Sanctions Evasion Reference

What are mixers and chain hopping?

Breaking the traceability of on-chain funds by pooling them with other users' funds, or by moving them between blockchains, so that outputs cannot be readily linked to their inputs.

category

Digital assets

also known as

tumblers, cross-chain hopping, obfuscation services

seen in

Democratic People's Republic of Korea, Russian Federation

reviewed

2026-08-20

A public blockchain records every transaction permanently and legibly. That is a problem for anyone holding funds whose history matters, and mixing and chain hopping are the two standard responses to it.

They attack different things. Mixing attacks the link between an input and an output on the same chain. Chain hopping attacks the continuity of analysis across chains. They are frequently used together.

How mixing works

A mixer pools funds from many users and redistributes them, so that the output a user receives is not the input they contributed. Custodial mixers take deposits and pay out from a common pool. Non-custodial protocols achieve a similar effect through smart contracts and cryptographic techniques without ever holding user funds.

The analytical effect is to introduce ambiguity. Before mixing, a chain of transactions is a chain. After it, an output can only be associated with a set of possible inputs.

It is worth being precise about where mixers appear in the guidance. OFAC’s 2021 virtual currency guidance does not mention mixers at all — an earlier version of this page said it treated mixer exposure as an indicator, and that was wrong. What it does is set the general expectations: a sanctions compliance programme, geolocation and IP blocking controls1 , know-your-customer procedures1 , and the recognition of red flags as indications that illicit activity or compliance breakdowns may be occurring2 .

The document that names the technology is FATF’s virtual assets guidance, which identifies mixers and tumblers3 among the products enabling reduced transparency and increased obfuscation of financial flows4 . And several mixing services have themselves been designated, which converts the question from an inference about provenance into a direct list match.

How chain hopping works

Analytics that cluster addresses and follow transactions operate within a single ledger. Moving value to a different blockchain — through a bridge, a swap service or an exchange — breaks that continuity, because the asset that arrives is a different asset on a different ledger.

Reconstructing the link requires identifying the bridge transaction and matching what went in against what came out, which is possible but is a separate piece of work for each hop, and each hop imposes cost and delay on the investigator. That cost is the entire benefit of the technique.

Why neither is a solution

Both techniques have the same limitation: they obscure history, and history is not the only thing that matters.

Mixing does not create clean funds; it creates funds with a documented association with a mixer, which is itself a red flag and, where the mixer is designated, a direct violation. Chain hopping does not remove the requirement to eventually convert to currency through a service that identifies its customers.

Both therefore delay attribution rather than defeat it, and both leave a distinctive signature: movement whose only apparent purpose is the reduced transparency and increased obfuscation of financial flows that FATF describes4 .

The fullest published account of the sequence is the UN Panel of Experts’ final report, which sets out the laundering patterns it observed as a list: theft of multiple assets, hundreds to thousands of intermediary addresses5 , increasing use of chain hopping6 , bridging, instant exchange services, and mixers and privacy protocols7 . Read in order it is a description of exactly the cost-imposing sequence described above, compiled from observed operations rather than inferred.

How it is caught

Designation. Where the service is listed, the analysis is a list match, not an inference.

Statistical de-anonymisation. Mixers are not perfect. Amount correlation, timing correlation and pool-size limitations all leak information, and published research has repeatedly reduced the anonymity set of specific implementations.

Bridge reconstruction. Cross-chain movements are recorded on both chains. Matching amounts and timings across the two ledgers reconstructs the hop, and analytics providers increasingly do this automatically.

Behavioural signature. Rapid movement across several chains with no economic purpose beyond breaking traceability is itself an indicator, and it is one the pattern cannot avoid producing.

The endpoint. Whatever is done in the middle, the funds must eventually reach a service that identifies its customers. Investigations that cannot reconstruct the path often succeed by working backwards from the exit.

The Multilateral Sanctions Monitoring Team, which replaced the Panel of Experts, names the whole infrastructure in one line of its 2025 report, recommending oversight of the cryptocurrency exchanges, swap services, mixers, bridges and cross-chain aggregators that have consistently been used to transfer cryptocurrency in violation of the assets freeze8 . Swap services and cross-chain aggregators are the chain-hopping layer; naming them alongside mixers is the monitoring body treating the two techniques on this page as one problem.

What the sources say

Each numbered claim above, with the words of the document it rests on and — for the Panel of Experts reports — the paragraph it comes from. Quotes are checked against the source text at build time.

  1. “know your customer (kyc) procedures”

    Sanctions Compliance Guidance for the Virtual Currency Industry. U.S. Department of the Treasury, Office of Foreign Assets Control, 2021.

  2. “red flags are indications that illicit activity or compliance breakdowns may be occurring”

    Sanctions Compliance Guidance for the Virtual Currency Industry. U.S. Department of the Treasury, Office of Foreign Assets Control, 2021.

  3. “mixers and tumblers”

    Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers. Financial Action Task Force, 2021.

  4. “reduced transparency and increased obfuscation of financial flows”

    Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers. Financial Action Task Force, 2021.

  5. “Hundreds to thousands of intermediary addresses”

    Report of the Panel of Experts established pursuant to resolution 1874 (2009). United Nations Security Council, 2024, para. 182, laundering (layering) patterns.

  6. “Increasing use of chain hopping”

    Report of the Panel of Experts established pursuant to resolution 1874 (2009). United Nations Security Council, 2024, para. 182, laundering (layering) patterns.

  7. “Mixers and privacy protocols”

    Report of the Panel of Experts established pursuant to resolution 1874 (2009). United Nations Security Council, 2024, para. 182, laundering (layering) patterns.

  8. “cryptocurrency exchanges, swap services, mixers, bridges, and cross-chain aggregators that DPRK cyber actors have consistently used to transfer cryptocurrency in violation of the assets freeze”

    The DPRK's Violation and Evasion of UN Sanctions through Cyber and Information Technology Worker Activities (MSMT/2025/2). Multilateral Sanctions Monitoring Team, 2025, p. 10, Recommendation 11.

Red-flag indicators

4 listed
01 A firm holds internet protocol address information about its users but does not use it to screen for and prevent potential sanctions violations. OFAC, 2021
“did not use the ip address information it collected”

OFAC, Sanctions Compliance Guidance for the Virtual Currency Industry (2021). Read the source document

02 Customer information obtained at onboarding and through the relationship is not used to conduct due diligence sufficient to mitigate sanctions risk. OFAC, 2021
“know your customer (kyc) procedures”

OFAC, Sanctions Compliance Guidance for the Virtual Currency Industry (2021). Read the source document

03 Value moves through anonymity-enhanced cryptocurrencies, mixers and tumblers, decentralised platforms or privacy wallets that reduce transparency and increase obfuscation of financial flows. FATF, 2021
“mixers and tumblers”

FATF, Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs (2021). Read the source document

04 Products and services are used specifically because they enable or allow for reduced transparency and increased obfuscation of financial flows. FATF, 2021
“reduced transparency and increased obfuscation”

FATF, Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs (2021). Read the source document

Each indicator above is quoted or paraphrased from the advisory or typology report named beside it. Expand a row for the citation. These are recognition aids drawn from published guidance, not a compliance checklist.

How it is detected

Where the service is itself designated, the question collapses into a list match rather than an inference. Otherwise, mixers leak: amount correlation, timing correlation and pool-size limits have repeatedly been used in published research to reduce the anonymity set of specific implementations. Cross-chain hops are recorded on both ledgers, so matching amounts and timings across them reconstructs the movement, and analytics providers increasingly automate this. The pattern also cannot avoid producing its own signature — rapid multi-chain movement with no economic purpose beyond obfuscation. Failing all of that, investigators work backwards from the off-ramp, which identifies its customers.

Enforcement record

Documented outcomes on this site that turned on this technique.
Case Outcome Authority Date Penalty
Blender, Tornado Cash and Sinbad: designating the mixers 2022–2023 Designation

Related techniques

Where this appears

Sanctions programmes

  • North Korea sanctions — The most comprehensive UN-mandated regime, prohibiting most trade with North Korea, backed by Panel of Experts reporting that documents evasion in unusual detail.
  • Russia sanctions — Measures imposed from 2014 and greatly expanded from 2022, combining designations, sectoral restrictions, export controls and a price cap on seaborne oil.

Jurisdictions in the published record

  • Hong Kong — A major financial and trading centre whose company formation regime, banking sector and re-export role place it in a large share of published corporate concealment cases.

Terms used on this page

  • Mixer — A service that pools virtual currency from many users and redistributes it, so that outputs cannot be readily linked to the inputs that funded them.
  • Chain hopping — Moving value rapidly between different blockchains, usually through bridges or swap services, to interrupt tracing that works within a single chain.
  • Blockchain analytics — The practice of clustering addresses and attributing them to real-world services or actors, using on-chain patterns and off-chain information.
  • Virtual asset service provider — A business that exchanges, transfers, safekeeps or administers virtual assets for others, and which FATF expects to be licensed and supervised like other financial institutions.
  • Layering — Inserting successive intermediate parties, transactions or jurisdictions between an asset and its owner so that the connection cannot be established from any single record.

Further reading and sources

  1. Sanctions Compliance Guidance for the Virtual Currency Industry. U.S. Department of the Treasury, Office of Foreign Assets Control, 2021.
  2. Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers. Financial Action Task Force, 2021.
  3. Crypto Crime Report. Chainalysis, 2024.
  4. Reports of the Panel of Experts, 1718 Committee (Democratic People's Republic of Korea). United Nations Security Council, 2024.
  5. Specially Designated Nationals and Blocked Persons List (SDN.XML). OFAC Sanctions List Service, 2026.