Privacy Coins and Mixers: How They Work and Why They're High-Risk
Monero, Zcash, mixers, and tumblers provide genuine privacy benefits — but also carry serious legal, regulatory, and practical risks that users need to understand.
For users who find standard cryptocurrency privacy insufficient, a set of more specialised tools exists: privacy-focused cryptocurrencies like Monero and Zcash, and transaction obfuscation services like mixers, tumblers, and CoinJoin implementations. These tools are technically interesting and provide genuine privacy improvements over standard Bitcoin or Ethereum. They also carry significant legal, regulatory, and practical risks that are not always clearly communicated.
This article explains how these tools work at a conceptual level and, critically, what using them means in the current legal environment. It is educational in intent — not a guide to evading law enforcement or financial regulations.
Privacy Coins
Monero (XMR)
Monero is the most widely used privacy-by-default cryptocurrency. Its design includes several overlapping privacy mechanisms:
Ring signatures: When a Monero transaction is signed, it is signed alongside a group of other unrelated transaction outputs (the “ring”). An observer can see that one of the ring members was the true sender but cannot determine which one.
Stealth addresses: Each transaction generates a one-time address on the recipient’s behalf, meaning that no two payments to the same recipient produce the same on-chain address. This prevents address clustering.
RingCT (Confidential Transactions): Transaction amounts are hidden using cryptographic commitments. Observers can verify that inputs and outputs balance without seeing the actual values.
The combination of these features makes Monero transactions substantially harder to trace than Bitcoin transactions. However, “harder” is not the same as “impossible” — research has identified statistical weaknesses in older ring signature implementations, and metadata (IP addresses, timing) can still leak information if other precautions are not taken.
Zcash (ZEC)
Zcash uses a cryptographic technique called zk-SNARKs (zero-knowledge succinct non-interactive arguments of knowledge) to enable “shielded” transactions in which sender, recipient, and amount are all hidden from observers. Shielded Zcash transactions, when used correctly, provide very strong privacy guarantees.
However, Zcash has a significant adoption problem: the majority of Zcash transactions use the transparent (non-shielded) pool, which is as publicly visible as Bitcoin. Shielded transactions require more computational work and wallet support, and many exchanges do not support them. When funds move between the shielded and transparent pools, that transition is observable.
Other Privacy Coins
Other coins such as Dash (which offers an opt-in mixing feature called PrivateSend) and Grin/Beam (which use the MimbleWimble protocol) provide varying levels of privacy. None are in as widespread use as Monero for privacy-focused applications.
Mixers, Tumblers, and CoinJoin
These are services and techniques that apply to standard cryptocurrencies like Bitcoin, attempting to obscure transaction trails by pooling or mixing coins.
Tumblers/mixers (centralised): A centralised service accepts your coins and returns equivalent amounts from a different pool, breaking the direct on-chain link. The major weakness is that the mixer operator knows the full input-output mapping. If the service is compromised, subpoenaed, or operated maliciously, that mapping is exposed. Several centralised mixers have been shut down and their operators prosecuted.
CoinJoin (decentralised): CoinJoin is a technique where multiple participants combine their transactions into a single transaction with many inputs and outputs, making it harder to determine which input corresponds to which output. Implementations include Wasabi Wallet, JoinMarket, and (historically) Samourai Wallet. CoinJoin does not require trusting a central operator, but it does require finding other participants and is subject to amount-matching analysis that can partially de-mix transactions.
The Legal and Regulatory Landscape
This is where the practical risks become significant, and where users must exercise genuine caution.
Delisting from Exchanges
Major exchanges in many jurisdictions have delisted Monero and other privacy coins due to regulatory pressure. Binance delisted Monero in early 2024 for users in several regions. Kraken removed it from UK availability. Many others have followed. This creates a practical liquidity problem: acquiring Monero without a KYC trail is difficult, and converting winnings back to usable currency is increasingly constrained.
Mixer Prosecutions
The legal risk around mixers has increased sharply. Several significant actions:
- The US Department of Justice has prosecuted operators of mixing services, with charges including money laundering and operating an unlicensed money transmission business.
- Tornado Cash, an Ethereum-based mixing protocol, was sanctioned by the US Office of Foreign Assets Control (OFAC) in 2022, with its smart contract addresses added to the Specially Designated Nationals list. Using a sanctioned mixer — even unknowingly — can create legal liability.
- Samourai Wallet’s founders were arrested in 2024 on money transmission and money laundering charges related to its mixing features.
Bank and Exchange Scrutiny
Financial institutions increasingly flag incoming funds that have passed through mixers. Blockchain analytics firms tag mixer-associated addresses, and exchanges apply automated screening. Depositing funds that trace back to a known mixer can result in:
- Account freezes while the exchange investigates
- Funds being held pending enhanced due diligence
- Account closure
- Regulatory reports being filed
This applies even if the mixing was done for entirely legitimate privacy reasons. The automated systems do not distinguish intent.
The “Gambling + Mixer” Combination
Combining privacy tools with gambling activity can compound scrutiny. From a compliance perspective, funds that have been mixed before reaching a gambling site — or gambling winnings that are mixed before cashing out — may be treated as higher-risk by analytics systems and regulated exchanges. This does not mean users are necessarily doing anything illegal, but it means they are more likely to encounter practical obstacles.
What Genuine Privacy Costs
Meaningful privacy on a public blockchain requires sustained effort across the entire transaction path: acquisition, storage, use, and conversion. Each step introduces risks. The legal environment has become considerably more hostile to privacy-enhancing tools since roughly 2022, and that trend has continued.
For most users, the privacy-versus-risk trade-off of these tools is unfavourable relative to what they achieve. For a grounding in why standard crypto is already more private than bank cards in some respects — while being less private than commonly assumed — see our pseudonymity vs anonymity article. For the broader legal framework, our regulation and legal overview is a useful starting point.
The appropriate place to end this discussion is with a simple observation: the tools described here exist, they work to varying degrees, and their use carries legal risks that are real, jurisdiction-specific, and have resulted in prosecutions. Anyone considering them should seek qualified legal advice in their jurisdiction before acting.