In brief
- European authorities have dismantled Cryptomixer, a cryptocurrency mixing service that has laundered over $1.4 billion in Bitcoin since 2016.
- The operation, conducted in Switzerland, resulted in the seizure of three servers, 12 terabytes of data, and more than $27 million in cryptocurrency.
- Cybercrime experts say the takedown will cause short-term disruption for criminal groups, but most will likely migrate to alternative laundering services within weeks.
European authorities have dismantled Cryptomixer, a crypto mixing service that laundered over $1.4 billion (€1.3 billion) in Bitcoin since 2016, seizing more than $27 million (€25 million) in BTC and 12 terabytes of data during a coordinated operation in Switzerland.
Law enforcement from Germany and Switzerland, supported by Europol and Eurojust, executed the takedown last week in Zurich, confiscating three servers and the cryptomixer.io domain.
Crypto mixers hide the origin of funds by shuffling incoming transactions and sending back coins that can’t be linked to the original source.
The operation placed a seizure banner on the website after shutting down the service, which operated on both the clear web and dark web, according to Europol’s press release.
Cryptomixer enabled ransomware crews, underground forums, and dark-web markets to launder proceeds from drug trafficking, weapons trafficking, ransomware attacks, and payment-card fraud by blocking the traceability of funds on the blockchain, according to the agencies.
A “major laundering hub”
Cybercrime consultant David Sehyeon Baek told Decrypt “the $1.4 billion volume signals a major laundering hub, not a small operation,” noting that mixers only reach that scale “when many ransomware crews, darknet markets, and fraud groups consistently rely on them.”
“Staying active for nearly a decade also shows operational maturity—stable infrastructure, automation, and a strong reputation on underground forums,” Baek said.
Baek noted the immediate operational impact will disrupt cash-out workflows for dependent criminal groups, causing “delays, stuck funds, and a lot of scrambling” as they seek alternative laundering routes.
However, he cautioned “most capable crews typically migrate to other mixers, cross-chain bridges, or high-risk exchanges within weeks.”
“The short-term friction is real, especially for high-volume operators, but overall laundering activity doesn’t disappear. It simply shifts,” Baek explained.
Europol coordinated the operation through the Joint Cybercrime Action Taskforce (J-CAT) in The Hague, providing on-the-spot forensic support during the action week and facilitating information exchange between participating countries, according to the press release.
The agency previously supported the takedown of ChipMixer, then the largest mixing service, in March 2023.
Europe’s crypto crackdown
Europol’s takedown of Cryptomixer is part of a broader European crackdown on crypto-enabled crime.
Earlier this month, police in Cyprus, Spain, and Germany, in coordination with Eurojust, arrested nine individuals in connection with a crypto money laundering network that defrauded victims of $689 million (€600 million).
Last month Europol seized $330,000 in crypto and arrested seven individuals as part of the takedown of a cybercrime-as-a-service network operating out of Latvia.
Europol’s Burkhard Mühl, who heads the agency’s European Financial and Economic Crime Centre, warned earlier that the misuse of crypto and blockchain for criminal purposes is “becoming increasingly sophisticated.”
“Investigating these crimes places a significant burden on the law enforcement agencies of EU member states,” Mühl said during the 9th Global Conference on Criminal Finances and Crypto Assets in late October.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
