Am I the only one who's surprised that 1900 Bitcoin was stored in hot wallets?
I don't think it is really possible for a mixer to not store all their coin in their hot wallet. If CM used cold wallets, moving coin to/from the cold wallet really couldn't be done on-chain, otherwise, it would be clear which groups of addresses belong to CM. Also, CM's operational model effectively put all their coin on a hot wallet, regardless of the location of it's private keys due to the fact that CM had such a low threshold for someone to get a "chip", which is effectively an IOU from CM to their customers -- all that is needed is a browser session.
Keeping funds offline would have been possible: once in a while, when they run out of chips, users could only get a voucher until new chips were created. In the same way funded keys could have been kept offline.
I think the backup-scenario sounds logical: 7 GB of data including several snapshots which includes some of the used private keys. I'm now curious if there's anyone left with (older) chips that haven't been emptied. I checked the changes
here yesterday, I'll do the same to day to see if more keys got swept. If that happened, I assume it's their owner emptying them now.
Update:
1 mBTC chips: March 16: 373824 - March 17: 374196 - Difference: 372 funded addresses. Total balance sweeped: 0.372 BTC.
2 mBTC chips: March 16: 79035 - March 17: 79117 - Difference: 82 funded addresses. Total balance sweeped: 0.164 BTC.
4 mBTC chips: March 16: 30463 - March 17: 30546 - Difference: 83 funded addresses. Total balance sweeped: 0.332 BTC.
8 mBTC chips: March 16: 13950 - March 17: 13958 - Difference: 8 funded addresses. Total balance sweeped: 0.064 BTC.
17 mBTC chips: March 16: 5053 - March 17: 5051 - Difference: -2 funded addresses. Total balance sweeped: -0.034 BTC.
32 mBTC chips: March 16: 3452 - March 17: 3430 - Difference: -22 funded addresses. Total balance sweeped: -0.704 BTC.
64 mBTC chips: March 16: 1359 - March 17: 1343 - Difference: -16 funded addresses. Total balance sweeped: -1,024 BTC.
128 mBTC chips: March 16: 830 - March 17: 820 - Difference: -10 funded addresses. Total balance sweeped: -1,280 BTC.
256 mBTC chips: March 16: 392 - March 17: 371 - Difference: -21 funded addresses. Total balance sweeped: -5,376 BTC.
500 mBTC chips: March 16: 57411 - March 17: 57443 - Difference: 32 funded addresses. Total balance sweeped: 16 BTC.
512 mBTC chips: March 16: 277 - March 17: 276 - Difference: -1 funded addresses. Total balance sweeped: -0.512 BTC.
1000 mBTC chips: March 16: 96525 - March 17: 96558 - Difference: 33 funded addresses. Total balance sweeped: 33 BTC.
1024 mBTC chips: March 16: 267 - March 17: 256 - Difference: -11 funded addresses. Total balance sweeped: -11,264 BTC.
2000 mBTC chips: March 16: 19792 - March 17: 19801 - Difference: 9 funded addresses. Total balance sweeped: 180 BTC.
2048 mBTC chips: March 16: 57 - March 17: 55 - Difference: -2 funded addresses. Total balance sweeped: -4,096 BTC.
4000 mBTC chips: March 16: 4496 - March 17: 4486 - Difference: -10 funded addresses. Total balance sweeped: -40 BTC.
4096 mBTC chips: March 16: 114 - March 17: 114 - Difference: 0 funded addresses. Total balance sweeped: 0 BTC.
8000 mBTC chips: March 16: 1284 - March 17: 1282 - Difference: -2 funded addresses. Total balance sweeped: -16 BTC.
8192 mBTC chips: March 16: 15 - March 17: 15 - Difference: 0 funded addresses. Total balance sweeped: 0 BTC.
Based on this, I can't really tell if any more chips have been swept.