Can cryptocurrency mixers adjust to endure legal actions from U.S. authorities?

Tornado Cash — a cryptocurrency mixing service that conceals the origins of crypto transactions — garnered attention after being sanctioned by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) in August 2022.

The mixer sparked significant discussion regarding the function of mixers in safeguarding personal financial privacy when utilizing cryptocurrencies.

U.S. authorities have maintained sanctions against such services, with Sinbad.io being the latest significant entity to face OFAC sanctions. Both Tornado Cash and Sinbad have been dismantled by the FBI, with the U.S. Treasury accusing them of enabling billions of dollars in illegal transactions, particularly linked to the North Korea-based hacking group Lazarus.

An anonymous spokesperson from the mixing service Mixero informed Cointelegraph that mixers like Tornado Cash and Sinbad are favored by North Korean hackers due to their “substantial cryptocurrency reserves, which allow North Korea to transfer large sums at once, thereby saving time.”

Despite their controversial reputation, mixers offer a legitimate service by maintaining the privacy of cryptocurrency transactions. However, the use of mixers by criminals to launder millions of dollars could jeopardize the legitimate use of these services by regular users seeking financial privacy in their cryptocurrency transactions.

The role of mixers in financial privacy

Cryptocurrencies have developed in their characteristics and applications, yet they are still frequently perceived by the general public as synonymous with a completely private medium for illicit activities.

Contrary to this belief, cryptocurrencies are not entirely anonymous. The underlying blockchain technology for most leading cryptocurrencies operates as an open ledger where all transactions are visible.

For instance, Bitcoin (BTC), the most widely used cryptocurrency, is only pseudo-anonymous. BTC addresses do not inherently disclose their owner’s identity, providing a degree of privacy.

However, if a specific transaction is linked to an individual’s identity, all past and future transactions can be traced back to that person. Convertible virtual currency (CVC) mixing — the service offered by crypto mixers — was developed for this fundamental reason.

There are numerous scenarios where individuals may desire financial privacy, such as ordering food delivery and paying with cryptocurrency. The courier or delivery service should not have access to your daily transactions or the total amount in your wallet. In such instances, a mixer can sever the connection between the sender and the recipient.

More serious examples include the desire to keep one’s salary confidential or to prevent criminals from knowing one’s total wealth. There are also extreme situations where a mixer could be life-saving, such as preventing a totalitarian regime from identifying individuals who contributed to an LGBTQ+ cause or supported a journalist critical of the government.

In these contexts, mixers can anonymize cryptocurrencies to ensure financial privacy and security.

Can mixers guarantee safety for financial privacy?

Mixers enhance privacy in cryptocurrency transactions by pooling and blending funds from multiple users, making it difficult to trace the origins of specific coins. This disrupts the transaction trail, enhancing fungibility and anonymizing the source of cryptocurrencies to bolster user privacy.

Even though mixers strive to anonymize all crypto transactions, the shutdowns of Sinbad and Tornado Cash illustrate how authorities can still track this anonymizing technology.

Recent: Over $300M in stolen crypto assets reached Bitcoin mixers in 2023

Jason Somensatto, head of North America public policy at blockchain analytics firm Chainalysis, stated to Cointelegraph that mixers cannot guarantee privacy: “I would clarify that mixers do not erase the trail. In many instances, Chainalysis can trace through mixing services and identify a user’s outputs. Furthermore, all transactions are permanently recorded on the blockchain. Thus, even if an illicit actor uses a service to effectively obscure their activity today, it may be traced in the future as tracing technology continues to advance.”

If a fundamental aspect of blockchain technology is its public ledger and mixers may not be foolproof, why do criminals continue to use cryptocurrencies for money laundering? Somensatto explained:

“Bad actors utilize cryptocurrencies for the same reasons that legitimate users do — they are user-friendly, cross-border, instantaneous, and liquid. Even when a criminal is aware of crypto’s transparency and traceability, they may determine that these advantages outweigh the risks.”

U.S. policy against mixer services

In October 2023, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) announced its intention to target mixers “as a class of transactions of primary money laundering concern.”

This policy aims to enhance transparency regarding mixers to combat their misuse by malicious entities, “including groups like Hamas, Palestinian Islamic Jihad, and the Democratic People’s Republic of Korea (DPRK),” as detailed in the document. According to FinCEN director Andrea Gacki:

“CVC mixing provides a crucial service that enables participants in the ransomware ecosystem, rogue state actors, and other criminals to finance their illegal activities and obscure the flow of ill-gotten gains […].”

FinCEN will pursue any of these services “within or involving jurisdictions outside the United States.” The U.S. has already extended its reach internationally, exemplified by the controversial arrest of the Tornado Cash developer in Amsterdam and collaboration with Dutch authorities to dismantle Sinbad.io.

The concern for U.S. authorities may not solely be the mixer service itself but rather its largest clientele.

As Chainalysis’s on-chain data analysis indicates, Sinbad has processed over $24 million of stolen assets from the Lazarus Group, including Ether (ETH) and BTC from the Axie Infinity and Horizon Bridge hacks.

The U.S. sanctions crypto mixer Sinbad.io for its involvement in North Korean laundering activities. Source: Chainalysis

Disabling an international mixer is a complex task. While many clearnet websites — accessible via standard web browsers — have ceased to exist, Sinbad’s dark web site remains operational. Tornado Cash has also been reintroduced in the clearnet, albeit with a revised approach and some compliance mechanisms.

Regardless, with U.S. authorities pursuing them, users of illicit mixers may have already transitioned, indicating a potential end for Sinbad.

Sinbad’s clearnet site is no longer operational. Source: Sinbad.io

In February 2023, the pseudonymous founder of Sinbad, Mehdi, described the mixer as a legitimate privacy-preserving technology initiative. He likened its service to privacy-centric cryptocurrencies like Monero (XMR) or Zcash (ZEC), as well as anonymity-enhancing crypto wallet software such as Wasabi or the Tor browser, which encrypts user traffic and routes it through multiple servers to conceal identities.

The right to financial privacy is a primary motivation for the creators of mixers. The Mixero representative stated:

“We believe that the U.S. sanctions targeting mixers like Tornado Cash or Sinbad are not only unwarranted but also infringe upon human privacy rights. Moreover, it is puzzling why mixers are specifically targeted, especially given the existence of fully anonymous cryptocurrencies like Monero. This raises questions about the justification for these actions against mixers.”

Protecting privacy: Can mixers address misuse?

Complete freedom, as a pure libertarian might desire, comes at a cost. A mixer adhering to a zero-control policy may possess legitimate values but can also be exploited by sanctioned groups like DPRK hackers, bringing the mixer under regulatory scrutiny.

So, should average users steer clear of mainstream mixers? What if mixers could establish barriers to prevent certain groups that attract attention from U.S. authorities, such as the Lazarus Group? Is this a viable option?

The Mixero spokesperson indicated that the only way to appease legislators would be to implement Know Your Customer standards, “but this contradicts the very purpose for which a mixer was created.”

On the other hand, Somensatto mentioned that there are mechanisms mixers can adopt, “including utilizing Chainalysis tools to monitor transactions and receive alerts regarding exposure to illicit sources.” He added, “Generally speaking, mixing service providers can evade enforcement actions by establishing a robust AML/CFT [Anti-Money Laundering/Combating the Financing of Terrorism] program, which fundamentally serves to prevent the laundering of money by illicit actors and sanctioned entities.”

The Mixero representative remarked, “Implementing these methods would contradict our policy.” Once again, the ideology of anonymity clashes with the tools for preventing money laundering.

Financial privacy as a human right

Many within the cryptocurrency community regard financial privacy as a human right. However, currently, few governing bodies acknowledge it as such.

The United Nations has an extensive list of “rights inherent to all human beings.” While financial privacy is not explicitly listed as a human right, privacy itself is. For some, it may be reasonable to infer financial privacy by extension. What does the law say?

Magazine: Terrorism & Israel-Gaza war weaponized to destroy crypto

Suzanne Ulrich, a privacy attorney and consultant based in the Netherlands, informed Cointelegraph that there are robust laws that pertain to financial privacy:

“In Europe, individuals are safeguarded by various laws, such as the Convention for the Protection of Human Rights and Fundamental Freedoms and the General Data Protection Regulation. Alongside these European umbrella protections, numerous countries have also enshrined privacy rights in their constitutions. In the United States, there is also a right to privacy, but financial privacy is less universally protected than in Europe. In the U.S., financial privacy is governed by laws enacted at both the federal and state levels.”

The law strongly upholds the human right to privacy, yet financial privacy may be less clearly defined. Therefore, are privacy protection laws adequate to justify the existence and legitimacy of mixer services?

Mixers have developed an unfavorable reputation over the years as they have opened their doors to any individual. To improve their image, they may need to devise strategies to exclude illicit actors, and their survival may hinge on this.