Cryptomixer Taken Down by Europol, German, Swiss, and Global Authorities

Key takeaways

• International operation dismantles cryptomixer: Cryptomixer, a major cryptocurrency mixing service used to launder illicit funds, was taken offline in a coordinated enforcement action by authorities from Germany, Switzerland, and Europol, with support from Eurojust and US law enforcement.
• Core infrastructure seized: Authorities seized the service’s backend servers in Zurich, took control of its domain, and removed access to both clear web and dark web versions. More than EUR 25 million in cryptocurrency was also confiscated.
• Extensive intelligence yield expected: Investigators secured approximately 12 terabytes of data, including transaction records, logs, and wallet clusters, enabling future attribution, asset tracing, and network mapping across jurisdictions.
• One of the longest-running mixers: Cryptomixer had operated since 2016 and processed over EUR 1.3 billion in Bitcoin, serving a wide range of criminal entities including ransomware actors, darknet vendors, and organized crime networks.

{{horizontal-line}}

On November 26, 2025, Europol announced that, in cooperation with law enforcement authorities from Germany and Switzerland and with support from Eurojust, it dismantled the cryptocurrency mixing service Cryptomixer following a coordinated international enforcement operation conducted between November 24 and 28, 2025. 

The action was led by German and Swiss authorities, including the Frankfurt and Zurich Public Prosecutors’ Offices and Germany’s Federal Criminal Police Office (BKA), with additional support from Europol, Eurojust, and US law-enforcement partners.

TRM Labs is proud to support the BKA and other European partners in the fight against cybercrime and money laundering. 

The action targeted the core infrastructure of the platform. Investigators seized three servers in Zurich hosting Cryptomixer’s backend systems, took control of the cryptomixer.io top-level domain, which is now the splash page for “Operation Olympia,”and rendered the service inaccessible on both the clear web and the dark web, where it had been actively promoted to criminal users. 

Authorities also seized more than EUR 25 million in cryptocurrency directly connected to the platform’s laundering activity and secured approximately 12 terabytes of operational data from the seized servers. The data set includes extensive transaction records, wallet cluster mappings, internal service logs, application files, and user-interaction metadata, which are now being preserved and analyzed for investigative use.

Cryptomixer operated as a hybrid cryptocurrency tumbling service that pooled deposits from multiple users into aggregated wallets and redistributed funds through smaller, randomized transactions sent to newly generated recipient addresses after variable time delays. The method was designed to break visible blockchain links between criminal proceeds and their beneficiaries, complicating tracing and attribution efforts. 

According to Europol, the service had been active since 2016 and processed more than EUR 1.3 billion worth of Bitcoin during its years of operation, positioning it among the longest-running and highest-volume laundering services dismantled to date. Investigators determined the platform was routinely used by a wide range of criminal networks — including ransomware groups, darknet marketplace vendors, organized drug- and weapons-trafficking operations, payment-card fraud rings, and other cybercrime actors — to launder digital assets prior to cross-border movement, fiat conversion, or reinvestment into additional criminal activity.

The takedown also produced a substantial intelligence yield expected to drive follow-on investigations across Europe and partner jurisdictions. The 12 terabytes of seized data will support efforts to reconstruct historic laundering flows, identify and map service users, link wallet clusters to real-world suspects, trace downstream financial movements, locate additional assets for seizure, and dismantle affiliated criminal money-movement networks. 

Europol confirmed that multi-agency analysis is already underway, with investigative leads anticipated to extend well beyond the immediate shutdown of the service and contribute to a broader campaign targeting crypto-enabled financial infrastructure supporting organized crime.

The Cryptomixer takedown marks another major action in the ongoing campaign by the BKA, Europol, and their international partners to dismantle cybercrime infrastructure across Europe and beyond. In its own public statement, the BKA highlighted a series of recent high-impact disruptions targeting criminal platforms and services that facilitate online fraud, ransomware, and financial-crime networks. These include operations against nulled.to, cracked.io, Dostat.cc, ChipMixer, Kingdom Market, and multiple additional exchanges and digital services tied to organized cybercrime operations. Together, these actions reflect a sustained and coordinated enforcement effort focused on attacking the financial and technical backbone that enables illicit activity online.

{{horizontal-line}}

Frequently asked questions (FAQs)

‍What is Cryptomixer and why was it targeted?

‍Cryptomixer was a cryptocurrency tumbling service designed to obscure blockchain transaction trails. Authorities dismantled it due to its extensive use by cybercriminals to launder illicit funds.

‍Who led the enforcement operation?

‍The action was led by German and Swiss law-enforcement agencies, including the Frankfurt and Zurich Public Prosecutors’ Offices and the BKA, with support from Europol, Eurojust, and US partners.

‍What data was seized and how will it be used?

‍Investigators obtained 12 terabytes of operational data, including transaction logs and wallet mappings. This intelligence will support follow-on investigations, asset tracing, and user attribution efforts.

How does this takedown fit into broader trends?

‍This operation follows a pattern of international actions against cybercrime infrastructure, including previous takedowns of ChipMixer, Kingdom Market, and others, reflecting a coordinated push to disrupt illicit crypto services.

‍