Europol Authorities Shut Down $1.4 Billion Crypto Mixer, Seizing $27 Million and 12TB of User Data

Summary:
Europol, along with law enforcement from Germany and Switzerland, has successfully dismantled one of the largest illicit crypto-mixing operations in Europe. This operation resulted in the seizure of €25 million ($27 million) in Bitcoin and over 12 terabytes of user data. Launched in 2016, the service, known as "Cryptomixer," has processed over €1.3 billion linked to various illegal activities, marking a significant step in the EU’s ongoing efforts to combat money laundering and obscure financial transactions.

Key Takeaways

Europol and national law enforcement have taken down the "Cryptomixer," a prominent illegal crypto-mixing service.
The operation seized €25 million ($27 million) in Bitcoin and 12TB of user data.
Cryptomixer had processed over €1.3 billion since its inception in 2016, facilitating a wide array of criminal activities.
New EU anti-money laundering regulations are making it more difficult for such services to operate.

Europol Authorities Bust $1.4B Crypto Mixer, Seizing $27M and 12TB of User Data

Six-Year-Old Crypto Laundering Service Taken Offline

The operation occurred between November 24 and 28 in Zurich, where Europol provided on-ground support to local authorities throughout the week.

Investigators successfully seized three servers, gained control of the cryptomixer(dot)io domain, and replaced it with a law enforcement seizure notice.

According to Europol, the "Cryptomixer" operated as a hybrid mixing service on both the clear web and dark web markets.

Since its launch in 2016, the platform has been involved in processing more than €1.3 billion in Bitcoin, primarily linked to various illegal activities.

Authorities report that the mixer was heavily utilized by ransomware groups, underground cybercrime forums, and operators in dark web marketplaces.

Image description

The service's software aggregated deposits for extended, randomized periods before redistributing funds to new addresses specifically designed to obscure transaction trails.

This method played a crucial role in masking the proceeds of drug trafficking, weapons trafficking, credit card fraud, and cyberattacks, enabling criminals to convert "cleaned" assets back into other cryptocurrencies or fiat through exchanges, ATMs, and bank accounts.

Europol facilitated intelligence-sharing through its Joint Cybercrime Action Taskforce and provided forensic specialists during these raids.

The agency has previously led several significant anti-mixing operations in recent years, such as the March 2023 shutdown of ChipMixer, then considered the largest such service.

The recent takedown aligns with the EU's commitment to strengthening its anti-money-laundering framework ahead of important regulatory deadlines. Under new Anti-Money Laundering (AML) rules tied to the Markets in Crypto-Assets (MiCA) regulation, crypto-mixing services are now banned within the EU, and anonymity-enhancing cryptocurrencies like Monero and Zcash will be prohibited by 2027.

Crypto-asset service providers must implement stringent Know Your Customer (KYC) checks, identify both senders and recipients of all transfers, and carry out enhanced due diligence on transactions exceeding €1,000.

These preventative measures are aimed at closing regulatory gaps that have traditionally allowed money laundering networks to operate across borders with little oversight.

Intensified Enforcement Against Digital Crime

The crackdown on mixing services has intensified globally. In January 2025, a U.S. federal grand jury indicted three Russian nationals alleged to have operated Blender(dot)io and its successor, Sinbad(dot)io, mixers reportedly used by the North Korean hackers known as the Lazarus Group.

In November, a New York court sentenced Keonne Rodriguez, co-developer of Samourai Wallet, to five years in prison for his role in laundering over $237 million in illicit funds.

This verdict has accelerated scrutiny over privacy-focused, non-custodial crypto tools.

Additionally, William Lonergan Hill, chief technology officer of Samourai Wallet, received a four-year federal prison sentence related to his involvement in mixing activities.

The shutdown of Cryptomixer coincides with one of Europol's busiest years for enforcement in the digital crime landscape.

In October, European investigators dismantled a cybercrime syndicate responsible for generating over 49 million fake online accounts.

This network offered temporary SIM-based phone numbers that allowed criminals to bypass two-factor authentication and create fraudulent identities used to exploit exchanges, banks, and e-commerce platforms.

Seven suspects were arrested, and numerous SIM servers and routers were confiscated.

In June, Europol also led raids against Archetyp Market, one of the longest-running drug markets on the dark web, resulting in the seizure of core infrastructure in the Netherlands and arrests across Europe, although experts noted that operators frequently regroup on decentralized platforms.