Mixing services try to distort cash flow tracking of cryptocurrencies and obfuscate the origin of customers’ earnings by substituting customers’ cryptocurrency funds with the funds of other customers or the mixers’ private assets. This quality makes mixing services interesting for money laundering, and they are therefore often used by criminals. As such, there is an urgent need to systematically understand how to restore the relationship between deposits and payouts of centralized mixing services. Unfortunately, there is minimal knowledge of how mixing processes of centralized mixing services work, and few attempts exist to create these demixing methods. This research aimed to develop a demixing method for centralized mixers with knowledge gained from ground-truth data. The ground-truth data contains information on orders and the transaction history of mixing service BestMixer. Demixing consists of collecting all addresses that are part of the mixer (attribution) and finding the correct payout to a deposit (reconstruction). Multiple statistical analysis techniques were applied to this data to verify existing attribution heuristics and find new characteristics of mixing services. Also, filtering techniques to reconstruct the relation between deposits and payouts were tested on the order data. This research verifies that BestMixer likely did not reuse addresses in the mixing process. It also showed that the lifespan of most addresses was shorter than 24 hours. In addition, many BestMixer addresses received or sent a transaction to another BestMixer address, which created sequences of BestMixer transactions. The sequences show that the mixer used a peeling chain pattern in combination with multi-input transactions. These characteristics can be used to attribute other centralized mixing services. The results also show that the mixer increased in popularity throughout time. Overall, the reconstruction attempt with filtering techniques did not perform well on BestMixer orders, as it returned an impracticable amount of possible payout combinations. The mixer showed less activity in the beginning days of the service, and there are signs that the reconstruction works better in this earlier stage of the mixer. This means that when a mixer becomes more popular, it could become more difficult to demix the orders correctly. From this research can be concluded that the ground-truth data of BestMixer does help in developing attribution heuristics for centralized mixers, but not in developing a general reconstruction method that correctly restores the relation between deposits and payouts, thus not suffice in demixing centralized mixers.

Money laundering has been in existence for a long time, but with recent developments in cryptocurrency technologies, using them as a new method of laundering criminal proceeds has become available to a wider audience of criminals due to mixer services. Bitcoin can be considered pseudonymous, and Mixer services attempt to obfuscate the money trail further by creating transactional chaos. Little is known about the exact functioning of these mixers and how criminals interact with these services. In this thesis, a literature study on existing anti- money laundering (AML) technologies and pattern analysis are applied. Unique to this research is the use of insider mixer administration data combined with the use of public blockchain data. The goal of this research is to gain insight into the degree with which mixer transactions can be identified as money laundering. This will increase the foundation for AML regulation and Law Enforcement procedures. The results show that a small share of the transactions can strongly be identified as money laundering, while for a large share of transactions the identification as money laundering is less strong. In addition, some unexpected phenomena such as reverse money laundering were identified.