No single technique cracks a mixer. Stacked, they collapse anonymity sets to single-digit candidates.
Mixers preserve statistical fingerprints. Deposit volume and withdrawal volume can be correlated across narrow time windows even when the pool appears opaque.
Attackers rarely wait. Cross-referencing deposit timestamps with withdrawal bursts inside an anonymity set materially reduces the candidate space.
Funds exiting a mixer are often peeled incrementally through dozens of intermediary wallets. Each peel preserves a deterministic signature we follow.
When operational patterns repeat — gas sources, note sizes, withdrawal cadence — the effective anonymity set collapses far below the nominal pool size.
Confirm the mixer contract(s) and version. Ingest the pool's historical deposit/withdrawal ledger for the relevant window.
Compute statistical fingerprints of the target deposit — note denomination, gas payer, relayer choice, timing cohort.
Narrow the withdrawal candidate set by intersecting the fingerprints with the pool's exits inside the likely window.
Continue the trace on each high-probability candidate. Peel chains followed through final hop into exchange or off-ramp.
Response within two business hours. Confidential. Success-fee terms on recovery work.