Case study: crypto followed through a mixer to the end point

What does this case study of crypto through a mixer show?

Following crypto through a mixer shows that the chain breaks at a specific point and that the investigation then shifts from following to comparing. Before the mixer you follow a line; after the mixer you work with time windows, amounts and patterns, and that asks different choices of the investigator.

What the injured party submitted in this file was limited: two own addresses, three transaction hashes and a series of screenshots of a platform that was no longer reachable. That is enough to begin with, and at the same time too little to attach conclusions to without verification.

Crypto through a mixer: what did the route look like beforehand?

Before the mixer the route ran in four steps: from the address of the injured party to an intermediate address, merged there with other incoming amounts, then split into smaller parts and only after that towards the mixer. That splitting into decreasing amounts is called a peel chain and is one of the most common patterns in files of this kind.

The first breakthrough was not in the technology but in the timeline. Two of the intermediate addresses received amounts from several injured parties within the same quarter of an hour, and that simultaneity made it plausible that this was a shared collection point. Such a determination is factual: the entries are there, with date, amount and transaction hash.

What happens exactly to a transaction inside a mixer?

Inside a mixer, incoming amounts from many different users are merged and then paid out in other compositions and at other moments, so that the direct link between a specific deposit and a specific payout disappears. The entries themselves remain visible; only the one-to-one relationship can no longer be read off.

That is precisely why a money laundering route through a mixer is attractive to anyone who wants to break a trail, and why a report here has to distinguish sharply between what has been established and what is probable.

Which choices did the investigator face in this file?

In this file the investigator faced a choice five times that determined the rest of the investigation, and each of those choices is accounted for in the report. Below they appear in the order in which they arose.

• First map the own addresses of the injured party completely, or follow the largest outgoing entry straight away. The first was chosen, because an incomplete starting point undermines every later conclusion.
• At the collection point, continue on the main flow, or first establish how many other injured parties ended up at the same address. The second delivered the timeline that later underpinned the pattern.
• At the peel chain, follow every branch, or only the branches above a certain amount. All branches were chosen, because it was precisely a small branch that turned out to lead to another network.
• After the mixer, work with a wide time window and a lot of noise, or with a narrow window and the risk of missing the payout. A narrow window was the starting point and it was widened step by step.
• Name the end point as a determination, or as a probable scenario. It was included as a probable scenario, with the data on which that rests alongside it.

How did crypto through a mixer come back into view afterwards?

The route came back into view after the mixer because a series of payouts matched, strikingly well in amount, timing and follow-up behaviour, the amounts that had gone in shortly before. That is not proof of identity and not a conclusive link either, but it is a traceable pattern that a third party can recalculate.

The second breakthrough was in a branch that skipped the mixer entirely. A small part of the amount went through a cross-chain transfer to another network and arrived there at a trading platform without intermediate steps. That branch could be followed in full and gave the file a solid lead that the mixer had not touched.

What is often underestimated here: the smallest amount sometimes delivers the strongest determination. We see that regularly in files where the main flow has been deliberately obscured and a remaining amount has been passed on carelessly.

What was the end point and what could the injured party do with it?

The end point was a cash-out point at a foreign exchange, the moment at which the balances arrive at a trading platform and the blockchain stops telling the story. From that point onwards the data sits with the service provider and no longer on the chain.

What the injured party could do with it is concrete and limited: the report named at which service provider the balances arrived, at what moment and in what size, so that this information could be followed up through the channels intended for it. The action then lay with the police report and with the service provider, not with Paucitas.

A comparison helps: in the case in which stolen bitcoin was investigated the end point lay after two intermediate steps, here after eleven. The difference in effort is a factor, the difference in certainty about the last step is larger.

Why does Paucitas follow a route of crypto through a mixer by hand?

Paucitas follows such a route by hand because an automated estimate at a mixer produces a probability that cannot be traced back to individual entries. At a mixer that difference is decisive, because with crypto through a mixer a route that looks plausible and a route that holds up look identical in a graph.

Paucitas uses no automated analysis software, in any role. The investigation is carried out by hand on the basis of publicly accessible block explorers. Every transaction and every transaction hash is verified one by one before it is included in a report.

If you would like to know how that method compares to automated analysis, the situation page on tracing stolen crypto is the starting point.

What can an investigation of crypto through a mixer not establish?

At a mixer, blockchain investigation establishes up to which point the route is certain, and not who sat on the other side. That boundary belongs explicitly in the report, because a file that keeps quiet about the boundary collapses at the first critical question.

• Where mixers or privacy-oriented networks are used, the chain cannot always be followed in full. In that case the report states explicitly up to which point the route can be established.
• Paucitas does not independently establish who is behind a crypto address. It does record which service provider or party the balances went to, so that this information can be followed up through the channels intended for it.
• Transactions outside the blockchain, such as cash payments or internal entries within an exchange, are not visible in blockchain data. Those are only included if underlying documents are available.
• Paucitas makes no commitment about the outcome of an investigation.
• Paucitas holds no balances itself and carries out no transactions on behalf of clients.
• A Paucitas report is limited to factual observations and the investigation of those observations.
• Paucitas gives no tax or legal advice.

What can you do yourself in such a situation and when is that not enough?

You can lay the most important groundwork yourself: record addresses and transaction hashes, keep screenshots with dates and change nothing about the wallet involved. How you do that is set out in how you secure evidence after a crypto theft.

It is no longer enough as soon as the route splits, runs across several networks or becomes crypto through a mixer. From that point on, the choice of time windows and branches determines the outcome, and that is work that has to be accounted for instead of estimated.

Paucitas never asks of its own accord for your recovery phrase or private key. If you need help reading or restoring your wallet, we guide you through that fully, without us having to see that data ourselves.

What is in the report and how long does the investigation take?

The report in this case followed the fixed structure: background and description of the assignment, questions put, scope, assumptions, data submitted, sources consulted, method in outline, verification and quality assurance, reservations and limitations, findings per element, chronological overview, analysis and coherence, conclusion, statement of independence and annexes. Not every report contains all elements; the structure is matched to the purpose.

Concretely, this file contained: eleven followed steps with a transaction hash, two collection points with the corresponding timeline, an explicit boundary at the mixer, a fully followed cross-chain branch and a conclusion in which the end point is included as a probable scenario. With that, the recipient could file a targeted police report and address a request to the service provider involved.

A Paucitas investigation takes between one working day and two weeks, depending on the size of the file and the urgency. An urgent report can be delivered within one working day and in exceptional cases the same day. A regular investigation is usually ready within three working days. For files with many transactions, several wallets or missing history, the lead time rises to around two weeks. A surcharge applies to urgent assignments.

Paucitas works with a fixed fee based on your situation. Sometimes we agree an hourly rate, but the hours are always fixed in advance, so you are never faced with surprises. No investigation is started before the costs have been discussed and agreed.

Where does the work of the police begin and where does that of Paucitas begin?

The police can record a report and demand data from a service provider by way of criminal procedure; Paucitas cannot do that and instead establishes the facts that underpin such a request. That division of roles is the reason the report belongs with the police report and does not come in place of it.

If you would like to know whether your file has enough leads to follow a route, you can have that looked at calmly in a free intake. We say honestly when a route is expected to run dead. More about this service is at blockchain investigation and transaction tracing.

For the context of the wider problem: Europol publishes periodically on the role of cryptocurrencies in organised crime, and the European Commission on the European framework against money laundering under which these service providers fall.

Date of last revision: 25 August 2026.