Law enforcement agencies in Switzerland and Germany have shut down Cryptomixer.io, one of Europe’s largest illicit Bitcoin-mixing operations.
The takedown unfolded between Nov. 24 and 28 in Zurich, with Europol coordinating cross-border support.
Authorities seized three servers, the cryptomixer.io domain, more than EUR 25 million in bitcoin and over 12 terabytes of data. A seizure banner (see below) now replaces the site. Investigators say the disruption will fuel new leads tied to ransomware groups, dark-web marketplaces and cross-border money-laundering schemes.
Cryptomixer launched in 2016. It quickly became a go-to service for cybercriminals who needed to hide their tracks, Europol said. The platform operated on both the clear web and dark web. Its hybrid design attracted users from ransomware crews, underground forums and online drug markets.
Mixers work by pooling user deposits, shuffling them for long, randomised intervals and redistributing them to new addresses. The process breaks the on-chain trail, making it difficult for analysts to trace specific coins.
Authorities say Cryptomixer moved more than EUR 1.3 billion worth of bitcoin for clients seeking to wash criminal proceeds. The service was frequently used before funds were pushed to exchanges, ATMs or bank accounts.
German federal investigators said the operation generated “billions of euros in revenues,” much of it tied to illegal activity. The Frankfurt Prosecutor General’s Office and the German Federal Criminal Police Office (BKA) worked alongside Zurich city and cantonal police to lead the on-site action.
Europol and Eurojust had support from The Hague.
Details of the cryptomixer shutdown
On the action day, Europol deployed cybercrime specialists to Zurich for forensic assistance and real-time coordination. The agency said its Joint Cybercrime Action Taskforce played a central role in connecting investigators across borders.
Europol also noted similarities to its 2023 takedown of ChipMixer, at the time the largest mixer ever dismantled.
Swiss authorities said the volume of data seized—over 12 terabytes—will be crucial for mapping wider criminal networks. Investigators believe it contains transaction logs, operational documentation and communication records that may link multiple cybercrime groups.
Cryptomixing services have long drawn scrutiny for enabling ransomware payouts, drug sales, weapons trafficking and payment-card fraud.
Regulators and agencies across the EU and U.S. have increasingly targeted mixers that advertise anonymity. High-profile precedents include sanctions and criminal charges against Tornado Cash founders in the U.S. and Netherlands.
Germany’s BKA said the findings from Cryptomixer “will contribute to the investigation of further cybercrimes.” Both countries signaled that more actions against crypto-laundering infrastructure may follow as forensic teams dig through the seized servers and blockchain data.
