A cryptocurrency mixer, sometimes called a tumbler, takes funds from many different users, pools them together, and returns an equivalent amount to each user from that shared pool rather than sending back their original coins directly. The stated purpose is privacy, since a public blockchain otherwise lets anyone trace a coin's full history from the moment it was mined onward. In practice, mixers have become one of the most consistently used tools by cryptocurrency thieves, and understanding how they function, and how investigators work around them, is essential to understanding why some cases take far longer to resolve than others.
How a mixer breaks the direct trail
Bitcoin style mixers typically use a coordination protocol where multiple participants combine their coins into a single joint transaction with many inputs and many equally sized outputs, making it mathematically ambiguous which output corresponds to which input. Ethereum based mixers such as Tornado Cash instead use a smart contract pool. Users deposit a fixed denomination of a token into the pool and later withdraw the same denomination using a cryptographic proof that verifies they made a valid deposit at some point, without revealing which specific deposit was theirs. In both models, the direct, one to one link between a deposit address and a withdrawal address is deliberately severed.
Tornado Cash: sanctions, a court fight, and a reversal
In August 2022, the United States Treasury's Office of Foreign Assets Control sanctioned Tornado Cash, citing its use by North Korea's Lazarus Group to launder more than seven billion dollars in virtual currency since the protocol's creation in 2019. The sanction meant that Americans were prohibited from interacting with the protocol at all, an unusually aggressive step since Tornado Cash is not a company but a set of autonomous smart contracts with no central operator able to comply with the order.
That structure became the center of a prolonged legal fight. In March 2025, the Treasury officially lifted the sanctions on Tornado Cash following a court ruling that its autonomous, immutable smart contracts could not properly be treated as sanctionable property in the same way a person or a company could. The delisting did not resolve the separate criminal case against one of the protocol's developers, Roman Storm, who faced trial in 2025 on charges including money laundering, sanctions violations, and operating an unlicensed money transmitting business.
Sinbad and the mixer migration cycle
When Tornado Cash was first sanctioned in 2022, laundering activity linked to Lazarus Group did not stop. It shifted to a different mixer, Sinbad.io, which United States authorities later identified as processing millions of dollars from major Lazarus Group heists, including funds from the Horizon Bridge and Axie Infinity thefts. Sinbad was seized by US authorities in November 2023 and subsequently sanctioned by the Treasury as a key money laundering tool for the group. This pattern, a mixer being sanctioned or seized and laundering activity migrating to a replacement service, has repeated enough times that investigators treat it as a predictable cycle rather than an exception.
Sanctioning or seizing one mixer does not eliminate mixing as a laundering technique. It shifts activity to alternative services, which is why tracing methodology, not just enforcement against any single platform, remains the more durable defense.
A broader regulatory push against mixing
The Tornado Cash and Sinbad cases are the most publicized examples of mixer enforcement, but they are part of a wider regulatory effort. In October 2023, the US Treasury's Financial Crimes Enforcement Network proposed designating cryptocurrency mixing itself, as a category of transaction rather than any single named service, a primary money laundering concern under federal law. The proposal specifically cited how mixers such as Tornado Cash and a separate service called Blender.io had been used in connection with the Axie Infinity and Harmony Horizon Bridge thefts, arguing that mixing technology as a whole posed an acute laundering risk because it deliberately shields transaction details from the financial institutions and investigators who would otherwise be able to follow them. That kind of category wide regulatory attention reflects an acknowledgment that targeting individual mixers one at a time, while necessary, has not been sufficient on its own to stop the underlying technique from being used by whichever service happens to be available at a given moment.
Why mixed funds are not actually untraceable
A mixer obscures the direct link between a deposit and a withdrawal, but it does not erase the surrounding evidence entirely. Analysts still know which addresses deposited into a mixer and roughly when, and which addresses withdrew from it and roughly when. Timing correlation, deposit and withdrawal amount matching, and clustering techniques covered in our guide on how blockchain tracing works can often narrow down probable links, especially when an attacker withdraws funds close in time to depositing them, or in denomination patterns that stand out against ordinary user activity.
The more durable choke point is what happens after the mixer. Funds eventually need to reach a point where they can be converted into spendable currency, most often a centralized exchange. Major exchanges have significantly increased their willingness to flag, freeze, and report deposits traced back to known mixer withdrawal addresses, a trend covered in our guide on exchange cooperation trends. A mixer can delay an investigation and force a wider net of tracing effort. It has not proven able to make large scale, sanctioned laundering activity permanently invisible.
How mixing fits into a broader laundering chain
In most significant thefts, a mixer is one step among several rather than the entire laundering strategy. Funds are commonly moved through cross chain bridges before or after passing through a mixer, split into smaller tranches to avoid triggering size based monitoring thresholds, and routed through no KYC exchanges or peer to peer services before any attempt at a final cash out. Public reporting on North Korean state linked laundering, covered in our guide on state linked hacking groups, describes exactly this kind of layered approach, combining mixers, bridges, and Chinese language money movement services within a structured, repeatable cycle.
The legitimate privacy case, and why it complicates policy
Part of what makes mixer policy genuinely difficult is that the underlying privacy motivation is not fabricated. A public blockchain by default exposes every transaction, balance, and counterparty an address has ever interacted with to anyone who looks, a level of financial transparency few people would accept from their bank. Journalists, political dissidents, and ordinary users with legitimate reasons to keep their financial activity private have all cited this exposure as a reason mixing technology should not be banned outright. Regulators and law enforcement, including in the Tornado Cash court proceedings, have generally not disputed that legitimate privacy use exists. Their argument, and the basis for continued scrutiny even after the Tornado Cash delisting, is that the same technology has demonstrably been used to launder billions of dollars for sanctioned state actors, and that a mixer's operators bear some responsibility for the uses their software is put to, even when the software itself runs autonomously once deployed.
What this means for victims and investigators
If stolen funds pass through a mixer, it is realistic to expect the investigation to take longer and to require more advanced clustering and correlation work than a case where funds move directly and visibly toward an exchange. It does not mean the case is closed. Investigators experienced with mixer analysis can often still identify probable exit points, flag them to relevant exchanges, and support law enforcement action, particularly for mixers that have already been the subject of prior sanctions or seizure, since much of their address activity has already been studied and documented.
For a victim specifically, the appearance of a mixer in the trail of your stolen funds is not a reason to give up on reporting or investigation. It is a reason to expect a longer timeline and to work with an investigator who has specific experience analyzing mixer activity, rather than assuming that generic blockchain lookup tools will be sufficient to identify where the funds ultimately went.
Frequently asked questions
Using a mixer is not automatically illegal in most jurisdictions, and some privacy focused users have legitimate reasons for wanting to obscure their transaction history. However, operating a mixer that knowingly launders funds for sanctioned actors or facilitates money laundering has led to criminal charges against mixer operators, and specific mixers have been formally sanctioned as prohibited services.
A federal court ruled that Tornado Cash's immutable, autonomous smart contracts could not properly be treated as sanctionable property under the law used to designate it, since no person or entity controls or can modify them. The Treasury removed the sanction in March 2025 following that ruling, though separate criminal proceedings against an individual developer continued.
No. Mixers make direct, one to one tracing significantly harder, but timing patterns, deposit and withdrawal amounts, and clustering analysis can still narrow down likely connections. The larger challenge for launderers remains converting mixed funds into usable currency without passing through a monitored exchange.
An experienced investigator will typically still attempt to identify probable withdrawal addresses using timing and pattern analysis, then flag those addresses to relevant exchanges and law enforcement. The case becomes harder, but mixer use is not treated as an automatic dead end in a properly resourced investigation.
Sources and further reading
- Treasury Sanctions Mixer Used by the DPRK to Launder Stolen Virtual Currency · U.S. Department of the Treasury
- U.S. Sanctions Crypto Mixer Sinbad.io for Role in North Korean Laundering Activities · Chainalysis
- US lifts sanctions on Tornado Cash, a crypto mixer linked to North Korean money laundering · TechCrunch
- Treasury proposes designating transactions with cryptocurrency mixers a Primary Money Laundering Concern · DLA Piper