Europol Authorities Bust $1.4B Cryptomixer, Seizing $27M and 12TB of User Data

Europol and law enforcement agencies in Germany and Switzerland have shut down one of Europe’s largest illicit crypto-mixing operations, seizing €25 million ($27 million) in Bitcoin and confiscating more than 12 terabytes of user data.

The takedown, announced on December 1, marks one of the most extensive actions yet under the EU’s ongoing effort to dismantle services that obscure the flow of criminal funds.

Six-Year-Old Crypto Laundering Service Taken Offline

The operation took place between November 24 and 28 in Zurich, with Europol supporting authorities on the ground throughout the action week.

Investigators seized three servers, took control of the cryptomixer(dot)io domain, and replaced the site with a law-enforcement seizure banner.

According to Europol, the platform, known as “Cryptomixer,” functioned as a hybrid mixing service on both the clear web and the dark web.

Since its launch in 2016, the service has processed more than €1.3 billion in Bitcoin linked to a wide range of illegal activity.

Authorities say the mixer was used heavily by ransomware groups, underground cybercrime forums, and operators on dark-web markets.

Its software pooled deposits for long, randomized periods, then redistributed funds to new addresses designed to break transaction trails.

This method helped conceal proceeds of drug trafficking, weapons trafficking, payment-card fraud, and cyberattacks, allowing criminals to convert “cleaned” assets back into other cryptocurrencies or fiat currency through exchanges, ATMs, and bank accounts.

Europol coordinated intelligence sharing through its Joint Cybercrime Action Taskforce and provided forensic specialists during the raids.

The agency has been involved in several major anti-mixing operations in recent years, including the March 2023 takedown of ChipMixer, then the largest service of its kind.

The shutdown comes as the EU tightens its anti-money-laundering framework ahead of major regulatory deadlines. Under new AML rules tied to MiCA, crypto-mixing services are banned across the bloc, and anonymity-enhancing coins such as Monero and Zcash will be prohibited by 2027.

Crypto-asset service providers are required to apply strict KYC checks, identify the sender and receiver of all transfers, and conduct enhanced due diligence on transactions above €1,000.

These measures aim to close regulatory gaps that have historically allowed laundering networks to operate across borders with minimal oversight.

Europol Leads Wave of Digital Crime Takedowns as Mixer Scrutiny Grows

The enforcement climate around mixers has intensified globally. In January 2025, a U.S. federal grand jury indicted three Russian nationals accused of running Blender(dot)io and its successor, Sinbad(dot)io, mixers the Department of Justice says were used by the North Korean Lazarus Group.

In November, a New York court sentenced Samourai Wallet co-developer Keonne Rodriguez to five years in prison after prosecutors said the service laundered more than $237 million in illicit funds.

The ruling has accelerated scrutiny of privacy-focused and non-custodial crypto tools.

Notably, Samourai Wallet’s chief technology officer, William Lonergan Hill, was also sentenced to four years in federal prison for his role in the mixer activities.

The Cryptomixer takedown also arrives during one of Europol’s most active enforcement years in the digital-crime ecosystem.

In October, European investigators dismantled a cybercrime syndicate responsible for creating more than 49 million fake online accounts.

The network provided temporary SIM-based phone numbers that allowed criminals to bypass two-factor authentication and mass-produce fraudulent identities used to exploit exchanges, banks, and e-commerce platforms.

Seven suspects were arrested, and hundreds of SIM servers and routers were seized.

Earlier in June, Europol led raids against Archetyp Market, one of the dark web’s longest-running drug marketplaces.

Authorities seized core infrastructure in the Netherlands and arrested suspects across Europe, though experts noted that operators often regroup on decentralized platforms.