A crypto mixer, also called a cryptocurrency tumbler, is a service that breaks the traceable link between a sender and a recipient on a public blockchain by pooling multiple users' funds together and redistributing equivalent amounts to new addresses. By obscuring the transaction trail, mixers make it significantly harder for blockchain analytics tools, regulators, and law enforcement to follow the movement of digital assets from source to destination.
## How Does a Crypto Mixer Actually Work?
At its most basic level, a crypto mixer intercepts coins at one address, mixes them with coins from other users, and sends out equivalent but different coins to destination addresses. The process involves collecting deposits from many users into a common pool, waiting for enough liquidity, then redistributing with time delays, randomized amounts, and multiple intermediate hops to confuse chain analysis.
## What Are the Different Types of Crypto Mixers?
| Feature | Centralized Mixers | Decentralized Mixers | CoinJoin |
|---|---|---|---|
| **Custody** | Custodial - operator holds keys | Non-custodial - smart contract | Non-custodial - peer-to-peer |
| **Examples** | Helix, BitcoinFog, ChipMixer | Tornado Cash, Typhoon Cash | Wasabi Wallet, JoinMarket |
| **Operator** | High involvement | Low - smart contract governed | None - P2P coordination |
| **Blockchain** | Primarily Bitcoin | Primarily Ethereum/EVM | Bitcoin |
| **Traceability** | Moderate - operator logs may exist | Low - no central logs | Moderate - UTXO analysis possible |
| **Regulatory Status** | Largely sanctioned or shut down | OFAC-sanctioned (Tornado Cash) | Legal grey area |
| **Detection Difficulty** | Moderate | High without specialized tools | Moderate |
| **AML Risk** | Very high | Very high | High |
Centralized mixers like Helix and ChipMixer have been shut down by law enforcement. Decentralized mixers like Tornado Cash use smart contracts, making them harder to shut down. CoinJoin is a Bitcoin-specific technique where multiple users collaboratively construct a single transaction.
## What Happened with Tornado Cash and OFAC Sanctions?
In August 2022, OFAC added Tornado Cash to the SDN list, sanctioning the smart contract itself. Circle froze USDC in linked addresses within hours. GitHub removed the repository. Developer Roman Storm was arrested, and Dutch courts convicted developer Alexey Pertsev in May 2024. In November 2024, the Fifth Circuit ruled OFAC exceeded its authority by sanctioning immutable smart contracts. However, Tornado Cash was used by North Korea's Lazarus Group to launder hundreds of millions from hacks including the Ronin Network ($625M) and Harmony's Horizon bridge.
## Why Do People Use Crypto Mixers?
Legitimate use cases include protecting business transaction details, preventing wallet-based targeting, preserving privacy in authoritarian regimes, and whistleblower protection. However, Chainalysis data shows a significant proportion of mixing service funds trace to illicit sources including darknet markets, ransomware, and exchange hacks.
## What Are the Legal Implications of Interacting with Mixed Funds?
For VASPs, receiving mixed funds creates multi-layered risk: sanctions exposure (OFAC strict liability), AML programme failures (unexplained mixer use is a red flag requiring enhanced due diligence), and potential criminal liability for knowingly facilitating money laundering.
## How Can Compliance Teams Detect Mixer Usage?
Detection requires blockchain analytics beyond simple address matching. Effective approaches include direct address matching against known mixer addresses, transaction graph analysis tracing funds through multiple hops, heuristic detection for CoinJoin's characteristic equal-output structures, and zero-knowledge proof pattern recognition for protocols like Tornado Cash.
Defy's Live AML platform incorporates dedicated mixer detection across all modalities. The system achieves 99.9% detection accuracy for Tornado Cash interactions and a 98% CoinJoin detection rate, enabling compliance teams to flag mixer-linked transactions in real time. The risk scoring engine assigns levels based on the proportion of funds traced to mixing, proximity in the transaction graph, and the specific mixer involved.
## What Should Compliance Teams Do When Mixer Activity Is Detected?
A structured response process includes: triggering enhanced due diligence immediately, filing SARs when mixer involvement cannot be satisfactorily explained, blocking or reversing transactions linked to sanctioned addresses, and potentially offboarding customers who cannot explain mixer usage. All steps must be thoroughly documented.
## Conclusion
Crypto mixers present a genuine compliance challenge for any institution in the digital asset space. Effective compliance requires technology capable of detecting mixing across all modalities, a risk-scoring framework that distinguishes exposure levels, and clear internal procedures. Defy's platform delivers industry-leading detection rates and real-time monitoring, giving compliance teams the visibility they need to manage mixer risk without disrupting legitimate business operations.