Loading story…
German and Swiss law enforcement agencies have dismantled Cryptomixer, an illegal cryptocurrency mixer service, confiscating over 25 million euros (approximately $29 million) in Bitcoin. This operation targeted the infrastructure used to launder illicit funds, disrupting a key service leveraged by cybercriminals to anonymize the proceeds of ransomware, fraud, and other cyber-enabled crimes. The takedown is part of a broader international effort to combat the use of cryptocurrency mixers in facilitating money laundering and hindering law enforcement investigations.
The seizure of Cryptomixer's assets and infrastructure is expected to have a significant impact on the cybercrime ecosystem, as such services are frequently used to obscure the origin of stolen or illicitly obtained digital assets. The action underscores the increasing collaboration between European law enforcement agencies in targeting the financial infrastructure that supports cybercrime, and serves as a warning to operators of similar services that they are within the reach of international law enforcement operations.
See the reporting duties and controls this puts on the clock.
11 events from the most recent confirmed update back to the earliest known activity.
The U.S. Cybersecurity and Infrastructure Security Agency added several vulnerabilities to its Known Exploited Vulnerabilities catalog, including flaws in OpenPLC ScadaBR and the Android Framework. The additions signaled evidence of active exploitation.
Universities were reported as affected by follow-on breaches tied to an Oracle hack. The reporting indicated the compromise had spread impact beyond the initially affected environment.
A separate data breach at Marquis was reported to have exposed information on more than 780,000 individuals. The disclosure added to a series of significant breach notifications during the period.
A data breach involving Coupang was reported as affecting 33.7 million users. The incident was cited among major consumer-impacting breaches disclosed in early December 2025.
A maximum-severity XML external entity vulnerability, CVE-2025-66516, in Apache Tika was reported and urgent patching was recommended. The disclosure identified the flaw as a serious risk for affected deployments.
Cloudflare reported blocking a record 29.7 Tbps distributed denial-of-service attack attributed to the AISURU botnet. The event highlighted the growing scale of volumetric DDoS activity.
Researchers identified malicious Rust packages aimed at Web3 developers after they had accumulated thousands of downloads. The packages were subsequently removed from distribution.
The Iran-aligned MuddyWater threat group was reported conducting new cyberespionage operations targeting organizations in Israel and Egypt. The campaigns used updated backdoors and reflected continued evolution in the group's tooling.
A critical remote code execution vulnerability in React Server Components, tracked as CVE-2025-55182, was patched. Defenders were urged to update quickly because of the severity of the issue.
Google released fixes for 51 Android vulnerabilities, including CVE-2025-48633 and CVE-2025-48572, which were reportedly under targeted exploitation. The update addressed actively abused flaws in the Android ecosystem.
Law enforcement authorities in Germany and Switzerland took down the illegal Cryptomixer cryptocurrency laundering service and seized more than €25 million in Bitcoin. The action was reported as part of broader 2025 efforts to disrupt cybercrime infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
German and Swiss law enforcement agencies, with support from Europol and Eurojust, have dismantled the Cryptomixer cryptocurrency mixing service as part of Operation Olympia. The operation, conducted in late November 2025 in Zurich, resulted in the seizure of three servers, the cryptomixer.io domain, and over €24 million in Bitcoin. Authorities also confiscated more than 12 terabytes of data, which may contain logs and other information that could help identify users of the service. A warning was posted on the seized domain, alerting operators and users that they are subject to investigation and prosecution. Cryptomixer was a hybrid mixing service accessible via both the clear and dark web, and it was widely used by cybercriminals to launder proceeds from ransomware, drug trafficking, weapons trafficking, payment card fraud, and other illicit activities. Since its inception in 2016, Cryptomixer reportedly processed over €1.3 billion in Bitcoin. The takedown follows similar actions against other crypto mixing services, such as the 2023 seizure of ChipMixer, and highlights ongoing efforts by international law enforcement to disrupt the infrastructure supporting cybercrime and money laundering.
Jun 29, 2026
Law enforcement agencies across multiple countries have conducted significant operations targeting cybercriminal groups responsible for large-scale financial fraud, data breaches, and cryptocurrency theft. In Spain, police arrested a 19-year-old hacker accused of stealing and attempting to sell 64 million personal data records from nine companies, while Ukrainian authorities apprehended a separate data broker who used custom malware to compromise accounts and sell access on hacker forums. In California, a member of the so-called "Social Engineering Enterprise" pleaded guilty to laundering millions in cryptocurrency stolen through sophisticated social engineering attacks, with the group responsible for a $263 million heist and extravagant spending of the proceeds. Meanwhile, Russian police dismantled a gang that used NFCGate-based malware to steal millions from bank customers by tricking victims into installing fake banking apps and harvesting card credentials for remote theft. A major international operation led by Europol and Eurojust dismantled a €700 million cryptocurrency scam network in Europe that used deepfake videos and aggressive marketing to lure victims into fake investment schemes. The network operated numerous fraudulent platforms, laundered funds through complex channels, and was taken down in coordinated raids across several countries, resulting in arrests and the seizure of cash, cryptocurrencies, and luxury items. These actions highlight the growing sophistication of cyber-enabled financial crime and the increasing collaboration between law enforcement agencies to disrupt such operations on a global scale.
Jun 29, 2026
An international law enforcement operation coordinated by **Europol** and **Eurojust** dismantled the **AudiA6** cryptocurrency laundering service, which investigators say washed more than **EUR 336 million** (about **$380 million**) between 2022 and 2025 for ransomware groups and other cybercriminal networks. Authorities linked the service to more than **15 international investigations** involving ransomware and major cryptocurrency theft, describing AudiA6 as an industrial-scale laundering pipeline that relied on thousands of fraudulent exchange accounts, stolen or purchased identities, and more than **6,000 KYC records** tied to money mule accounts. The crackdown included coordinated arrests, searches, domain takedowns, server seizures, cryptocurrency freezes, and the seizure of vehicles, properties, and Telegram accounts across multiple jurisdictions. Investigators said the case advanced after Polish authorities arrested a Ukrainian suspect in September 2025, with forensic analysis leading to additional arrests in Georgia; the U.S. Department of Justice identified **Ruslan Igorevich Tkachuk** and **Alexander Vladimirovich Ledenev** as senior AudiA6 members now in Georgian custody. Europol also said the same suspects were tied to administration of the **Dark2Web** cybercrime forum, underscoring the role of specialized laundering services in sustaining the ransomware ecosystem.
Aug 11, 2026