Exchanges brace as regulators turn the spotlight on crypto mixing services

In October, the U.S. Department of Treasury’s Financial Crimes Enforcement Network (FinCEN) assessed its first-ever penalty — including a fine of $60 million — against the operator of a cryptocurrency “mixer.” 

According to FinCEN, Dean Harmon illegally operated a service called Helix as an unregistered money service business between 2014 and 2017. Helix worked by “mixing” the crypto funds of multiple people before redistributing them, making those funds more difficult to track using publicly available data.

Helix sent or received more than $311 million as Harmon “advertised its services in the darkest spaces of the internet as a way for customers to anonymously pay for things like drugs, guns, and child pornography,” FinCEN said.  

Mixers have long been fixtures of the cryptocurrency world, but until recently they have not drawn much attention from regulators. Interpol first made its concerns about such crypto mixers public in 2018 and moved to shutter a mixing service the following year. But the enforcement action against Harmon seems to reflect a new reality.

Law enforcement officials are now paying much closer attention, perhaps due in part to the roles they played in a number of recent high-profile crimes, including the $4.2 billion PlusToken Ponzi scheme and the $280 million KuCoin exchange hack.

Last year, FinCEN issued guidance clarifying that it considers mixers to be “money transmitters” under the law, which requires them to register with the agency and comply with anti-money-laundering rules. 

This fall, the Department of Justice highlighted mixing services in its Cryptocurrency Enforcement Framework. And Europol called them a “top threat” in its yearly Internet Organized Crime Threat Assessment, which also called out two Bitcoin wallet-based mixing services — Wasabi Wallet and Samourai Wallet — by name.

There are no laws or regulations that specifically pertain to mixing services. No country has made it illegal, for instance, for exchanges to handle mixed funds. But since it is possible to detect funds that have been through mixing services using blockchain analytics tools, some exchanges may take extra precautions.

Ultimately, however, the complicated question of whether and how the use of mixers should be more strictly controlled is as much about financial privacy as it is about financial crime.

A 'constant arms race'

A mixer can take many forms, and over time there has been an evolution in form thanks to new technical approaches. 

Harmon’s business was a centralized service. Users could send Helix money and get new funds back, for a fee. Wasabi and Samourai, meanwhile, are wallets that use CoinJoin, a decentralized approach that combines Bitcoin payments from different spenders into a single transaction to make it more difficult for external parties to determine which user paid which recipient. 

One of the most sophisticated mixing services is Ethereum-based Tornado Cash, which uses zero-knowledge proofs to hide the connection between deposit and withdrawal addresses.

But any service that prevents the on-chain tracing of the flow of funds could be considered a mixer — even some exchanges, according to Tom Robinson, co-founder of blockchain analytics firm Elliptic. “If an exchange is not identifying its customers or keeping records of transactions, it is basically operating like a mixer.” 

Meanwhile, it hasn't been lost on compliant exchanges that law enforcement officials seem to be zeroing in on these services. That is probably why at least some of them have enlisted the services of Robinson’s Elliptic or other firms to help them detect whether new deposits have gone through mixers. 

What might an exchange do if it sees that a customer has used a mixer? First, it might take further steps to determine the nature of the funds. The customer could be asked questions about why they used a mixer, similar to the way people have to jump through extra hoops to deposit large amounts of physical cash at a bank, said Robinson.

The Block reached out to six of the most popular exchanges — Coinbase, Gemini, Binance, Bitfinex, Bitstamp and Bittrex — and asked them about how they deal with mixed funds. Two answered our questions.

A spokesperson for Coinbase said that it has “methods of identifying when mixers have been used” and that it “conduct[s] related due diligence accordingly,” but declined to comment further. 

A Bitfinex spokesperson said all digital token transactions sent and received are screened for a number of factors, including connectivity to mixers. They also said that whether a coin is from a mixer is not the only important question.

“Another relevant factor is at what point a coin goes through a mixer,” the spokesperson said. “For example, a direct connection to Bitfinex from a mixer may be a different risk than a coin being processed through a mixer several hops back.”

The other four exchanges either declined to comment or did not respond to multiple requests for comment.

Whatever measures exchanges are taking, though, mixers are continuing to evolve and are becoming harder to identify, according to Robinson. It's a "constant arms race," he said.

The other side of the coin

Besides being technically difficult, the issue is also philosophically complicated.

“There are plenty of legitimate reasons why you would want to use a mixer, for example, just to preserve your financial privacy,” said Robinson. It’s similar to why you might use physical cash, he explained. “There's no reason why the exchange should know what kind of purchases you've been making."

The problem? "It is impossible to distinguish between somebody using a mixer for financial privacy reasons and somebody using a mixer because they are laundering proceeds of crime," said Robinson. 

Turning to blockchain analytics tools to track stolen funds is “not going to solve the root of the problem,” said Bálint Harmat, CEO and co-founder of zkSNACKS, the firm behind Wasabi, in a statement shared with The Block. The "bad actors" who have taken advantage of services like Wasabi will continue to commit crimes, he said.

“Wasabi is a tool created to improve the privacy of Bitcoin users, and not intended for criminals to launder money,” Harmat said. “We prohibit and strictly reject any kind of illegal activity, as shown in our Terms & Conditions.”

Harmat said regulators should perhaps focus their attention on the crimes — particularly exchange hacks — that occur before the mixing service comes into play. “Should they not introduce stricter security protocols in order to protect user funds? Isn't user security the most important at the end of the day?”