A mixer is a service that pools crypto from many users and pays it back out in a way that breaks the on-chain link between sender and receiver, hiding where funds came from. Some use is for privacy, but mixers are a core laundering tool, so exposure to one is a significant risk flag and, for sanctioned mixers, possibly prohibited.
What is a mixer, in plain English?
A mixer, sometimes called a tumbler, is a service designed to hide the origin of crypto. It takes in funds from many different users, pools them together, and then pays out equivalent amounts in a way that severs the connection between who put money in and who took it out. After mixing, an observer can see that funds went in and came out, but not reliably which input became which output.
Some people use mixers for legitimate privacy, since a public ledger otherwise exposes their entire financial history. But mixers are also a core laundering tool, the go-to step for washing stolen, extorted, or otherwise dirty crypto. Because the two uses look the same on-chain, exposure to a mixer is treated as a significant risk flag, not a conviction on its own.
Mixers range from custodial services, where you trust an operator to hold and return your funds, to decentralized protocols that mix through smart contracts. A crucial distinction for compliance is legal status: some mixers are sanctioned, which can make interacting with them prohibited rather than merely risky.
How a mixer breaks the link
- Deposit — Funds go in. Many users send crypto into the mixer's pool at different times.
- Pool — Everything mingles. Deposits are combined so individual funds lose their distinct trail.
- Withdraw — Funds come out. Users receive equivalent amounts to fresh addresses, unlinked from their deposits.
- Privacy — Legitimate use. A user simply wants their activity kept private.
- Laundering — Illicit use. A criminal washes stolen or extorted funds.
- Assess — Weigh the exposure. Analysts treat mixed funds as lower-confidence and factor in the mixer's status.
Who is involved?
Who | Their role |
The mixer operator or protocol | Pools deposits and pays out to break the on-chain link, whether custodial or decentralized. |
Privacy users | Use the mixer legitimately to keep their financial history private. |
Launderers | Push dirty funds through to obscure their origin before cashing out. |
The analyst | Treats mixed funds as lower-confidence and distinguishes sanctioned mixers from merely risky ones. |
What it looks like in practice
In practice
Shortly after a protocol is exploited, the stolen funds are sent into a mixer. On the other side, funds emerge to fresh addresses that no longer trace cleanly back to the theft. An analyst screening a later deposit finds mixer exposure in its history and lowers confidence in the source accordingly.
Before acting, they check which mixer it was. If it is a sanctioned service, interacting with the funds may be prohibited outright, not just risky, and the response escalates. If it is a merely risky privacy tool, they weigh volume, timing, and the specific mixer's reputation. The distinction between sanctioned and risky changes the whole decision.
Why it matters to operators
Mixers are the classic crypto laundering step, so exposure to one is one of the more serious flags a screening team handles. Mixed funds carry genuinely lower-confidence history, which means a team cannot simply trace them back to a clean origin and move on. That uncertainty is exactly what the launderer bought, and pretending it is not there understates the risk.
The sharpest operator point is the difference between a sanctioned mixer and a merely risky one. A risky mixer raises the score and warrants closer review; a sanctioned mixer can carry legal prohibitions, so touching its funds is a compliance event of a different order. Ignoring that distinction is a real failure mode, so analysts weigh volume, timing, and the specific mixer's reputation and legal status rather than treating all mixing the same.
What to watch in the data
- Deposits into and withdrawals from a mixer. Funds entering or leaving a known mixer are the core exposure to trace and score.
- Sanctioned versus risky. Identify the specific mixer; a sanctioned one can be prohibited, not just elevated risk.
- Lower confidence after mixing. Treat post-mix funds as mixed, with reduced certainty about origin, and record it honestly.
- Volume and timing. Large amounts or mixing right after a theft or ransom payout strengthen the laundering read.
- Custodial versus decentralized. The mixer's design and reputation shape how much weight its exposure carries.
Quick questions
Is using a mixer illegal?
It depends on the mixer and the jurisdiction. Using a mixer for privacy is not inherently illegal everywhere, but some mixers are sanctioned, and interacting with those can be prohibited. Exposure is always a risk flag, and for sanctioned services it can be far more than that.
How is a mixer different from a CoinJoin?
A CoinJoin is one specific privacy technique: a collaborative bitcoin transaction where participants pool into one transaction. Mixer is the broader category of services that pool and redistribute funds, including custodial operators and decentralized protocols. CoinJoin is one approach within that wider space.
Does a mixer make funds untraceable?
It lowers confidence rather than guaranteeing anonymity. Analysts can still trace funds into and out of a mixer and reason about volume and timing. The link between specific inputs and outputs is broken, but the exposure itself is visible and scorable.
Why does a sanctioned mixer matter more?
Because interacting with a sanctioned entity can carry legal prohibitions, not just elevated risk. A merely risky mixer prompts closer review; a sanctioned one can make handling the funds a compliance violation. Always identify which you are dealing with.
How should mixed funds be treated in screening?
As lower-confidence in origin and as carrying a significant risk flag. Weigh the volume, the timing relative to any known incident, and the specific mixer's reputation and legal status before deciding to allow, review, or block.
What is a tumbler?
Tumbler is another name for a mixer; the terms are used interchangeably. Both describe services that pool and shuffle crypto to break the link between sender and receiver.
Go deeper
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.
- OFAC, US Treasury ↗ — Administers US sanctions programs, the SDN list, and licensing.