On-chain forensics firm traces a $180M cluster across three mixers

A newly published forensics report walks through a re-clustering technique that links roughly $180 million in flows across three separate mixing services.

The methodology is not novel in principle — it combines timing analysis with fee-pattern fingerprinting — but the scale of the demonstration is notable. Prior public work has stopped at the tens of millions; this one is an order of magnitude larger and adds a cross-service correlation step that the field has been talking about but rarely shipped.

The paper stops short of naming a specific attributed actor, but the flow shape is consistent with prior public reporting on a state-linked cluster. Two independent researchers we consulted said the methodology is sound; a third argued the timing-signal weighting is aggressive and would benefit from a sensitivity analysis the report does not include.

The wider implication is uncomfortable for privacy-tool developers and for their users. As adversary models get better funded, the marginal privacy gain of an off-the-shelf mixer without operational discipline is shrinking fast.