{"investigation":{"slug":"chipmixer","entity_name":"ChipMixer","trust_score":0,"severity_base":null,"score_modifier":0,"confidence":0.97,"status":"published","content_type":"investigation","summary":"ChipMixer was a darknet Bitcoin mixing service that operated from August 2017 to March 2023, processing over $3 billion in illicit cryptocurrency on behalf of ransomware groups, North Korean state hackers, Russian military intelligence, and darknet drug markets. On March 15, 2023, U.S. and German authorities seized its infrastructure, domains, and approximately $46 million in cryptocurrency in a coordinated international takedown. Minh Quoc Nguyen, 49, a Vietnamese national residing in Hanoi, was charged in the Eastern District of Pennsylvania with money laundering, operating an unlicensed money transmitting business, and identity theft; he remains a fugitive.","sections":[{"content":"ChipMixer was a cryptocurrency mixing service — commonly called a tumbler — that operated on both the clearnet and as a Tor hidden service. Launched in August 2017, the platform allowed users to deposit Bitcoin in exchange for pre-funded tokens called 'chips,' each assigned a fixed denomination ranging from 0.001 BTC to 4.096 BTC. Because the chips were pre-funded before the user's deposit, no on-chain link existed between the incoming deposit and the outgoing chip addresses, effectively severing the blockchain trail. Users could further split and merge chips to add additional obfuscation layers. The service charged fees for mixing and operated without registering with the U.S. Financial Crimes Enforcement Network (FinCEN) and without collecting any customer identifying information, in deliberate violation of Bank Secrecy Act requirements. Operator Minh Quoc Nguyen publicly stated that 'AML/KYC is a sellout to the banks and governments' and instructed users on evasion methods.","heading":"Service Overview and Technical Operation","sources":[{"url":"https://www.justice.gov/archives/opa/pr/justice-department-investigation-leads-takedown-darknet-cryptocurrency-mixer-processed-over-3","name":"justice.gov","type":"other","credibility":3},{"url":"https://flashpoint.io/blog/usa-vs-minh-quoc-nguyen/","name":"flashpoint.io","type":"other","credibility":3},{"url":"https://www.moneylaunderingnews.com/2023/03/darkweb-cryptocurrency-mixer-chipmixer-shut-down-for-allegedly-laundering-3-billion-worth-of-crypto/","name":"moneylaunderingnews.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Between August 2017 and March 2023, ChipMixer processed cryptocurrency currently valued at over $3 billion in total, representing laundered proceeds from a broad spectrum of criminal activity. Court documents filed in the Eastern District of Pennsylvania itemize the flows: approximately $700 million was associated with wallets designated as stolen funds; $17 million was linked to approximately 37 ransomware strains including Sodinokibi (REvil), Mamba, SunCrypt, Dharma, Zeppelin, and LockBit; more than $200 million was associated directly or through intermediaries with darknet markets including over $60 million on behalf of customers of Hydra Market, the largest darknet market in the world prior to its April 2022 shutdown; and more than $35 million was connected to fraud shops. Europol estimated the total at approximately 152,000 Bitcoin, equivalent to roughly EUR 2.73 billion at the time of the takedown.","heading":"Scale of Illicit Activity","sources":[{"url":"https://www.justice.gov/archives/opa/pr/justice-department-investigation-leads-takedown-darknet-cryptocurrency-mixer-processed-over-3","name":"justice.gov","type":"other","credibility":3},{"url":"https://flashpoint.io/blog/usa-vs-minh-quoc-nguyen/","name":"flashpoint.io","type":"other","credibility":3},{"url":"https://www.europol.europa.eu/media-press/newsroom/news/one-of-darkwebs-largest-cryptocurrency-laundromats-washed-out","name":"europol.europa.eu","type":"other","credibility":3},{"url":"https://eucrim.eu/news/chipmixer-taken-down/","name":"eucrim.eu","type":"other","credibility":3}],"severity":"medium"},{"content":"ChipMixer was used by threat actors with documented ties to nation-state governments. Bitcoin associated with the Russian General Staff Main Intelligence Directorate (GRU), specifically the 85th Main Special Service Center (military unit 26165), also known as APT 28, was processed through ChipMixer and used to purchase server infrastructure for the Drovorub malware, first disclosed in a joint FBI/NSA advisory in August 2020. North Korea's Lazarus Group, the state-sponsored hacking unit held responsible by U.S. authorities for the March 2022 Axie Infinity Ronin Bridge theft ($625 million in cryptocurrency) and the June 2020 Harmony Horizon Bridge theft, laundered a portion of those stolen funds through ChipMixer. On-chain research by SlowMist identified approximately 3,460 BTC (valued at approximately $73 million at the time) from the Ronin Bridge heist routed through ChipMixer. These flows represent the most operationally significant known use of the service by state-linked actors.","heading":"State-Sponsored and Nation-State Criminal Clients","sources":[{"url":"https://www.justice.gov/archives/opa/pr/justice-department-investigation-leads-takedown-darknet-cryptocurrency-mixer-processed-over-3","name":"justice.gov","type":"other","credibility":3},{"url":"https://cryptoslate.com/ronin-bridge-hackers-used-chipmixer-to-launder-over-73m-of-stolen-funds/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://flashpoint.io/blog/usa-vs-minh-quoc-nguyen/","name":"flashpoint.io","type":"other","credibility":3},{"url":"https://thehackernews.com/2023/03/authorities-shut-down-chipmixer.html","name":"thehackernews.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On March 15, 2023, a coordinated multinational law enforcement operation dismantled ChipMixer's infrastructure. Participating agencies included the U.S. Federal Bureau of Investigation, Homeland Security Investigations (HSI), Europol, the German Federal Criminal Police (Bundeskriminalamt, BKA), and authorities from Belgium, Poland, and Switzerland. U.S. authorities executed court-authorized seizures of two domains directing users to the ChipMixer service and one associated GitHub account. German authorities seized ChipMixer's backend servers along with more than $46 million in cryptocurrency — at the time the largest single cryptocurrency seizure in BKA history. Investigators also recovered approximately 7 TB of data from the seized servers. The DOJ simultaneously unsealed a criminal complaint in the Eastern District of Pennsylvania against Minh Quoc Nguyen.","heading":"Law Enforcement Takedown — March 2023","sources":[{"url":"https://www.justice.gov/archives/opa/pr/justice-department-investigation-leads-takedown-darknet-cryptocurrency-mixer-processed-over-3","name":"justice.gov","type":"other","credibility":3},{"url":"https://www.europol.europa.eu/media-press/newsroom/news/one-of-darkwebs-largest-cryptocurrency-laundromats-washed-out","name":"europol.europa.eu","type":"other","credibility":3},{"url":"https://www.coindesk.com/policy/2023/03/15/germany-and-us-seize-over-46m-crypto-tied-to-chipmixer-investigation-europol","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.ice.gov/news/releases/hsi-arizona-investigation-leads-takedown-cryptocurrency-mixer-processed-over-3","name":"ice.gov","type":"other","credibility":3}],"severity":"medium"},{"content":"Minh Quoc Nguyen, 49, a Vietnamese national residing in Hanoi, Vietnam, was charged in the Eastern District of Pennsylvania with three counts: (1) operating an unlicensed money transmitting business, (2) money laundering, and (3) identity theft. The charges relate to his alleged role in creating, operating, and promoting ChipMixer from approximately 2017 onward. According to court documents, Nguyen registered domains, procured hosting, and publicized the service using pseudonyms, stolen identities, and anonymous email accounts. If convicted on all counts, he faces a maximum penalty of 40 years in prison. As of the time of the takedown, Nguyen was located in Vietnam and had not been apprehended; the FBI issued a wanted notice. Vietnam does not have an extradition treaty with the United States, raising questions about Nguyen's ability to evade U.S. prosecution. Note: some secondary sources have incorrectly attributed this indictment to Mihai Calin Ionut Paunescu, a Romanian national who is a separate defendant charged in the Southern District of New York in connection with an unrelated bulletproof hosting scheme involving the Gozi banking malware.","heading":"Criminal Charges and Defendant","sources":[{"url":"https://www.justice.gov/archives/opa/pr/justice-department-investigation-leads-takedown-darknet-cryptocurrency-mixer-processed-over-3","name":"justice.gov","type":"other","credibility":3},{"url":"https://flashpoint.io/blog/usa-vs-minh-quoc-nguyen/","name":"flashpoint.io","type":"other","credibility":3},{"url":"https://vietnaminsiders.com/a-vietnamese-phd-wanted-by-fbi-for-3-billion-cryptocurrency-laundering-case/","name":"vietnaminsiders.com","type":"other","credibility":3},{"url":"https://www.inquirer.com/news/chip-mixer-crypto-bitcoin-seized-ming-quoc-nguyen-charges-20230315.html","name":"inquirer.com","type":"other","credibility":3}],"severity":"medium"},{"content":"ChipMixer was structured to systematically avoid all U.S. anti-money laundering obligations. As a money transmitter serving U.S. customers, the platform was legally required to register with FinCEN under the Bank Secrecy Act, maintain an AML compliance program, and collect customer identifying information under Know Your Customer (KYC) rules. ChipMixer did none of these. The operator publicly mocked AML and KYC requirements. This pattern mirrors the regulatory posture of other mixer services subsequently targeted by U.S. authorities, including Tornado Cash (OFAC-sanctioned in August 2022) and Sinbad (sanctioned by OFAC in November 2023). While OFAC did not separately sanction ChipMixer itself — the service was dismantled via criminal prosecution — its primary user base included entities on the OFAC SDN list, including Hydra Market and the Lazarus Group.","heading":"Regulatory Context and AML Violations","sources":[{"url":"https://www.justice.gov/archives/opa/pr/justice-department-investigation-leads-takedown-darknet-cryptocurrency-mixer-processed-over-3","name":"justice.gov","type":"other","credibility":3},{"url":"https://www.moneylaunderingnews.com/2023/03/darkweb-cryptocurrency-mixer-chipmixer-shut-down-for-allegedly-laundering-3-billion-worth-of-crypto/","name":"moneylaunderingnews.com","type":"other","credibility":3},{"url":"https://www.fincen.gov/enforcement-actions-failure-register-money-services-business","name":"fincen.gov","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the March 2023 takedown, copycat and mirror sites using the ChipMixer brand appeared on the clearnet and darknet, as is common after high-profile mixer seizures. These sites have no verified connection to the original operation and represent independent fraud or scam risks. The seized data — approximately 7 TB from backend servers — was retained by law enforcement and is likely being used in ongoing investigations of ChipMixer's criminal clients. Nguyen remained a fugitive as of the most recently available public reporting. The ChipMixer takedown was followed by subsequent mixer enforcement actions including the OFAC designation of Sinbad in November 2023 and the indictment of Tornado Cash developers, reflecting a sustained U.S. and European regulatory focus on cryptocurrency obfuscation services.","heading":"Post-Seizure Landscape","sources":[{"url":"https://www.europol.europa.eu/media-press/newsroom/news/one-of-darkwebs-largest-cryptocurrency-laundromats-washed-out","name":"europol.europa.eu","type":"other","credibility":3},{"url":"https://www.bankinfosecurity.com/chipmixer-shut-down-for-allegedly-laundering-3-billion-a-21445","name":"bankinfosecurity.com","type":"other","credibility":3},{"url":"https://www.trmlabs.com/resources/blog/us-treasury-sanctions-north-koreas-preferred-mixer-sinbad","name":"trmlabs.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2017-08","event":"ChipMixer launches as an unlicensed Bitcoin mixing service on the darknet and clearnet, with no FinCEN registration and no KYC procedures.","source":"","date_original":"2017-08-01"},{"date":"2020-06","event":"North Korea's Lazarus Group conducts the Harmony Horizon Bridge theft; funds are later traced through ChipMixer according to DOJ court filings.","source":"","date_original":"2020-06-01"},{"date":"2020-08","event":"FBI and NSA publish joint advisory disclosing Drovorub malware linked to Russian GRU unit 26165 (APT 28); DOJ later alleges infrastructure for Drovorub was purchased using Bitcoin laundered through ChipMixer.","source":"","date_original":"2020-08-01"},{"date":"2022-03-29","event":"Lazarus Group executes the Axie Infinity Ronin Bridge hack, stealing approximately $625 million in cryptocurrency; on-chain research later identifies roughly 3,460 BTC of these funds routed through ChipMixer.","source":""},{"date":"2022-04-05","event":"OFAC sanctions Hydra Market, the Russia-based darknet market for which ChipMixer processed over $60 million in customer transactions.","source":""},{"date":"2022-08-08","event":"OFAC sanctions Tornado Cash, a competing mixer; ChipMixer remains active and continues to attract displaced users.","source":""},{"date":"2023-03-14","event":"Criminal complaint against Minh Quoc Nguyen filed in the Eastern District of Pennsylvania (Case 2:23-mj-00528); federal arrest warrant issued.","source":""},{"date":"2023-03-15","event":"DOJ, FBI, HSI, Europol, BKA, and authorities from Belgium, Poland, and Switzerland execute coordinated takedown: domains seized, GitHub account seized, backend servers in Germany seized, and approximately $46 million in cryptocurrency seized. Approximately 7 TB of data recovered.","source":""},{"date":"2023-03-16","event":"Vietnam's government confirms FBI is seeking Nguyen; Nguyen remains at large in Hanoi. Vietnam has no extradition treaty with the United States.","source":""}],"sources_used":[{"url":"https://www.justice.gov/archives/opa/pr/justice-department-investigation-leads-takedown-darknet-cryptocurrency-mixer-processed-over-3","name":"justice.gov","type":"other","credibility":3},{"url":"https://flashpoint.io/blog/usa-vs-minh-quoc-nguyen/","name":"flashpoint.io","type":"other","credibility":3},{"url":"https://www.moneylaunderingnews.com/2023/03/darkweb-cryptocurrency-mixer-chipmixer-shut-down-for-allegedly-laundering-3-billion-worth-of-crypto/","name":"moneylaunderingnews.com","type":"other","credibility":3},{"url":"https://www.europol.europa.eu/media-press/newsroom/news/one-of-darkwebs-largest-cryptocurrency-laundromats-washed-out","name":"europol.europa.eu","type":"other","credibility":3},{"url":"https://eucrim.eu/news/chipmixer-taken-down/","name":"eucrim.eu","type":"other","credibility":3},{"url":"https://cryptoslate.com/ronin-bridge-hackers-used-chipmixer-to-launder-over-73m-of-stolen-funds/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://thehackernews.com/2023/03/authorities-shut-down-chipmixer.html","name":"thehackernews.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/policy/2023/03/15/germany-and-us-seize-over-46m-crypto-tied-to-chipmixer-investigation-europol","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.ice.gov/news/releases/hsi-arizona-investigation-leads-takedown-cryptocurrency-mixer-processed-over-3","name":"ice.gov","type":"other","credibility":3},{"url":"https://vietnaminsiders.com/a-vietnamese-phd-wanted-by-fbi-for-3-billion-cryptocurrency-laundering-case/","name":"vietnaminsiders.com","type":"other","credibility":3},{"url":"https://www.inquirer.com/news/chip-mixer-crypto-bitcoin-seized-ming-quoc-nguyen-charges-20230315.html","name":"inquirer.com","type":"other","credibility":3},{"url":"https://www.fincen.gov/enforcement-actions-failure-register-money-services-business","name":"fincen.gov","type":"other","credibility":3},{"url":"https://www.bankinfosecurity.com/chipmixer-shut-down-for-allegedly-laundering-3-billion-a-21445","name":"bankinfosecurity.com","type":"other","credibility":3},{"url":"https://www.trmlabs.com/resources/blog/us-treasury-sanctions-north-koreas-preferred-mixer-sinbad","name":"trmlabs.com","type":"other","credibility":3}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-30T18:25:07.057056+00:00","updated_at":"2026-08-29T01:33:38.141+00:00"}}