Tornado Cash — a cryptocurrency mixer service that can hide the origin of crypto transactions — hit the headlines after being sanctioned by the United States Department of the Treasury’s Office of Foreign Assets Control (OFAC) in August 2022.
The mixer opened Pandora’s box, igniting an open debate about the role of mixers in ensuring personal financial privacy when using cryptocurrencies.
U.S. authorities have continued sanctions against these services, with Sinbad.io being the most recent big player under OFAC sanction. Tornado Cash and Sinbad have been taken down by the FBI, with the U.S. Treasury accusing them of facilitating billions of dollars in illicit transactions, particularly those of North Korea-based hacking group Lazarus.
An anonymous representative of mixing service Mixero told Cointelegraph that mixers, such as Tornado Cash and Sinbad, are popular with North Korean hackers because of their “substantial cryptocurrency reserves, which enable North Korea to transfer large amounts at once, thus saving time.”
Despite their reputation, mixers provide a legitimate service by keeping cryptocurrency transactions private. However, criminals using mixers to launder millions of dollars may threaten the legitimate use of these services by ordinary users seeking financial privacy when using cryptocurrencies.
The role of mixers in financial privacy
Cryptocurrencies have evolved in their properties and usage, but currently, for the mainstream audience, they are still often seen as synonyms for a totally private medium for illicit activities.
Contrary to this misconception, cryptocurrencies are not fully anonymous. The underpinning blockchain technology for most of the top cryptocurrencies is an open ledger in which all transfers are public.
For example, the most popular cryptocurrency, Bitcoin (BTC), is only pseudo-anonymous. BTC addresses don’t necessarily reveal their owner’s identity, which provides a layer of privacy.
However, if a unique transfer is linked to their identity, all historical past transfers and future movements can be tracked to that individual. Convertible virtual currency (CVC) mixing — the service provided by crypto mixers — was created for that core reason.
There are many instances where citizens might want financial privacy, such as ordering delivery food and paying with cryptocurrency. The courier or the delivery company shouldn’t be able to see your daily transactions or the total money in your wallet. In this case, a mixer can interrupt the chain between the recipient and the sender.
Other more serious examples include not wanting your salary to be public or letting criminals know your total wealth. There are also extreme cases in which a mixer could save a life, such as avoiding a totalitarian regime to be able to see who donated to an LGBTQ+ cause or endorsed a journalist critical of the government.
In such situations, mixers can anonymize cryptocurrencies to provide financial privacy and safety.
Can mixers guarantee safety for financial privacy?
Mixers enhance privacy in cryptocurrency transactions by pooling and mixing multiple users’ funds, making it challenging to trace the origin of specific coins. This breaks the transaction trail, increasing fungibility and anonymizing the source of cryptocurrencies to improve user privacy.
Even if mixers ensure that all crypto transactions are anonymized, the closures of Sinbad and Tornado Cash demonstrate how authorities can still track this anonymizing tech.
Recent: Over $300M in stolen crypto assets reached Bitcoin mixers in 2023
Jason Somensatto, head of North America public policy at blockchain analytics firm Chainalysis, told Cointelegraph that mixers can’t provide a guarantee of privacy: “I would clarify that mixers do not delete the trail. In many cases, Chainalysis can trace through mixing services and detect a user’s outputs. Further, all transactions are captured permanently on the blockchain. So even if an illicit actor uses a service to effectively obfuscate their activity today, it may be traced in the future as tracing technology continues to improve.”
If an intrinsic feature of blockchain technology is its public ledger and mixers may not be impenetrable, why do criminals still use cryptocurrencies to launder money? Somensatto explained:
“Bad actors use cryptocurrencies for the same reasons people use them for legitimate purposes — they’re easy to use, cross-border, instantaneous and liquid. Even in cases where a criminal understands crypto’s transparency and traceability, they may decide that these benefits outweigh the risks.”
U.S. policy against mixer services
In October 2023, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) stated its intention to target mixers “as a class of transactions of primary money laundering concern.”
The policy seeks to enhance transparency over mixers to combat their exploitation by malicious actors, “including groups like Hamas, Palestinian Islamic Jihad and the Democratic People’s Republic of Korea (DPRK),” as outlined in the document. In the words of FinCEN director Andrea Gacki:
“CVC mixing offers a critical service that allows players in the ransomware ecosystem, rogue state actors, and other criminals to fund their unlawful activities and obfuscate the flow of ill-gotten gains […].”
FinCEN will pursue any of these services “within or involving jurisdictions outside the United States.” The U.S. has already stepped abroad, with the controversial arrest of the developer of Tornado Cash in Amsterdam and collaborating with Dutch authorities to take down Sinbad.io.
The issue for U.S. authorities may not strictly be the mixer service itself but rather its largest clients.
As Chainalysis’s on-chain data analysis reveals, Sinbad has managed over $24 million of stolen funds from the Lazarus Group, including Ether (ETH) and BTC from the Axie Infinity and Horizon Bridge hacks.
Taking down an international mixer is not easy. While the clearnet website — the site conventional web browsers can access — many no longer exist, Sinbad’s dark website is still operational. Tornado Cash has also been relaunched in the clearnet, though it has changed its approach and offered some compliance mechanisms.
Either way, with the U.S. authorities on their tail, illicit mixer users may have already migrated, signaling the possible end for Sinbad.
Speaking to reporters in February 2023, pseudonymous Sinbad founder Mehdi described the mixer as a legitimate privacy-preserving technology project. He compared its service to privacy-focused cryptocurrencies Monero (XMR) or Zcash (ZEC), anonymity-enhancing crypto wallet software like Wasabi or the Tor browser, which encrypts user traffic and routes it through multiple servers to hide people’s identities.
Financial privacy rights are a primary driver for the creators of the mixers. The Mixero representative explained:
“We hold the view that the U.S. sanctions targeting mixers such as Tornado Cash or Sinbad are not only unjustified but also represent an infringement on human privacy rights. Additionally, it’s perplexing why mixers are singled out, especially considering the existence of fully anonymous cryptocurrencies like Monero. This raises questions about the rationale behind these actions against mixers.”
Protecting privacy: Can mixers address misuse?
Total freedom, as a pure libertarian would want, has a price. A mixer following a zero-control policy may have legitimate values and can also be used by sanctioned groups like DPRK hackers, bringing the mixer under regulatory scrutiny.
So, should ordinary users avoid mainstream mixers? What if mixers could implement barriers to block certain groups that draw attention from U.S. authorities, such as the Lazarus Group? Is this feasible?
According to the Mixero spokesperson, the only way to satisfy legislators would be to implement Know Your Customer standards, “but this goes against the very purpose of what a mixer is created for.”
Conversely, Somensatto said that there are mechanisms that mixers can implement, “including using Chainalysis tools to monitor transactions and be notified of exposure to illicit sources.” He added, “Broadly speaking, mixing service providers can avoid being subject to enforcement actions by implementing a robust AML/CFT [Anti-Money Laundering/Combating the Financing of Terrorism] program, which, at its core, is a mechanism to prevent the laundering of money by illicit actors and sanctioned entities.”
The Mixero representative said, “Adopting these methods would be against our policy.” Yet again, anonymity ideology crashes with money laundering prevention tools.
Financial privacy as a human right
Many in the cryptocurrency space consider financial privacy a human right. But at the moment, few governing bodies recognize it as such.
The United Nations has an extensive list of “rights inherent to all human beings.” Financial privacy does not explicitly appear as a human right, but privacy does. For some, it could be reasonable to include financial privacy by extension. What about the law?
Magazine: Terrorism & Israel-Gaza war weaponized to destroy crypto
Suzanne Ulrich, a privacy lawyer and consultant based in the Netherlands, told Cointelegraph that there are solid laws that apply to financial privacy:
“In Europe, people are protected by various laws, such as the Convention for the Protection of Human Rights and Fundamental Rights and the General Data Protection Regulation. In addition to these European umbrella protections, many countries have also included privacy rights in their constitutions. In the United States, there is also the right to privacy, but financial privacy is less generally protected than in Europe. In the United States, financial privacy is regulated through laws enacted at the federal and state level.”
The law firmly protects the human right to privacy, but financial privacy may be vague. Therefore, are privacy protection laws sufficient to justify the existence and legitimacy of mixer services?
Mixers have gained an unpopular image over the years as they have opened the saloon doors to any drifter in town. To clean up their image, they may need to find strategies to bar entry to illicit actors, and their survival may depend on it.