Swiss and German authorities carried out a coordinated action in Zurich this week to take down Cryptomixer, a cryptocurrency mixing service available on both the clear and dark web through the Tor browser.
Europol, which supervised the operation, said the move followed a long-running investigation into the service’s use by ransomware groups and dark web markets.
During the operation, authorities seized three servers, the cryptomixer.io domain, its clear web and Tor gateways, plus more than fourteen terabytes of data and about €24 million ($28 million) in Bitcoin.
Europol noted that the seized systems provide investigators with data that had previously been concealed by the mixer’s processes. Cryptomixer’s servers now display a seizure notice, and authorities are continuing to examine the data pulled from the infrastructure.
Investigators say Cryptomixer has operated since 2016 and processed more than one point three billion Euros in Bitcoin. The service pooled deposits for extended periods and redistributed them at unrelated times, a method that enabled cybercrime groups to hide transactions connected to ransomware, drug trafficking, weapons trafficking and payment card fraud.
The action was organised under Operation Olympia and backed by Europol’s Joint Cybercrime Action Taskforce. The agency coordinated meetings, handled intelligence exchange and placed forensic specialists on site during the seizure. Eurojust and Empact also supported the judicial and operational work.
The shutdown follows earlier actions against BestMixer.io, Sinbad.io, Blender.io, and Samourai Wallet as investigators worldwide pressure mixers that hide financial trails on public blockchains.
German agencies involved included the Federal Criminal Police Office and the Frankfurt Cyber Crime Centre. Swiss participation came from Zurich City Police, Zurich Cantonal Police and the Zurich Public Prosecutor. Europol said further analysis of the seized material is already underway.