Smart contract mixers: hard to police?

As of September 2026: Roman Storm's retrial on the money laundering and sanctions counts is set for April 26, 2027. His acquittal motion is undecided and he has not been sentenced. FinCEN's October 2023 mixing proposal is still listed as a proposed rule; no final rule was found.

A smart contract mixer is a mixing service written as code on a blockchain instead of run as a business. People send coins into a public contract and later withdraw to a different address, and cryptography hides which deposit matches which withdrawal. It is hard to police because nobody runs it: once deployed, it keeps working with no owner to arrest, subpoena or shut down.

How is it different from a custodial mixer?

A custodial mixer, such as Bitcoin Fog, Helix or ChipMixer, is a company in practice. An operator takes your coins, pays out from a common pool and keeps servers, domains and bank or payment links. Every one of those is something police can seize. ChipMixer’s domains and servers were taken in March 2023. Bitcoin Fog’s operator was sentenced to 12 years and 6 months in 2024, and Helix’s operator to three years.

A smart contract mixer moves those jobs into software. Tornado Cash, the best-known example, was a set of contracts that could not be changed once deployed. Our Tornado Cash case page has the full story, and the crypto mixers guide covers the mechanics.

Why is “no operator” such a problem for enforcement?

Most anti-money-laundering law works through intermediaries. Banks and exchanges hold customer funds, verify identities and file reports. A VASP that gets a subpoena can hand over records. Code holds no records and answers no letters.

That leaves two awkward options: go after the code itself, or go after the people who wrote it. Both have been tried, and both have run into limits.

What have regulators and courts done?

The record so far, in order:

• August 8, 2022. OFAC sanctioned Tornado Cash, saying it had been used to launder more than US$7 billion since 2019. It was the first sanction on a decentralized protocol.
• October 2023. FinCEN proposed treating crypto mixing as a class of transactions of primary money laundering concern, which would add record-keeping and reporting duties for US financial institutions. It is still listed as a proposal.
• November 2024. Bitcoin Fog and Helix operators were sentenced, showing that custodial mixers carry ordinary criminal liability.
• November 26, 2024. In Van Loon v. Department of the Treasury, the Fifth Circuit held that Tornado Cash’s immutable smart contracts are not “property” under the sanctions statute, because no one can own or control them. OFAC had exceeded its authority.
• March 21, 2025. OFAC removed Tornado Cash from its sanctions list.
• August 2025. A jury convicted co-founder Roman Storm of conspiracy to operate an unlicensed money transmitting business and deadlocked on the money laundering and sanctions counts.
• November 2025. Samourai Wallet founders Keonne Rodriguez and William Hill, who had pleaded guilty to the same unlicensed money transmitting conspiracy, were sentenced to five and four years.
• August 2026. The judge set Storm’s retrial for April 26, 2027. His acquittal motion remains undecided.

Notice the split. Sanctioning the code failed in court. Charging people has worked when they pleaded guilty or ran a custodial service, and remains open when a developer contests it.

What can investigators still see?

A smart contract hides the link inside the pool, not the edges around it. Blockchains are public, so investigators can still see which addresses deposited, how much and when. They can see where withdrawals went next, and whether one landed at an exchange. Blockchain analytics tools use that timing and those amounts to narrow the possibilities. A thief who empties a hacked wallet into a mixer within hours of an exploit, then sends matching amounts to a fresh address that reaches an exchange, leaves a pattern even if no single link is proven.

Investigators also rely on the rest of the chain. Mixing is usually one step among swaps across networks and cash-outs, and every step that touches a regulated service creates records.

What do exchanges do?

Exchanges are the choke point. Compliance teams screen deposits for exposure to mixer addresses and hacks, and may delay, refuse or report a deposit that shows it. Exposure alone does not prove crime, but it raises the risk score and the questions asked of the customer. Because these platforms must know their customers, a cash-out gives investigators a name where the mixer gave none.

Is privacy a legitimate reason to use one?

Yes, and that is why the law is unsettled. Public ledgers expose salaries, donations and purchases to anyone who learns an address. Developers and privacy advocates argue that writing privacy software should not make an author liable for what strangers do with it. Prosecutors answer that stolen funds, including hundreds of millions attributed to North Korea’s Lazarus Group, flowed through these tools and that some builders knew it. Both positions are being tested in court, and a ruling on the Storm retrial could shape how far criminal law reaches the people who write privacy code.