Unmasking the Mixer: How On-Chain Sleuths Demix Tornado Cash Transactions

Tornado Cash's privacy promise can be undone in practice through "demixing," in which on-chain analysts use behavioral heuristics on public blockchain data to probabilistically link deposits to withdrawals, without breaking any cryptography. The article describes heuristics such as address reuse, gas price fingerprinting, timing correlation, and voucher count matching, and says academic studies and forensic tools have linked sometimes 20-35% or more of transactions when combined. It highlights two open-source tools: tornado-demix, a Python CLI by prettydeath for deposit-withdrawal correlation, and retrace, a web dashboard by 0xKoda for post-mixer withdrawal analysis.