A mixer makes stolen cryptocurrency harder to follow. It does not make it untraceable. Investigators trace mixers by combining on-chain patterns (amounts, timing, address behavior) with off-chain evidence such as exchange records. The result is usually a probability-weighted lead that grows stronger as evidence stacks up, not a single yes-or-no answer. This guide explains how that works, what the odds look like, and what you should do if your funds went through one.
TL;DR
- A mixer pools funds from many users and pays them out to new addresses, which breaks the obvious link between sender and receiver.
- Tracing through a mixer relies on pattern analysis, wallet fingerprinting and what happens after the funds leave, especially when they reach an exchange.
- Results are graded by confidence. A well-documented report explains which links are strong and which are inferred.
- Speed and records matter: transaction hashes, wallet addresses and communications you save now shape what an investigator can prove later.
- If you are in the U.S., report to the FBI’s IC3 and keep your original evidence. Be wary of recovery services that charge up-front fees.
Table of Contents
- What a crypto mixer does to a transaction trail
- How investigators trace funds through a mixer
- Connecting a mixer exit to a person or a scam
- How certain can a mixer trace be?
- What affects the chance of recovery
- Perspective: why we trace past the mixer
- What to preserve and report if you were scammed
- Get a mixer trace built for legal use
- FAQ
- Sources
What a crypto mixer does to a transaction trail
The U.S. Secret Service describes mixers as services that conceal transactions by commingling funds from various sources, which makes investigations and seizures harder for law enforcement. The UN Office on Drugs and Crime gives the mechanical picture: coins from multiple sources go to one address, are mixed, then split into portions and sent to different addresses. The process may repeat several times before the funds reach their final destination.
On an ordinary blockchain, anyone can follow a payment from wallet A to wallet B. A mixer inserts a pool in the middle. Many deposits go in, many withdrawals come out, and the direct line between a particular deposit and a particular withdrawal is cut or blurred.
Centralized and decentralized mixers
The Secret Service’s advisory separates two models:
- Centralized mixers take cryptocurrency from one user and return the same amount, minus a fee, drawn from another user’s deposit. They may also retain clients’ IP addresses, which matters a great deal if the operator is ever seized.
- Decentralized mixers combine customer transactions through a peer-to-peer or coordinated method and reallocate funds individually to each sender. On Bitcoin this is done with the CoinJoin protocol.
Smart-contract privacy pools work on a similar principle. The St. Louis Fed explains that users deposit the same amount of an asset into a pool, and later anyone who contributed can withdraw to a fresh address. Third parties can still see which addresses deposited and which withdrew, but with a large enough group they cannot link a specific depositor to a specific withdrawal.
That last detail is the starting point for investigators: the pool is visible. Only the pairing is hidden.
Why scammers and thieves use them
Mixers have lawful privacy uses, but they also attract stolen money. The same St. Louis Fed primer cites analytics-firm estimates that almost 30% of the funds deposited to Tornado Cash came from illicit activity, and notes that hack proceeds, some allegedly linked to the North Korean Lazarus group, were deposited there. The international J5 group of tax enforcement agencies lists sending to or receiving from mixers as a risk indicator for virtual asset activity.
In August 2022, the U.S. Treasury’s OFAC sanctioned Tornado Cash and more than 40 associated addresses, accusing it of facilitating the laundering of $7 billion in virtual currencies since 2019. If you want the legal side of mixer use, our guide Are Bitcoin Mixers Illegal? covers it.
How investigators trace funds through a mixer
No single trick defeats every mixer. Analysts work through layers of evidence, and each layer either supports or weakens a hypothesis about where the money went.
1. Map everything before the mixer
The first job is to establish the full path from the victim’s wallet to the mixer deposit. That means every hop, split and consolidation, with transaction hashes and timestamps. Thieves rarely send stolen funds straight into a mixer. They often route through intermediate wallets, swaps and bridges first, and those intermediate steps carry the most identifying behavior. Our walkthrough of how to trace the flow of funds in crypto explains this stage in detail.
2. Analyze deposits and withdrawals around the pool
Once funds enter a mixer, analysts look at what the pool exposes publicly: deposit amounts, withdrawal amounts, timing gaps and fee patterns. The questions are practical. Did a withdrawal of a similar size appear shortly after the deposit? Did the same actor use the same pool repeatedly? Did withdrawals land at addresses that were funded from the same place?
These signals are heuristics, not proof. Each one has cases where it fails, which is why analysts combine several and document the reasoning. Larger transactions are generally easier to follow, and Andrew Fierman of Nansen has said that each additional mixing layer adds complexity to following the trail.
3. Look for behavior that gives a mixer away
Some services try to look like ordinary traffic. A DFRWS 2025 paper by Jan Zavřel studied a Bitcoin tumbler that tried to hide with ordinary-looking transactions. Using wallet fingerprinting, it identified 344 service addresses and 461 customer addresses from a single starting point. Customer withdrawals could then be followed directly into well-known online services.
The takeaway is that small technical habits, such as how a wallet constructs transactions, can link addresses that look unrelated. The author also notes that the method needs wider testing and validation, which is a reminder that findings should be stated with the confidence they actually deserve.
4. Follow the exit
Money that stays inside a mixer is useless to a thief. Eventually it has to be cashed out, swapped, or spent, and that is where investigators regain visibility. Withdrawals frequently end up at exchanges, payment processors or swap services. Our guide on exchange-to-exchange tracing shows how those hops are followed, and the page on tracing crypto to a bank account covers the final conversion to cash.
For readers who want a look at the research side of linking mixer addresses and tracing mixer withdrawals to exchanges, that overview of digital investigation work is a good companion.
Connecting a mixer exit to a person or a scam
On-chain evidence tells you where funds moved. It does not tell you who controlled the wallets. Attribution needs off-chain information.
| Evidence type | What it can show | Where it comes from |
|---|---|---|
| Transaction hashes and addresses | The exact path of funds and timing | Your own records, wallet history, block explorers |
| Exchange account records | The identity behind a deposit address | Exchange compliance teams, usually through legal process |
| Mixer operator data | Possibly client IP addresses, for centralized services | Seized servers or law enforcement action |
| Communications | How the scammer made contact and which identifiers they used | Chat logs, emails with full headers, phone logs |
| OSINT findings | Usernames, domains and handles that recur across scams | Public records and open-source research |
The FBI asks victims for much of this: cryptocurrency addresses, amounts, transaction hashes, dates and times, and details such as how the scammer made contact, platforms used, web domains and phone numbers. The better your starting file, the more an analyst can do with it.
This is also where OSINT investigations and digital attribution matter. A wallet cluster becomes much more meaningful when it connects to a domain, a social handle or an exchange account that appears in other complaints.
How certain can a mixer trace be?
Honest forensic work grades its own conclusions. A trace through a mixer is rarely a single certain line. It is a set of findings with different strengths.
Academic work gives a sense of the scale. A USENIX Security 2025 study tested commercial blockchain analytics attribution against ground-truth data from three seized illicit services, including the BestMixer mixing service. It found accuracy with a reliable lower bound between 24.54 and 94.85 percent and very few false positives, under 0.5 percent. Two lessons follow. Attribution coverage varies a lot by service and changes over time. And when a label is applied, it tends to be right.
This is why a report built for legal use should:
- separate confirmed facts (the victim’s transaction, the deposit to the mixer) from inferences (the likely withdrawal);
- name the method behind each inference;
- record the date of the analysis, since attribution data changes;
- preserve the underlying data so another expert can review it.
Methods and tool coverage also evolve as mixer protocols change, so analysis should be current as of the engagement. We cover what makes this kind of work stand up in court in Admit Blockchain Evidence in U.S. Court and Wallet Activity Analysis: 6 Checks Forensic Analysts Need for Court.
What affects the chance of recovery
Tracing a mixer is a means to an end. Recovery usually depends on whether funds can be located at a service that can freeze or return them, or whether authorities can act on the findings.
The Bybit theft shows how this plays out at scale. Decrypt reported that 88.87% of the stolen assets remained traceable, 7.59% had gone dark, and 3.54% had been frozen through coordination with exchanges. Bybit’s CEO called decoding mixer transactions the number one challenge the company faced. Even in a case where a mixer was in play, most of the funds stayed visible and some were stopped.
Enforcement can also change the picture. In December 2025, German and Swiss authorities, with Eurojust and Europol, took down a mixing service and seized more than EUR 25 million in cryptocurrency, after it was suspected of laundering proceeds from fraud and other crimes. Seized servers can hold the data that links deposits to withdrawals.
Factors that tend to help a case:
- Speed. Funds that have not yet been cashed out are the ones that can still be frozen.
- Clean records. Hashes, addresses and timestamps recorded at the time of the theft.
- Size and pattern. Larger, distinctive transfers are easier to follow than many small ones.
- A visible exit. A deposit at a regulated exchange gives investigators and law enforcement someone to ask.
No investigator can promise recovery. What a thorough trace can do is turn “the money vanished into a mixer” into a documented account of where it went and who may be able to act.
Perspective: why we trace past the mixer
Victims are often told that once funds touch a mixer, the case is over. We see it differently. A mixer is one stage in a longer path, and the stages before and after it leave evidence that a mixer cannot erase.
Our approach goes deeper than basic wallet tracking. We analyze detailed transaction patterns on public blockchains, reconstruct asset flows that pass through mixers and bridges, and connect wallet activity to wider fraud networks. Then we put the findings in a forensic report designed for legal proceedings, with each conclusion tied to its supporting data.
We work directly with law firms, and we keep the process transparent for the victim. You should always know what has been established, what is inferred, and what the next step is.
If your funds went through a mixer, the most useful thing you can do is bring us your records early. Our blockchain forensics work starts from what you have and builds outward.
cristian
What to preserve and report if you were scammed
If your funds were stolen and you suspect a mixer is involved, these steps protect your case.
- Stop sending money. The FBI advises victims to stop payments, file a report at ic3.gov, and avoid telling the suspected criminals about the FBI’s involvement, since that can compromise an investigation.
- Record the on-chain facts. Save wallet addresses, transaction hashes, amounts, asset types, dates and times.
- Keep original evidence. IC3 does not collect attachments, so the FBI says victims should keep original documents in a secure location. That can include crypto receipts, chat transcripts, phone logs, emails with full headers and hard drive images. Our guides on digital evidence preservation and crypto chain of custody explain how to do this properly.
- File a complaint with the FBI’s IC3. The FBI encourages it even where no loss occurred. If you are 60 or older, the National Elder Fraud Hotline can help you file. Our page on what to report to trigger police crypto investigations lists what U.S. victims should include.
- Be careful with recovery offers. The FBI warns victims to be wary of cryptocurrency recovery services, especially those charging an up-front fee.
For a longer sequence, our 24 to 72 hour checklist covers the first days in detail.
Get a mixer trace built for legal use
If your stolen funds passed through a mixer, Recovera Forensics can analyze the transaction trail, document wallet activity, and prepare a technical report suitable for legal proceedings. Our cryptocurrency scam investigation and evidence preservation services are open to individual victims. Law firms can work with us through our professional services for legal offices.
FAQ
Can you trace crypto after it goes through a mixer?
Often you can trace what happens before and after the mixer, and sometimes link specific deposits to withdrawals using timing, amount patterns and wallet fingerprinting. The conclusions come with levels of confidence rather than certainty. The strongest results usually come when the exit reaches an exchange or other service with identity records.
How does a mixer make crypto harder to trace?
It pools coins from many users and pays them out to new addresses, sometimes in smaller pieces and over several rounds. This breaks the visible link between the sender and the final receiver. The pool itself and the addresses entering and leaving it remain public on the blockchain.
Can mixed funds be recovered?
Sometimes. Recovery depends on finding the funds at a service that can freeze them, or on law enforcement acting on the evidence. In the Bybit case, 3.54% of the stolen assets were frozen through exchange coordination, and most of the rest remained traceable at the time of reporting. No one can guarantee an outcome.
What should I give an investigator?
Give them wallet addresses, transaction hashes, amounts, dates and times, plus any messages, emails, domains, usernames and phone numbers connected to the scammer. Keep the originals untouched. The more complete the file, the more an analyst can connect.
Sources
- Public Advisory: Cryptocurrency Mixers (U.S. Secret Service)
- Money laundering through cryptocurrencies (UNODC)
- Tornado Cash and Blockchain Privacy: A Primer (St. Louis Fed)
- Virtual Assets Risk Indicators (J5)
- The Distributed Ledger (Skadden)
- Tumbling down the stairs (DFRWS 2025)
- Ghost Clusters (USENIX Security 2025)
- Bybit Hackers Turn to Crypto Mixers (Decrypt)
- Cryptocurrency mixing service taken down (Eurojust)
- Cryptocurrency (FBI IC3)
- FAQ (FBI IC3)
- Cryptocurrency Investment Fraud (FBI)
