Skip to content

Mixer / Tumbler

Definition

A service that pools cryptocurrency from multiple users, exchanges it, and returns equivalent amounts to different addresses, intentionally breaking the transaction graph. CoinJoin is the non-custodial Bitcoin variant. Mixers are used to obscure fund flows and are a primary counter-tracing technique investigators must recognise and work around.

Function
Pools and exchanges cryptocurrency to break the transaction graph
Non-custodial Bitcoin variant
CoinJoin
Purpose for users
Obscuring fund flow
Relevance
Primary counter-tracing technique investigators must address

Common questions

How does a mixer actually break the transaction graph that investigators rely on?+

Standard blockchain tracing follows funds by linking sending and receiving addresses across transactions. A mixer pools funds from many users and pays out equivalent amounts from a shared pool to new addresses, severing the direct on-chain link between a specific input and its corresponding output.

Is CoinJoin fundamentally different from a custodial mixing service?+

Yes. CoinJoin is a non-custodial protocol where participants jointly construct a single transaction with multiple inputs and outputs without ever handing custody of their coins to a third party, while a custodial mixer takes control of funds and independently decides what to return, introducing a counterparty and trust risk that CoinJoin avoids.

Can investigators ever trace funds successfully through a mixer?+

It is harder but not always impossible. Techniques such as timing analysis, amount correlation, clustering heuristics, and exploiting mixer implementation weaknesses have de-anonymised some mixing transactions in past cases, though success depends heavily on the specific mixer's design and the investigator's available tooling.

Related terms

Address Clustering
A technique that groups blockchain addresses likely controlled by the same entity. The most common method uses the common-input-ownership heuristic: all input...
Blockchain Explorer
A web interface or API that indexes a blockchain and allows queries by address, transaction hash, or block. Examples: Blockstream.info for Bitcoin,...
KYC (Know Your Customer)
The identity verification process that regulated exchanges and virtual asset service providers (VASPs) are legally required to perform before allowing users to...
UTXO (Unspent Transaction Output)
The fundamental accounting unit of the Bitcoin protocol. Each transaction consumes previous UTXOs as inputs and creates new UTXOs as outputs. The...
VASP (Virtual Asset Service Provider)
The Financial Action Task Force (FATF) term for businesses that exchange, transfer, or custody cryptocurrency on behalf of customers. VASPs are subject...

Explained in

Your journey to becoming a forensic professional starts here.

Practice with mock tests, learn from structured notes, and get your questions answered by a global forensic community, all in one place.