Cryptomixer Takedown Seizes $29M and Disrupts EUR 1.3B Laundering Service

Law enforcement agencies have shut down Cryptomixer, a crypto-mixing service that laundered approximately 152,000 BTC (about EUR 1.3 billion) in cybercrime proceeds since 2016, in an operation that seized $29 million in Bitcoin and key infrastructure, mapped to MITRE ATT&CK technique T1650 (Acquire Infrastructure) from a defender’s perspective. Europol announced that Operation Olympia, conducted by German and Swiss authorities with support from Europol and Eurojust, seized three servers in Switzerland and the cryptomixer.io domain, confiscating more than 12 terabytes of data and over EUR 25 million in cryptocurrency. Cryptomixer operated on both the clear and dark web, pooling user deposits and returning "mixed" coins to obscure transaction trails, a model frequently abused by ransomware gangs, dark-web markets, and operators of illegal goods and child exploitation sites. Investigators linked Cryptomixer to transactions from major dark-web markets and ransomware groups including Zeppelin, SunCrypt, Mamba, Dharma, and LockBit, and are probing whether assets tied to a major crypto exchange collapse in 2022 were washed through the platform. The takedown follows Europol’s 2023 support for dismantling ChipMixer, another large mixer service, signaling sustained enforcement pressure on mixing infrastructure. For businesses, particularly exchanges, custodians, and regulated financial institutions, the operation underscores both the risk of exposure to tainted funds and rising expectations from regulators that crypto flows be monitored for mixer interactions. Entities that handled coins passing through Cryptomixer may face questions about their AML controls, transaction monitoring systems, and responsiveness to law enforcement data requests derived from the seized 12 TB of records. Financial institutions and crypto businesses should ensure their blockchain analytics tools and compliance programs are tuned to detect flows involving Cryptomixer and similar services, reviewing historical transactions for exposure and filing suspicious activity reports where appropriate. As law enforcement continues to focus on mixing services, organizations should expect more intelligence-driven scrutiny on high-risk wallets and strengthen KYC, sanctions screening, and transaction monitoring to manage the legal and reputational risk of inadvertently servicing cybercrime-linked funds.