Raid against Cryptomixer: how one of the largest crypto mixers was shut down

An international operation has shut down the Cryptomixer service. Cryptomixer, a major service used for mixing cryptocurrencies and laundering illegal money, was shut down as a result of a joint operation by law enforcement agencies in Germany, Switzerland, and Europol, with the support of Eurojust and the US authorities.

The service’s key infrastructure has been seized. Law enforcement agencies confiscated servers in Zurich, took over the service’s domain, and completely shut down access to it on both the regular internet and the darknet. More than 25 million EUR in cryptocurrency was also seized.

A large amount of operational data is expected. Investigators obtained approximately 12 terabytes of information, including transaction records, operational logs, cryptocurrency wallet data, and other technical files. All of this will help investigate the activities of criminal networks in different countries.

One of the longest-running mixers, Cryptomixer, had been operating since 2016 and had processed more than 1,3 billion EUR in bitcoin. It was actively used by criminal groups, including extortionists, darknet sellers, drug cartels, arms dealers, and others.

The main trend in cryptocurrency laundering in 2025: cross-chain transfers

Cybercriminals have significantly complicated the process of legalizing illegally obtained cryptocurrency in 2025

Читать дальше

Operation Olympia

Europol reported that, in cooperation with law enforcement agencies in Germany and Switzerland and with the support of Eurojust, it carried out an operation to shut down the Cryptomixer cryptocurrency mixer. The operation took place from November 24 to 28, 2025.

The operation was led by German and Swiss authorities, including the Frankfurt and Zurich public prosecutor’s offices and the German Federal Criminal Police Office (BKA). Europol, Eurojust, and US law enforcement agencies also provided support.

The operation targeted the “core” of the service. Investigators seized three servers in Zurich that ran Cryptomixer’s internal system, took over the cryptomixer.io domain (which now displays the “Operation Olympia” page), and shut down the service on the regular internet and the darknet, where it was actively advertised to criminals.

Cryptomixer homepage after shutdown

Law enforcement also seized over 25 million EUR in cryptocurrency linked to money laundering and got about 12 terabytes of data from servers. This includes transaction records, wallet schemes, internal system logs, application files, and user interaction data. These materials are now being stored and analyzed for further investigation.

North Korean hackers: the complete dossier, description of methods and chronology of cryptocurrency thefts

Over the past few years, North Korea’s cyber units have carried out large-scale operations to infiltrate various structures and steal digital assets

Читать дальше

Cryptomixer operated as a hybrid cryptocurrency mixer, combining the funds of multiple users into a single wallet and then distributing them back in small portions to new addresses with time delays. This method was designed to hide the connection between dirty money and its owners, making it harder to track transactions.

According to Europol, the service had been operating since 2016 and processed more than 1,3 billion EUR in bitcoin. It was regularly used by numerous criminal groups, ranging from extortionists to drug and arms dealers, fraudsters, and cybercriminals. They “laundered” cryptocurrency before transferring it to other countries, exchanging it for fiat money, or using it for further crimes. More than 1,4 million Cryptomixer addresses processed millions of dollars in illegal funds.

Cryptomixer address structure. Visualization: TRM Labs

The shutdown of the service has provided investigators with a huge amount of data that will enable them to launch new investigations in Europe and other countries. The 12 terabytes of information obtained will help to:

• reconstruct money laundering schemes from previous years;
• identify service users;
• link crypto wallets to real people;
• track further movements of money;
• find assets for confiscation;
• destroy related criminal networks.

Europol reported that joint analysis is already underway, and investigations will continue for a long time.

The closure of Cryptomixer was another major blow in the ongoing campaign by the BKA, Europol, and their international partners to destroy cybercriminal infrastructure. The BKA statement lists other recent high-profile operations against criminal platforms involved in online fraud, extortion, and financial crimes. These include nulled.to, cracked.io, Dostat.cc, ChipMixer, Kingdom Market, and other services.

All these actions demonstrate that the fight against illegal cryptocurrency infrastructure is becoming consistent, large-scale, and targeted: law enforcement agencies are attacking the technical and financial foundations on which criminal online networks are based.