Europol shuts down ‘crypto-laundromat’ Cryptomixer

In a sweeping cross-border operation, authorities from Switzerland and Germany, supported by Europol and Eurojust, have shuttered Cryptomixer (cryptomixer.io), one of the largest cryptocurrency mixing services in operation.

During the Nov. 24–28 takedown, police seized three servers, the platform’s domain, more than 12 terabytes of data, and roughly €25 million ($27–29 million) in Bitcoin.

Cryptomixer had processed around €1.3 billion ($1.4 billion) in Bitcoin since 2016, according to investigators.

From Europol’s press release:

Cryptomixer was a hybrid mixing service accessible via both the clear web and the dark web. It facilitated the obfuscation of criminal funds for ransomware groups, underground economy forums and dark web markets. Its software blocked the traceability of funds on the blockchain, making it the platform of choice for cybercriminals seeking to launder illegal proceeds from a variety of criminal activities, such as drug trafficking, weapons trafficking, ransomware attacks, and payment card fraud. Since its creation in the year 2016, over EUR 1.3 billion in Bitcoin were mixed through the service.

A seizure banner has replaced the Cryptomixer homepage – a symbolic end to a service described by authorities as a major laundering hub.

Source: Europol

What is crypto mixing?

Crypto mixing (also called tumbling) is the process of obscuring the transaction trail of cryptocurrencies, particularly on public blockchains like Bitcoin or Ethereum – where every transaction is visible and permanently recorded.

A “crypto mixer,” or “tumbler,” pools funds from many users, mixes them, then redistributes equivalent amounts to new wallet addresses after random delays. Because the funds are jumbled and sent through many paths, it becomes extremely difficult (though not impossible) to trace who sent what to whom.

Mixers can serve legitimate purposes – for example, people who value financial privacy may seek to decouple their identity from their on-chain activity. But this same property of privacy makes mixers a powerful tool for criminals. Launderers use them to scrub “dirty” crypto – proceeds from ransomware, theft, darknet markets or other illicit activities – and make them look “clean.”

As a result, mixers have become a cornerstone of crypto-enabled money laundering schemes, drawing growing attention from regulators and law-enforcement worldwide.

Crypto laundering over the years

Operation Olympia comes amid heightened global scrutiny of crypto laundering infrastructure. Over the last few years, similar services have been dismantled or sanctioned.

In 2023, authorities shut down ChipMixer, seizing tens of millions of dollars in Bitcoin.

In the U.S., co-founders of Tornado Cash – a once-popular Ethereum-based mixer – have been charged with money laundering and operating an unlicensed money-transmitting service.

Cyber-criminal groups like Lazarus Group have been known to deploy advanced laundering strategies, combining crypto mixing, intermediary wallets, cross-chain bridges and decentralized finance (DeFi) flows – to evade detection.

Likely only a temporary roadblock

The Cryptomixer takedown shows how police are increasingly able to infiltrate and dismantle major parts of the crypto-laundering ecosystem. But the “mixing business” is resilient – when one service falls, criminals adapt and move to new platforms or techniques.

Law-enforcement officials expect this disruption to reverberate across ransomware actors, darknet markets, and other cyber-criminal networks – at least temporarily.

However, if history is any indication, criminal groups will simply shift to alternate mixers or laundering mechanisms in the coming weeks.

You may also want to read:

US Prosecutors Charge Founders of Crypto Mixer Tornado Cash with Money Laundering

Lazarus Group Continues Crypto Laundering Spree, Drops New Malware Strains

Tornado Cash Crypto Mixer Co-Founder Sentenced to Five Years in Prison