Crypto Mixers Explained with Real Blockchain Data

‍

Summary

• A crypto mixer is a service that commingles coins from many users in one shared pool and pays out matching amounts to fresh addresses, preventing an observer from linking individual deposits to withdrawals.
• Custodial mixers maintain full control over deposits, while smart-contract mixers like Tornado Cash let you prove ownership of a deposit and withdraw it without leaving an on-chain link between the two addresses.
• Using a mixer is not illegal in itself, but U.S. authorities have historically sanctioned mixers, jailed their operators and continue to prosecute Tornado Cash's developer, Roman Storm.
• Deposits and withdrawals stay public, so timing, amounts, small pools and exchange off-ramps often allow investigators to link funds on either side of the mixer.

Tracing a Hacker Using a Crypto Mixer

You can interact with the transfers window below to find out more about each transaction. Click the blue timestamp next to each transfer to open a TXID explorer page.

‍

On September 24, 2026, attackers drained the crypto casino Duelbits’ hot wallets on Ethereum, BNB Chain, Tron and Bitcoin. The casino’s co-founder put the loss at roughly $7 million. Arkham’s data shows the stolen tokens arriving in one ETH wallet within minutes, brought in from other chains through bridges such as Relay and deBridge. 

Two days later, the mixing began. Between September 26 and 28, two Duelbits Hacker wallets made 20 deposits into Tornado Cash, totaling 1,370 ETH, or about $3.6 million at the time. On September 28, one wallet sent 12 deposits of exactly 100 ETH in about ten minutes, then six deposits of 10 ETH.

The round numbers are the important part. Tornado Cash only accepts fixed amounts, so the hacker’s ETH sits in the same pools as everyone else’s deposits. After that, the connection between the old wallets and the new wallets is severely weakened, although it is not completely severed, as we will find out below.

What Is a Crypto Mixer?

A crypto mixer is a tool that obfuscates the on-chain trail between the address that sends funds and the address that finally receives them. Think of dropping a marked banknote into a crowded collection box and later drawing out a different note of the same value. The box knows you contributed, but not which note you took home. In the context of crypto mixers, any user can see who deposits into a mixer service and which addresses receive funds from it, but the mixer makes it hard to link the depositors with the recipients. Mixers are also referred to as tumblers or blenders.

Mixers are used for a variety of reasons, with the two main reasons being money laundering and privacy. On a transparent ledger, paying someone can reveal your balance and history, so some users cover their tracks through mixers for ordinary financial privacy. The same feature appeals to thieves and launderers who want to separate stolen funds from the crime. In August 2022, the U.S. Treasury said Tornado Cash was used to launder more than $7 billion since 2019.

How Do Crypto Mixers Work?

Mixers come in two broad designs.

Custodial mixers are run by an operator. The user sends their coins to an address the service controls, and after a delay, it sends the user an unrelated output of the same value, minus a fee, to an address that they chose. Bitcoin Fog, ChipMixer and Sinbad all operated this manner. The main weakness in a custodial mixer lies in trust. The operator holds your funds and can see both ends of every transfer.

Non-custodial mixers replace the operator with smart contracts. Tornado Cash is a set of Ethereum smart contracts that hold pools of fixed sizes, such as 0.1, 1, 10 or 100 ETH. A depositor puts in one fixed amount and receives a secret note. Later, from a fresh wallet, they present a zero-knowledge proof showing the note matches some deposit in the pool, without revealing which. The contract pays out without an on-chain link between the two addresses.

The fixed deposit denominations matter. By limiting the denominations possible, it reduces the likelihood of linking a specific deposit amount to a withdrawal or withdrawals adding up to the same value. This group of possible owners is called the anonymity set, and the larger it grows, the harder any single withdrawal is to pin down.

‍

The live feed above shows the Tornado Cash entity on Arkham. Deposits arrive in the fixed deposit sizes from a range of unrelated addresses, and withdrawals leave in the same round sizes to different addresses, with nothing on the page tying one to the other. As of October 2026, Tornado Cash holds close to $860M in assets, with the majority of it in ETH.

Key Transactions That Used Mixers

The three cases below show funds entering a mixer or a cross-chain swap service shortly after a theft.

Ronin Bridge Exploit (2022)

‍

‍

In March 2022, attackers drained about $624 million from the Ronin bridge, which connected Ethereum to the Ronin L2. When the Treasury sanctioned Tornado Cash that August, it cited more than $455 million, linked to this exploit, that North Korea's Lazarus Group had stolen and laundered through the mixer. Arkham's records show the exploit's proceeds moving from the exploiter's wallets into several other Lazarus Group wallets, before being deposited into Tornado Cash.

WazirX Exchange Exploit (2024)

‍

‍

On 18 July 2024, a hacker drained more than $235 million from WazirX, then one of India's largest centralized exchanges. After about six weeks of silence, Arkham recorded the hacker's address sending $6.3 million in ETH to Tornado Cash, nearly emptying that wallet. The stolen ETH were proceeds from swapping over 190 different crypto tokens from the exchange’s reserves, to prevent freezing of the funds, before being deposited into the mixer. This is a common modus operandi for Lazarus Group attacks.

Bybit Exchange Exploit (2025)

‍

‍

On February 21, 2025, roughly $1.5 billion in ETH and ETH-based tokens were stolen from the Bybit centralized exchange. Instead of a classic mixer, the hackers, which were identified as Lazarus Group hackers, leveraged cross-chain bridges, including THORChain, to obfuscate their on-chain trail. Arkham tracked over $1 billion laundered through it, mostly into native Bitcoin. While hopping chains break a single-chain trace, both legs of each swap stay public and can be traced by investigators.

Are Crypto Mixers Legal?

In the U.S., using a mixer is not a crime in itself, but running one, or moving criminal proceeds through one, can be. The Tornado Cash saga shows how unsettled the line has been.

August 8, 2022: The Treasury's Office of Foreign Assets Control (OFAC) sanctioned Tornado Cash, adding its smart contract addresses to the sanctions list and barring U.S. persons from using them.

November 26, 2024: In Van Loon v. Department of the Treasury, the Fifth Circuit ruled that OFAC had exceeded its authority, because immutable smart contracts are not property that can be blocked.

March 21, 2025: The Treasury lifted the sanctions, while saying it would keep targeting malicious cyber actors and North Korea's revenue streams.

August 2025: A jury convicted Tornado Cash co-founder Roman Storm on one count tied to unlicensed money transmitting and deadlocked on money laundering and sanctions charges. A retrial on those two counts is set for April 26, 2027, with his acquittal motion still pending.

Custodial mixers have fared worse. In March 2023, U.S. and German authorities took down ChipMixer, which prosecutors say laundered more than $3 billion, including over $700 million in stolen funds. In November later that year, OFAC sanctioned Sinbad for processing funds stolen by the Lazarus Group. In November 2024, Bitcoin Fog operator Roman Sterlingov was sentenced to more than 12 years for laundering over $400 million, mostly darknet proceeds, between 2011 and 2021. 

The regulatory push has also eased in places. In October 2026, FinCEN withdrew its 2023 proposal to treat mixing as a class of primary money laundering concern, citing worries about “a chilling effect on legitimate activity”, though it acknowledges the use of mixers by illicit actors.

In practice, the bigger risk for ordinary users is commercial, not criminal. Exchanges screen deposits for exposure to mixing services, and Arkham's risk scores include it as a category. Mixed funds can trigger a compliance review, a delayed withdrawal or a frozen account.

Why Mixed Funds Are Still Traceable 

A mixer only hides the link inside the pool, so investigators work with transactions on the edges. A deposit followed soon after by a same-sized withdrawal narrows the anonymity set to a handful of candidates, and a pool with little traffic offers less cover to begin with. Arkham's Tornado Cash research notes that after the 2022 sanctions cut volume, sleuths matched withdrawals to exchange deposits more easily.

Fresh recipient wallets also required funding for gas fees, and that first transfer can point straight back to an already known address. Most of all, stolen funds eventually have to be spent or cashed out, and the exchanges that convert crypto to cash often require some level of KYC. Tools like Arkham's Tracer follow funds to those exits, which is where blockchain forensics usually connects an address to a real-world identity.

Conclusion

Mechanically, mixers do what they promise: inside the pool, one deposit looks like any other. But the pool sits on a public ledger, with every deposit and withdrawal recorded, and the exchanges where funds finally land are closely watched. Mixing only makes the on-chain trail harder to follow, but not impossible.