Decentralized Mixers

Decentralized (or DeFi) mixers rely on peer-to-peer protocols, smart contracts, or other distributed architectures instead of a single custodian, allowing users to aggregate and shuffle their deposits—often via CoinJoin-like features—to obscure traceable links between inputs and outputs. Because no central entity holds custody or transaction records, investigators face significantly more complexity in mapping illicit funds to their origin. Criminals favor these services to reduce regulatory exposure and enhance anonymity, leveraging the absence of standardized KYC and the self-executing nature of smart contracts. In particular, non-custodial mixers remove any single operator that law enforcement can compel to freeze funds, further frustrating seizure or intervention efforts. Many of these decentralized platforms limit or entirely omit compliance controls, and some are specifically designed to cater to illicit use by enabling large-scale laundering with minimal scrutiny.

[
Code
T0003.002
]
[
Name
Decentralized Mixers
]
[
Version
1.0
]
[
Parent Technique
]
[
Tactics
]
[
Risk
Product Risk, Channel Risk
]
[
Created
2025-02-06
]
[
Modified
2025-04-02
]

Decentralized Mixer

Coinswap Service

DeFi Mixers

Tactics

ML.TA0007
|
|

Decentralized mixers combine and redistribute crypto funds through peer-to-peer protocols and smart contracts, explicitly obscuring the transaction trail and making it more difficult for investigators to connect illicit proceeds to their criminal source. This is a core layering strategy that distances criminal proceeds from their origin.

Risks

RS0002
|
Product Risk
|

Decentralized mixers are fundamentally anonymity-focused services with a non-custodial architecture and self-executing smart contracts that inherently thwart oversight. Criminals exploit these features to obscure fund flows and evade conventional AML controls, making product-level anonymity the primary vulnerability.

RS0003
|
Channel Risk
|

This technique exploits an emerging unregulated peer-to-peer (P2P) DeFi channel, eliminating any central intermediary or custodian subject to AML oversight. By transacting across decentralized smart contracts, criminals circumvent typical KYC requirements, frustrating seizure and tracing attempts. This represents a distinct secondary risk due to the unregulated delivery method.

Indicators

IND00720
|

Absence of verifiable identity data or compliance oversight for funds transferred via non-custodial smart contracts, aligned with minimal or nonexistent KYC processes.

IND00721
|

Rapid cross-chain transfers immediately following mixing transactions, where funds quickly move to decentralized exchanges or other platforms, indicating layering of transactions.

IND00758
|

Transactions routing funds through smart contract addresses known to function as decentralized mixers, where funds from multiple sources are pooled and then redistributed.

IND00759
|

Multiple small deposits from various unrelated wallets into a single mixer address followed by rapid, fragmented withdrawals to diverse wallets.

IND00801
|

Frequent and consistent usage of decentralized mixing services by a wallet with no apparent economic or operational rationale.

IND01011
|

A network of wallet addresses linked solely by their participation in the same mixing pools, lacking legitimate commercial or personal ties.

IND01012
|

Irregular or random deposit and withdrawal intervals from decentralized mixers, with time delays designed to evade transaction tracing.

Data Sources

  • Provides detailed logs of user and transaction data from regulated or semi-regulated exchanges.
  • Enables tracing of funds as they move between decentralized mixers and VASP accounts, bridging on-chain activity with identifiable account holders.
  • Assists investigators in linking suspicious on-chain mixer transactions to real-world user profiles maintained by VASPs.
  • Contains verified identity data (e.g., names, addresses, beneficial owners, risk profiles) for customers.
  • Enables investigators to identify customers with incomplete or suspicious KYC profiles who transact with decentralized mixers.
  • Assists in tracing real-world identities behind wallet addresses linked to mixer activity, highlighting potential illicit use.
  • Provides comprehensive on-chain transaction details, such as transaction IDs, timestamps, sender and receiver wallet addresses, and amounts.
  • Enables identification of known decentralized mixer smart contracts or aggregator addresses used for mixing.
  • Facilitates analysis of cross-chain layering activity after mixers, helping uncover suspicious address clusters or transaction patterns.

Mitigations

For customers identified as frequently transacting with decentralized mixers, require detailed information on the source and purpose of funds. Validate identity details through additional documentation or interviews, and conduct deeper checks against open-source intelligence or specialized blockchain data to ensure legitimate usage. This heightened scrutiny targets the anonymity risk inherent in DeFi mixers and helps uncover illicit behavior.

Implement targeted rules and real-time alerts to flag deposits or withdrawals from decentralized mixer smart contract addresses, focusing on transactions lacking identifiable commercial rationale or showing cross-chain layering patterns. By promptly identifying unusual activity linked to known mixers, institutions can investigate or apply additional controls before funds are further laundered.

Use specialized blockchain analytics solutions to track transactions to or from known decentralized mixer addresses, analyze cross-chain bridging or aggregator usage that might indicate layering, and promptly escalate suspicious patterns for further investigation. This measure provides advanced insight into the flow of funds, enabling institutions to identify hidden connections and reduce the anonymity provided by decentralized mixing protocols.

Continuously collect intelligence on emerging decentralized mixers by obtaining wallet addresses flagged by law enforcement or reputable blockchain analytics providers. Cross-check customer or transaction data against these external sources to identify undisclosed connections to high-risk mixers, ensuring that suspicious activities are flagged or investigated promptly.

Restrict or block transactions to and from wallet addresses associated with high-risk decentralized mixer services, or require manual compliance approval for such transactions. By limiting direct access to known mixer pools, institutions can deter attempts to launder funds and prompt further review for potentially illicit activity.

Instruments

  • Decentralized mixers can enhance the anonymity of privacy coins by pooling multiple sources of funds, including swapped or bridged privacy coins, making it nearly impossible to trace specific inputs.
  • The absence of centralized control or compliance checks in these mixers amplifies the privacy-centric features of these coins, frustrating efforts to identify originating wallets or ultimate beneficiaries.
IN0027
|
|
  • Criminals exploit the widespread DeFi acceptance of stablecoins by depositing them into decentralized mixing contracts, blending them with legitimate users’ funds and concealing the criminal proceeds.
  • Because stablecoins maintain a consistent fiat-equivalent value, illicit actors can layer transactions and preserve their holdings’ value, complicating proactive detection or freezing of tainted assets.
  • Criminals deposit publicly traceable cryptocurrencies (e.g., Bitcoin, Ethereum) into decentralized mixers, which combine multiple user inputs into aggregated transactions, obscuring the trail of funds on the blockchain.
  • Because there is no single controlling entity, no KYC measures exist to verify users, facilitating the anonymous placement and withdrawal of illicit funds.
  • This mixing process severs the on-chain link between sending and receiving addresses, enabling layering by splitting or merging illicit proceeds among numerous outputs, thwarting investigators’ efforts to link the funds to their origin.
  • Criminals wrap assets (e.g., BTC to WBTC) to access Ethereum-based or multi-chain DeFi mixers, leveraging cross-chain interoperability to break direct ties to the original blockchain.
  • After mixing, they can unwrap the tokens, effectively disconnecting the final destination addresses from the initial deposit addresses, hindering transactional forensics across multiple networks.

Service & Products

  • Criminals deposit illicit proceeds into non-custodial smart contracts that automatically shuffle funds among multiple participants, obscuring transaction links.
  • The absence of centralized oversight and standard KYC processes allows perpetrators to bypass conventional AML checks, making it challenging to trace the origin of funds.
  • By relying on peer-to-peer protocols and removing a single operator, these services further complicate investigative efforts and frustrate attempts to freeze or seize tainted assets.

Actors

Professional money launderers use decentralized mixers to:

  • Deposit and blend illicit proceeds within non-custodial smart contracts, breaking traceable links between input and output addresses.
  • Evade centralized oversight or intervention by eliminating a single operator or custodian.

These actions frustrate financial institutions' AML efforts by reducing visibility into transaction flows and hindering timely freezes or seizures of tainted funds.

Virtual asset users engage decentralized mixers to:

  • Combine their digital assets with others in peer-to-peer or smart contract pooling, obscuring transaction trails.
  • Circumvent KYC requirements by transacting in non-custodial architectures with minimal compliance controls.

This practice complicates financial institutions’ monitoring of transactions and hampers investigations linking funds back to illicit or high-risk sources.

References

  1. Moiseienko, A., Izenman, K. (2019, September). From intention to action: Next steps in preventing criminal abuse of cryptocurrency. Royal United Services Institute for Defence and Security Studies. https://www.rusi.org/explore-our-research/publications/occasional-papers/intention-action-next-steps-preventing-criminal-abuse-cryptocurrency

  2. O'Neill, A. (2024). Upholding North Korea Sanctions in the Age of Decentralised Finance. Royal United Services Institute for Defence and Security Studies.https://static.rusi.org/north-korea-sanctions-and-cryptomixers-op-march-2024.pdf

  3. Kenneth, S.(2023) The Satoshi Laundromat: A Review on the Money Laundering Open Door of Bitcoin Mixers. Journal of Financial Crime, Vol. 31 No. 2, pp. 416-426, 2024 DOI: 10.1108/JFC-11-2022-0269, Available at SSRN: https://ssrn.com/abstract=4281625 or http://dx.doi.org/10.2139/ssrn.4281625

  4. Polismyndigheten, Nationella operativa avdelningen. (2022). Penningtvätt och finansiering av terrorism med kryptovalutor (PMY Rapport). Polismyndigheten, Nationella operativa avdelningen. https://polisen.se/siteassets/dokument/finanspolisen/rapporter/penningtvatt-och-finansiering-av-terrorism-med-kryptovalutor.pdf

  5. Izenman, K. (2021, September). Counterproliferation financing for virtual asset service providers. Royal United Services Institute for Defence and Security Studies. https://static.rusi.org/299_SR_CPF_VirtualAssetsGuide.pdf

  6. CGMF (Interdepartmental coordinating group on combating money laundering and the financing of terrorism) Switzerland. (2024). National Risk Assessment (NRA): Risk of money laundering and the financing of terrorism through crypto assets. CGMF. Switzerland. https://www.newsd.admin.ch/newsd/message/attachments/86329.pdf