Bestmixer

🔴 High Risk

Bestmixer was a leading cryptocurrency mixing service primarily used to launder criminal proceeds by obscuring the origin and destination of Bitcoin and other cryptocurrencies. Operating mainly from the Netherlands, it processed over $200 million in illicit funds within a year, facilitating darknet market transactions and other cybercrimes. Its takedown in 2019 by Dutch authorities, Europol, and international partners marked a significant victory against crypto-enabled money laundering, demonstrating effective cooperation and the evolving challenges in tracing digital crime. This case highlights how mixing services play a critical role in the underground economy by enabling criminals to evade detection, underscoring the importance of robust regulatory and technological responses to cryptocurrency laundering.

Bestmixer was one of the largest cryptocurrency mixing services that facilitated the laundering of approximately $200 million in Bitcoin through its anonymizing platform. Investigated and dismantled by Dutch authorities in coordination with Europol and associated international enforcement bodies, Bestmixer enabled criminals worldwide—including drug traffickers, hackers, and other illegal actors—to conceal the origin of illicit cryptocurrency transactions. The service used advanced mixing techniques that broke transaction links on the blockchain, obscuring the trail for investigators. Following a tip-off from McAfee in 2018, investigators seized six servers in the Netherlands and Luxembourg in May 2019, shutting down the service. Subsequent enforcement actions led to arrests in the Netherlands and the confiscation of significant assets linked to laundering proceeds. This case represents a critical moment in combating cryptocurrency-enabled money laundering by demonstrating international cooperation and effective disruption of darknet financial services.

Countries Involved

The key countries involved in the Bestmixer case include the Netherlands, Luxembourg, France, Latvia, the United States, and Germany. The investigation was led primarily by Dutch authorities with cooperation from Europol and law enforcement agencies in Luxembourg, France, and Latvia, reflecting a multinational law enforcement effort. Customers utilizing the Bestmixer service were located globally, especially in the Netherlands, the United States, and Germany. This transnational involvement indicates the widespread reach of Bestmixer’s cryptocurrency mixing service, drawing users from multiple jurisdictions, thereby complicating the efforts of authorities to trace illicit financial flows. The Netherlands played a particularly central role due to its hosting of operational servers and active law enforcement response. These cross-border interactions underline the international dimension of cryptocurrency laundering challenges and the necessity for collaborative enforcement strategies. The inclusion of multiple European countries and U.S. agencies illustrates a layered cooperation approach in seizing and analyzing digital evidence, highlighting how interconnected financial crime investigations on cryptocurrencies are in the current global environment.

Date Discovered / Reported

The Bestmixer laundering service was predominantly taken down and reported on May 22, 2019. The investigation started in June 2018, following a report from cybersecurity firm McAfee, which alerted Dutch authorities about the service’s illicit activities. The formal seizure of servers and law enforcement operations culminated in May 2019, when Bestmixer was taken offline. Subsequent arrests and enforcement actions around the Netherlands strengthened the reported timeline through 2019 and into early 2020, with additional arrests credited to intelligence gained from the initial Bestmixer takedown. The timely dissemination of information among the J5 coalition of countries (United States, Canada, Netherlands, United Kingdom, and Australia) further extended the operational impacts well past the initial discovery. The timeline highlights both the complexity and multi-year duration often involved in fully dismantling high-level cryptocurrency laundering networks such as Bestmixer.

Cryptocurrency Involved

Bitcoin (BTC)

Type of Crime

The Bestmixer case encompasses cryptocurrency money laundering with direct ties to concealing the proceeds of predicate crimes such as drug trafficking, cybercrime, fraud, and potentially terrorism financing. The main criminal activity involved using the Bestmixer platform as a laundering service to sanitize Bitcoin transactions by mixing clean and illicit coins, thereby preventing traceability. This allowed criminals to integrate criminal funds into the legitimate financial ecosystem while avoiding detection and prosecution. Money laundering activities facilitated by Bestmixer aimed at disrupting AML checks and enabling criminals to enjoy the proceeds of their crimes without raising suspicions. The platform also operated as an enabler of cybercriminal payments on darknet markets, highlighting its role in facilitating broader criminal ecosystems around the globe. Hence, the crime type is money laundering primarily enabled by digital currency mixing technology.

Entities Involved

Entities involved include the Bestmixer online platform operators and users, as well as law enforcement and regulatory bodies like the Dutch Fiscal Information and Investigation Service (FIOD), Europol, and cooperating agencies in Luxembourg, France, Latvia, the US, and Germany. The operational servers were physically seized in the Netherlands and Luxembourg, implicating hosting providers and infrastructure entities indirectly involved by facilitating Bestmixer’s operations. The users comprised global clients largely interested in anonymizing Bitcoin transactions to evade regulatory scrutiny. In addition to private sector involvement such as cybersecurity firms (e.g., McAfee, which reported Bestmixer), government enforcement agencies coordinated a multi-agency effort to disrupt the service. This cooperation between private and public sectors was crucial to uncovering transactional data and facilitating arrests linked to money laundering activities facilitated by Bestmixer.

PEP Involvement

There is no publicly available evidence indicating direct involvement of Politically Exposed Persons (PEPs) in the Bestmixer money laundering case. Investigations and reports have predominantly focused on criminal actors such as drug traffickers, hackers, and other illicit actors using the service to anonymize their funds. While PEPs can be involved in various money laundering schemes, the Bestmixer case so far has not highlighted identifiable PEP involvement in its publicly disclosed data or enforcement actions. The focus remains on criminal networks and individual suspects linked to predicate crimes rather than politically exposed figures.

Laundering Techniques Used

Bestmixer employed sophisticated cryptocurrency mixing or “tumblers” techniques to launder Bitcoin. This process involved pooling together Bitcoins from multiple users, breaking the connection between incoming and outgoing transactions, thus obscuring transaction trails. The service split Bitcoin into various amounts and redistributed them through a vast mix of transactions, sometimes using time delays and layered transfers to complicate blockchain analysis. The mixing effectively hindered law enforcement’s ability to trace the original source or destination of criminal proceeds. Customers paid a fee to use the mixer to evade AML controls and the transparent nature of blockchain ledgers. Additionally, the platform exploited the anonymity offered by darknet markets and privacy-focused internet access to conceal operational locations. These techniques were part of a technological innovation in laundering that adapted to increasing regulatory scrutiny and blockchain transparency tools.

Estimated Value Laundered

The estimated value laundered through Bestmixer was approximately $200 million worth of cryptocurrency, primarily Bitcoin. This substantial amount reflects Bestmixer’s status as one of the largest cryptocurrency tumblers in the world before its takedown. The scale highlights how profoundly such services can impact the concealment of illicit funds within the crypto ecosystem, enabling criminal enterprises to move large amounts of cryptocurrency with reduced risk of detection. These estimates were derived from law enforcement analysis of transactional volumes associated with the mixer before its server seizure and data recovery. The figure illustrates the financial magnitude of the laundering operation and justifies the multi-agency priority given to its investigation and shutdown.

Transaction Analysis Summary

Analysis of the transactions passing through Bestmixer revealed a high volume of mixed Bitcoins involved in criminal proceeds with complex transaction flows intended to obscure the linkage between sender and receiver. Law enforcement, using data seized from six operational servers, reconstructed transactional graphs showing money moving through layered, multi-step processes that amalgamated coins from numerous sources. The patterns evidenced deliberate attempts to erode the transparency of blockchain ledgers, complicating forensic tracing efforts and helping criminal actors to launder illicit funds effectively. Customers from countries across the world sent Bitcoins to Bestmixer, which then redistributed cleaned coins to finalized addresses, effectively hiding the original source. The transaction analysis also revealed frequent use by darknet market actors and criminals in the US, Germany, and the Netherlands, showing the mixer’s global impact on laundering activities.

Regulatory/Enforcement Actions Taken

On May 22, 2019, Dutch law enforcement, led by the FIOD with cooperation from Europol, took Bestmixer offline by seizing six operational servers located in the Netherlands and Luxembourg. This significant action was supported by cyber security intelligence from McAfee and coordinated with authorities in Luxembourg, France, Latvia, Germany, and the US. Subsequent investigations led to the arrest of two individuals in the Netherlands in early 2020 who were suspected of using Bestmixer for laundering criminal proceeds. During these enforcement operations, digital evidence, physical and digital assets including business accounts, wallets, cryptocurrency holdings, luxury items, and vehicles were confiscated. The intelligence obtained from this case has been shared among the J5 law enforcement group of countries to assist in further global anti-money laundering efforts related to cryptocurrency. The takedown of Bestmixer is considered a landmark action demonstrating successful international collaboration against cryptocurrency-enabled financial crime.

Links to Reports / Sources

Case Title / Operation Name:

Bestmixer Cryptocurrency Laundering Case

Country(s) Involved:

France, Germany, Latvia, Luxembourg, Netherlands, United States

Platform / Exchange Used:

Bestmixer (cryptocurrency mixing/tumbling service)

Cryptocurrency Involved:

Bitcoin (BTC)

Volume Laundered (USD est.):

Approximately $200 million USD

Wallet Addresses / TxIDs :

Seized wallets and transactions linked to Bestmixer servers (specific addresses undisclosed)

Method of Laundering:

Cryptocurrency mixing/tumbling, transaction layering, anonymization

Source of Funds:

Drug trafficking, cybercrime, fraud, darknet markets

Associated Shell Companies:

N/A

PEPs or Individuals Involved:

N/A

Law Enforcement / Regulatory Action:

Seizure of servers in Netherlands and Luxembourg (May 2019), arrests of suspects, asset confiscation, multinational cooperation led by Dutch FIOD and Europol

Year of Occurrence:

2018 (discovery/reporting began) to 2019 (takedown)

Ongoing Case:

Closed

AML Network Risk Rating:

🔴 High Risk