Loading story…
German and Swiss law enforcement agencies, with support from Europol and Eurojust, have dismantled the Cryptomixer cryptocurrency mixing service as part of Operation Olympia. The operation, conducted in late November 2025 in Zurich, resulted in the seizure of three servers, the cryptomixer.io domain, and over €24 million in Bitcoin. Authorities also confiscated more than 12 terabytes of data, which may contain logs and other information that could help identify users of the service. A warning was posted on the seized domain, alerting operators and users that they are subject to investigation and prosecution.
Cryptomixer was a hybrid mixing service accessible via both the clear and dark web, and it was widely used by cybercriminals to launder proceeds from ransomware, drug trafficking, weapons trafficking, payment card fraud, and other illicit activities. Since its inception in 2016, Cryptomixer reportedly processed over €1.3 billion in Bitcoin. The takedown follows similar actions against other crypto mixing services, such as the 2023 seizure of ChipMixer, and highlights ongoing efforts by international law enforcement to disrupt the infrastructure supporting cybercrime and money laundering.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
On or around December 1, 2025, European authorities publicly announced the dismantling of Cryptomixer and the seizure of its infrastructure and cryptocurrency assets. Officials said the service had been used to launder proceeds from ransomware, darknet markets, fraud, trafficking, hacking, and other cybercrime, including funds linked to Lazarus Group activity.
German and Swiss authorities, supported by Europol and Eurojust, carried out Operation Olympia against Cryptomixer from November 24 to 28, 2025. During the action, they seized three servers in Switzerland, took control of the cryptomixer.io domain, confiscated more than 12 TB of data, and seized roughly €25 million to $29 million in bitcoin.
Authorities said Cryptomixer had been active since 2016, offering cryptocurrency mixing services on both the open web and dark web. Investigators later alleged it processed over €1.3 billion to $1.5 billion in bitcoin, much of it tied to criminal activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
11 references tracked. Mallory keeps watching after this page renders.
bankinfosecurity.com
Open sourcesecurityaffairs.com
Open sourcesecurityonline.info
Open sourcescworld.com
Open sourcedarkreading.com
Open sourcedatabreaches.net
Open sourcehelpnetsecurity.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
German and Swiss law enforcement agencies have dismantled Cryptomixer, an illegal cryptocurrency mixer service, confiscating over 25 million euros (approximately $29 million) in Bitcoin. This operation targeted the infrastructure used to launder illicit funds, disrupting a key service leveraged by cybercriminals to anonymize the proceeds of ransomware, fraud, and other cyber-enabled crimes. The takedown is part of a broader international effort to combat the use of cryptocurrency mixers in facilitating money laundering and hindering law enforcement investigations. The seizure of Cryptomixer's assets and infrastructure is expected to have a significant impact on the cybercrime ecosystem, as such services are frequently used to obscure the origin of stolen or illicitly obtained digital assets. The action underscores the increasing collaboration between European law enforcement agencies in targeting the financial infrastructure that supports cybercrime, and serves as a warning to operators of similar services that they are within the reach of international law enforcement operations.
Jun 29, 2026
Law enforcement agencies across multiple countries have conducted significant operations targeting cybercriminal groups responsible for large-scale financial fraud, data breaches, and cryptocurrency theft. In Spain, police arrested a 19-year-old hacker accused of stealing and attempting to sell 64 million personal data records from nine companies, while Ukrainian authorities apprehended a separate data broker who used custom malware to compromise accounts and sell access on hacker forums. In California, a member of the so-called "Social Engineering Enterprise" pleaded guilty to laundering millions in cryptocurrency stolen through sophisticated social engineering attacks, with the group responsible for a $263 million heist and extravagant spending of the proceeds. Meanwhile, Russian police dismantled a gang that used NFCGate-based malware to steal millions from bank customers by tricking victims into installing fake banking apps and harvesting card credentials for remote theft. A major international operation led by Europol and Eurojust dismantled a €700 million cryptocurrency scam network in Europe that used deepfake videos and aggressive marketing to lure victims into fake investment schemes. The network operated numerous fraudulent platforms, laundered funds through complex channels, and was taken down in coordinated raids across several countries, resulting in arrests and the seizure of cash, cryptocurrencies, and luxury items. These actions highlight the growing sophistication of cyber-enabled financial crime and the increasing collaboration between law enforcement agencies to disrupt such operations on a global scale.
Jun 29, 2026
US authorities reported multiple enforcement actions tied to **crypto-enabled crime**. In the Empire Market case, prosecutors said co-creators **Raheim Hamilton** and **Thomas Pavey** designed the dark web marketplace to help users evade law enforcement and launder proceeds; the market allegedly facilitated about **$430M** in transactions (drugs, stolen payment data, counterfeit currency) before disappearing in 2020 in what investigators described as an exit scam that stole an estimated **$30M** in bitcoin. Hamilton pleaded guilty to federal drug conspiracy charges and agreed to forfeit roughly **1,230 BTC** plus **24.4 ETH** and real estate; Pavey previously pleaded guilty and agreed to forfeit about **1,584 BTC** and other assets. Separately, reporting highlighted alleged misuse and laundering of digital assets in other contexts. On-chain investigator **ZachXBT** traced movements from wallets associated with **US-seized crypto** (held under U.S. Marshals Service custodianship) to wallets allegedly linked to **John Daghita**, the son of a federal contractor executive, with claims of roughly **$23M** in diverted cryptocurrency and another wallet holding about **$36M** in Ethereum; ZachXBT said he alerted the **U.S. Marshals Service**. In another DOJ case, **Jingliang Su** (a Chinese national) was sentenced to **46 months** for laundering proceeds from a cryptocurrency investment fraud that authorities said victimized **174** people for **$36.9M**, using social engineering via social media/dating platforms and counterfeit trading sites, with **$26.9M** restitution ordered and multiple US agencies involved in tracing funds and dismantling the network.
Jun 29, 2026