Cointelegraph Bitcoin & Ethereum Blockchain News

What are Coin Mixers and Their Role in High-Profile Hacks?

Crypto mixers, also referred to as tumblers, have become a critical aspect of the cryptocurrency landscape, particularly in high-profile hacks. These smart contracts are designed to obscure the source of crypto transactions. Hackers typically send their stolen cryptocurrency to a mixer’s address, where it is blended with coins from other users. This way, while users might send and receive seemingly random amounts of the same cryptocurrency—like Ether (ETH)—it effectively conceals the original source of each coin.

For instance, if ten users each mix 1 ETH, they do not receive back the same coins they sent. This anonymity attracts not only hackers looking to hide their trails but also individuals seeking greater privacy from surveillance. Despite the controversy surrounding their use, mixers persist as tools for maintaining anonymity in the crypto world.

The Mechanisms of Crypto Laundering

Hackers frequently pair the use of mixers with strategies like decentralized exchange (DEX) trading, peel chains, and crosschain bridges. In DEX trading, users can exchange cryptocurrencies directly, thereby avoiding the need for a central authority, which adds a layer of anonymity. Peel chains involve transferring smaller amounts of cryptocurrency across multiple wallets, making it challenging for investigators to trace the original amounts.

One notable example is North Korea’s Lazarus Group, which has executed complex laundering schemes to obscure funds obtained from various hacks. After the Bybit hack that resulted in the theft of approximately $1.46 billion, the Lazarus Group utilized mixers and decentralized crosschain protocols such as THORChain to launder these stolen assets within just a few days.

In 2024 alone, this group is believed to have stolen around $800 million in crypto assets, quickly directing them through mixers, intermediary wallets, DEXs, and crosschain bridges to obfuscate their origins further. Since 2017, North Korean hackers have been linked to over $5 billion in stolen cryptocurrencies, employing platforms like Ren Bridge and Avalanche Bridge, and utilizing various mixers such as Tornado Cash and Wasabi Wallet to mask their activities.

The Role of Crosschain Bridges in Laundering Efforts

Crosschain bridges serve as another crucial tool for hackers by allowing the transfer of assets between different blockchain networks, thereby facilitating a greater degree of anonymity. These bridges typically secure the original token in a smart contract and mint a corresponding wrapped version on the target blockchain. For example, when transferring from Ethereum to Solana, the original asset is locked on Ethereum, and a wrapped version is created on Solana.

However, vulnerabilities exist within these bridge systems. Hackers can exploit weaknesses to create wrapped assets on the target chain without locking the original assets or manipulate systems to unlock original assets without performing the necessary procedures. Instances of false deposit events, validator takeovers, and flawed deposit validation processes illustrate how these vulnerabilities can be exploited.

Typical Money Laundering Process in Crypto

Hackers typically conduct crypto laundering in three key stages:

1. Placement: Criminals introduce illicit funds into the financial system by fragmenting large sums into smaller transactions to evade detection. They purchase cryptocurrencies through intermediaries, complicating tracing efforts by law enforcement.

2. Layering: During this stage, hackers make multiple transactions across different platforms, obscuring the origins of funds. They enjoy the freedom provided by exchanges with lax anti-money laundering (AML) regulations.

3. Integration: Finally, the laundered funds are integrated back into the legitimate economy. By this time, the transactions have been cycled through various platforms, significantly disconnecting them from criminal activities. This might include cashing out through fiat off-ramps or reinvesting in legitimate assets.

Investigative Tools and Techniques

Investigators combating crypto fraud employ specialized tools that track crosschain illicit transactions, using techniques that differ from traditional single-chain analytics. Automated crosschain tracking enables rapid identification of transaction flows, facilitating quicker responses when illicit funds appear on exchanges.

Key features of modern investigations include:

• Crosschain Hopping Detection: Identifying when criminals transfer funds between different chains helps maintain a clear view of laundering activities.
• Attribution and Entity Identification: Linking addresses to known entities aids investigators in determining possible transaction paths for stolen funds.
• Automated Investigation Boards: These visualize connections between multiple addresses across various chains, streamlining the process of tracking illicit funds and patterns.
• VASP Directory Integration: For cases involving centralized exchanges, this feature allows them to freeze assets before they are laundered.

Regulatory Challenges

Crypto mixers and their role in laundering illicit funds have attracted the attention of regulators worldwide. The U.S. Office of Foreign Assets Control (OFAC) has sanctioned various mixers due to their links with cybercrimes. The first sanctioned mixer, Blender.io, was alleged to have laundered substantial funds from high-profile hacks, and despite being shut down, it re-emerged under a different name, Sinbad.io.

Regulatory bodies like the Financial Action Task Force (FATF) have flagged the use of mixers as indicators of illicit activity, prompting various international guidelines for better transparency. However, challenges remain, especially regarding holding developers accountable for potential laundering activities performed post-sanctioning.

The Future of Privacy vs. Security in Crypto

The ongoing evolution of crypto necessitates a delicate balance between user privacy and security. Emerging technologies like zero-knowledge proofs offer a solution for maintaining user anonymity while complying with stricter AML regulations. The crypto community continues to navigate this complex landscape, seeking solutions that ensure privacy and prevent criminal activities, ultimately fostering trust in digital asset ecosystems.