TBW - Crypto mixers: exclusive report on their use and contribution to money laundering

Cryptocurrency transactions are often perceived as anonymous. In reality, they are pseudonymous: each transfer is recorded on the blockchain and can be traced via analysis of wallet addresses. Without a dedicated tool, users remain identifiable. This is where crypto blenders come in, services designed to strengthen the confidentiality of transactions by blurring the lines.

The principle is simple: these services mix deposited funds with those of other users, making it more difficult to associate a sending address with a receiving address. Modern mixers generally operate in the form of decentralised applications (dApps) using smart contracts. Tornado Cash, for example, operates on Ethereum. When a user deposits funds, a smart contract stores them temporarily before redistributing them to a new address, with no apparent link to the original address. Cryptographic proof, in the form of a "hash", allows the owner to recover their money.

Other solutions exist, such as CoinJoin, a system used for Bitcoin. Unlike mixers based on smart contracts, it relies on the aggregation of transactions between several participants to make tracking more complex.

While these tools are prized by those who wish to preserve their privacy, they also raise concerns. Because of their ability to anonymise financial flows, some mixers have been hijacked for money laundering or other illicit activities. This is a debate that pits defenders of confidentiality against regulators, who are determined to regulate their use.

Use declining, but still sustained

After reaching an all-time peak in April 2022 with more than $1.5 billion worth of cryptos mixed, mixing services have seen their popularity decline as the bear market has taken hold. But according to Chainalysis, 2024 marks a strong comeback for these tools, in line with the overall recovery of the cryptocurrency market.

While volumes remain below the record levels of 2021 and early 2022, the trend is upwards. According to a report published in July 2024, Tornado Cash and Wasabi Wallet are among the most dynamic mixers. Conversely, Samourai Wallet ceased operations in April 2024, while Joinmarket lost its appeal during the second quarter.

A strong signal of renewed interest in blockchain-based privacy solutions, despite the increasing regulatory pressure surrounding these services.

Laundering and mixers: what are the facts?

Not all funds passing through mixers are linked to illicit activities. In 2024, 9% of flows from suspect addresses were mixed, according to Chainalysis. Yet these services remain popular with cybercriminals for laundering stolen funds or concealing dubious transactions.

Among the most active groups, Lazarus, affiliated to North Korea, has regularly used mixers. After hacking HTX's HECO bridge in 2023, it reportedly concealed more than $100m via Tornado Cash. A similar scenario had occurred in 2022, when the group laundered $455 million from the Ronin Bridge hack, contributing to Tornado Cash's inclusion on the list of entities sanctioned by the United States.

Mixers are also used in other types of cybercrime. Ransomware exploits these services to anonymise Bitcoin payments extorted from their victims, while darknet marketplaces such as Silk Road, Hydra and Alphabay have long used them to erase traces of transactions linked to the sale of drugs, weapons or false documents.

The crackdown is intensifying. In April 2024, the US authorities shut down Samourai Wallet, accused of facilitating the laundering of $100 million from darknet markets. Furthermore, Chainalysis reports that around 2% of funds passing through platforms without KYC and 1% of those circulating in DeFi were mixed in 2024. A modest figure, but one that is fuelling increased scrutiny from regulators.

According to Chainalysis' 2024 cryptocurrency crime report, $40.9 billion moved via addresses associated with illicit activity, or 0.14% of total crypto transaction volume.

While 9% of these funds passed through a blender, it is estimated that around $4 billion of criminal origin passed through it over the year. A sizeable figure, but one that remains marginal compared with all cryptocurrency flows, confirming that these services are not used exclusively for fraudulent purposes.

The most popular mixers

Tornado Cash

Launched in 2019 by Roman Storm, Alexey Pertsev and Roman Semenov, Tornado Cash is a decentralised application (dApp) operating as a cryptocurrency mixer on the Ethereum blockchain. Compatible with the Ethereum Virtual Machine (EVM), it anonymises transactions on Ethereum, Arbitrum, Optimism, Avalanche, Binance Smart Chain (BSC), Polygon and Gnosis Network.

Its operation is based on zk-SNARKs technology, which allows users to prove possession of an item without revealing its details, guaranteeing a high degree of confidentiality. When a user wishes to anonymise their funds, they make a deposit in a smart contract, generating a cryptographic hash ("note"), which will later be used for withdrawal. To avoid any link between addresses, it is recommended to withdraw the funds to a new wallet or to use a relayer, which disguises the origin of the transaction by paying the gas fees in exchange for a commission.

Before being sanctioned by the United States in August 2022, Tornado Cash was experiencing growing adoption. By April 2022, it was recording 7,453 weekly deposits, with a total locked-in value (TVL) of 293,000 ETH, or around $1 billion at the time. The protocol was generating $2.5 million in monthly fees at the time, 94% of which came from ETH transactions.

But its success has attracted the attention of the authorities. Accused of facilitating money laundering for criminal groups, including North Korea's Lazarus Group, the protocol was blacklisted by the OFAC (Office of Foreign Assets Control). The impact was immediate: within a week, the number of withdrawals plummeted by 66%, and monthly revenues fell from $1.28 million in January 2022 to just $109,000 a year later.

Despite the sanctions and the arrest of its founders, Tornado Cash has never stopped operating, thanks to its decentralised model. At the beginning of 2025, the protocol's TVL reached 183,000 ETH, or around $485.6 million, with Ethereum accounting for 89.3% of the funds deposited. The total number of users exceeds 98,000 depositors and 164,000 withdrawals since its inception.

The protocol is benefiting from a resurgence in the crypto market and a US court ruling overturning sanctions in January 2025, which caused the price of the governance token, TORN, to rise 225%.

Launched in February 2021, the TORN governance token allows its holders to vote on decisions made by the Tornado Cash DAO. At the beginning of 2025, it had a capitalisation of $46.2 million and a Fully Diluted Valuation (FDV) of $121.2 million.

Despite controversy and increased scrutiny from regulators, Tornado Cash remains one of the few fully decentralised tools guaranteeing the anonymity of crypto transactions. Its fate remains uncertain, but its success is based on growing demand for privacy solutions at a time when the traceability of blockchain transactions is becoming increasingly stringent.

WabiSabi (Wasabi Wallet)

Wasabi Wallet is a privacy-focused, non-custodial Bitcoin wallet that uses CoinJoin technology to break visible links between transactions on the blockchain. This technique makes it possible to mix several transactions between different users in order to hide the origin and destination of funds. Unlike traditional transactions, which are recorded transparently and traceably, CoinJoin aggregates multiple inputs and outputs into a single transaction, making blockchain analysis far more complex.

Historically, Wasabi Wallet relied on a single coordinator, operated by the company zkSNACKs, to organise these blending sessions. However, the situation has changed radically: zkSNACKs ceased operations following the arrest in 2024 of the founders of Samourai Wallet. Now, there is no longer a default coordinator, but the WabiSabi protocol, on which the old Wasabi Wallet was based, still allows CoinJoin to operate.

WabiSabi is an open source protocol, which means that anyone can operate a CoinJoin coordinator. With the demise of zkSNACKs, several new coordinators have emerged, operated both anonymously and by well-known people in the Bitcoin ecosystem. Some offer their services for free to avoid potential legal action, while others still charge fees to fund their infrastructure.

However, this diversification of coordinators comes with new challenges. Some could be malicious, either by being exploited by blockchain analytics companies seeking to monitor transactions, or by exploiting loopholes in the protocol to siphon funds from users.

Despite these risks, most of the new coordinators offer the same guarantees as zkSNACKs, with one major difference: the dispersion of users across several coordinators leads to fragmentation of liquidity. Now, to maximise the efficiency of a CoinJoin and strengthen the anonymisation of transactions, it is preferable for the greatest number of users to converge on the same coordinator.

Mixero

Mixero is a Bitcoin mixing service aimed at strengthening the confidentiality of transactions by making their traceability more complex. Unlike Wasabi Wallet, which is a Bitcoin wallet incorporating CoinJoin functionality to anonymise transactions, Mixero presents itself as a separate platform dedicated exclusively to mixing Bitcoins.

Mixero offers several blending modes to meet the varying needs of users:

Basic Mode: This mode uses only CoinJoin transactions to anonymise funds.

Advanced Mode: This mode adds an extra layer of privacy by going through a Monero bridge (XMR), temporarily converting BTC to XMR before converting back to BTC.

Ricochet mode: This mode increases the number of CoinJoin cycles, known as "hoops", and allows users to define a random number of these cycles as well as delays between transactions, making transactions harder to trace.

In comparison, Wasabi Wallet primarily used the WabiSabi protocol to organise CoinJoin sessions, without offering the advanced or ricochet modes that Mixero offers.

Mixero works as a centralised service, where users send their bitcoins to the platform to be shuffled and sent back to new addresses. This model requires trust in the service operator regarding the secure management of funds and the non-conservation of transaction logs.

The information available does not specify the identity of Mixero's designers. Mixero's business model is based on variable service fees (from 0.7% to 4.7%) depending on the mixing mode chosen.

Whir

Whir uses the CoinJoin protocol to aggregate multiple transactions into a single transaction, making it more difficult to trace funds. Users can specify up to three receiving addresses to distribute the commingled bitcoins, and have the option of introducing delays of up to 48 hours to increase the anonymity of transactions.

Whir is a centralised service, which means that users send their bitcoins to the platform to be commingled and sent back to new addresses. This model requires trust in the service operator regarding the secure management of funds and the non-conservation of transaction logs.

The information available does not specify the identity of Whir's designers. Whir's business model is based on a fixed service fee of 3%, plus a network commission of 0.001 BTC per transaction. Users can choose mixing times ranging from "Mix ASAP" (immediate mixing) to times of 1 hour, 2 hours, up to 2 days, depending on their confidentiality needs. Whir limits the number of bitcoins that can be mixed to one unit

Privacy of crypto mixers: a technological myth?

The idea that cryptocurrency mixers guarantee absolute privacy is largely shattered by advances in blockchain analysis tools. "Chainalysis has a great deal of expertise in tracing funds, even when they go through blenders," Matthias Bauer-Langgartner, in charge of European affairs for Chainalysis, tells The Big Whale. In other words, although blenders add a layer of complexity to transactions, they do not make them untraceable. Far from being hermetically sealed black boxes, these anonymisation tools leave exploitable traces, which companies like Chainalysis are working hard to decipher.

The core of this capability is based on identifying "patterns" that enable funds to be traced back to their source. Matthias Bauer-Langgartner, for example, claims that Chainalysis can "demix" transactions, revealing the origin of crypto assets, despite users' efforts to cover their tracks. This reality calls into question the initial promise of mixers: while their usefulness lies in obfuscating flows, their effectiveness in the face of advanced analysis tools seems increasingly limited.

This observation is all the more important given that the use of mixers is not limited to cybercriminals. Matthias Bauer-Langgartner acknowledges that these services can "also serve legitimate purposes, such as preserving a degree of confidentiality." Anonymity is therefore not systematically synonymous with illegality, but the tension between these two uses is reflected in recent regulatory developments.

The new European anti-money laundering regulation (available here) is part of this drive for tighter control. From now on, entities subject to this regulation, including MiCA-regulated digital asset service providers (CASPs), will not be able to use mixers or offer anonymous accounts.

But does this ban have any real impact? The answer remains uncertain. In practice, Matthias Bauer-Langgartner points out that "few European entities and CASPs currently offer mixer services." In other words, this formal measure may not fundamentally upset the existing ecosystem. Above all, the European regulations - and a fortiori the French legislation in preparation - do not extend to private portfolios. Individual users therefore retain the possibility of accessing mixers, including for illicit uses.

So a general ban on mixers seems difficult to apply. Matthias Bauer-Langgartner points to a major obstacle: "A blanket ban on mixer services would be very difficult to enforce, given the often decentralised nature of these offerings." This argument highlights a fundamental limitation of regulation: while centralised service providers can be constrained, purely decentralised protocols largely escape traditional legal frameworks.

Faced with this complexity, the traceability of flows is becoming a strategic issue for the authorities and players in the sector. Matthias Bauer-Langgartner stresses "the crucial role of our tracing solutions in helping companies assess and manage AML risks, and enabling law enforcement agencies to effectively track illicit flows." The approach is no longer limited to a posteriori analysis, but now tends towards active prevention: "This also highlights the importance of our evolution from purely investigative tools - analysing transactions after the fact - to proactive solutions that detect and prevent losses of funds before they even occur. "

Strengths and weaknesses of cryptocurrency mixers

Like any solution in the digital asset space, cryptocurrency mixers have their strengths and weaknesses. In the following section, we will outline some of the key strengths and weaknesses:

Strengths

Enhanced privacy and anonymity: One of the key strengths of cryptocurrency blenders is their ability to offer users enhanced privacy. These services prevent blockchain analysis tools from easily tracing transactions by breaking the link between sender and receiver. This is particularly important for people who value financial privacy, such as journalists, activists or individuals living under oppressive regimes.

Protection against surveillance and tracking: Government agencies, corporations and malicious actors are increasingly monitoring transactions on the blockchain. Cryptocurrency blenders allow users to prevent scrutiny of their financial activities, ensuring the privacy of their spending habits and wealth.

Security against hacks and targeted attacks: Hackers and scammers often target users holding large amounts of cryptocurrencies. If an individual's transactions can be traced, they become a potential target. Cryptocurrency blenders help hide transaction history, making it more difficult for malicious actors to identify and exploit holders of large amounts.

Breaking transaction history for fungibility: Some cryptocurrencies, such as Bitcoin, have a public ledger that records all transactions. This can lead to some coins being "tainted" due to previous associations with illicit activity. By using a mixer, users can effectively "clean up" their coins, improving the fungibility of digital assets.

Decentralised and non-custodial options: Some cryptocurrency mixers operate in a decentralised manner, meaning they do not require users to trust a central entity with their funds. Non-custodian mixers increase security and reduce the risk of exit scams or seizures by law enforcement.

Weaknesses

Association with illicit activities: One of the biggest criticisms of cryptocurrency mixers is their association with money laundering, terrorist financing and other illegal activities. Because they mask the origin of transactions, criminals have used them to launder stolen or illegally obtained cryptocurrencies. This has led to increased scrutiny from regulatory agencies and law enforcement.

Regulatory crackdown and legal issues: Governments around the world are imposing stricter regulations on financial privacy tools, including cryptocurrency blenders. Some jurisdictions have banned their use outright, while others require blenders to comply with anti-money laundering (AML) and know your customer (KYC) regulations. This legal uncertainty poses a significant risk to users and operators of blending services.

Risk of outbound scams and theft: Many cryptocurrency blenders operate as centralised custodial services (custodial), requiring users to trust them with their funds during the blending process. This has led to cases where operators have stolen deposited funds in so-called "exit scams". Users who rely on centralised mixers risk losing their assets with no recourse.

High fees and transaction delays: Many mixers charge fees of up to 5% of the transaction amount. In addition, blending can introduce delays, forcing users to wait for several transactions to be processed before receiving their funds. These factors can make blenders impractical and expensive for privacy-seeking users.

Inconsistent anonymity guarantees: The effectiveness of a cryptocurrency blender depends on the number of users participating in the service. If too few people use a particular blender, the anonymity set is smaller, making it easier for blockchain analysts to link transactions. In addition, some mixers do not implement robust privacy measures, leaving users vulnerable to de-anonymisation.

Conclusion

Often associated with money laundering and criminal activity, crypto mixers nevertheless have legitimate uses and play a key role in the confidentiality of on-chain transactions. In particular, they allow political donors to preserve their anonymity, wealthy individuals to secure their privacy and philanthropists to make donations without being identified. But more simply, they strengthen online privacy.

Beyond these use cases, blenders also help preserve the fungibility of cryptocurrencies. By blending assets, they prevent a token or coin from being associated with a past transaction, ensuring that no history can affect its value or acceptance. This essential feature ensures that cryptocurrencies remain interchangeable and freely usable, with no risk of discrimination linked to their origin.

From a technological point of view, mixers represent a major advance in the crypto ecosystem. Relying on smart contracts for EVM-compatible blockchains or UTXO systems for Bitcoin and its equivalents, these protocols make it possible to dissociate deposit and withdrawal addresses, thereby guaranteeing a high level of confidentiality.

With the rise of cryptocurrencies and the decline in the proportion of illicit flows in global transactions, these tools could gradually shed their negative image. Provided they are properly supervised, they could even evolve towards greater compliance with anti-money laundering regulations while continuing to fulfil their primary mission: ensuring the protection of privacy and the fungibility of digital assets.

‍