Europol-backed operation shuts down Cryptomixer, seizes bitcoin worth €25 million
Police in Germany and Switzerland shut down Cryptomixer, one of the largest bitcoin mixing services, and seized bitcoin worth more than €25 million, Europol announced on Dec. 1.
Mixers pool cryptocurrency from many users and pay it back out in randomized transactions, which makes it harder to trace the money. Ransomware gangs use them to clean extortion payments, so removing a major mixer raises the cost of cashing out.
What was seized
The takedown ran from Nov. 24 to 28 under Operation Olympia, with support from Europol and Eurojust. According to The Record and CyberScoop, investigators seized three servers in Switzerland, the cryptomixer.io domain and more than 12 terabytes of data. The site now displays a seizure notice warning users and operators that they may face investigation.
Outlets converted the seized bitcoin to between about $28 million and $29 million (U.S.). Europol said the service had handled more than €1.3 billion in bitcoin since it launched in 2016, much of it tied to criminal activity. Europol described Cryptomixer as a platform of choice for ransomware groups, payment card fraudsters and drug and weapons traffickers, and said it was "intentionally built to hide the movement of money on the blockchain."
Context
Cryptomixer ran on both the open web and the dark web. It succeeded ChipMixer, which German and U.S. authorities took down in 2023 after seizing about $46.5 million (U.S.) in bitcoin. In May 2025, German police seized infrastructure belonging to the eXch exchange and confiscated more than $30 million (U.S.).
Analysts caution that the mixing business is resilient: when one service disappears, criminals tend to move to others. The 12 terabytes of seized data could, however, give investigators information about past users.
Mixers have also figured in state-linked laundering. CyberScoop cited TRM Labs research on North Korea's Lazarus Group, which stole about $1.46 billion (U.S.) in Ethereum from the Bybit exchange in February 2025 and laundered $160 million within two days. TRM researchers said North Korea now appears to favour speed and automation over traditional anonymity tools.
U.S. authorities have targeted mixers before through sanctions, including Blender.io and Tornado Cash in 2022. The Cryptomixer action relied instead on seizing the service's servers and domain, which takes it offline for everyone rather than only for users in sanctioning countries.
What we don't know yet
Authorities did not announce any arrests or name the people behind Cryptomixer. They also did not say whether Canadian users or Canadian ransomware victims' payments were traced through the service.
