Coin mixing services are bouncing back as users migrate to alternative platforms, according to Cambridge University

Coin Mixer Activity Surges to Highest Levels Since 2022

Recent analysis from the Cambridge Centre for Alternative Finance (CCAF) reveals that the use of coin mixers has climbed to its highest point since 2022.

Researchers Wenbin Wu and Keith Bear, in a report released Tuesday, observed a steady increase in coin mixer transactions following the Tornado Cash ban in 2022. This shift has largely been toward platforms that adhere more closely to regulatory standards.

The study highlights the dramatic effect of sanctions imposed in 2022, which caused Tornado Cash’s daily transaction volume to plummet by 97% within days. Overall, mixer transactions dropped by 48% during the same period.

From late 2022 until March 21, 2025, mixer usage remained subdued. This changed when the U.S. Treasury lifted sanctions on Tornado Cash.

While 2024 saw a modest uptick in mixer activity compared to 2023 (about 21,000 transactions versus 16,000), usage surged in 2025, reaching roughly 32,000 transactions. This is close to the 38,000 transactions recorded in 2022 and 2020. By late 2025, daily transaction counts approached 300, though they had exceeded 450 just before August 2022.

User Migration and Platform Shifts

Although transaction numbers are rebounding, Wu and Bear note that users have largely migrated to other platforms. Tornado Cash, once the dominant player, has only partially regained its market share since March of the previous year.

Currently, Railgun—a platform that employs a ‘proof-of-innocence’ mechanism to screen deposits against blacklists—handles 71% of all mixer activity.

Tornado Cash (including both Tornado Classic and Tornado Nova) accounted for 25% of mixer transactions in 2025, while Privacy Pools made up 5%.

Privacy Pools, similar to Railgun, uses association sets to verify that deposits do not originate from blacklisted addresses, but it performs these checks before withdrawals are made.

The rise of Railgun and Privacy Pools signals a trend toward more regulation-friendly mixer protocols. However, the CCAF report points out that these platforms depend on external services to identify suspicious addresses.

As blacklists are updated in real time when new exploits are discovered, there remains a window for malicious actors to move funds before restrictions take effect.

There is evidence that the speed of transactions involving mixers has increased since 2022. Most transfers now occur within 24 hours of wallet creation, whereas previously, the majority took place after a day or more.

The report notes a marked shift toward rapid deposits—under 24 hours—suggesting that users, possibly including those with illicit intent, are acting quickly to avoid detection.

Changing Sources of Mixer Deposits

Another sign of potentially unlawful activity is the near disappearance of deposits from centralized exchanges—which are typically required to follow KYC and AML rules—after the 2022 Tornado Cash sanctions.

Today, the vast majority of mixer funding—95%, up from 76% in 2020—comes from unlabelled sources, meaning addresses with no known organizational ties.

While this trend could indicate that illicit use dominates, the report’s authors clarify that mixers also serve many legitimate users.

“People use privacy tools for valid reasons, such as protecting their financial privacy, safeguarding themselves from targeted attacks (which are increasingly common among crypto holders), and maintaining business confidentiality,” explained Wenbin Wu, a Research Associate at the University of Cambridge’s CCAF.

Sanctions and Their Consequences

In an interview with Decrypt, Wu emphasized that blockchains are “extremely transparent,” and that this openness can drive legitimate users to seek privacy through mixers in certain situations.

However, Wu also observed that the 2022 sanctions unintentionally discouraged lawful users while pushing bad actors to seek out new protocols and platforms.

“Our main takeaway is that sanctions mainly deterred compliant users, while those with illicit intentions adapted—first by switching to other mixers, and more recently by using cross-chain bridges and decentralized exchanges,” Wu said.

He also acknowledged that the sanctions imposed significant operational challenges on criminal networks and encouraged a shift toward more compliant alternatives, thereby narrowing opportunities for illicit activity.

Wu added, “Newer protocols like Railgun and Privacy Pools, which screen deposits against known illicit addresses, are inherently less appealing to bad actors.”

The CCAF report references research from the Federal Reserve Bank of St Louis, which found in a 2023 study that only 30% of Tornado Cash’s traffic could be linked to illegal sources.

Nevertheless, mixers remain a favored tool among cybercriminals. A 2025 study by researchers at the University of Birmingham and the University of Sydney found that Tornado Cash was used in 78% of Ethereum-related security incidents between August 8, 2022, and March 21, 2025.