Seized mixers: ChipMixer, CryptoMixer

If you typed ChipMixer, CryptoMixer, Bestmixer, Sinbad or Blender into a search box, you are looking for a service that no longer exists. Every one of them was seized by law enforcement, and the pages ranking above this one are press releases written on the day it happened. None of them answers the question you actually have, which is what is at that address right now and whether the thing loading in your browser is the real one.

So we measured it. We run notrace.exchange, a mixing service, which makes us an interested party and also the kind of party that checks. Everything below was taken on 30 September 2026, and you can repeat all of it yourself.

What is at those addresses today

Six domains, checked by DNS, by the public registry record and by asking them over HTTP:

• chipmixer.com resolves through Cloudflare and answers on HTTPS with a seizure banner: "This domain has been seized by the Federal Bureau of Investigation in accordance with a seizure warrant issued pursuant to Title 18 U.S.C. §§ 981(a)(1)(A), 981(b), 982(a)(1), 982(b), and Title 21 U.S.C. §§ 853 issued by the United States District Court for the Eastern District of Pennsylvania". The banner lists the agencies involved, from the Bundeskriminalamt to the Kantonspolizei Zürich.
• sinbad.io does not complete a TLS handshake at all, but answers plain HTTP with its own banner: "This service has been seized as part of a coordinated law-enforcement action between the Federal Bureau of Investigation, the Financial Intelligence and Investigation Service (FIOD), and the National Bureau of Investigation taken against the Sinbad.io cryptocurrency mixing service."
• bestmixer.io still resolves, to a single address that is not behind a CDN, and then answers nothing at all. Both ports time out. The name works; there is no service behind it.
• blender.io does not resolve. The name is gone from the DNS entirely.
• cryptomixer.io resolves to a CDN which returned us a 403 and no page. We could not read it from where we are, and we are not going to tell you what it says on the basis of not having seen it. What the record says about it is in the next section but one.
• samouraiwallet.com, a wallet rather than a mixer, is the clearest case of all, and we will come back to it, because it is where the method is.

Five different-looking outcomes, and only two of them involve a page that announces anything. That is the first useful finding: the absence of a seizure notice is not evidence that a service is alive, and a page that loads is not evidence of anything at all.

The registry says more than the page does

A domain's public registry record is a better source than its homepage, because the operator does not write it.

Two contrasting records, both read on 30 September 2026:

• chipmixer.com carries three status flags set at registry level: server delete prohibited, server transfer prohibited, server update prohibited. The "server" prefix matters. Ordinary locks that a registrar offers a customer are the "client" kind; the server kind is applied by the registry itself and is, in practice, the fingerprint of a legal hold. The domain was registered on 7 July 2016, runs to 7 July 2027, and was last changed on 8 July 2026. Its nameservers, meanwhile, are ordinary Cloudflare ones.
• samouraiwallet.com has no address record at all, so nothing loads, and for a while that was all we knew about it. The reason is in the registry: its nameservers are ns1.fbi.seized.gov and ns2.fbi.seized.gov. There is no banner to read, no page to judge, and no ambiguity either.

That is the whole method, and it takes a minute. Look up the domain's registry record and read two fields: the status flags and the nameservers. A seizure leaves a trace in at least one of them, and neither field is under the control of whoever is serving the page.

It also explains the awkward case above. We could not read cryptomixer.io ourselves — but two accounts we could read say what is there. The European criminal-law journal eucrim reports that "a seizure notice was placed on the website" after the cryptomixer.io domain was seized; TRM Labs reports the domain was seized and replaced with an "Operation Olympia" splash page.

What the seizures actually took

Two of these were large operations, and the published numbers are worth reading side by side.

ChipMixer, taken down on 15 March 2023 by German and US authorities with Europol and with Belgium, Poland and Switzerland. Per eucrim: "approximately 1909.4 Bitcoins (worth approx. €44.2 million)" seized, along with four servers and 7 TB of data. The service had been running since 2017 and had moved, by the same account, "an estimated 152.000 Bitcoins in crypto assets, worth roughly €2.73 billion according to current estimations".

CryptoMixer, taken down during an action week of 24–28 November 2025 in Zurich, announced on 26 November, by Swiss and German authorities with Europol and Eurojust. Three backend servers, more than €25 million in cryptocurrency, and roughly 12 terabytes of data.

That last number is the one to dwell on, because of what was in it. TRM Labs describes the haul like this: "The data set includes extensive transaction records, wallet cluster mappings, internal service logs, application files, and user-interaction metadata."

We could not open the Department of Justice or Treasury pages from here — one returns 401 to our exit and the other was refused outright — and the Europol page arrives as an empty shell that renders in the browser. So the paragraphs above cite the two sources we actually read. Where you see a number in this article, we read it; where we could not, there is no number.

What twelve terabytes proves about "no logs"

"We keep no logs" is the most repeated promise in this market. It is also the only claim a customer can never test, because the test requires access to the servers.

Seizures are that access. And each time it has happened, the data was there:

• CryptoMixer, November 2025: twelve terabytes, including internal service logs and user-interaction metadata, as quoted above. That is ten months ago, not ancient history.
• ChipMixer claimed logs and session information were deleted after seven days; researchers testing the service found their session tokens still valid after sixteen.
• Bestmixer promised to erase order history completely and automatically within 24 hours; the seizure produced IP addresses, transaction logs, wallet addresses and chat messages.

The last two we went through in detail in crypto tumbler vs mixer, with the academic paper they come from, so we will not re-run them here. The point they make together is structural rather than a matter of these particular operators being liars: a deletion promise is unfalsifiable while the service is running and falsified only once it is too late to matter. It is worth exactly as much as the operator's honesty, and it is priced by customers as though it were a technical guarantee.

The useful reaction is not to look for a service with a better promise. It is to stop treating that promise as information, and to weigh the things that can be checked before you pay instead.

A dead brand is worth stealing

There is one more state a seized domain can reach, and it is the dangerous one.

A seized or abandoned name eventually leaves the registry, and then anyone can take it. Tornado Cash is the worked example: the domain was registered afresh on 25 March 2025, long after the protocol was sanctioned, and the site that appeared on it was a trap. A user arrived through an old bookmark, entered a deposit note into what looked like the familiar interface, and lost it — whoever presents the note first can withdraw, so nothing needed to be broken. The chain shows 1,010 ETH taken across two addresses. As of today that domain does not resolve at all. We went through the whole sequence in Tornado Cash: what happened to it.

Note what the victim had. A correct brand name. A working bookmark. A page that looked right and loaded normally. Every signal people actually use, and all of them were satisfied.

This is why the two checks above are worth the minute they cost, and why we have not put a single link to any of these domains in this article. Type nothing from memory; verify the record, not the page.

An error of our own, one day old

On 29 September 2026 we ran a competitive survey of twelve mixing services and recorded cryptomixer.io among the working ones, because it answered and had the search footprint of a live site. It had been seized ten months earlier.

The measurement was not wrong about what it measured; the conclusion drawn from it was. We are describing our own mistake here rather than quietly correcting it, because it is precisely the failure this article is about, made by people who were looking directly at the question and still went by "the domain answers".

A second one, from the measurement for this article: the first pass wrote every HTTP response into the same temporary file, and when a request failed the file kept the previous domain's page. For a few minutes ChipMixer's seizure banner appeared to be Bestmixer's and Sinbad's. Each host needs its own response file, or a failure reads as the neighbour's success.

Where we stand

We are a service in this market, so the sensible thing is to state what we do rather than what we would never do.

• We do not claim to keep no logs. What is kept is the order — its addresses, amounts and times. An order created on the clearnet site also records the connecting IP address, which on 30 September 2026 was erased after 30 days; an order created over Tor carries no IP at all. The current wording and figure are on the FAQ page.
• The service is custodial while your chosen delays run, and section 8 of the terms says so in those words. What that does and does not change is in custodial vs non-custodial.
• Each order comes with a letter signed with our PGP key, naming what you send, the least you will receive, both payout addresses and both delays. That is checkable before you pay, which is the whole reason it exists.
• The payout leaves as two transfers with independent delays, each settable from zero to 6 hours on 30 September 2026, and our fee that day was 0.5% and was the only thing added to the quote.

None of that removes what is already written in the chain, and no service can. What changes is whether coins leaving a known address can be followed forward.

Where to start

If you came here for one brand, the answer is that it is gone and what remains at the address is either a government banner, silence, or somebody else. Check the registry record before you trust a page.

If you came here to choose a replacement, the checks in how to choose a bitcoin mixer are the ones we would run, including against ourselves, and they deliberately contain nothing that depends on believing a deletion promise. If you want to see what the chain keeps regardless of which service you pick, is Bitcoin traceable covers it, and the bitcoin mixer page opens our form with its current minimum.