In brief
- Researchers from the Cambridge Centre for Alternative Finance have found that the use of coin mixers rose significantly last year, following the lifting of sanctions against Tornado Cash.
- Data indicate that most users have migrated to new mixing protocols, with Railgun now accounting for 71% of all transaction volume.
- The available metrics suggest that a significant proportion of mixer usage remains illicit, and that Tornado Cash usage remained high amongst bad actors even after the 2022 ban.
Usage of coin mixers has reached its highest level since 2022, according to new research from the Cambridge Centre for Alternative Finance (CCAF).
In an article published on Tuesday, researchers Wenbin Wu and Keith Bear reported that transactions for coin mixers have been rising since the 2022 Tornado Cash ban, as users migrate primarily to more compliant platforms.
The report notes the massive impact sanctions had in 2022 and beyond, with Tornado Cash’s daily transactions falling by 97% in a matter of days, while transactions for mixers as a whole dropped by 48%.
Usage remained low between late 2022 and March 21, 2025, when the U.S. Treasury removed its sanctions against Tornado Cash.
While 2024 did record a modest rise in transactions in relation to 2023 (c. 21,000 vs 16,000), 2025 witnessed a significant increase in usage, as total transactions rose to approximately 32,000.
This compares with approximately 38,000 in 2022 (and 2020), while daily numbers climbed close to 300 in late 2025, having topped 450 just prior to August 2022.
Users on the move
Numbers have been steadily recovering, yet Wu and Bear report that users have shifted to alternative platforms, and that Tornado Cash’s formerly dominant market share has recovered only modestly since March of last year.
Railgun, which uses a ‘proof-of-innocence’ system to check deposits against blacklists, now accounts for 71% of all activity.
It’s followed by Tornado Cash (both Tornado Classic and Tornado Nova), which accounted for 25% of transactions in 2025, and then by Privacy Pools, which accounted for 5% of all mixer transactions.
Similar to Railgun, Privacy Pools employs association sets to prove that deposits came from non-blacklisted sources, although it checks provenance prior to withdrawals.
While the growth of Railgun and Privacy Pools indicates a shift to more compliant mixer protocols, the CCAF report notes that such platforms rely on external providers to flag addresses.
In other words, blacklists “are updated dynamically as new exploits are identified,” providing some opportunity for bad actors to move funds to (and from) them quickly, before it becomes impossible.
There is some indication that transactions to and from mixers have accelerated in the post-2022 landscape: most transactions now occur within 24 hours of wallet creation, whereas pre-2022 most transactions happened after 24 hours.
Noting that “users shifted dramatically toward fast deposits under 24 hours,” the article then goes on to state that such “fast behaviour is consistent with users seeking to avoid identification, a profile more likely to include illicit actors.”
Also pointing to a potentially illicit source of transactions is the fact that, after the 2022 sanctions against Tornado Cash, deposits from centralized exchanges—which generally have to comply with KYC and AML regulations—virtually vanished.
Most deposits now come from unlabelled sources, which are addresses with no recorded entity associations, and which now account for 95% of all funding to mixers (up from 76% in 2020).
While this may suggest that use of mixers remains predominantly illicit, the report’s authors do affirm that such platforms also attract significant numbers of legitimate users.
“Legitimate motivations for using privacy tools include personal financial privacy, protection from targeting (physical attacks on crypto holders are a well-documented and growing problem), and commercial confidentiality,” said Wenbin Wu, who is a Research Associate at the University of Cambridge’s Cambridge Centre for Alternative Finance.
The effect of sanctions
Speaking to Decrypt, Wu emphasized that blockchains are “radically transparent,” and that such transparency—and permanent visibility—can lead legitimate users to seek out mixers in certain cases.
Yet Wu also states that the 2022 sanctions had the somewhat perverse effect of scaring off legit users, while forcing bad actors to find new channels and protocols.
He said, “The key finding is that sanctions primarily deterred compliant users while illicit actors adapted, initially to alternative mixers, and more recently to cross-chain bridges and decentralised exchanges altogether.”
Having said that, Wu acknowledges that the sanctions imposed “meaningful operational costs” on illicit networks and precipitated the shift to compliant alternatives, providing less scope for bad actors to operate.
He added, “The newer protocols like Railgun and Privacy Pools, which screen deposits against known illicit addresses, are by design less attractive to bad actors.”
CCAF’s report cites research from the Federal Reserve Bank of St Louis, which in a 2023 paper concluded that only 30% of Tornado Cash traffic could be shown to have derived from illegitimate sources.
However, there’s no doubt that mixers remain popular among cybercriminals, with a 2025 paper from researchers at the University of Birmingham and the University of Sydney finding that hackers continued to use Tornado Cash in 78% of Ethereum-related security incidents between August 8, 2022 and March 21, 2025.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Related: More from Security & Hacks | DOJ Seizes $580M Crypto from Chinese Actors | Minnesota Considers Banning Cryptocurrency Kiosks Due to Scams
