Key takeaways

• International operation dismantles cryptomixer: Cryptomixer, a major cryptocurrency mixing service used to launder illicit funds, was taken offline in a coordinated enforcement action by authorities from Germany, Switzerland, and europol, with support from Eurojust and US law enforcement.
• Core infrastructure seized: Authorities seized the service’s backend servers in Zurich, took control of its domain, and removed access to both clear web and dark web versions. More than EUR 25 million in cryptocurrency was also confiscated.
• Extensive intelligence yield expected: Investigators secured approximately 12 terabytes of data, including transaction records, logs, and wallet clusters, enabling future attribution, asset tracing, and network mapping across jurisdictions.
• One of the longest-running mixers: Cryptomixer had operated as 2016 and processed over EUR 1.3 billion in Bitcoin, serving a wide range of criminal entities including ransomware actors, darknet vendors, and organized crime networks.

{{horizontal-line}}

On November 26, 2025, Europol announced that, in cooperation with law enforcement authorities from Germany and Switzerland and with support from Eurojust, it dismantled the cryptocurrency mixing service Cryptomixer following a coordinated international enforcement operation conducted between November 24 and 28, 2025.

The action was led by German and Swiss authorities, including the Frankfurt and Zurich Public Prosecutors’ offices and Germany’s Federal Criminal Police Office (BKA), with additional support from Europol, Eurojust, and US law-enforcement partners.

TRM Labs is proud to support the BKA and other European partners in the fight against cybercrime and money laundering.

The action targeted the core infrastructure of the platform. Investigators seized three servers in Zurich hosting Cryptomixer’s backend systems, took control of the cryptomixer.io top-level domain, which now displays the splash page for “Operation Olympia,” and made the service inaccessible on both the clear web and the dark web, where it had been actively promoted to criminal users.

Authorities also seized more than EUR 25 million in cryptocurrency directly connected to the platform’s laundering activity and secured approximately 12 terabytes of operational data from the seized servers. The data set includes extensive transaction records, logs, and wallet clusters. This data will help investigators attribute crimes, trace assets, and map networks across different countries.