The History of Crypto Mixer and Swap Service Shutdowns

Bitcoin made it possible to send money without a bank, but left a public record of the transfers. Services emerged to make that record harder to follow. Some accepted deposits and returned different coins. Others coordinated transactions between users, or offered a quick exchange into another cryptocurrency.

The enforcement history follows those differences. Authorities have seized custodial servers, prosecuted wallet operators, sanctioned smart contracts, and disrupted exchanges. The legal outcomes range from prison sentences to a successful challenge to sanctions. A closed website tells only part of the story.

This history covers public records checked through November 8, 2026. Amounts use the valuation given in the cited announcement. Charges are allegations until resolved by a plea or judgment. Where a later outcome could not be established, that limit appears beside the case.

Mixing, CoinJoin and swaps are different systems

A custodial mixer receives coins under an operator's control and arranges later payouts. Its customers depend on the operator returning funds and handling records as promised. In CoinJoin, participants construct a transaction together, making ownership relationships less obvious without necessarily handing spending keys to a coordinator. Whirlpool's source documentation identifies it as a CoinJoin implementation.

A smart-contract privacy pool has another structure. Users deposit into a blockchain program and later prove withdrawal eligibility without publicly identifying their deposit. A website or relayer can help users interact with it, but removing that interface need not remove deployed contract code. The Van Loon opinion distinguishes Tornado Cash's immutable contracts from components people could still control.

Service design	What a shutdown can interrupt
Custodial mixer: an operator receives and redistributes funds	Its servers, payout wallets and records can become seizure targets.
CoinJoin coordinator: users collaborate on transactions	Losing the coordinator can stop new rounds without giving authorities every user's private keys.
Contract privacy pool: withdrawal rules run on-chain	Interfaces and operators can be targeted even where immutable contracts remain deployed.
Instant exchange: a service accepts one asset and pays another	Deposits, payouts and the provider's records depend on its infrastructure.
Centralized exchange: customers trade against account balances	Account access and withdrawals depend on the operator and its custody arrangements.

Cross-chain trading is not automatically mixing. An atomic swap links settlement on two blockchains through protocol conditions. A deposit-and-payout exchange instead promises to send the second asset after receiving the first. Our DEX, CEX and instant-swap comparison explains those custody differences.

Timeline of major interventions

The timeline distinguishes arrests and infrastructure seizures from court decisions. The case histories below provide sources and later outcomes.

• July 2017: BTC-e is dismantled around Alexander Vinnik's arrest.
• February 2020: Larry Harmon is arrested over Helix, which operated during 2014 to 2017.
• April 2021: Roman Sterlingov is arrested in the Bitcoin Fog case.
• May and August 2022: U.S. sanctions target Blender.io and Tornado Cash respectively.
• January and March 2023: Bitzlato is disrupted, followed by ChipMixer's international takedown.
• November 2023: Sinbad infrastructure is seized and the service is sanctioned.
• April 2024: Samourai's founders are arrested and its infrastructure is seized.
• March and April 2025: Authorities seize infrastructure belonging to Garantex and eXch. Treasury separately removes Tornado Cash's sanctions.
• July to November 2025: Samourai's founders plead guilty and receive sentences. Storm receives a split jury verdict in August. Cryptomixer.io is taken down in November.
• January to September 2026: A final Helix forfeiture order transfers title to seized assets. Storm's retrial is moved to 2027. The D.C. Circuit affirms Sterlingov's judgment.

Helix and Grams: a mixer linked to darknet markets

Helix operated from 2014 to 2017 alongside Harmon's Grams search service. It offered Bitcoin mixing and integrations with darknet markets. Prosecutors described transactions involving roughly 354,468 BTC, worth about $300 million when processed, with much of that traffic coming from or going to drug markets. That historical throughput is different from a later seizure valuation.

Harmon pleaded guilty to a money-laundering conspiracy in August 2021. On November 15, 2024, he received 36 months in prison and three years of supervised release. The sentencing announcement also records a $311,145,854 forfeiture money judgment. A money judgment sets a financial obligation. It is not a statement that the same amount has already been recovered.

The January 2026 update concerns another stage: on January 21, the court entered a final order giving the government legal title to more than $400 million in previously seized assets, including cryptocurrency and real estate. It was not a new mixer takedown or a second conviction.

BTC-e: an exchange dismantled

BTC-e let customers trade cryptocurrencies and conventional currencies through a centralized exchange. Its shutdown belongs in this history because exchanges can connect opaque flows to account records and spendable money. Its architecture was not a CoinJoin protocol.

The DOJ's account of the case says BTC-e processed more than $9 billion in transactions between 2011 and its July 2017 shutdown. That is total transaction volume, not an established $9 billion theft. Vinnik was arrested in Greece, later extradited to the United States, and pleaded guilty to money-laundering conspiracy in May 2024.

Stopping the history at that plea would give the wrong current picture. A June 2025 court order in the related Klimenka case records that Vinnik's U.S. case was dismissed on February 11, 2025, before sentencing, as part of the prisoner exchange involving Marc Fogel. Dismissal under that arrangement was not an acquittal after trial. Nor does it establish the outcome of every civil claim or co-defendant's case.

Bitcoin Fog: conviction followed by appellate review

Bitcoin Fog offered custodial Bitcoin mixing from 2011. Sterlingov was arrested in April 2021 and convicted by a jury in March 2024 of money laundering and money-transmission offenses. On November 8, 2024, he was sentenced to 150 months, or twelve and a half years. The court also ordered forfeiture, including a money judgment of about $395.6 million and his interest in a Bitcoin Fog wallet.

Sterlingov disputed the identification of him as the operator and challenged expert evidence. On September 25, 2026, the D.C. Circuit affirmed his convictions and sentence. That judgment resolves the appeal described in that opinion. It should not be expanded into a claim that every later review route has ended.

The decision matters beyond the sentence because the dispute included blockchain-analysis evidence. Upholding its admission in this case does not certify every commercial tracing result or establish that every Bitcoin Fog customer was identified.

Blender.io and Sinbad.io: sanctions, then operator charges

Blender and Sinbad accepted Bitcoin for mixing. Treasury sanctioned Blender on May 6, 2022, and Sinbad on November 29, 2023, linking their use to North Korea's Lazarus Group and stolen cryptocurrency. Sanctions restrict dealings within the applicable legal regime. They are not themselves criminal convictions.

Sinbad's infrastructure was seized in a coordinated operation involving U.S., Dutch and Finnish authorities. DOJ announced an indictment in January 2025 charging Roman Ostapenko, Alexander Oleynik and Anton Tarasov with roles in operating the services. Ostapenko and Oleynik had been arrested on December 1, 2024. Tarasov was described as at large in that announcement.

The charges include money-laundering conspiracy and unlicensed money transmission. The reviewed public sources did not establish a later plea, trial judgment or sentence for these defendants. The known record ends with charges rather than judgments.

Bitzlato: the U.S. sentence was not the end of the legal history

Bitzlato was a cryptocurrency exchange. U.S. authorities announced its disruption in January 2023 following the Miami arrest of founder and majority owner Anatoly Legkodymov. French authorities acted against its infrastructure. Prosecutors focused on its handling of illicit funds and inadequate controls, including transactions involving Hydra Market.

Legkodymov pleaded guilty in December 2023 to operating an unlawful money-transmitting business. He agreed to dissolve Bitzlato and relinquish claims to approximately $23 million in seized assets. The plea announcement does not report full repayment of customers.

A June 15, 2026 court report and recommendation records his July 18, 2024 sentence of time served plus two years of supervised release. It also describes later detention and a challenge to extradition to France, recommending that his habeas petition be denied. A magistrate judge's recommendation is not the district judge's final ruling. No later final extradition disposition was verified for this feature.

ChipMixer: seized infrastructure, an alleged operator still listed as wanted

ChipMixer accepted Bitcoin deposits and mixed them with other customers' funds to obscure links to subsequent transfers. On March 15, 2023, authorities announced an international takedown. The DOJ release records the seizure of back-end servers in Germany and more than $46 million in cryptocurrency.

U.S. prosecutors charged Minh Quốc Nguyễn with money laundering, operating an unlicensed money-transmitting business and identity theft. Their allegation that ChipMixer processed more than $3 billion in unlawful transactions is a prosecution claim, not a conviction of Nguyễn or every customer.

The FBI's wanted notice remained available when checked for this article. No verified arrest, plea or trial outcome was located. The service is down, but the reviewed record stops short of an arrest or judgment against its alleged operator.

Samourai Wallet: keys, coordination and criminal liability

Samourai combined a Bitcoin wallet with privacy services. Whirlpool coordinated CoinJoin transactions. Ricochet added intermediate transactions before a payment reached its destination. They should not be treated as the same mechanism.

The 2024 indictment acknowledges that users' private keys were stored on their phones rather than shared with Samourai employees. It also describes servers coordinating transactions and broadcasting Ricochet payments. Users kept their keys while relying on Samourai's infrastructure for those services.

On April 24, 2024, authorities announced the arrests of Keonne Rodriguez and William Lonergan Hill, seizure of servers and a domain, and steps to remove the application from Google's U.S. app store. This disrupted the service without demonstrating that authorities possessed every wallet's recovery material.

Both founders pleaded guilty on July 30, 2025 to conspiracy to operate a money-transmitting business involving criminal proceeds. Rodriguez received five years on November 6, 2025, and Hill four years on November 19. The sentencing release describes more than $237 million in criminal proceeds. No outcome from a later challenge to those judgments was verified.

Tornado Cash: sanctions litigation and criminal prosecution diverged

Tornado Cash used Ethereum smart contracts and zero-knowledge proofs to separate deposits from withdrawals. A proof can show that a withdrawal is authorized without identifying the corresponding deposit to the public. That does not conceal everything about a user's device, network connection or interactions with exchanges.

OFAC first sanctioned Tornado Cash in August 2022. In November 2024, the Fifth Circuit held that its immutable smart contracts were not sanctionable property under the statute at issue. The ruling concerned OFAC's authority over that code. It was not a judgment that money laundering through software is lawful.

Treasury removed the Tornado Cash sanctions on March 21, 2025. The criminal case against developer Roman Storm continued. On August 6, 2025, a jury convicted him of conspiracy to operate an unlicensed money-transmitting business. It did not reach unanimous verdicts on the money-laundering and sanctions-conspiracy counts. Deadlock is neither acquittal nor conviction on those counts.

An August 25, 2026 scheduling order moved the retrial to April 26, 2027, citing the pending acquittal motion and request for a continuance. Independent reporting on the order corroborates that date. No later order disposing of the unresolved counts or changing that schedule was verified in this review. The court can still change a trial date.

Tornado Cash did not simply disappear when its operators faced enforcement. Sanctions, a developer's prosecution and the continued existence of immutable contracts describe different things. The U.S. case also should not be confused with proceedings against other developers in other jurisdictions.

Garantex: domains, databases and frozen funds

Garantex was a centralized exchange sanctioned by the United States in April 2022. In March 2025, authorities targeted its infrastructure and charged Aleksej Besciokov and Aleksandr Mira Serda. DOJ's announcement describes domain seizures on March 6, server seizures in Germany and Finland, and frozen funds exceeding $26 million.

The charges allege money-laundering conspiracy, with additional sanctions and money-transmission counts against Besciokov. Indian officials later reported his arrest, as covered by the Indian Express. No later U.S. conviction or sentence was established in the sources reviewed.

The March disruption was not the last relevant development. In August 2025, Treasury sanctioned Grinex, describing it as Garantex's successor and alleging that customer funds and business had migrated there. That is Treasury's account of continued activity, not a finding that every former customer participated in sanctions evasion.

eXch: the seizure preceded the planned closure

eXch offered exchanges between cryptocurrencies through a deposit-and-payout service. Users sent one asset to the service to receive another. That arrangement relied on the provider completing the payout.

The operators announced a planned closure for May 1, 2025. German authorities acted first, seizing the German infrastructure on April 30. The May 9 statement from the BKA and Frankfurt prosecutors reports approximately €34 million in Bitcoin, Ether, Litecoin and Dash, plus more than eight terabytes of data. It describes an investigation into suspected commercial money laundering and operation of a criminal online trading platform.

Authorities alleged that part of the proceeds of the February 2025 Bybit theft passed through eXch. That does not establish that the entire theft was processed there. The statement identifies no convicted operator, and no later public trial outcome was verified here. The amount of seized data alone does not establish a complete, identified customer list.

Cryptomixer.io: a German-Swiss operation

German and Swiss authorities seized Cryptomixer.io's infrastructure on November 26, 2025, according to the BKA and Frankfurt prosecutors. The seizure fell within an action week running November 24 to 28. Eurojust's December 1 announcement describes a joint investigation, three seized servers, a seized domain, more than €25 million in cryptocurrency, and over 12 terabytes of data.

The service sought to obscure connections between Bitcoin deposits and payouts. Authorities said it was suspected of laundering proceeds from crimes including fraud, drug trafficking and cybercrime. The announcement describes an enforcement action and investigative suspicions. It does not identify a convicted operator or establish criminal intent for all users.

The BKA said the operators had not yet been identified at the time of its announcement. No later named-defendant judgment was verified for this feature. Its significance is the combination of infrastructure, assets and data acquired across jurisdictions. The public announcement leaves the later analysis of that material largely undisclosed.

How the investigations worked

Public blockchains give investigators durable transaction records. They do not automatically supply a person's name. Connecting activity to a person can require exchange records, financial records, infrastructure evidence, witness testimony and an explanation of how those sources fit together.

The Bitcoin Fog appellate opinion describes blockchain analysis alongside exchange and IP evidence. The court rejected challenges to the admission of expert testimony about Chainalysis Reactor. The ruling addresses the evidence in that case.

Server seizures can add information absent from the chain. In the Garantex case, DOJ said investigators obtained earlier server copies containing customer and accounting databases. International cooperation made it possible to reach infrastructure outside the prosecuting country. A domain seizure alone would not have supplied those databases.

Data volume is a poor measure of identification. A terabyte count can include software, duplicated files and unrelated material. Without disclosure of the contents and attribution method, it cannot be converted into a reliable number of identified users. A tracing hypothesis is not interchangeable with a conviction, which requires proof of the charged conduct under the applicable legal standard.

What happened to users?

Some prosecuted money launderers used mixing services. The Sterlingov opinion records testimony by Ilya Lichtenstein and Larry Harmon that they used Bitcoin Fog to launder illicit funds. Both had pleaded guilty in separate money-laundering cases. Their convictions were not convictions for merely visiting a mixer website, and their testimony does not establish universal identification of other users.

For other customers, service disruption could mean inaccessible deposits, an interrupted trade, loss of convenient wallet functions, or uncertainty over records. The effect depends on custody. Taking an operator's payout wallet can immobilize customer funds held there. Taking a coordinator does not, by itself, reveal private keys held on customers' devices.

Forfeiture and reimbursement are also different. An order transferring property to a government does not establish that every claimant has received compensation. Some announcements provide claim procedures, but eligibility, deadlines and evidence requirements belong to the proceeding. Users should consult authentic court or agency notices rather than a purported recovery agent asking for a seed phrase.

Financial privacy, software and criminal liability

Privacy can protect salary information, business relationships and personal safety. A tool's lawful uses do not prevent someone from using it for crime. The difficult legal question is when developing or running that tool makes its operator responsible for criminal conduct.

FinCEN's 2019 guidance distinguishes anonymizing service providers that accept and transmit value from providers of anonymizing software. The guidance does not settle how every criminal statute applies to software described as "noncustodial". The statutory basis of a charge, operational role and evidence of knowledge all require attention.

The DeFi Education Fund's account of Storm's defense argues that liability for publishing and maintaining noncustodial software threatens lawful development and financial privacy. That is the defense perspective. Prosecutors described knowing operation of a business transmitting criminal proceeds, alleging involvement beyond publishing source code.

Samourai's founders entered guilty pleas. Storm received a split verdict. Tornado Cash users succeeded in challenging sanctions authority over immutable contracts. Those decisions address different conduct and statutory powers.

Bitcoin mixing and Monero's native privacy

Bitcoin mixing attempts to make relationships harder to infer on a ledger whose ordinary transactions disclose amounts and spending relationships. Monero builds privacy into transaction construction. Its protocol overview describes hidden amounts and privacy requirements built into ordinary payments. Using them does not require a deposit into a separate mixer operator's wallet.

Stealth addresses protect the public destination relationship, while RingCT hides transaction amounts. That changes what an outside chain observer can inspect. It does not remove evidence held elsewhere.

An exchange can record the identity, amount and address associated with a withdrawal. A payment counterparty knows its own transaction. A compromised device can expose keys or local records. Network connections and remote nodes can reveal metadata. Moving into XMR does not erase earlier Bitcoin transactions or KYC records.

The cases here do not prove that Monero privacy has been broken, nor that Monero users cannot be investigated. Investigators can pursue evidence at exchanges and endpoints even when the underlying payment protocol conceals on-chain information. Our network-privacy guide explains another part of that distinction.

Questions these cases do and do not answer

Does a shutdown mean every user was identified?

No. Publicly reported infrastructure seizures establish control over seized assets or systems. Identifying a person and proving an offense require additional evidence. None of the cited announcements establishes a complete conviction or identification list for all customers.

Is using a mixer automatically a crime?

The answer depends on jurisdiction and conduct. Applicable sanctions, local law, the transaction's purpose and the user's knowledge can matter. These operator cases cannot be treated as a universal ruling about every customer. Someone with a real legal exposure needs advice about their jurisdiction and facts.

Did removing Tornado Cash sanctions clear its developers?

No. Delisting and criminal prosecution followed different legal processes. Storm's 2025 conviction and unresolved counts remained part of the public case record after the sanctions were removed.

Can seized customer money always be recovered?

A seizure does not guarantee recovery. Custody arrangements and the relevant forfeiture or claims process matter. A historical seizure amount is not a guarantee of funds available to an individual customer.

What remains unresolved?

Public updates are uneven. This review did not verify final later outcomes for the Blender/Sinbad defendants, Nguyễn, eXch's operators, Cryptomixer's operators, or the Garantex defendants. It also did not establish a final decision on Legkodymov's later extradition challenge. Storm's scheduled retrial is still in the future. The gaps mean these cases need continued checking.

Sources and case records

The references below distinguish official records from reporting and advocacy. Court reproductions are labeled. Indictments document allegations. Later pleas and judgments determine the outcomes reported here.

• DOJ: Helix final forfeiture, January 2026 (primary).
• DOJ: Harmon sentencing, November 2024 (primary).
• DOJ: Sterlingov sentencing, November 2024 (primary).
• D.C. Circuit: United States v. Sterlingov, September 25, 2026 (primary).
• DOJ: ChipMixer takedown and charges, March 2023 (primary).
• FBI: Minh Quốc Nguyễn wanted notice (primary).
• DOJ: Blender and Sinbad charges, January 2025 (primary).
• Treasury: Sinbad sanctions, November 2023 (primary).
• DOJ: Samourai arrests and infrastructure seizure, April 2024 (primary).
• Samourai indictment: architecture and initial allegations (primary).
• DOJ: Samourai guilty pleas, July 2025 (primary).
• DOJ: Samourai sentences, November 2025 (primary).
• Samourai: Whirlpool CoinJoin implementation (primary).
• Fifth Circuit: Van Loon v. Treasury, November 2024 (primary).
• Treasury: Tornado Cash delisting, March 2025 (primary).
• DOJ: Storm conviction, August 2025 (primary).
• Storm scheduling order, August 25, 2026, court-text excerpt (court reproduction).
• The Block: reporting on Storm's 2027 retrial date (independent reporting).
• DeFi Education Fund: defense perspective and filings (primary advocacy).
• BKA and Frankfurt prosecutors: eXch seizure, May 9, 2025 (primary).
• Eurojust: November 2025 mixer operation (primary).
• DOJ: BTC-e history and Vinnik plea, May 2024 (primary).
• Klimenka order documenting Vinnik dismissal, June 2025 (primary).
• DOJ: Bitzlato disruption, January 2023 (primary).
• DOJ: Legkodymov plea and forfeiture agreement, December 2023 (primary).
• Legkodymov extradition habeas recommendation, June 15, 2026 (court reproduction).
• DOJ: Garantex operation and charges, March 2025 (primary).
• Treasury: Garantex and Grinex sanctions, August 2025 (primary).
• Indian Express: CBI account of Besciokov arrest (independent reporting).
• FinCEN: convertible virtual currency guidance, May 2019 (primary).
• Monero: protocol privacy overview (primary).

• Monero: Bitcoin and Monero atomic swaps (primary).

• BKA and Frankfurt prosecutors: Cryptomixer seizure and unidentified operators, December 2025 (primary).

• DOJ: Harmon arrest, February 2020 (primary).