Europol Shuts Down CryptoMixer, Seizes €25 Million and 12 TB of Data
Europol, in cooperation with international partners, has dismantled the cryptocurrency mixer Cryptomixer and seized the equivalent of €25 million in Bitcoin. The service, which had been operating since 2016 and helping criminals obscure the origins of illicit funds, was—according to law-enforcement authorities—used to launder more than €1.3 billion in cryptocurrency. It has now been fully shut down following an operation in Zurich.
Between 24 and 28 November 2025, Swiss and German law-enforcement agencies conducted a coordinated operation in Zurich with Europol’s support. Three servers and the domain cryptomixer[.]io were seized. After investigators took control of the infrastructure, the service’s website began displaying a seizure banner, and authorities gained access to more than 12 terabytes of data and over €25 million worth of Bitcoin.
Cryptomixer functioned as a hybrid cryptocurrency-mixing service, accessible both on the surface web and the dark web. Its primary purpose was to obscure the provenance of funds, rendering transactions nearly untraceable. For this reason, it was heavily used by ransomware groups, dark-forum participants, and operators of black-market platforms.
The service operated using a method typical for mixers: deposits from multiple users were consolidated into a common pool and held there for a variable, randomly determined period. The funds were then redistributed to new addresses at random intervals and in altered proportions. Because many cryptocurrencies rely on publicly accessible transaction ledgers, this form of “mixing” makes tracing individual coins exceedingly difficult and effectively disguises the illicit origins of the money.
Such services often serve as an intermediate stage before funds are moved to cryptocurrency exchanges. After passing through a mixer, the “cleaned” coins can be exchanged for other cryptocurrencies or converted into fiat—via crypto ATMs or bank accounts. For criminals, mixers remain one of the most important tools for laundering proceeds from drug and weapons trafficking, ransomware attacks, and payment-card fraud.
This is not Europol’s first strike against anonymizing-service infrastructure. In March 2023, Europol played a central role in dismantling Chipmixer, then the world’s largest mixer. Now, another of the key global instruments for laundering cryptocurrency—used by cybercriminals for years—has been brought down.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
