European regulators are increasing pressure on cybercrime networks as they target services that conceal the movement of digital funds. A coordinated action supported by Europol has taken down Cryptomixer, a long-running platform used to mask crypto transactions on the clear web and the dark web. Authorities report that the site handled more than a billion euros over the past decade and became a prominent method for laundering illicit proceeds.
In brief
- •Swiss and German teams seized Cryptomixer servers, €25M in Bitcoin, and over 12TB of data during coordinated raids.
- •Investigators say over €1.3B in Bitcoin passed through Cryptomixer since 2016, fueling cybercrime networks.
- •Europol, J-CAT, and Eurojust supported intelligence sharing, forensic work, and cross-border legal coordination.
- •Regulators expect more actions targeting crypto mixers as criminal groups lean on anonymizing tools to move illicit funds.
Investigators Trace €1.3B Through Cryptomixer Before Shutting Platform Down
Law enforcement teams from Switzerland and Germany carried out the operation in Zurich between November 24 and 28. Officers seized the cryptomixer.io domain along with three servers that operated the platform.
Europol confirmed that investigators seized more than €25 million in Bitcoin and over 12 terabytes of data during the raids. Visitors to the platform now encounter a seizure banner indicating the shutdown.
Cryptomixer provided technology designed to disrupt the traceability of blockchain transactions, making it difficult for analysts to track fund movements. Cybercriminals relied on the service to wash money from drug and weapons trafficking, bank card fraud, ransomware operations, dark web markets, and underground forums.
According to investigators, more than €1.3 billion in Bitcoin has passed through the service since 2016. Most of these assets were either transferred to exchanges or converted into cash through ATMs and bank accounts.
Authorities worked through Europol’s coordination networks to share intelligence and technical support. The Joint Cybercrime Action Taskforce (J-CAT), based at Europol’s headquarters in The Hague, enabled real-time communication between agencies. Europol also deployed digital forensics specialists on the ground. Meanwhile, Eurojust assisted prosecutors by managing cross-border legal steps.
Crackdowns on Crypto Mixers Mark Shifting Landscape for Privacy Platforms
Recent enforcement actions across Europe have continued to target crypto-mixing operations. In March 2023, Europol assisted in shutting down Chipmixer, a service that processed more than $3 billion during six years of activity. Criminal groups have continued to seek anonymization tools despite these actions.
A recent case involved a 400-ETH transaction linked to North Korea’s Lazarus Group on Tornado Cash, a well-known anonymizing platform. Pressure on Tornado Cash intensified after co-founder Roman Storm was convicted of operating an unlicensed money transmission business.
Prosecutors allege that the site handled $1 billion in funds tied to criminal schemes, though Storm denies having any knowledge of the activity. The jury was unable to reach a verdict on charges related to money laundering and sanctions violations.
Europol’s account of the Cryptomixer shutdown points to several factors that contributed to the operation’s success:
- •Swiss and German investigators collaborated within a shared cybercrime framework.
- •J-CAT coordinated rapid intelligence exchange.
- •Forensic specialists examined the seized digital evidence.
- •Authorities removed servers supporting the site’s clear-web and dark-web infrastructure.
- •Eurojust guided cross-border legal procedures.
Officials expect additional actions against digital anonymity tools as crime networks increasingly adopt crypto-based methods. Data recovered from Cryptomixer is expected to support multiple investigations involving ransomware groups, trafficking operations, and financial fraud rings.
Scrutiny of services that obscure crypto transactions is likely to grow as regulators and law enforcement tighten oversight of digital assets. The takedown of Cryptomixer reflects a broader effort to restrict financial infrastructure that supports cybercrime across Europe.