European authorities swoop on bitcoin mixing service

As cryptocurrency companies reflect on fresh FinCEN guidance, authorities are already springing into action. Dutch police have shut down Bestmixer.io — one of the most popular cryptocurrency mixing services.

A cryptocurrency tumbler is an anonymity service that aims to anonymize cryptocurrency transactions. It does this by mixing transactions from multiple users into a single group, and then ‘tumbling’ the funds. This makes it difficult to track the original source of the funds.

Blatantly advertised money laundering?

An ominous note left by authorities on the Bestmixer domain states that the investigation began in June 2018 — just one month after the service was launched. In its short lifetime, the mixer became one of the most popular ways of obscuring cryptocurrency transactions, processing an estimated total of $200M worth of bitcoin, bitcoin cash and litecoin.

CipherTrace CEO David Jevans, who specializes in cryptocurrency intelligence, suggests the mixing service has several unique characteristics that could have attracted unwanted attention from regulators. Unlike competitor CoinJoin — which relies on a decentralized protocol — Bestmixer.io was a centralized, custodial service, putting it firmly in the category of Money Transmitter according to FinCEN guidance, and meaning that it would need an MSB license to serve American customers, in addition to a local Dutch operating license from De Nederlandsche Bank.

To attract customers, the mixer advertised on popular industry blogs and placed sponsored posts and press releases in the same publications — a marketing presence that may have contributed to the service’s downfall.

“Bestmixer has blatantly advertised money laundering services”, said Jevans in a statement to Brave New Coin, suggesting that the mixer crossed a line by advertising itself as a tumbling service. In the eyes of the law, this is effectively a criminal enterprise with the ability to help shield money launderers from the authorities.

Though mixing services themselves aren’t illegal, a McAfee blog post chronicling the takedown states that “the legality changes when a mixing service advertises itself as a successful method to avoid various anti-money laundering policies via anonymity.”

Crypto dusting

Aside from advertising, the mixer also resorted to more machiavellian marketing techniques — claiming to have created a tool that could track transactions ‘tumbled’ by competing services, and using notorious ‘dusting’ attacks to gain publicity.

The controversial campaign began last October when Bestmixer sent tiny amounts of bitcoin to thousands of addresses in a bid to hide illicit transactions behind an enormous cloud of ‘dust’, creating publicity by confusing the recipients of the small transactions.

“By running a malicious advertising scheme that involves sending Bitcoin to the top BTC addresses, BestMixer is technically tainting these addresses by causing them to transact with a mixer without their consent,” said Ciphertrace in a blog post on the issue.** “**As time progresses in the cryptocurrency world, this form of spam may soon become a primary technique for bad actors to spread taint and contaminate legitimate users in massive dusting campaigns.”

While Bestmixer had been on the radar of authorities, the exact location of the mixer’s servers wasn’t known until the McAfee security firm, which was working in conjunction with authorities, alerted the Dutch anti-Fraud Agency (FIOD) to a suspicious location in the Netherlands. The Bestmixer website said its base was in the Caribbean tax haven of Curaçao.

With the servers identified, authorities were able to swoop in and take the operation down. However, some suspect that — as is often the case with darknet market seizures — the authorities seized and ran the site for some time, continuing to operate it in order to gather evidence from those using the service.

This data, which is said to include “IP addresses, transaction details, bitcoin addresses and chat messages” from the past year of interactions on the platform, will be analyzed by Dutch police in cooperation with other European authorities and shared with relevant authorities abroad.