Europol, Swiss authorities, and German investigators dismantled a crypto mixing service identified as Cryptomixer after seizing bitcoin valued at about $29 million. According to officials, the investigation targeted a platform that operated on both the public internet and the dark web and offered services designed to obscure the origin and destination of cryptocurrency transfers. Investigators said this structure enabled users to mask financial trails that would otherwise remain visible on public blockchains.
Authorities reported that the service was used by cybercrime groups, ransomware operators, and dark web marketplaces. They said Cryptomixer played a role in laundering criminal proceeds generated through ransomware attacks, fraud schemes, and illegal online trading. According to investigators, the mixer allowed users to commingle legitimate and illicit funds by routing them through automated systems that broke transactions into smaller components before redistributing them to new wallet addresses.
The operation resulted in the seizure of the service’s domain infrastructure and physical servers. Investigators secured 12 terabytes of data from those systems. Officials said the recovered material includes logs, transaction information, and operational records that may support ongoing investigations. They added that the data could assist in identifying networks that rely on concealed cryptocurrency flows to move illicit funds across borders.
Law enforcement agencies said the takedown followed a coordinated investigation involving cross-border data collection, forensic analysis, and cooperation with international partners. Investigators described the operation as an example of growing collaboration among authorities seeking to limit the use of anonymisation tools in criminal activity. They said the case reflects a wider strategy to disrupt platforms that facilitate the movement of funds connected to cybercrime.
Europol stated that the investigation builds on previous actions against other crypto mixers used by organised crime groups. Past operations dismantled platforms that processed large volumes of cryptocurrency linked to illegal marketplaces and ransomware campaigns. According to Europol, those actions demonstrated that even services that present themselves as privacy tools can be subject to enforcement when they are used primarily for money laundering.
Analysts said the removal of Cryptomixer from both the clear web and the dark web could temporarily disrupt criminal transactions. They noted that mixers are often part of a broader laundering chain involving exchanges, privacy coins, and cross-chain swaps. They also said that any enforcement action that eliminates a popular service can increase operational risk for criminals who rely on stable infrastructure to store and move funds.
Authorities stated that investigations will continue based on the seized data. They said that material extracted from the service’s servers may reveal links to actors involved in ransomware operations and darknet trading networks. Investigators also noted that the data could assist in tracing cryptocurrency flows that have not previously been attributed to known entities.
Officials said the case demonstrates the growing technical capacity of law enforcement to conduct blockchain analysis and follow cryptocurrency transactions even when criminals use sophisticated obfuscation methods. They added that cooperation with national agencies allows investigators to combine jurisdiction-specific legal authorities with shared investigative resources.
Europol said further updates will be provided as investigators review the seized data and pursue additional leads connected to the mixer’s operations.