Mixers and tumblers: how they work and how to spot them

A mixer is the blockchain's laundromat. Its sole job is to break the link between the sender and the recipient of funds so that an analyst cannot trace the coins' path. For an AML check, funds passing through a mixer is a red flag of maximum severity, almost always on a par with a sanctions hit. Let's break down the mechanics, the specific services, and the signs by which a mixer is visible right on the blockchain.

▶ Video lesson: how to spot a mixer (English narration).

How a mixer works: the shared pool

To understand why a mixer is so dangerous for tracing, you need to understand how it is built. In an ordinary transaction everything is transparent: address A sent 5 ETH to address B, and the link is visible forever. A mixer breaks this direct link through a shared pool.

1. Deposit. The user deposits a fixed amount (for example, exactly 0.1, 1, or 10 ETH) into the mixer's smart contract. The amount is deliberately fixed — this is essential, because unique amounts are easy to match "input↔output".Fixed denominations make all deposits indistinguishable from one another — like identical banknotes in a shared till.
2. Mixing. The deposited coins go into a single pool together with the funds of hundreds of other users. At this stage the individual "coin" ceases to exist — there is only a common cauldron.In cryptographic mixers (Tornado Cash) the user receives a secret "note" (a zero-knowledge proof) that confirms the right to withdraw but does not reveal which deposit was theirs.
3. Withdrawal. Later — often with a delay and to a new, "clean" address — the user withdraws the same amount from the pool. Formally, the link between their deposit and withdrawal is cryptographically severed.It is precisely the delay and the change of address that are meant to defeat simple timing analysis.

Key services

• Tornado CashThe most famous Ethereum mixer, a set of smart contracts with fixed denominations of 0.1 / 1 / 10 / 100 ETH. Added to the OFAC SDN list in August 2022. It was through this mixer that the Lazarus Group laundered funds.
• SinbadA Bitcoin mixer that OFAC named the direct successor to the previously shut-down Blender.io. Also actively used by North Korea. Sanctioned in November 2023.
• Successors and clonesAfter sanctions against the major players, forks and smaller services appear (CoinJoin implementations, private pools). The mechanics are the same — a shared pool and a broken link — so they are recognised by the very same signs.

Sanctions status: why this is a double blow

Analysing a real screenshot

A real Tornado Cash address in a blockchain explorer. Note the BLOCKED label and the uniform 0.1 ETH deposits.

This screenshot is a textbook lesson in recognising a mixer. Let's break down exactly what is visible on it:

1. The BLOCKED label. The explorer directly marks the address as blocked/sanctioned. This is a ready-made signal: analytics services have already classified the address.Public labels are the first and cheapest level of a check, but you cannot rely on them alone: new addresses may not yet be labelled.
2. Identical round amounts. A series of transactions of exactly 0.1 ETH. In ordinary economic life people almost never transfer perfectly round, fixed amounts over and over again. This is the signature of a mixer with fixed denominations.0.1 / 1 / 10 / 100 ETH are the characteristic "denominations" of Tornado Cash.
3. The deposit method. In the transaction details you can see a call to the smart contract's deposit method. This is direct interaction with the mixer contract, not an ordinary wallet-to-wallet transfer.From the name of the called contract method, an analyst instantly understands the nature of the operation.
4. Many different senders. Deposits pour into the pool from dozens of independent addresses — the visual picture of a "common cauldron".Symmetrically, withdrawals go out to a multitude of fresh addresses.

Signs of a mixer on the blockchain (without a ready-made label)

The BLOCKED label is not always present — new clones and private pools may be unlabelled. In that case a mixer is recognised by its behavioural signs:

• Fixed round denominationsRepeated transfers of exactly 0.1 / 1 / 10 ETH are the strongest indicator.
• Interaction with a smart contractNot a P2P transfer, but calls to the deposit/withdraw methods of a single contract through which a huge volume passes.
• A broken "input↔output" chainFunds come in from one cluster of addresses and go out to a completely unrelated new address — a classic sign of obfuscation.
• Delay and batchingDeposit and withdrawal are separated in time; withdrawals are split into a series of identical amounts.
• Anomalous concentrationA single contract receives and returns a disproportionately large flow from thousands of addresses — economically this is not a "wallet" but a service.

Why passing through a mixer is a maximum-severity red flag

There is also a statistical argument. A legitimate user rarely needs a mixer — only for privacy. But for laundering stolen goods, paying ransomware, and cashing out Lazarus funds, a mixer is a mandatory tool. Therefore the posterior probability of crime for "mixed" funds is very high. Regulators and exchanges understand this and treat a mixer trail with extreme severity: it is often an automatic stop, on a par with sanctions.

Lesson summary

• Mixer = a broken input↔output linkThrough a shared pool and fixed denominations, traceability is severed.
• Major mixers are sanctionedTornado Cash, Sinbad — on the OFAC SDN list; a double risk (sanctions + obfuscation).
• The signs are visible on the blockchainRound amounts, the deposit method, the BLOCKED label, many inputs/outputs.
• The verdict is almost always a stopA severed history cannot be "cleaned up"; the unknown = maximum risk.

Next we will look at the sources from which criminal funds most often flow into mixers and wallets: darknet markets, ransomware payments, and thefts.

This material is educational and does not constitute legal advice.