Traditional mixers are losing market share, while cross-chain bridges, no-KYC swaps, and guarantee networks are gaining ground. What this means for crypto forensics (2022–2026).
Whitepaper 2026
Executive Summary
Mixers (tumblers) obscure the origin of crypto assets by pooling coins from different users and paying them out in newly combined amounts—thus breaking the direct on-chain link between depositor and recipient. With non-custodial protocols like Tornado Cash, this is achieved through zero-knowledge proofs, meaning no operator controls the funds.
The decline is a result of targeted prosecution and sanctions against the key services:
| service | Enforcement measure | time | Result |
|---|---|---|---|
| Tornado Cash | US sanctions; co-founder Roman Storm convicted | Aug 2022 · Aug 2025 | Sanction overturned in court in March 2025 — deterrence remained in place |
| ChipMixer | Dismantling by US and German authorities | March 2023 | 7 TB of data & > $46 million seized; operator convicted |
| Blender.io / Sinbad | Sanctioning (Atomic, Axie, Horizon hacking fees) | Nov 2023 | 2 out of 3 suspected operators arrested in Dec 2024 |
Chainalysis summarizes the consequence: Either criminal actors currently lack a trustworthy mixer, or they resort to less sophisticated—but harder to attack—concealment strategies. Both are true in practice.
| Key figure | Period | Value / Source |
|---|---|---|
| Decline in mixer-related activity | 2024 → 2025 | -37 % (TRM Labs) |
| Growth in bridge activity | 2024 → 2025 | +66 % (TRM Labs) |
| Share of hack money via Bridges | H1 2025 | 50.1 % ~$1.5B (Elliptic) |
| Share of hack money via mixers | H1 2025 | ≈ 11 % ~$339M (Elliptic) |
| Total illegal on-chain volume | 2025 | ≥ 154 billion USD · +162 % YoY (Chainalysis) |
| Share of stablecoins in the illegal volume | 2025 | 84 % (Chain Analysis) |
| Sales of Chinese-speaking lingerie networks | 2025 | $16.1 billion · 1,799 wallets (Chainalysis) |
Important for context: The decline is relative, not absolutely harmless. Mixers continue to be used—primarily by actors without access to more efficient alternatives or for smaller amounts; moreover, new, smaller mixer successors are constantly emerging outside US/EU jurisdiction.
Classic mixers have not been replaced by alternatives that are fundamentally harder to detect, but rather by faster, more liquid and more fragmented alternatives:
| Technology | How it works | Forensic relevance |
|---|---|---|
| Cross-Chain Bridges | Value transfer between blockchains (e.g. via THORChain); high liquidity, speed, often no identity verification. | Bridge transaction patterns & cross-chain tracing instead of output clustering. |
| No-KYC instant swaps | Crypto-to-crypto exchange without identification; integral part of the Lazarus/DPRK laundry chain (e.g., eXch, discontinued in 2025). | Fast replacements; focus on swap endpoints and connecting wallets. |
| Huione / Guarantee Networks | „Laundering-as-a-Service“ via Telegram marketplaces (Cambodia); ≥ USD 4 billion processed, cumulative > USD 31 billion. | Identify aggregation/guarantee platforms; displacement rather than elimination. |
| Privacy Coins (Monero) | ~87 % of criminal Privacy Coin transactions are in XMR; ransomware payments in Privacy Coins +27 % (IOCTA 2025). | Delistings make access more difficult; watch THORChain-XMR-Swap (2026) as a new bridge. |
| Peel Chains / Wallet Hopping | Automated distribution across thousands of intermediate wallets to Cluster-to make analyses more difficult. | Pattern and time series analysis; aggregation points at the end of the chain. |
| Stablecoins & Modularization | 84 % of the illegal volume; LaaS providers each take on one step (procurement, laundering, cash-out). | Cross-border stablecoin flows; issuer freeze as leverage. |
Huione & Chinese-speaking networks. FinCEN Huione was classified as a "primary money laundering concern" in May 2025; in June 2026, the DOJ seized its backend infrastructure. Despite the shutdown, the surrounding ecosystem continues to grow (US$16.1 billion in revenue in 2025) — an example of displacement rather than elimination.
Privacy Coins. Monero remains dominant (~87 % of criminal privacy coin transactions, ~58 % of the market capitalization of this class). Major exchanges have delisted XMR; a native THORChain-Monero swap announced for 2026 could facilitate the bridge between transparent chains and XMR again.
The largest crypto hack to date, with a value of approximately USD 1.5 billion — the Lazarus Group / Attributed to DPRK — illustrates the new laundry logic. Classic mixers played only a minor role in this chain.
Traditional mixers have lost significant market share compared to 2021/2022—primarily due to sanctions and prosecutions against centralized platforms. They have been replaced by faster, more liquid, and more fragmented alternatives. For forensic practice, this means a shift in the focus of analysis—while the overall volume of activity under investigation is simultaneously increasing.
The focus of the analysis is shifting from mixer output clustering to... Cross-chain tracing, bridge transaction patterns and the identification of aggregation/guarantee platforms.
Speed is key. The Bybit case shows laundry in under 48 hours — track protection, bridge monitoring and off-ramp focus must take effect immediately.
Off-ramps and regulated contact points remain the lever. Where assets meet regulated exchanges or stablecoin issuers, documentable reasons and hedging opportunities arise.
More volume, not less work. The total volume of illegal activity is growing — the need for reliable, legally sound prosecution is increasing accordingly.
The accuracy of individual privacy coin percentage figures varies significantly more between providers than Chainalysis/TRM/Elliptic figures and should be cited with caution. As of July 19, 2026.
David Lüdtke
Managing Director · OSINT-Analyst & Crypto Forensic Expert · Finanz Forensik GmbH
Court-admissible crypto transaction analysis, OSINT-based asset investigation, and expert reports for defense attorneys, insolvency administrators, and companies. Certified Crystal Expert (CECF, CEEI, CEUI). Finanz Forensik Supports law firms, companies, investigative bodies and insolvency administrators — focus areas: Blockchain forensics, wallet analysis, court-admissible documentation, OSINT.
We conduct cross-chain tracing, reconstruct bridge and peel chain patterns, and identify regulated touchpoints for disclosure, freeze, and asset protection.
