Europol has taken down the illegal cryptocurrency mixing service ‘Cryptomixer’, which is suspected of facilitating cybercrime and money laundering. During the operation, which was conducted in conjunction with Swiss and German law enforcement, €25m ($30m) worth of the cryptocurrency Bitcoin was seized. Action took place between 24-28 November 2025 in Zurich, Switzerland.
Three servers were seized, along with the cryptomixer.io domain. The operation resulted in the confiscation of over 12 terabytes of data. After the illegal service was taken over and shut down, law enforcement placed a seizure banner on the website.[1]
The law enforcement effort has resulted in Cryptomixer being shut down. Cryptomixer was a hybrid mixing service accessible via both the clear web and the dark web. It facilitated the obfuscation of criminal funds for ransomware groups, underground economy forums, and dark web markets. Its software blocked the traceability of funds on the blockchain, making it the platform of choice for cybercriminals seeking to launder proceeds from a variety of criminal activities, including drug trafficking, weapons trafficking, ransomware attacks, and payment card fraud. Since its creation in 2016, over €1.3bn ($1.5bn) in Bitcoin has been mixed through the service, according to Europol.
See: https://redskyalliance.org/xindustry/a-mixer-is-not-a-teenager-s-dance
Mixing services, such as Cryptomixer, offer their clients anonymity and are often used before criminals redirect their laundered assets to cryptocurrency exchanges. This allows ‘cleaned’ cryptocurrency to be exchanged for other cryptocurrencies or fiat currency at cash machines or via bank accounts.
In March 2023, the ChipMixer cryptocurrency mixer was targeted by a joint investigation led by German and US authorities with the support of Europol, Belgium, Poland and Switzerland. The operation took down ChipMixer infrastructure and seized four servers, 7TB of data, and 1909.4 Bitcoins ($47.3m) in 55 transactions.
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators-of-compromise information via a notification service (RedXray) or an analysis service (CTAC). For questions, comments, or assistance, please get in touch with the office directly at 1-844-492-7225 or feedback@redskyalliance.com
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://register.gotowebinar.com/register/5207428251321676122
[1] https://www.infosecurity-magazine.com/news/europol-takes-down-illegal/
Comments