Tracing crypto across multiple wallets and mixers: what stays traceable

What exactly does a crypto mixer do?

A crypto mixer, also called a tumbler, pools the deposits of many users and then pays out comparable amounts to new addresses. The goal is to break the direct link between the incoming and outgoing address, so that at first glance it is no longer visible which outgoing amount belongs to which deposit. For anyone wanting to hide stolen crypto, that is an attractive intermediate step. International law-enforcement agencies such as Europol also point to the role of mixers in obscuring criminal money flows.

Important to know: a mixer does not erase any data from the blockchain. All deposits and payouts remain visible; what is obscured is the link between them. That distinction is precisely what investigating a mixer is about: the data is not missing, but the direct connection has to be made plausible again.

Can you trace crypto after it has gone through a mixer?

Yes, crypto is often still partly traceable after a mixer, although the result depends on the type of mixer, the volume and the passage of time. With smaller or poorly set-up mixers, incoming and outgoing amounts can sometimes be linked back to one another based on amount, timing and patterns. With large, heavily used mixers the link becomes weaker, but leads often still emerge downstream.

Tracing crypto is then not a matter of pressing a button. It is the manual tracing of crypto in which an investigator maps patterns, tests hypotheses and substantiates likely routes. This ties in with the broader work around tracing stolen crypto, in which the mixer is just one of the links in the chain.

A mixer as a laundering step: what does that mean for the investigation?

A mixer is a classic link in the laundering of crypto: by obscuring the origin, a perpetrator tries to give the money a clean source. In money-laundering crypto investigations, it is therefore not only about where the money went, but also about making it plausible that a series of transactions was intended to conceal the route.

Tracing crypto and mapping that laundering route is more than a technical exercise; it produces substantiation that carries weight towards an exchange, a bank or the authorities. It is precisely the pattern of obscuring, splitting and passing on that often tells just as much as the individual transactions. This laundering problem is central to the European approach at EU level.

From mixer to three wallets: partly reconstructing a route

Take a case in which stolen crypto first went through a mixer and was then spread across three consecutive wallets. The mixer’s payouts are visible; which of them belong to the stolen amount is not immediately clear. By looking at amounts, timings and the way the three wallets behave afterwards, a picture emerges of the most likely route.

That reconstruction is rarely a hundred per cent watertight, but it is often enough to indicate a credible direction, for example towards an exchange where the crypto was ultimately converted. That is exactly where an investigation adds value: not in absolute certainty, but in a traceable, substantiated route.

Limits and possibilities: what can an investigation do and not do?

An investigation can map the visible transactions, substantiate likely links and point to an endpoint, such as an exchange or a cash-out point. What such an endpoint looks like we showed earlier in how stolen crypto is followed to an exchange. What an investigation cannot do is guarantee that every step is established with certainty or that the assets will be recovered. Anyone who does promise that goes further than the technique allows.

For a case this means that the outcome is usually a substantiated report that you can use towards an exchange, a lawyer or when filing a report. It increases the chance of follow-up steps, without guaranteeing an outcome. We deliberately maintain that sober line.

What does a partly reconstructed route mean for your case?

A partly reconstructed route is valuable above all as evidence and as direction. If the trail demonstrably leads to an exchange, there is a concrete lead for a request for cooperation or for the authorities. Even a partial picture can thus make the difference between a case without direction and a case with a substantiated next step.

Expectations remain important. A reconstructed route is not a repayment and not a guarantee, but a factual substantiation that others can build on. It is precisely that honesty that makes the report usable.

Get in touch for more clarity

If your crypto has disappeared through a mixer and across multiple wallets, the first step is finding out what is still visible. Get in touch directly to gain more clarity about what is possible in your situation.

That way you will quickly know whether a traceable route is within reach and what an investigation would yield in your situation.