From Mixers to Bridges: the new speed of crypto laundering
The problem is no longer only the concealment of funds, but the speed with which they are moved between ecosystems. Mixers remain relevant, but the center of gravity has shifted toward bridges, DEXs and smart contracts.
IOCTA 2026 shows that, in crypto crime, the central problem has shifted from concealing funds toward the speed with which they are moved between ecosystems. Mixers remain relevant, but the centre of gravity has shifted toward bridges, DEXs and smart contracts that allow funds to cross multiple blockchains rapidly, before investigators can establish the trail.
Published by Europol in April 2026, the report “The evolving threat landscape. How encryption, proxies and AI are expanding cybercrime” describes this acceleration in a broader context, dominated by encryption, proxy infrastructures and the use of artificial intelligence in cybercrime.
For the crypto space, the message conveyed by the report is more precise: the laundering of funds depends less on identifiable mixing services and more on legitimate infrastructures used successively to fragment the trail. Bridges have extended the effect of mixers without replacing them and have moved obfuscation from a relatively well-defined service into a chain of fast, distributed operations that are difficult to track using isolated tools or procedures.
For 2025, IOCTA describes a faster and more fragmented form of crypto crime. Crypto-assets continue to be the preferred method of payment in ransomware and still appear in the monetisation of child sexual exploitation material. In the area of money laundering, the trend highlighted is chain-hopping: the successive movement of funds between blockchains, typically through cross-chain bridges, to break the continuity of the trail followed by investigators.
-
Bridges
Bridges are a legitimate technology. Without them, blockchain ecosystems would remain more isolated, and liquidity would circulate less easily between networks. Their intended role is to enable interoperability between distinct ecosystems. Their use as a layer of obfuscation is a derivative use.
It is precisely these qualities, however, that make them useful for crime as well. Transfer speed, available liquidity and the absence of common heuristics across networks fragment the trail of funds. For the investigator, the difficulty has shifted from identifying an address to reconstructing a sequence of movements between infrastructures that were not designed to be analysed together.
-
Mixers, DEXs, privacy coins and drainers
Classic CoinJoin-type mixers (a technique that combines several transactions from different users into a single transaction, to make individual tracing more difficult) remain relevant, but do not always meet the need for speed. Actors seeking rapid settlement may prefer on-chain mixers based on smart contracts or routes through DEXs with AMMs (automated market makers). On these routes, funds move 24/7, directly on-chain, without a contractual relationship comparable to that of centralised exchanges.
Privacy coins, especially Monero, play a different role. They reduce transactional visibility within their own network, without fragmenting the trail between ecosystems. This property explains their recurring presence in cases where actors seek to break the link between the initial payment and subsequent flows.
At the retail end of the phenomenon, drainers have reached the maturity of a crime-as-a-service model (CaaS, in which tools and infrastructure are offered for a fee to other malicious actors). The consolidation of the market following the takeover of Inferno Drainer’s infrastructure by Angel Drainer in October 2024 suggests that these tools are moving from the realm of technical improvisations into that of specialised criminal services.
In the typical scenario, the victim is convinced to connect their wallet to a seemingly legitimate interface and to sign an approval that allows the automatic draining of funds. The immediate target is, as a rule, the user’s decision, less so the protocol’s code. The attack exploits trust in the interface and the opacity of the approvals displayed in the wallet.
-
Fund exit points and the authority’s response
The exit channels for illicit funds have likewise diversified. Crypto pre-paid cards, physical exchange offices (cash desks) and certain offshore services exploit the differences between supervisory regulations, KYC levels and the authorities’ capacity to obtain information quickly. At these points, flows leave the strictly on-chain space and enter an environment in which tracing depends increasingly on institutional cooperation, commercial data and traditional investigative means.
IOCTA also signals a worrying secondary phenomenon: the recruitment of minors as intermediaries. They may be persuaded to rent out wallets, accept funds, or receive cryptocurrency “gifts”, without initially understanding that they are becoming links in a money laundering circuit.
On the law enforcement side, 2025 was not a year without results. The operation coordinated by the Swiss and German authorities, with the support of Europol, led to the closure of the cryptomixer.io service. According to Europol, more than 1.3 billion euros in Bitcoin had passed through this service since 2016, and the authorities seized over 12 TB of data and assets worth more than 25 million euros in cryptocurrencies.
Read in the context of IOCTA 2026, this victory also shows the limits of the classic intervention model. Cryptomixer.io was an identifiable service. The new obfuscation routes are more distributed: smart contracts, DEXs, liquidity pools and bridges. The problem is migrating from concentrated infrastructure that is easy to target toward the ordinary infrastructure of the crypto ecosystem.
Here lies the essential asymmetry highlighted by the report: a transaction that crosses three blockchains and an on-chain mixer can be completed in a few minutes, while a cross-border request for judicial assistance needed to reconstruct the trail can take months. In crypto crime, the difference between minutes and months is the operational space in which funds disappear.
-
Implications for blockchain intelligence
For professionals in blockchain intelligence, the asymmetry described above is the starting point of current activity. Tracking a flow that crosses several networks fits less well with a sequence of isolated checks. Analysis needs to permanently integrate cross-chain tools, data on bridges, interactions with DEXs, exposure to smart contract mixers and possible cash-out points.
Equally important is the existence of shared libraries of addresses, behavioural patterns and indicators associated with drainer kits. These can help both with the proactive blocking of malicious approvals at the wallet or protocol level, and with quick post-incident recognition, before the funds cross several networks.
Visibility must also increase around exit channels: crypto pre-paid cards, physical exchange offices, offshore services and operators that function at the edge of uneven AML regimes. There, funds leave the on-chain analyst’s screen and enter an area where reconstructing the trail becomes slower, more expensive and dependent on institutional cooperation channels.
-
Common standards
These capabilities, however, remain fragmentary if the industry does not converge on common standards. The way an analyst moves from an address to a cluster, and from a cluster to an identifiable entity, still differs significantly from one provider to another. The differences do not affect only operational efficiency. They can weaken the evidentiary value of analytical reports and make them more vulnerable to challenge, especially in cases involving drainers, on-chain mixers or long bridge chains.
For this reason, a common nomenclature for attributions and documented clustering methodologies, in line with the logic of the Blockchain Data Interoperability Project, have a concrete operational effect. They make it possible for a report produced in one jurisdiction to be compared, verified and used operationally in another jurisdiction.
The problem goes beyond the technical level. If multi-chain flows become ordinary behaviour in crypto crime, then the skills required to investigate them also need a clearer definition.
Looking further ahead, the question remains whether the profession of blockchain analyst will exist in formal European mechanisms as an occupation with explicit requirements, documented professional ethics and visible training pathways. Recognition in ESCO (the European classification of skills, competences, qualifications and occupations) could turn the expertise accumulated in the community into an easily integrable professional profile. Cooperation with law enforcement authorities, with competent authorities under the MiCA Regulation (Markets in Crypto-Assets) and with the structures resulting from the European AML package could be supported by such recognition.
Without such professionalisation, the number of specialists capable of rigorously documenting a multi-chain flow is very likely to remain below operational need. In practice, the lack of trained people produces the same effect as the lack of tools: it delays the response precisely in the interval in which funds are dispersed.
The European response relies heavily only on sanctions and formal supervision. Cooperation with DEXs, with DeFi protocols handling significant volumes and with stablecoin issuers is becoming, by force of circumstances, a complementary component. Circuit-breaker-type mechanisms, the rapid signalling of abnormal transactions and stable channels of voluntary cooperation can transform industry self-regulation into a practical component of AML infrastructure.
The limit of global fragmentation, however, remains: non-EU exchanges, offshore operators and services that exploit differences between AML regimes can quickly absorb the flows rejected by compliant actors. For this reason, technical standards and voluntary cooperation need effective international coordination, beyond formal commitments.
-
Conclusion
IOCTA 2026 confirms that the adversary is reorganising faster than the institutional mechanisms built to track it. Mixers remain, but they no longer concentrate the problem on their own. Crypto laundering is moving into a logic of infrastructure: bridges, liquidity pools, smart contracts, DEXs and fragmented cash-out channels.
For authorities and for blockchain intelligence professionals, the stakes now include the rapid, documented and legally usable reconstruction of a multi-chain trail, beyond the simple tracking of a single transaction. Under the conditions described by the report, money moves in minutes, and if analysis, cooperation and standards remain at the speed of classic procedures, the difference exceeds the technical level. This is precisely the space in which crime gains time.