The report notes the massive impact sanctions had in 2022 and beyond, with Tornado Cash’s daily transactions falling by 97% in a matter of days, while transactions for mixers as a whole dropped by 48%.
While 2024 did record a modest rise in transactions in relation to 2023 (c. 21,000 vs 16,000), 2025 witnessed a significant increase in usage, as total transactions rose to approximately 32,000.
This compares with approximately 38,000 in 2022 (and 2020), while daily numbers climbed close to 300 in late 2025, having topped 450 just prior to August 2022.
Users on the moveNumbers have been steadily recovering, yet Wu and Bear report that users have shifted to alternative platforms, and that Tornado Cash’s formerly dominant market share has recovered only modestly since March of last year.
Railgun, which uses a ‘proof-of-innocence’ system to check deposits against blacklists, now accounts for 71% of all activity.
It’s followed by Tornado Cash (both Tornado Classic and Tornado Nova), which accounted for 25% of transactions in 2025, and then by Privacy Pools, which accounted for 5% of all mixer transactions.
Similar to Railgun, Privacy Pools employs association sets to prove that deposits came from non-blacklisted sources, although it checks provenance prior to withdrawals.
While the growth of Railgun and Privacy Pools indicates a shift to more compliant mixer protocols, the CCAF report notes that such platforms rely on external providers to flag addresses.
In other words, blacklists “are updated dynamically as new exploits are identified,” providing some opportunity for bad actors to move funds to (and from) them quickly, before it becomes impossible.
Noting that “users shifted dramatically toward fast deposits under 24 hours,” the article then goes on to state that such “fast behaviour is consistent with users seeking to avoid identification, a profile more likely to include illicit actors.”
Most deposits now come from unlabelled sources, which are addresses with no recorded entity associations, and which now account for 95% of all funding to mixers (up from 76% in 2020).
While this may suggest that use of mixers remains predominantly illicit, the report’s authors do affirm that such platforms also attract significant numbers of legitimate users.
“Legitimate motivations for using privacy tools include personal financial privacy, protection from targeting (physical attacks on crypto holders are a well-documented and growing problem), and commercial confidentiality,” said Wenbin Wu, who is a Research Associate at the University of Cambridge’s Cambridge Centre for Alternative Finance.
The effect of sanctionsSpeaking to Decrypt, Wu emphasized that blockchains are “radically transparent,” and that such transparency—and permanent visibility—can lead legitimate users to seek out mixers in certain cases.
Yet Wu also states that the 2022 sanctions had the somewhat perverse effect of scaring off legit users, while forcing bad actors to find new channels and protocols.
He said, “The key finding is that sanctions primarily deterred compliant users while illicit actors adapted, initially to alternative mixers, and more recently to cross-chain bridges and decentralised exchanges altogether.”
Having said that, Wu acknowledges that the sanctions imposed “meaningful operational costs” on illicit networks and precipitated the shift to compliant alternatives, providing less scope for bad actors to operate.
He added, “The newer protocols like Railgun and Privacy Pools, which screen deposits against known illicit addresses, are by design less attractive to bad actors.”
