Detect Crypto Mixer Usage
“Which addresses will route funds through known mixing services in the next 14 days?”
Book a demo and get a free trial of the full platform: research agent, fine-tune capabilities, and forward-deployed engineer support.
By submitting, you accept the Terms and Privacy Policy.
Loved by data scientists, ML engineers & CXOs at
A real-world example
Which addresses will route funds through known mixing services in the next 14 days?
Blender.io (sanctioned May 2022), Tornado Cash (Aug 2022). Mixers break the tracing chain — once mixed, recovery is exponentially harder. Transacting with Tornado Cash is an OFAC violation. Catching funds before mixing occurs is the last intervention window.
How KumoRFM solves this
Graph-powered fraud intelligence
Kumo identifies the pre-mixing behavioral signature: consolidation from multiple addresses, specific denomination patterns matching mixer pools, and interaction history with known pre-mixer staging addresses. ADDR001 is consolidating funds from 5 addresses into fixed denominations matching Tornado Cash deposit pools — 93% probability of mixer interaction within 14 days.
From data to predictions
See the full pipeline in action
Connect your tables, write a PQL query, and get predictions with built-in explainability — all in minutes, not months.
Your data
The relational tables Kumo learns from
Addresses
| address_id | first_seen | entity_type | chain |
|---|---|---|---|
| ADDR001 | 2024-02-18 | individual | ETH |
| ADDR002 | 2024-08-30 | unknown | ETH |
On-Chain Transfers
| txn_hash | from_address | to_address | amount | timestamp |
|---|---|---|---|---|
| 0xg9... | ADDR001 | ADDR400 | 10.0 | 2025-01-10 |
| 0xh1... | ADDR002 | ADDR401 | 32.0 | 2025-01-15 |
Labels
| address_id | tag | source | confidence |
|---|---|---|---|
| ADDR400 | tornado_cash | OFAC | 1.00 |
| ADDR401 | mixer | Chainalysis | 0.94 |
Write your PQL query
Describe what to predict in 2-3 lines — Kumo handles the rest
PREDICT LIST_DISTINCT(ON_CHAIN_TRANSFERS.TO_ADDRESS WHERE LABELS.TAG IN ("mixer", "tornado_cash"), 0, 14, days) FOR EACH ADDRESSES.ADDRESS_ID
Prediction output
Every entity gets a score, updated continuously
| ADDRESS_ID | CLASS | SCORE | TIMESTAMP |
|---|---|---|---|
| ADDR001 | ADDR400 | 0.93 | 2025-02-01 |
| ADDR002 | ADDR401 | 0.81 | 2025-02-01 |
Understand why
Every prediction includes feature attributions — no black boxes
Address ADDR001
Predicted: 93% probability of routing to ADDR400 (Tornado Cash)
Top contributing features
Transfer amount to ADDR400
10.0 ETH
39% attribution
Label tag
tornado_cash (OFAC)
28% attribution
Label confidence
1.00
15% attribution
Address entity_type
individual
11% attribution
Address first_seen recency
12 months
7% attribution
Feature attributions are computed automatically for every prediction. No separate tooling required. Learn more about Kumo explainability
PQL Documentation
Learn the Predictive Query Language — SQL-like syntax for defining any prediction task in 2-3 lines.
Python SDK
Integrate Kumo predictions into your pipelines. Train, evaluate, and deploy models programmatically.
Explainability Docs
Understand feature attributions, model evaluation metrics, and how to build trust with stakeholders.
Bottom line: Intercept funds before they enter mixers. Transacting with Tornado Cash is an OFAC violation. Flag mixer-bound transactions within the block confirmation window.
Related scenarios
Explore more fraud predictions
Topics covered
