Law enforcement agencies in Switzerland and Germany have dismantled Cryptomixer.io, one of the largest illicit Bitcoin-mixing services in Europe.
The operation took place from November 24 to 28 in Zurich, with Europol providing cross-border support.
Authorities confiscated three servers, the cryptomixer.io domain, over EUR 25 million in Bitcoin, and more than 12 terabytes of data. A seizure notice (as shown below) now occupies the website. Investigators believe this disruption will generate new leads related to ransomware groups, dark web markets, and international money-laundering operations.
Cryptomixer was established in 2016 and quickly became a preferred platform for cybercriminals aiming to obscure their activities, according to Europol. The service was available on both the clear web and dark web, drawing users from ransomware groups, underground forums, and online drug markets.
Mixing services function by aggregating user deposits, shuffling them over lengthy, randomized intervals, and redistributing them to new addresses. This technique obscures the on-chain trail, complicating efforts for analysts to trace specific coins.
Authorities report that Cryptomixer facilitated the movement of more than EUR 1.3 billion in Bitcoin for clients looking to cleanse criminal funds. The service was often utilized before transferring assets to exchanges, ATMs, or banks.
German federal investigators stated that the operation generated “billions of euros in revenue,” much of which was linked to illegal activities. The Frankfurt Prosecutor General’s Office and the German Federal Criminal Police Office (BKA) coordinated efforts with Zurich city and cantonal police to execute the on-site operation.
Europol and Eurojust received assistance from The Hague.
Details of the Cryptomixer Shutdown
On the day of the operation, Europol dispatched cybercrime specialists to Zurich for forensic support and real-time coordination. The agency emphasized that its Joint Cybercrime Action Taskforce was vital in connecting investigators from different countries.
Europol also highlighted parallels with its 2023 takedown of ChipMixer, which was the largest mixer dismantled at that time.
Swiss authorities remarked that the data volume seized—exceeding 12 terabytes—will be essential for mapping broader criminal networks. Investigators suspect it contains transaction logs, operational documents, and communication records that may connect various cybercrime groups.
Cryptomixing services have long been scrutinized for facilitating ransomware payments, drug trafficking, weapons sales, and payment card fraud.
Regulatory bodies and authorities from the EU and U.S. have increasingly targeted mixers promoting anonymity. Notable precedents include sanctions and legal actions against the founders of Tornado Cash in both the U.S. and the Netherlands.
Germany’s BKA indicated that the insights gained from Cryptomixer will aid in investigating additional cybercrimes. Both nations have suggested that further actions against cryptocurrency-laundering infrastructures could follow as forensic teams analyze the confiscated servers and blockchain data.
