ChipMixer Takedown (2023)
What was ChipMixer and what happened to it?
ChipMixer was a bitcoin mixing service that ran from 2017 until police seized it on March 15, 2023. It no longer operates. The US Justice Department said it processed more than US$3 billion, including funds tied to ransomware, darknet markets and North Korean hacks, and charged its alleged operator, Minh Quốc Nguyễn, who has not been arrested. This page explains how investigators took it apart, not how to use such a service.
As of September 2026: The charges against Minh Quốc Nguyễn are allegations. He has not been arrested, and the FBI wanted notice remained published when checked in September 2026. No plea, extradition or sentence has been reported. The US$3 billion figure is the Justice Department's 2023 allegation.
What happened?
On March 15, 2023, police in the United States and Germany shut down ChipMixer, a cryptocurrency mixing service that had run since 2017. The service no longer operates. US agents seized two web domains and a GitHub account. Germany’s Federal Criminal Police (the BKA) seized the servers behind it and more than US$46 million in cryptocurrency. Europol, the EU police agency, coordinated with help from Belgium, Poland and Switzerland and reported four servers, about 1,909 bitcoin and 7 TB of data taken.
The US Justice Department said ChipMixer laundered more than US$3 billion between August 2017 and March 2023. It also charged the man it says ran the service, Minh Quốc Nguyễn of Hanoi, Vietnam. A charge is an allegation, not a finding of guilt.
Which techniques did it use?
ChipMixer was a custodial mixer. Users sent bitcoin to the service, which pooled it with other users’ coins and paid out from the pool. Europol described deposits being split into small tokens that were then blended together, which cut the visible link between where coins came from and where they went. That is layering done as a service: it sells distance from the source.
The complaint says the service ran mainly as a Tor hidden service, which hides where servers sit, with a public web domain as well. It served many US customers but did not register with FinCEN as a money services business and did not collect customer identity information, the basic KYC step that regulated services perform. For how mixers fit into a longer laundering chain, see the crypto mixers technique page.
How was it found?
Bitcoin’s ledger is public, so investigators could follow funds into the service even though they could not see inside it. Earlier cases fed the work: information from the 2022 takedown of the Hydra darknet market helped identify transactions, according to Europol. Analysts also recognised wallets tied to known thefts and ransomware payments flowing in. See blockchain analytics for how that tracing works.
The servers were the other weak point. Running on physical machines in Europe, they could be seized by a national police force, and the US complaint alleges the operator paid for domains and hosting using stolen identities and pseudonyms, leaving a paper trail.
What was the outcome?
What the investigation attributed to ChipMixer, per the Justice Department:
- US$17 million in bitcoin for criminals linked to about 37 ransomware strains.
- Over US$700 million tied to wallets designated as stolen funds, including heists by North Korean hackers from the Ronin Bridge (2022) and Harmony Horizon Bridge (2022).
- More than US$200 million linked to darknet markets, including over US$60 million for customers of Hydra Market.
- More than US$35 million tied to “fraud shops” that sell stolen card and account data.
- Bitcoin used by Russian military intelligence to buy infrastructure for malware.
The operator’s case has not moved. Nguyễn was charged on March 14, 2023 in the Eastern District of Pennsylvania with money laundering, operating an unlicensed money transmitting business and identity theft, facing up to 40 years. As of September 2026 the FBI still lists him as wanted, and no arrest, extradition, plea or sentence has been reported. The seized coins are a matter for forfeiture proceedings; the sources reviewed do not say what became of them.
What were the warning signs?
- Coins arriving from addresses tied to thefts or ransomware. Exchanges that screen incoming deposits could spot funds that had passed through a known mixer.
- A service with no registration and no customer checks. Operating for US users without FinCEN registration is itself a legal red flag.
- An operator who mocked compliance rules. The complaint quotes posts by the operator attacking anti-money laundering and KYC requirements, which prosecutors used as evidence of intent.
- Volume out of proportion to lawful demand. Billions in flows, with large shares tracing to crime, is not what a privacy tool with ordinary users looks like.
What changed afterwards?
ChipMixer became one of several mixer takedowns that show the same pattern: services that hold customer funds and have a findable operator can be seized and prosecuted. It sits alongside the Tornado Cash case, where no operator held the funds and the legal fight is still unresolved, and the Lazarus Group case, where North Korean hackers used mixers to move stolen money.
The case also shows why one seizure helps many investigations. Servers and blockchain records let authorities link a single service to ransomware, hacks and darknet markets across separate cases, and Europol said it supported crypto tracing that connected the data to criminal cases inside and outside the EU. The same principle guides exchange screening: a regulated platform can check whether incoming funds trace back to a service that police have seized. For how state-linked actors move stolen funds, see sanctions evasion.
Frequently asked questions
Is ChipMixer still running?
No. Authorities seized its domains, its GitHub account and its back-end servers on March 15, 2023. Any site using the name today is not the original service and should not be trusted.
Who ran ChipMixer and what happened to him?
The US charged Minh Quốc Nguyễn, of Hanoi, Vietnam, in a federal court in Philadelphia. A criminal complaint is only an allegation, and he is presumed innocent until proven guilty. As of September 2026 he has not been arrested, and the FBI still lists him as wanted.
How much did ChipMixer launder?
The US Justice Department said more than US$3 billion between August 2017 and March 2023. Europol's estimate was about 152,000 bitcoin, roughly EUR 2.73 billion at the time. Both are allegations from the investigation, not court findings, and the figures differ because of how and when bitcoin was priced.
Why was ChipMixer treated differently from a privacy tool?
According to the complaint, it served US customers without registering as a money services business, collected no customer identity information, and its operator promoted it to people avoiding reporting rules. That combination of unlicensed operation and a criminal clientele is what prosecutors focused on.
Techniques used in this case
- Mixers, tumblers, and CoinJoin · Services that pool many users' coins and pay out equivalent amounts from the pool, breaking the on-chain link between where crypto came from and where it went.
- Unlicensed exchanges and nested services · Crypto exchanges that skip licensing and identity checks, and small services hidden inside big exchanges, that let criminals convert coins to cash without questions.
- Sanctions evasion · Hiding who really owns or benefits from assets and payments so sanctions do not bite, using many of the same tools as money laundering but often with lawfully earned money.
Related cases
- Tornado Cash · The first sanctioned crypto mixer, a court ruling that limited the sanctions, and a developer trial whose outcome will define liability for privacy code.
- Lazarus Group · North Korea's state hackers have stolen roughly US$6.75 billion in cryptocurrency and launder it at a speed no other criminal group matches.
- The Bitfinex hack laundering · A married couple spent five years laundering 119,754 bitcoin stolen from the Bitfinex exchange, and the blockchain recorded every move.
- Cross-chain bridge hacks · Bridges that move value between blockchains hold huge pools of funds, and the 2022 thefts from Ronin, Harmony, Wormhole and Nomad show how thieves launder them and how investigators respond.
Glossary
Sources
- Justice Department Investigation Leads to Takedown of Darknet Cryptocurrency Mixer that Processed Over $3 Billion of Unlawful Transactions (US Department of Justice, Office of Public Affairs, March 15, 2023).
- One of the darkweb's largest cryptocurrency laundromats washed out (Europol, March 15, 2023).
- Minh Quốc Nguyễn, Cyber's Most Wanted (Federal Bureau of Investigation, Checked September 2026).