Ben Strack

<div id="highlights-block_62542bbc93124" class="highlights">
 <ul>
 <li>Mixing services pool together crypto transactions to obfuscate the fund sources and improve privacy</li>
 <li>Recent crypto seizures by authorities in Florida and Germany involved alleged criminal use of mixers</li>
 </ul>
 
</div>



Crypto services designed to improve transaction privacy continue to be used in illegal activities, but using so-called mixers for nefarious purposes is becoming increasingly risky.&nbsp;



A cryptocurrency mixing service is used to privately transfer cryptoassets between wallets by comingling funds in a pool of assets belonging to many participants.



The hacker who last month <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">exploited the Ronin Network</a> for roughly $625 million recently transferred thousands of ether to Tornado Cash, a privacy tool for Ethereum. More than 165,000 ETH remains <a href="https://etherscan.io/address/0x098b716b8aaf21512996dc57eb0615e2383e2f96" target="_blank" rel="noreferrer noopener">in the attacker’s wallet</a>.



Tornado Cash, a decentralized protocol for private transactions on Ethereum, breaks the on-chain link between source and destination addresses, according to its website. The protocol uses a smart contract accepting ETH deposits that can be withdrawn by a different address. The longer the funds remain in the pool before being withdrawn, the greater the privacy protections.



“While Tornado Cash can be used for illegal activities, like money laundering or tax fraud, many believe that it is a crucial tool for maintaining financial anonymity,” NetSPI Chief Technology Officer Travis Hoyt told Blockworks.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“Due to the nature of mixers like Tornado Cash obscuring transactions, consumers that lack a full understanding of crypto’s security infrastructure may be susceptible to risks such as inadvertent money laundering.”&nbsp;</blockquote>



Also last week, federal prosecutors in Florida seized roughly $34 million worth of crypto and German authorities confiscated about $25 million worth of bitcoin. The alleged criminals in both cases used mixing services to mask transactions.



But obscuring sources of funds through mixers is an increasingly risky option for bad actors, especially when trying to move the large quantities needed to evade sanctions, launder stolen funds or cash out the proceeds of a darknet marketplace, according to Gurvais Grigg, Chainalysis’s global public sector chief technology officer.



“Mixers require the participation of many users inputting comparable amounts of cryptocurrency in order to provide the desired obfuscation, and the liquidity often can&#8217;t support this,” he told Blockworks.&nbsp;



Mriganka Pattnaik, co-founder and CEO at Merkle Science, <a href="https://cms.blockworks.co/how-the-crypto-industry-is-being-stunted/" target="_blank" rel="noreferrer noopener">agreed</a> that mixers, tumblers or privacy coins do not have sufficient liquidity for individuals to move hundreds of millions of dollars in untraceable ways. He noted that cash is still the preferred monetary medium for smart criminals.



<a href="https://cms.blockworks.co/chainalysis-report-illicit-addresses-received-14b-in-2021/" target="_blank" rel="noreferrer noopener">A Chainalysis report</a> published in February found that while illicit crypto transactions reached an all-time high of $14 billion last year, criminal activity’s share of cryptocurrency transaction volume has never been lower.



Grigg noted that Chainalysis’s recently publicized demixing capabilities may further disincentivize mixer usage for illicit purposes. Forbes <a href="https://www.forbes.com/sites/laurashin/2022/02/22/exclusive-austrian-programmer-and-ex-crypto-ceo-likely-stole-11-billion-of-ether/?sh=79e0e367f589" target="_blank" rel="noreferrer noopener">reported</a> in February that Chainalysis has a “previously secret forensics tool” that was able to demix transactions tied to The DAO hack of 2016 and track their output to four exchanges.



A Chainalysis spokesperson declined to share further details about the blockchain data platform’s demixing efficacy.



<h3 class="wp-block-heading">The latest seizures</h3>



Still, alleged criminals are using the mixing services.&nbsp;



A Florida man allegedly used an online alias and made more than 100,000 sales of illicit items and hacked online account information — such as for HBO, Netflix and Uber — on several dark web marketplaces, according to a Monday <a href="https://www.justice.gov/usao-sdfl/pr/united-states-forfeits-millions-cryptocurrency-used-launder-illicit-dark-web-proceeds" target="_blank" rel="noreferrer noopener">statement</a>.



He used “tumblers” — mixing services that pool together multiple cryptocurrency transactions — and illegal dark web money transmitter services to launder one cryptocurrency for another.&nbsp;



The tumbler distributes the cryptocurrency to a designated cryptocurrency wallet at random times and in random increments to obscure the original source of funds, officials said. Law enforcement agents seized various cryptocurrency wallets associated with the illegal dark web conduct.



The seizure came a day before German authorities revealed Tuesday that the country’s Federal Criminal Police Office (BKA) and its Central Office for Combating Internet Crime (ZIT) took down servers of Hydra Market, the world’s largest darknet marketplace. The agencies confiscated about $25 million worth of bitcoin after an investigation that began in August.



Focused on trading illegal narcotics, the Russian-language darknet platform had been accessible through the Tor network since at least 2015. Roughly 17 million customers and 19,000 seller accounts were registered on the marketplace.



According to ZIT and BKA estimates, Hydra Market’s sales amounted to at least 1.2 billion euros in 2020. The “Bitcoin Bank Mixer,” a service for obfuscating digital transactions provided by the platform, made crypto investigations extremely difficult for law enforcement authorities, officials said.



In another case, <a href="https://blog.crypto.com/crypto-com-security-report-next-steps/" target="_blank" rel="noreferrer noopener">funds stolen from Crypto.com</a> in January were reportedly being moved through Tornado Cash, according to <a href="https://twitter.com/peckshield/status/1483246262371557378/photo/1" target="_blank" rel="noreferrer noopener">on-chain data spotted</a> at the time by blockchain security and data analytics company PeckShield.



Tornado Cash co-founder Roman Semenov <a href="https://www.coindesk.com/tech/2022/01/25/tornado-cash-co-founder-says-the-mixer-protocol-is-unstoppable/" target="_blank" rel="noreferrer noopener">told CoinDesk</a> that month that the service was designed to be “unstoppable,” noting that the team has little control over what its users do with the protocol. That means that once non-upgradeable software is deployed on an immutable blockchain like Ethereum, it will operate as long as Ethereum — and by extension the internet — does. The popular <a href="https://cms.blockworks.co/?s=uniswap" target="_blank" rel="noreferrer noopener">Uniswap</a> decentralized exchange is another such example.



A Tornado Cash spokesperson did not return a request for comment.



The ethos behind mixers is to harbor more financial freedom and privacy, bringing cash-like anonymity to otherwise public transaction ledgers, by deliberately making transactions hard to regulate, Hoyt said. Such technology can be used lawfully or unlawfully; the only way to avoid risk completely is to not engage at all.&nbsp;



“While there are a plethora of general resources about crypto available, the industry must prioritize education on the inherent security risks and how to best mitigate these risks,” Hoyt said. “Aside from consumers actively choosing to not utilize mixers, this is the best way to ensure ethical crypto traders remain protected.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

dark web

Newsletter

Blockworks Research