A breakdown of the $7.6B+ in ETH that Tornado Cash received since 2019 shows 49.6% was from DeFi, 17.7% was from sanctioned entities, and 10.5% was stolen funds
Chainalysis :
Context & Ripple Effects
Chainalysis' composition breakdown of the record criminal crypto flows of 2021 arrives at a charged moment for mixing services: earlier reporting showed criminals moved $8.6B through laundering channels in 2021, with exchanges taking 47% and DeFi just 17%. This new cut of Tornado Cash's $7.6B+ in ETH flips that lens, asking not where dirty money ends up but what feeds a single mixer.
The answer complicates the picture: roughly half the ETH came from DeFi, only 17.7% from sanctioned entities, and 10.5% from outright theft. That mix matters because it quantifies how much of the mixer's volume is ordinary DeFi activity versus the sanctioned and stolen shares that justify enforcement attention.
First-order effects
- Regulators now have a compositional baseline for Tornado Cash: with under a third of inflows tied to sanctioned entities or stolen funds, blanket treatment of the mixer sweeps in the ~50% of volume originating from DeFi.
- DeFi protocols and exchanges gain a data-backed reason to treat mixer-linked deposits as a distinct risk category, since the same contract touches legitimate DeFi flows and the 17.7% sanctioned share.
Second-order effects
- Compliance vendors like Chainalysis convert this kind of attribution into product: screening tools that flag mixer exposure become a purchase necessity for DeFi protocols facing the same counterparty-risk questions exchanges faced when they took 47% of laundered funds.
- If mixer exposure gets flagged at the protocol level, some users route around it, pushing sanctioned actors toward smaller or newer obfuscation services and fragmenting the laundering market Chainalysis tracks.
Third-order effects
- The pattern points toward enforcement keyed to fund-flow composition rather than to individual addresses — a shift later visible in reporting that Tornado Cash inflows jumped 108% from 2023 even as sanctioned jurisdictions drew $15.8B in 2024, suggesting sanctions redirect rather than eliminate mixer usage.
- Analytics firms' share-of-flow breakdowns harden into the de facto legitimacy test for crypto infrastructure, widening the gap between protocols that can demonstrate clean composition and those that cannot.
The trend: On-chain analytics firms are becoming the arbiters of which crypto infrastructure counts as legitimate, with fund-composition data increasingly driving sanctions and compliance design.