Authorities Shut Down ChipMixer Platform Tied to Crypto Laundering Scheme

Mar 16, 2023Ravie LakshmananCyber Crime / Cryptocurrency

A coalition of law enforcement agencies across Europe and the
U.S. announced^[1]
the takedown of ChipMixer, an unlicensed cryptocurrency mixer that
began its operations in August 2017.

“The ChipMixer software blocked the blockchain trail of the
funds, making it attractive for cybercriminals looking to launder
illegal proceeds from criminal activities such as drug trafficking,
weapons trafficking, ransomware attacks, and payment card fraud,”
Europol said^[2]
in a statement.

The coordinated exercise, besides dismantling the clearnet and
dark web websites associated with ChipMixer, also resulted in the
seizure of $47.5 million in Bitcoin and 7 TB of data.

Mixers, also called tumblers, offer full
anonymity^[3] for a fee by commingling
cryptocurrency from different users – both legitimate and
criminally-derived funds – in a manner that makes it hard to trace
the origins.

This is achieved by funneling different payments into a single
pool before splitting up each amount and transmitting them to
designated recipients, thereby turning it into an attractive option
for criminals looking to cash out and exchange the tainted money
for fiat currency.

According to a report^[4]
from Chainalysis in January 2023, “mixers processed a total of $7.8
billion in 2022, 24% of which came from illicit addresses,” and
“the vast majority of illicit value processed by mixers is made up
of stolen funds, the majority of which were stolen by North
Korea-linked hackers.”

ChipMixer, the world’s largest centralized crypto mixer service,
is estimated to have laundered no less than $3.75 billion worth of
digital assets (152,000 BTC) to further a wide range of criminal
schemes.

Blockchain analytics firm Elliptic said ChipMixer has been used
to launder over $844 million in Bitcoin that can be linked directly
to criminal activity.

“ChipMixer was one of a variety of mixers used to launder the
proceeds of hacks perpetrated by North Korea’s Lazarus Group^[5],” Elliptic’s co-founder
and chief scientist, Tom Robinson, said^[6].

This comprises the KuCoin theft^[7]
in September 2020 as well as the Axie Infinity Ronin Bridge^[8] and Harmony Horizon Bridge^[9]
hacks that took place last year.

The Lazarus Group is far from the only infamous client to have
used the service to obfuscate the financial tracks. The other
prominent actors consist of ransomware crews like LockBit,
Sodinokibi (aka REvil), Zeppelin, Mamba, Dharma, and SunCrypt.

Additionally, ChipMixer is said to have attracted more than $200
million in Bitcoin linked to purchases originating from darknet
markets, including $60 million from customers of the now-defunct Hydra^[10].

The mixer platform, per the U.S. Department of Justice (DoJ),
also processed cryptocurrency used by the Russia-linked APT28 hacking group^[11] (aka Fancy Bear or
Strontium) to procure infrastructure employed in connection with a
malware called Drovorub^[12].

Coinciding with the crackdown, the DoJ further charged a
49-year-old Vietnamese national, Minh Quốc Nguyễn, for his role in
creating and running ChipMixer’s online infrastructure and
advertising its services.

“ChipMixer facilitated the laundering of cryptocurrency,
specifically Bitcoin, on a vast international scale, abetting
nefarious actors and criminals of all kinds in evading detection,”
U.S. Attorney Jacqueline C. Romero said^[14].

“Platforms like ChipMixer, which are designed to conceal the
sources and destinations of staggering amounts of criminal
proceeds, undermine the public’s confidence in cryptocurrencies and
blockchain technology.”

The development is the latest in a string^[15] of law enforcement actions^[16] undertaken by
governments across the world to tackle cybercrime, and comes weeks
after “penal procedures” were initiated against suspected core
members of the DoppelPaymer ransomware^[17] gang.

ChipMixer is also the fourth mixer service to be outlawed over
the past few years following the disruption of Bestmixer^[18], Blender^[19], and Tornado Cash^[20], the latter two of
which were sanctioned by the U.S. Treasury Department last year for
abetting Lazarus Group and other threat actors in laundering
ill-gotten proceeds.