Crypto mixers: how they work and what their trace in a wallet history means

A crypto mixer, or tumbler, is a service that blends the funds of many users so that an incoming transfer cannot be tied to an outgoing one on-chain. For blockchain analytics this is the point where the trail ends: everything before the pool is known, everything after it is not. That is why a mixer trace in a wallet history almost always means a high risk assessment — including cases where the owner of that wallet never used a mixer at all.

What a crypto mixer is and why people use one

Motives differ. Privacy is a legitimate interest in itself: a public ledger shows the balance and the entire transaction history to anyone who knows the address, and not everyone is willing to disclose their finances to counterparties. But the same mechanism makes mixers the primary laundering tool for stolen funds.

Risk assessment does not distinguish between those motives. It sees one fact: the funds went through a service designed to destroy traceability.

Three types of mixers

They are built differently, and that changes what analytics can see.

None of them makes the funds invisible. What they make impossible is verifying where the funds came from — and for compliance those are not the same thing.

Why a mixer produces the highest risk

Risk assessment is built on traceability: analytics walks the chain of transfers backwards and looks at where the money has been. A known bad source is bad, but it can be measured: the category, the share and the depth of the link are all clear. A mixer answers that question differently — it gives no answer at all.

For compliance procedures, an unverifiable origin is worse than a known bad one. Hence the maximum scores and the hard reaction from platforms.

The scale is visible in sanctions cases. When it sanctioned the Sinbad.io mixer, the U.S. Department of the Treasury described it as a key money-laundering tool of the North Korean Lazarus group: the service processed funds from the $100M Atomic Wallet theft, the roughly $620M Axie Infinity hack and the roughly $100M Horizon Bridge attack.

More on what AML in cryptocurrency is — in a separate articleRead more

If you never used a mixer but the label is there

This is the most common scenario for ordinary holders. The label appears not because of anything you did, but because the coins arrived along a chain where a mixer sat earlier.

How it happens:

1. 1. A P2P purchase from a seller who received the coins from a counterparty with that history.
2. 2. An exchange through a service without verification: it blends the flows of all its clients, and you receive funds from the common till.
3. 3. A payout from a service that does not track the source of its own incoming funds.

The difference between direct and indirect links matters here. Direct means your address received funds straight from a mixer address. Indirect means several intermediate transfers sit between you and the pool. The more intermediate steps and the smaller the share of such funds in the total volume, the weaker the effect on the final assessment. One transfer from a mixer and 0.5% of the same source five steps away are fundamentally different situations, even though the report shows the same category.

Sanctions and legal status: why delisting does not remove the label

Using a mixer is not universally prohibited — regulation differs across jurisdictions. But individual services have faced both sanctions and criminal enforcement: Blender.io and Sinbad.io were added to sanctions lists, and criminal cases were built around Bitcoin Fog and ChipMixer.

Tornado Cash is the instructive case. The U.S. Department of the Treasury removed the service from the sanctions list on 21 March 2025, following the Fifth Circuit ruling in Van Loon, where the court held that immutable smart contracts are not «property» within the meaning of the statute applied. In the same announcement the department stressed that it continues to monitor transactions that may benefit malicious actors and the North Korean regime.

Regulation of the category itself is a separate track. In the United States, FinCEN proposed designating convertible virtual currency mixing as a class of transactions of primary money laundering concern, with additional reporting requirements for financial institutions.

What a mixer trace looks like in a report

In an address report this is not one line but three parameters at once:

• Source category — mixers form a separate category, usually with maximum weight.
• Share of funds — what percentage of incoming funds is linked to that category.
• Depth of the link — how many transfers separate your address from the pool.

All three matter. The headline number without the breakdown says almost nothing: it looks the same for a direct transfer from a mixer and for a years-old trace far down the chain.

What to do if a trace is found

For a business the order is different: the operation is paused, proof of source of funds is requested, and the decision and its grounds are recorded. That is what monitoring connected through an API is for, rather than checking addresses by hand.

How to check your address

A check takes less than a minute and shows not only the final assessment but the breakdown by source, with shares and depth of links. We show the result from several providers at once: Crystal Intelligence, VALEGA Chain Analytics and BitOK. Providers use different label sets, so the discrepancies between them are extra information rather than a nuisance.