For more than half a decade, Coinomize has quietly operated as one of the most persistent Bitcoin mixers on the dark web. Through continuous adaptation and the adoption of multi-chain laundering routes, it has managed to survive numerous crackdowns that have dismantled similar services.
Caudena is the first company to have fully mapped Coinomize’s blockchain infrastructure, covering the mixer’s activity from 2019 through 2025. Our cluster now contains over 61,500 addresses linked to the mixer and tracks more than $366.35 million USD in laundered volume since its inception.
Mapping Coinomize: A Five-Year Markup
Over the past month, Caudena’s analysts conducted an exhaustive tracing of Coinomize-related transactions across Bitcoin, Monero, Ethereum, and several cross-chain bridges. Leveraging Caudena Prism, the industry’s most advanced investigation platform, we were able to reconstruct close to 90% of the mixer’s full operational footprint.
Prism’s native fingerprint analysis and auto-demixing algorithms, developed with Europol EC3, enabled us to distinguish two distinct behavioral fingerprints used by Coinomize before and after May 2023. Both were verified by internal laundering clusters that Coinomize operators used to wash user deposits and redistribute funds across several chains.
By combining cross-chain swap intelligence, OSINT data, and Monero attribution, we identified not only the mixer’s operational nodes but also the internal wallets linked directly to its owners. This reconstruction revealed three distinct laundering timelines, each reflecting a major shift in infrastructure and laundering strategy.
Stage 1 — The Trezor Cluster (Feb 2018 – Jul 2023)
The earliest Coinomize-related operations trace back to a Trezor wallet cluster used by the founders prior to the mixer’s public launch. This cluster exchanged Bitcoin for Monero and XRP through various centralized swaps, including transactions leading to the AstraPay XRP address rBm....
Multiple (196) transactions routed Bitcoin to the Monero wallet 48TBiWt..., which later re-emerged through XRP address rhVs..., activated by HitBTC and subsequently returning funds to AstraPay.
One address, D8hs..., currently holds around $70,000 in Dogecoin, continuing to receive transfers from Monero-linked swaps through 2025.
Other remnants include unspent outputs on bc1qhe..., dormant since July 2022 with a balance of $340,000 in Bitcoin.
Caudena’s automated demixing confirmed that early operators also tested BestMixer, with approximately 80% of post-mix flows converging to Wirex-linked wallets — a consistent exit route for early-stage laundering. This finding also validates our auto-demix capability for BestMixer: the feature produced highly accurate, repeatable reconstructions of post-mix flows and reliably surfaced the operator exit patterns.
Notably, Caudena has fully cracked BestMixer as well, reconstructing its internal flow mechanics and historical clusters. A detailed article on that case will be published shortly, providing a deep dive into one of the first large-scale mixing operations dismantled by Europol in 2019.
Moreover, we detected connections to the German underground forum CrimeNetwork, tied to a moniker “sickhavana”.
Stage 2 — The Exch Era (Jul 2023 – Aug 2024)
By mid-2023, Coinomize operations shifted markedly. After the shutdown of several early laundering venues, the operators adopted eXch — a cross-chain swap service that became a core component of their architecture.
Caudena, having previously published a comprehensive report on Exch’s laundering ecosystem, holds unmatched coverage across BTC, ETH, and LTC transactions. This enabled near-instant reconstruction of Coinomize’s ETH-based laundering layer.
Funds entering ETH were quickly transferred through Simpleswap.io or funneled into dozen of Binance deposits, with over 114 million USD processed, notably each address was active for 13 to 18 months, constantly receiving deposits north of $100K.
Stage 3 — Thorchain Integration (Sep 2024 – Jul 2025)
Following Exch’s closure, Coinomize underwent a third transformation. Laundering activity migrated to Thorchain, often intermediated via ShapeShift, enabling seamless swaps between Bitcoin, Dogecoin and Ethereum.
We are still actively gathering intelligence on this stage: activity is comparatively sparser and requires more manual analysis to fully reconstruct. That additional manual work does not reduce Caudena’s investigatory effectiveness nor does it meaningfully obfuscate the funds — transaction fingerprints, reused behavioral patterns, and cross-chain swap metadata continue to provide actionable attribution vectors.
Closing the Loop
Coinomize exemplifies the persistence of mixer operators adapting to enforcement pressure through rapid infrastructure changes. Yet, each evolution left behind identifiable traces — transaction fingerprints, reused wallets, and consistent behavioral patterns — all captured within Caudena’s continuous cluster updates.
Our current Coinomize dataset now spans over 62K transactions in tracked flows, and retains live monitoring of the remaining operational assets.
This level of insight was only achievable through Caudena Prism’s native UTXO rendering, cross-chain intelligence, and unique OSINT data-set, allowing investigators to explore decades of blockchain data with court-admissible precision.