Wasabi Wallet - Total Privacy For Bitcoin

[Pmalek]

TRM Labs claims to have demixed certain Wasabi and mixer transactions in connection to the stolen crypto from the LastPass hack in 2022. Wallets allegedly drained in 2024 and 2025 were linked by TRM Labs on-chain back to their original clusters. They further claim that they were able to follow the stolen crypto to Russian fiat on/off-ramps even after they went through Wasabi and mixers. It's believed that $28 million was converted to bitcoin and coinjoined through Wasabi in late 2024 and early 2025.

TRM analysts allegedly use certain "demixing techniques" to match deposit to withdrawal clusters. By considering values and timings of on-chain movements, they tie pre-mix bitcoins to post-mix bitcoin and conclude that the same operator controls certain deposits and withdrawals from Wasabi.

Besides the claims by TRM, there is no actual evidence or examples showing that they connected pre-mixed bitcoin to post-mix bitcoin and inputs to outputs. At least not in this blog post.


Source: https://www.trmlabs.com/resources/blog/trm-traces-stolen-crypto-from-2022-lastpass-breach-on-chain-indicators-suggest-russian-cybercriminal-involvement

[NotATether]

Besides the claims by TRM, there is no actual evidence or examples showing that they connected pre-mixed bitcoin to post-mix bitcoin and inputs to outputs. At least not in this blog post.

Without actual evidence, their claims must be taken with a grain of salt, because WabiSabi coinjoins can be of variable sizes AFAIK depending on the server configuration.

[FinneysTrueVision]

TRM analysts allegedly use certain "demixing techniques" to match deposit to withdrawal clusters. By considering values and timings of on-chain movements, they tie pre-mix bitcoins to post-mix bitcoin and conclude that the same operator controls certain deposits and withdrawals from Wasabi.

Demixing is a somewhat misleading term because they have not broken the obfuscation algorithm to know with 100% certainty which outputs came from which specific inputs. Using Wasabi in and of itself isn’t enough to deanonymize a user. What they can analyze are behavior patterns. If you are trying to launder millions of dollars, you are still going to stick out like a sore thumb if you are sending large amounts of coinjoined BTC in a systematic, identifiable manner to 1 or 2 centralized destinations. With enough educated guesswork, you can eventually piece together enough information, with clues left by the hackers, to say ‘this is the most plausible culprit’.

[lontivero]

By considering values and timings of on-chain movements, they tie pre-mix bitcoins to post-mix bitcoin and conclude that the same operator controls certain deposits and withdrawals from Wasabi.

What does "By considering values and timings of on-chain movements" mean? Imagine you're monitoring Wasabi coinjoin liquidity and notice that a substantial amount of money enters the system, significantly increasing available liquidity. For example, let's say 600 BTC flows in. You then observe that total system liquidity stabilizes at this higher level—indicating the entity that deposited is still actively coinjoining. At this point, you can no longer track the funds, but you know the entity remains in the mixing process.

Then, you notice liquidity drops sharply—say, by 300 BTC. You decide to trace the outgoing funds and discover either a large consolidation of tens or hundreds of bitcoins, or multiple deposits flowing to the same exchange. Shortly after, liquidity drops again. Following the exiting funds once more, you find additional consolidations or more deposits to that same exchange.

Here's the critical question: what are the odds that 600 BTC entered the system and 600 BTC exited—only to end up at the exact same exchange?




This is why a whale can never hide among small fishes. This is why big consolidating lots of coins is a bad idea, especially for whales and this is why using Wasabi as a mixer is a bad idea.

[Pmalek]

What does "By considering values and timings of on-chain movements" mean?
<Snip>

TRM Labs' analysis is guesswork based on observable patterns. They couldn't identify the individuals doing the coinjoining. At least, there is no proof of it in the shared article. The only thing that the analysis showed was that stolen funds (around $28 million BTC) were sent to Wasabi for coinjoining and then similar numbers around the same time were observed going to Russian fiat on/off ramps. Some of them sanctioned before or maybe because of the connection to the stolen crypto. And yes, the inputs and outputs stand out because of the huge number of money involved.

[JollyGood]

This is something some people/teams find as a challenge. If they can find the root of an mix or coinjoin they will get the plaudits and publicity that goes along with it. Others might want to remain anonymous but want it known if mixers and/or coinjoins can be traced back to the origin therefore want to discover if it really can be achieved.

I am not stating it is impossible, however credibility is essential. Any individual, group or organisation making claims really should provide substantial evidence before announcing anything otherwise they will never be taken seriously. Until (or unless) they provide evidence, their claim means nothing.

TRM Labs claims to have demixed certain Wasabi and mixer transactions in connection to the stolen crypto from the LastPass hack in 2022. Wallets allegedly drained in 2024 and 2025 were linked by TRM Labs on-chain back to their original clusters. They further claim that they were able to follow the stolen crypto to Russian fiat on/off-ramps even after they went through Wasabi and mixers. It's believed that $28 million was converted to bitcoin and coinjoined through Wasabi in late 2024 and early 2025.

TRM analysts allegedly use certain "demixing techniques" to match deposit to withdrawal clusters. By considering values and timings of on-chain movements, they tie pre-mix bitcoins to post-mix bitcoin and conclude that the same operator controls certain deposits and withdrawals from Wasabi.

Besides the claims by TRM, there is no actual evidence or examples showing that they connected pre-mixed bitcoin to post-mix bitcoin and inputs to outputs. At least not in this blog post.


Source: https://www.trmlabs.com/resources/blog/trm-traces-stolen-crypto-from-2022-lastpass-breach-on-chain-indicators-suggest-russian-cybercriminal-involvement