The Challenge With Crypto Mixers, Tumblers and Blenders

Crypto mixers are making headlines lately, and the recent sanction of Tornado Cash raised many questions on the topic. However, many people do not understand what mixers, blenders or tumblers are. While being upset at a government moving ahead to sanction code is one thing, understanding their use cases, risks and mechanics and then forming opinions is a different matter. This is my bit to educate folks so people can form their own opinions.

A service or entity designed to blend cryptocurrencies from many users or source wallets to mask the origin of funds and release funds to a new destination wallet for a fee is called a mixer, tumbler or blender. These terms are often used interchangeably, I will stick to the mixer terminology for this article.

Key Use Cases

There are legal and illegal use cases for these services, let us look at them below.

Many people use these for a need for privacy, which is more prevalent with folks who live in dictatorial regimes or need anonymity. These mixers are an alternative to privacy chains like Monero, Zcash, etc.

Many of these mixers are used by cybercriminals for money laundering and to obscure the connection of funds from the source and destination crypto wallets, allowing them to transfer illegitimate and untraceable funds onto crypto exchanges. Many times, they invalidate AML alerts using these roundabout techniques. The mixer services are also used by folks in gambling, high-risk exchanges and even anonymous charities.

Mixer Mechanics

Mixers aggregate, pool and randomly shuffle their deposits and redeposit them to new addresses under the control of the original user for a fee. They also help with the withdrawal of assets in a random fashion, e.g., randomizing amounts and withdrawal frequency—making it tough to trace. There are also self-annihilating mixers or tumblers that destroy themselves after a pre-defined set of transactions has been executed.

Mixer Categories

There are four broad categories of mixers, with some being more autonomous than others.

Centralized And Custodial

They are run by a single operator (holds users’ crypto) and due to this centralized model users do not alleviate privacy concerns. Being unregistered money services, law enforcement is always watching them.

CoinJoin Mixers

They are baked into wallets of privacy chains and co-mingle funds of multiple users in a single transaction. They are non-custodial.

Autonomous Mixer

This is a non-custodial mixer and does not co-mingle funds. A redeemable cryptographic hash is sent after receipt of funds. It can be redeemed at a different address. Smart contracts work with “relayer” services funding gas fees and eliminating transaction history. They are unscalable due to the requirement of advanced cryptography, zero-knowledge proofs, etc.

Self-Destruct Mixer

The mixer self-destructs after a set of transactions are consummated, these are usually programmed into autonomous mixers built for a certain purpose. They are hard for governments and regulators to identify, track, trace or regulate. Absent conventional methods for locating and regulating such entities, governments started sanctioning code.

Mixer Legality

Despite illegal use cases around mixers, they have not explicitly been declared illegal. Many entities are not compliant with legal requirements, e.g., FinCEN (Financial Crimes Enforcement Network) wants custodial mixers to be registered with them, and they want them to document everything and have AML controls in place. A mixer compliant with the above criteria will likely not be useful for either the privacy or the money laundering use case. Hence if a custodial mixer exists and is used, it is likely non-compliant.

Getting Compliant

Companies must ensure that all AML programs are in place, strong record-keeping practices are installed and they do business only with registered entities. Unregistered entities pose a risk of unknowingly being involved in the process of potentially questionable activities. Many enterprises have also started questioning their interactions with unlicensed and “non-KYC ed” actors like miners and validators based on discussions with multiple executives. Companies do not need to use crypto mixers; they can use privacy blockchains or decentralized platforms which can maintain sensitive data off-chain while maintaining its hash on-chain as alternatives.

Concluding Thoughts

While these services and tools can enhance privacy and drive anonymous transactions, they are also abused for money laundering. Privacy-oriented chains like Monero and privacy wallets like Wasabi generate stealth addresses and new addresses per transaction, respectively maintaining privacy and marginally reducing money-laundering risk compared to other methods.

The mixer conundrum is that they will lose privacy-needing users if they are compliant while getting a rap on the knuckle from the powers that be if they do not comply. That’s a hard place to be. Although this could play out differently, my opinion is that mixers in this current form and configuration could cease to exist and advances in blockchain privacy technology and regulation will bring in newer and more innovative solutions that are AML-compliant. Yes, and the code can be sanctioned—at least until then.