Police shut down cryptocurrency mixer linked to laundering more than $3 billion in criminal funds

North Korean hackers alone used the tool to launder bitcoin worth more than $700 million.
Bitcoins on a conveyor belt. (Vector illustration)

European and U.S. law enforcement officials announced on Wednesday that they have taken down a cryptocurrency mixer responsible for processing transactions worth more than $3 billion linked to criminal activity, including those by Russian and North Korean hackers.

Cryptocurrency mixers tumble funds from different accounts to help users obfuscate their origins. The entity shut down this week, ChipMixer, served as a critical node in laundering money from criminal schemes and attracted a significant clientele, according to a Justice Department press release.

Among ChipMixer’s alleged users were North Korean hackers, who used the service to launder over $700 million in bitcoin associated with a pair of high-profile heists, the breach of the Axie Infinity video game’s Ronin Bridge and Horizon Bridge, a cryptocurrency transfer tool. Hackers affiliated with Russia’s military intelligence unit used the service to purchase malware infrastructure. The mixer processed transactions linked to more than three dozen ransomware schemes.

ChipMixer also served as a prominent financial tool for darknet markets and their intermediaries, processing roughly $200 million in bitcoin associated with these online markets, including more than $60 million in bitcoin from customers of Hydra Market before German and U.S. law enforcement shut it down in April 2022. The mixer was also reportedly used to transfer funds stolen from FTX after its collapse in November.


The operation to shut down ChipMixer included the court-authorized seizure of two domains and a GitHub account belonging to ChipMixer by U.S. law enforcement and the seizure of back-end services and more than $46 million in cryptocurrency by German authorities. Minh Quốc Nguyễn, a Vietnamese national who began operating the ChipMixer infrastructure around August 2017, was charged Wednesday in Philadelphia with money laundering, operating an unlicensed money-transmitting business and identity theft connected to the operation.

“Criminals have long sought to launder the proceeds of their illegal activity through various means,” Jacqueline Maguire, special agent in charge at the FBI Philadelphia Field Office said in a statement. “Technology has changed the game, though, with a site like ChipMixer and facilitator like Nguyen enabling bad actors to do so on a grand scale with ease.”

A Justice Department complaint alleges that Nguyễn posted in online forums about his disdain for anti-money laundering and reporting requirements for financial institutions.

The takedown is the latest in a string of international operations to shutter cryptocurrency infrastructure alleged to be involved in laundering criminal proceeds. In January U.S. authorities arrested the Russian national running Bitzlato, a cryptocurrency exchange that also processed dark net funds and flouted reporting requirements. In 2021, U.S. law enforcement arrested the operators of BitcoinFog and Helix respectively, leading to the mixers shutting down.

According to cryptocurrency forensics firm Chainalysis illicit cryptocurrency activity reached an all-time high in 2022, due in part to more aggressive action by the U.S. government in sanctioning cryptocurrency entities, including the mixer Tornado Cash.

Tonya Riley

Written by Tonya Riley

Tonya Riley covers privacy, surveillance and cryptocurrency for CyberScoop News. She previously wrote the Cybersecurity 202 newsletter for The Washington Post and before that worked as a fellow at Mother Jones magazine. Her work has appeared in Wired, CNBC, Esquire and other outlets. She received a BA in history from Brown University. You can reach Tonya with sensitive tips on Signal at 202-643-0931. PR pitches to Signal will be ignored and should be sent via email.

Latest Podcasts