So-called crypto mixers that help their users, criminals included, protect their financial privacy, have adapted to sanctions and continue to grow, reminding policymakers that sanctions mostly hit legitimate users, while criminals adapt.

Researchers at the University of Cambridge Judge Business School found that after an initial drop in 2023 due to sanctions, the share of mixer-related transactions on the Ethereum (ETH) network increased by 50% since then, still reaching a negligible 0.006% of all transactions on the network. This activity had been growing even before the US Treasury removed Tornado Cash from the sanctions list in March 2025.

In any case, the mixer market is now different compared to what it was before Tornado Cash was sanctioned in 2022.

"After sanctions, users migrated to protocols that offered what Tornado Cash couldn’t: a way to prove their funds weren’t tainted. Railgun emerged as the dominant protocol, growing from 13% in 2022 to 71% in 2025," the researchers found.

The graph shows monthly net mixer flow (deposits minus withdrawals) by protocol, where positive values indicate net inflows.

According to them, the sanctions didn't eliminate mixer demand, and the remaining Tornado Cash users appear more sophisticated and harder to trace, while enterprise interest in transaction privacy is growing.

Therefore, according to the researchers, "The underlying policy dilemma persists: banning privacy tools deters legitimate users, while criminals adapt."

For example, after the sanctions, legitimate users of Tornado Cash, deterred by legal risk, moved to cross-chain bridges and decentralized exchanges, while crypto attackers kept using Tornado.

However, not only are criminals adapting, as some mixers, such as Privacy Pools and Railgun, are also integrating compliance solutions. Even a study by the Federal Reserve Bank of St. Louis estimated that around 70% of pre-sanctions Tornado Cash volume was non-illicit.

Vitalik Buterin is also using Railgun himself, praising this compliance-focused tool for preventing hackers from laundering stolen funds in a case in 2025.

While not bulletproof, this prevention system checks whether the depositor's address is linked to known hacks, scams, or sanctioned addresses, and if so, it is rejected. Meanwhile, Privacy Pools uses a more complex system, as it screens at the exit, meaning that when users withdraw, they must prove their funds came from a clean subset of deposits that passed screening by trusted third-party providers.

However, this also has its own trade-offs, as users must trust third parties not to censor legitimate activity.

Unlock more exclusive Cybernews content on YouTube.