Crypto Mixing Is Back — And Criminals Adapted Faster Than The Rules Did

Overview

Recent research from the Cambridge Centre for Alternative Finance (CCAF) indicates a resurgence in the usage of crypto mixers, returning to levels seen before regulatory actions against tools like Tornado Cash. This trend highlights a significant shift in user behavior, revealing that ordinary users seeking privacy were more affected by the sanctions than criminals.

The Resurgence of Crypto Mixers

In 2022, US crypto regulators implemented a crackdown on Tornado Cash with the intention of eliminating illicit activities associated with it. However, this approach did not yield the expected results. Instead of deterring criminals, the sanctions primarily pushed compliant users away from using these tools. According to CCAF researchers Wenbin Wu and Keith Bear, the total number of crypto mixer transactions reached approximately 32,000 in 2025, marking a notable increase from roughly 21,000 in 2024 and 16,000 in 2023. This resurgence in usage coincided with the US Treasury lifting sanctions against Tornado Cash on March 21, 2025.

Railgun’s Dominance in the Market

Among the various mixing protocols, Railgun has emerged as the dominant player, accounting for 71% of all mixer transaction volume in 2025. Tornado Cash contributed to around 25% of transactions, while Privacy Pools held the remaining 5%. Both Railgun and Privacy Pools have attempted to filter out known bad actors by screening deposits against lists of flagged addresses. However, CCAF reports indicate a significant gap in this filtering process; blacklists are updated only when new exploits are discovered, which allows a window of opportunity for funds from newly flagged addresses to slip through.

The Impact of Sanctions on Users

The 2022 crackdown on Tornado Cash led to an immediate and drastic decline in its daily transactions, which plummeted by 97% within days. The broader mixer market experienced a volume drop of 45%. However, the impact of these sanctions was uneven. CCAF’s findings suggest that while compliant users were deterred from using mixers, illicit actors quickly adapted by moving to alternative platforms, cross-chain bridges, and decentralized exchanges.

Deposit patterns further illustrate this shift. Prior to 2022, centralized exchanges—which require identity verification—accounted for a significant portion of mixer funding. Following the ban, these deposits largely disappeared. By 2025, an astounding 95% of all crypto mixer funding originated from unlabeled wallet addresses with no recorded entity ties, a sharp rise from 76% in 2020.

Changes in Transaction Timing

Another notable change in user behavior is the timing of transactions. Before the sanctions, most mixer activity occurred more than 24 hours after wallet creation. This pattern has reversed, with researchers noting that most transactions now happen within 24 hours. This shift is interpreted as users seeking to avoid identification. It is also important to note that a 2023 paper from the Federal Reserve Bank of St. Louis found that only about 30% of Tornado Cash traffic could be linked to illegitimate sources, underscoring that privacy tools also serve lawful purposes.

From Author

The findings from the CCAF research shed light on the complexities surrounding the use of crypto mixers and the unintended consequences of regulatory actions. The data suggests that regulatory efforts to curb illicit activities in the crypto space can have the paradoxical effect of driving legitimate users away while allowing criminals to adapt. As more users seek privacy, it raises questions about the balance between regulation and the need for financial anonymity.

Impact on the Crypto Market

• The resurgence of crypto mixers indicates a growing demand for financial privacy among users.
• Regulatory efforts may inadvertently create gaps that criminals exploit, complicating the effectiveness of such measures.
• The shift in funding sources to unlabeled wallet addresses highlights a trend towards anonymity in the crypto space.
• The increase in rapid transactions may signal a strategic move by users to evade identification and scrutiny.
• The findings suggest a need for regulators to reassess their approaches to effectively address both illicit activities and the rights of compliant users.