Crypto Mixers: The Bad and the Ugly

From encryption to decentralization features, Bitcoin and other cryptocurrencies have been warmly welcomed by users with a penchant for privacy. While the forefather of cryptocurrency, Bitcoin, isn’t completely anonymous, other popular cryptocurrencies like Monero and Zcash are designed to ensure privacy with the help of sophisticated protocols. A popular method to improve anonymity is mixing, or tumbling. As the name implies, mixing involves pooling together different streams of potentially identifiable cryptocurrencies, and then redistributing them in order to muddle their origins and make the source of the cryptocurrencies harder, and sometimes impossible, to trace.

DASH (originally XCash, then DarkCoin) is one such cryptocurrency that obscures the origins of crypto funds via the CoinJoin mixing protocol to tumble transactions. DASH is a cryptocurrency that offers its users the ability to improve privacy via its PrivateSend function.

Which brings us to the big question— how easy is it to mix crypto?

A quick Google search will tell you that it’s alarmingly easy. From Reddit threads that teach crypto fans how to learn to mix crypto from scratch, to anonymization apps and built-in privacy features on cryptocurrencies, it’s apparent that finding a mixing service is childsplay, even for people who aren’t crypto holders. No, really, a child could enter some keywords and get a list of websites of automated mixing services in no more than three seconds.

One can find many mixing services posted as announcements on Bitcointalk. Bitcointalk was created by Satoshi himself, and is one of the largest online Bitcoin forums to date. The forum has more than three million members registered, and publicizing mixing services there increases their visibility. Information on mixing services is so easily obtained that there are even comparison tables and articles ranking the best one based on ease, reliability and price, like the one in this thesis done regarding the public Bitcoin mixer ecosystem. 

There are also dozens of step-by-step mixing tutorials that teach Internet users how to conceal their transaction trail. These come in the form of free YouTube video courses, paid courses on Coursera, Reddit threads, and other free articles put out by both mixing service providers as well as people who use them. 

Apart from tutorials on finding and using mixers, there are also guides that teach interested individuals how to create a cryptocurrency mixer, advertise their services, and attract investors to grow their mixing business. With open-source codes and ready-made APIs available, creating a mixer service is not only cheap, but can be quick as well.

To make things even simpler, one may discover that some crypto wallets have in-built mixing services like the Wasabi and Samourai wallets. Mobile wallets can be downloaded by anyone with a smartphone, and privacy wallets with mixing services make crypto mixing extremely accessible.

This means that anyone can easily find and use a mixer to break the link between their real-life identity and the cryptocurrencies that they hold.

Who uses mixers anyways?

Improved anonymity through mixed cryptocurrency can appeal to people who value privacy in general. These individuals may also seek anonymity to protect trade secrets so as to not lose their competitive edge. This is not uncommon even in the traditional world, where non-Swiss, law-abiding citizens sought secrecy from Swiss banks, courtesy of the Swiss Banking Law of 1934.

However, lurking in the underbelly of the internet are drug and human traffickers, patrons of child pornography, fraudsters, money-lauderers and other cybercriminals who mix cryptocurrencies to evade detection. Business Email Compromise (BEC) schemes often employ mixers to wash their cryptocurrencies clean. Last month, a hacker who stole an estimated $90 million from Japanese cryptocurrency exchange Liquid sent almost $20 million worth of cryptocurrencies to a non-custodial mixer in a bid to obfuscate their transactions. Because it is significantly more compelling for criminals to attempt to escape detection by washing their tainted cryptocurrencies, it is unsurprising that mixing services are employed by such actors.

Needless to say, mixed crypto leaves us with more than just some mixed feelings.

The legal stance on mixers

While there is no universal law against cryptocurrency mixing specifically as of date, authorities are clamping down on such trail-obfuscating services. In 2019, Europol shut down BestMixer.

Earlier in April, the alleged operator of Bitcoin Fog, the longest-running bitcoin money laundering service on the darknet, was arrested. The mixing service provider allegedly laundered $335 million in cryptocurrency since 2011. Just last month, another operator of mixing service Helix, pleaded guilty to conspiracy to launder money, and faces up to 20 years in prison. Clearly, authorities have made their stance clear on the matter of mixers.

With the barriers to mixing services being almost non-existent, it is a cause for concern for VASPs and exchanges. Smarter criminals frequently employ mixing services to evade detection. Furthermore, by allowing cryptocurrency that has been mixed, it goes against KYC and AML guidelines. In addition, the new FATF travel rule requires exchanges to share both the sender and recipient’s data during transactions. And finally, failure to internally regulate and safeguard against sanctioned governments, terrorists, and criminals using mixed crypto perpetuates such activities, damaging business reputation and goes against moral values in general. Ultimately, digital currency exchanges and crypto-asset service providers may find themselves caught in an expensive (and sometimes legal) crossfire if they are not vigilant in weeding out users who use crypto mixer services.

To stay compliant and prevent being associated with potentially ‘dirty’ cryptocurrency, some exchanges have already taken to screening and banning mixed crypto services from their platform. Binance Singapore and Paxful are two such examples that have taken action against user accounts that were found to have been using mixing services. And with KYC and AML regulations evolving to encompass the realm of cryptocurrency and other virtual assets, it’s likely that exchanges that wish to stay compliant will follow in their footsteps.

Keeping mixed cryptocurrency at bay

Exchanges can detect and monitor accounts using mixing services by integrating software or services that were built to do just that. Some of these software providers can also help meet evolving cryptocurrency regulations by generating compliance reports.

BitRank Verified^® is a blockchain intelligence software that provides fast, easy and accurate real-time monitoring and scoring of transactions and addresses to stop transactions connected to bad actors and sanctioned entities. Each transaction and address is scanned and given a BitRank^® score to provide visibility of how they are utilized, and assess whether they are associated with illicit activities including money laundering. The intelligence software was designed to utilize multiple heuristic and deterministic behavior techniques, including input heuristics for clustering and conjoins, and generates scores for risk assessment and mitigation. 

BitRank Verified^® is sensitive towards transactional behavior indicative of obfuscation of the transaction trail, and examines the association to bitcoin abuse, mixers, and CoinJoin, among other relevant categories, to generate the risk scores. In addition, accounts found to have ties to sanctioned entities will be flagged as having the highest risk immediately. This helps exchanges and VASPs to quickly identify and deal with accounts that use mixing services. Additionally, BitRank Verified^® helps prepare for compliance checks by automating transaction monitoring and generating Enhanced Due Diligence reports.

Given the ease of accessing mixing services, and with regulatory bodies advocating AML, KYC, and the crypto travel rule, exchanges have to be prepared to ensure that their frameworks comply with these regulations, using intelligence software like BitRank Verified^®  or otherwise.