The crypto mixing service, available via the regular web and the dark web, facilitated the laundering of cryptocurrencies by pooling deposited funds from users for a long and randomised period and then redistributing them to destination addresses, again at random times. This process makes it difficult to trace the specific coins and conceal their origin. After criminals receive their cleaned-up cryptocurrency, they can exchange it for other cryptocurrencies or cash, or they can deposit the value into bank accounts.

As important domains were located in Germany and servers of the crypto mixing service were found in Switzerland, authorities from both countries needed to work together to conduct further investigations and take action against the service. A joint investigation team was set up at Eurojust to allow real-time exchange of information and evidence. The authorities met at the Prosecutor’s Office in Zurich to discuss their findings on the service and plan the next steps of the investigation. Throughout the operation, Europol facilitated the exchange of information, coordinated coordinating the involved partners and hosted operational meetings. On the action day, Europol’s cybercrime experts provided on-the-spot support and forensic assistance.

During the action week, which took place from 24 to 28 November, three servers and the crypto mixing service’s domain were seized, along with over 12 terabytes of data. More than EUR 25 million in cryptocurrency was also seized. As a result of the action week, the service was taken down, and authorities placed a seizure banner on the service’s website.

The actions were carried out by the following authorities:

• Germany: Prosecutor General’s Office Frankfurt am Main, Cyber Crime Centre; Federal Criminal Police Office
• Switzerland: Public Prosecution Office of Zurich; Zurich Cantonal Police; Zurich City Police