Europol Dismantles Cryptomixer in Major Cryptocurrency Money Laundering Operation

Breached Company

Breached Company

— 3 min read
Europol Dismantles Cryptomixer in Major Cryptocurrency Money Laundering Operation

EUR 25 million seized as authorities shut down cryptocurrency mixing service facilitating cybercrime

Law enforcement authorities from Switzerland and Germany, with support from Europol, have successfully taken down Cryptomixer, an illegal cryptocurrency mixing service suspected of facilitating cybercrime and money laundering activities. The coordinated operation, conducted from November 24-28, 2025 in Zurich, Switzerland, resulted in significant seizures and dealt another blow to cryptocurrency-based money laundering infrastructure.

Operation Results

The operation yielded substantial results:

  • Three servers seized in Switzerland
  • The cryptomixer.io domain confiscated
  • Over 12 terabytes of data recovered
  • More than EUR 25 million worth of Bitcoin seized
  • Seizure banner placed on the website following takedown

How Cryptomixer Facilitated Criminal Activity

Cryptomixer operated as a hybrid mixing service accessible through both the clear web and dark web, making it particularly attractive to cybercriminals. The platform enabled criminals to obfuscate the origin of illicit funds by blocking traceability on the blockchain.

The service worked by pooling deposited funds from various users for randomized periods before redistributing them to destination addresses at random intervals. This process effectively concealed the origin of cryptocurrency, making it nearly impossible to trace specific coins back to their source.

Since its creation in 2016, Cryptomixer facilitated the mixing of over EUR 1.3 billion in Bitcoin, serving as the platform of choice for criminals involved in:

  • Ransomware attacks
  • Drug trafficking
  • Weapons trafficking
  • Payment card fraud
  • Various cybercrime operations

The service was particularly popular among ransomware groups, underground economy forums, and dark web marketplace operators seeking to launder their illegal proceeds before converting them to other cryptocurrencies or fiat currency through exchanges, ATMs, or bank accounts.

International Cooperation

The operation was coordinated through Europol's Joint Cybercrime Action Taskforce (J-CAT), hosted at Europol's headquarters in The Hague, Netherlands. Europol's cybercrime experts provided crucial support throughout the operation, including:

  • Coordinating involved partners
  • Hosting operational meetings
  • Providing on-the-spot forensic assistance during the action day
  • Facilitating information exchange between law enforcement agencies

Participating Authorities

Germany:

  • Federal Criminal Police Office (Bundeskriminalamt)
  • Prosecutor General's Office Frankfurt am Main, Cyber Crime Centre

Switzerland:

  • Zurich City Police (Stadtpolizei Zürich)
  • Zurich Cantonal Police (Kantonspolizei Zürich)
  • Public Prosecutor's Office Zurich

International Agencies:

  • Europol
  • Eurojust

Pattern of Enforcement Against Crypto Mixers

This operation continues law enforcement's targeting of cryptocurrency mixing services. In March 2023, Europol supported the takedown of ChipMixer, which was then the largest mixing service in operation.

The ChipMixer Precedent

The ChipMixer operation resulted in:

  • Four servers seized
  • Approximately 1,909.4 Bitcoins confiscated in 55 transactions (about EUR 44.2 million)
  • 7 TB of data recovered
  • Evidence suggesting the platform laundered 152,000 Bitcoins (approximately EUR 2.73 billion)

ChipMixer had operated since mid-2017 and facilitated money laundering for ransomware groups including Zeppelin, SunCrypt, Mamba, Dharma, and LockBit. The service was also connected to dark web markets, illicit goods trafficking, child sexual exploitation material procurement, and stolen cryptocurrency assets.

The Broader Fight Against Crypto Money Laundering

These consecutive takedowns demonstrate law enforcement's increasing capability to identify, infiltrate, and dismantle cryptocurrency mixing services despite their sophisticated obfuscation techniques. The operations send a clear message to cybercriminals that anonymity services are not beyond the reach of international law enforcement cooperation.

As cryptocurrency continues to play a central role in cybercrime operations, authorities are developing more sophisticated methods to trace illicit funds and identify the infrastructure supporting criminal activity. The seizure of massive datasets during these operations provides investigators with valuable intelligence that may lead to further investigations and arrests.

For cybersecurity professionals and compliance officers, these operations underscore the importance of implementing robust transaction monitoring systems and maintaining awareness of emerging money laundering typologies in the cryptocurrency space.

Source: Europol Press Release

Read more