Crypto mixers explained: privacy, money laundering and the Tornado Cash sanctions

Every bitcoin or Ethereum transaction is public. Anyone can follow coins from one address to the next. Mixers, also called tumblers, exist to break that trail, and that makes them both a privacy tool and one of the favorite tools of crypto launderers.

This guide explains what mixers do, why US and UK authorities have targeted them, what happened with Tornado Cash, and what it all means if you just want to use crypto legally.

What a mixer does

FinCEN, the US Treasury’s financial crimes bureau, describes mixers as services that accept crypto and retransmit it in a way designed to prevent others from tracing it back to its source, or as software that does the same. The UK’s sanctions office, OFSI, describes mixing as pooling funds from multiple users and redistributing them, making it difficult to trace the original source.

Some mixers are run by a company or person who takes custody of your coins. Others, like Tornado Cash, run as smart contracts on Ethereum. See what is a smart contract?

Privacy vs laundering

There’s a real debate here, and official documents reflect both sides.

• Privacy: a July 2025 report by the White House’s President’s Working Group on Digital Asset Markets, quoted by FinCEN, said the administration supports the ability of lawful users to transact privately on a public blockchain, and acknowledged that lawful users may use mixers for financial privacy.
• Laundering: the same report said illicit actors use mixers to obfuscate and launder funds. OFSI says sanctions evaders often use mixing services to obscure payment trails, and that smart contract mixers add another layer of obfuscation.

The US sanctions on mixers

The US Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned several mixers, linking them to North Korea’s state-sponsored hacking group, the Lazarus Group:

For how these thefts happened, see crypto bridges explained.

Tornado Cash’s delisting

On 21 March 2025, Treasury removed the sanctions against Tornado Cash. Its statement said the decision followed a review of “novel legal and policy issues” raised by using financial sanctions against activity in evolving technology and legal environments, as reflected in its filing in the court case Van Loon v. Department of the Treasury.

The court case behind it

The case Treasury referred to had already gone against it. On 26 November 2024, the US Court of Appeals for the Fifth Circuit ruled in Van Loon v. Department of the Treasury, brought by six Tornado Cash users. The court held that Tornado Cash’s immutable smart contracts, which it described as privacy-enabling software code that can’t be owned, controlled or changed, even by its creators, are not the “property” of a foreign national or entity. That meant they couldn’t be blocked under the sanctions law, the International Emergency Economic Powers Act, and that OFAC had overstepped its authority.

The court stressed that OFAC’s concerns about laundering were “undeniably legitimate”, and suggested Congress might update the law to cover technologies like crypto-mixing software. The ruling was about the code; it didn’t protect people who use mixers to launder money.

Treasury added that it remained deeply concerned about North Korea’s hacking and money laundering campaign, and that US persons should exercise caution before engaging in transactions that present such risks.

FinCEN’s withdrawn rule

In October 2023, FinCEN proposed treating international crypto mixing as a class of transactions of “primary money laundering concern”. If finalized, it would have required US financial institutions to report transactions they knew or suspected involved mixing.

On 6 October 2026, FinCEN published a notice withdrawing that proposal. It said it still believes illicit actors use mixers to hinder investigations, but that the withdrawal was informed by concerns that the proposed definition of mixing was so broad it could chill legitimate activity and place a large reporting burden on institutions. FinCEN said it will continue to monitor mixer activity and may act in the future.

What still applies

Two older rules matter more for most people:

• Running a mixing service: FinCEN’s 2019 guidance says a person who provides anonymizing services by accepting crypto and transmitting it on is a money transmitter under its regulations. Simply supplying anonymizing software is not, and someone using such software for their own transactions may be just a user.
• Sanctions are strict: OFAC says its sanctions obligations apply equally to crypto and traditional currency. US persons are generally prohibited from dealing with sanctioned persons or property, directly or indirectly, and OFAC can impose civil penalties on a strict liability basis, meaning a person can be liable even without knowing they were breaking the rules, although OFAC considers all the circumstances.

In the UK, OFSI’s 2025 threat assessment lists the use of mixing services, and concentrated inflows from mixers followed by immediate withdrawals, among red flags that crypto firms should watch for.

How sanctioned addresses are listed

OFAC can add digital currency addresses to its Specially Designated Nationals (SDN) List, to alert the public to addresses associated with a blocked person. Its FAQs explain:

• You can search for an address in OFAC’s Sanctions List Search tool by pasting it into the “ID #” field. The search returns only exact matches.
• OFAC’s address listings are “not likely to be exhaustive”. An address that isn’t listed may still belong to a sanctioned person.
• Anyone subject to US sanctions rules who holds crypto they believe belongs to, or is associated with, a sanctioned person should block it and report it to OFAC.

For most people, the practical point is that exchanges screen against these lists, which is one reason deposits linked to sanctioned addresses get frozen.

What this means for ordinary users

1. Check before you interact. Don’t send funds to, or receive funds from, an address you know is sanctioned. Sanctions lists change, as the Tornado Cash delisting shows.
2. Expect questions from exchanges. Funds that have passed through a mixer may be flagged, delayed or frozen, because platforms have their own sanctions and anti-money-laundering duties. See why your exchange wants your ID.
3. Don’t “clean” funds. Using a mixer to hide the origin of money from crime is money laundering, whatever the legal status of the tool.
4. Privacy has other options. Using a fresh address for each payment, as Bitcoin.org recommends, improves privacy without the legal risks of mixers. See public keys, private keys and addresses.
5. Avoid “sanctions-proof” services. Public marketing of “no-passport cash-out” or “sanctions-proof” services on social media is on OFSI’s list of red flags.

For the wider picture of how crypto is regulated, see is crypto legal?