Bitcoin mixers break the visible trail between incoming and outgoing transactions. By severing the link between pre-mixing and post-mixing addresses, they provide anonymity that is attractive for laundering illicit funds. For investigators, this creates two obstacles: the vast number of outputs that overwhelm capacity, and the lack of knowledge of internal mixer mechanics that forces reliance on external transaction signals.

This thesis investigates whether transaction patterns before and after mixing can reduce the pool of possible post-mixing addresses linked to a pre-mixing address. The aim is not to prove exact one-to-one links but to narrow the search space so investigators can focus on the most likely outcomes.

We use a unique dataset seized from Bestmixer.io, a centralised mixer dismantled in 2019, containing thousands of verified pre- and post-mixing addresses. The analysis proceeds in two stages. First, we cluster wallets on address-level attributes using HDBSCAN, which yields only coarse profiles. Second, we build transaction graphs capturing how funds move through the mixer, learn graph embeddings with a Graph Autoencoder, and cluster them with k-means. This graph-based view reveals clearer transaction patterns. Pre-mixing, we identify consolidators pooling funds, straightforward depositors from exchanges, aggregator funnels combining smaller inputs, and higher-risk users via unregulated services. Post-mixing, we find splitters dispersing funds, large distributors sending bigger amounts to fewer addresses, and straightforward users with minimal redistribution.

We then test whether pre-mixing patterns can predict post-mixing outcomes. Using tree-based ensemble models (Random Forest and Gradient Boosting) with graph embeddings and the original deposit amount, the best model achieves 48 percent accuracy across five classes, more than double the 20 percent baseline. This demonstrates that transaction graph signals can probabilistically reduce the investigative search space.

The study provides the first ground-truth typology of mixer transaction patterns and shows that probabilistic “de-mixing” is feasible. Rather than pinpointing a single post-mixing address, the method highlights a smaller set of likely candidates, offering law enforcement a way to prioritise leads without access to a mixer’s internal mechanics.

Money laundering has been in existence for a long time, but with recent developments in cryptocurrency technologies, using them as a new method of laundering criminal proceeds has become available to a wider audience of criminals due to mixer services. Bitcoin can be considered pseudonymous, and Mixer services attempt to obfuscate the money trail further by creating transactional chaos. Little is known about the exact functioning of these mixers and how criminals interact with these services. In this thesis, a literature study on existing anti- money laundering (AML) technologies and pattern analysis are applied. Unique to this research is the use of insider mixer administration data combined with the use of public blockchain data. The goal of this research is to gain insight into the degree with which mixer transactions can be identified as money laundering. This will increase the foundation for AML regulation and Law Enforcement procedures. The results show that a small share of the transactions can strongly be identified as money laundering, while for a large share of transactions the identification as money laundering is less strong. In addition, some unexpected phenomena such as reverse money laundering were identified.