';
  frame-ancestors 'none';
  base-uri 'self';
  form-action 'self';
  object-src 'none'
Referrer-Policy: no-referrer
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Permissions-Policy: geolocation=(), microphone=(), camera=()

No third-party trackers or external requests

No analytics scripts. No advertising pixels. No external fonts.
All assets (logos, icons, styles, scripts) are served from the same origin.
Explorer links open with rel="noopener noreferrer nofollow".
Referrer-Policy: no-referrer is enforced.

This matters for a privacy mixer. If Northmix loaded third-party analytics, those destinations would see the asset you selected, the amount you entered, and the timing of your session. A no-logs posture on the service is meaningless if Northmix leaks the same data to third parties. See the privacy page for the data handling policy.

Safe DOM rendering

All dynamic content — user input, transaction references, addresses, hashes — is rendered with textContent or attribute assignment, never with innerHTML on untrusted input. This eliminates reflected XSS vectors from user-controlled values.

Input validation

Validation lives in js/validation.js and covers:

Amount: numeric, non-zero, respects asset decimals, no leading zeros.
Transaction hash: per-network expected format (EVM 0x+64 hex, Bitcoin/Litecoin 64 hex, Solana base58).
Wallet address: per-network shape check (full on-chain validation is a service responsibility).
Secret rejection: input matching seed-phrase or private-key shape is refused.

The address shape checks for each network are listed on the supported networks page.

Wallet storage

Northmix does not persist wallet information to browser storage, sessionStorage or cookies. A connected wallet lives only in memory for the duration of the session and is cleared on disconnect or page unload.

Out of scope

This document covers Northmix security model. Service security (key management, signing infrastructure, deposit-address derivation, network-node access, output-pool management) is handled separately by the service team. Northmix does not claim absolute anonymity; mixing is a privacy tool that breaks the on-chain link between deposit and payout, and the strength of that break depends on user behaviour, including the use of a fresh payout address and a sensible delay. See the FAQ for more.

← Back to app