The Shape of DeFi (Part II)
Tracing by Behaviour
Part II of III in The Shape of DeFi series. Read Part I here.
Between early July and early September 2026, 11,723 new addresses each received a single withdrawal from Tornado Cash, the best-known crypto mixer. About 48 seconds later (four Ethereum blocks), each sent everything to another network. On Arbitrum, 95% of those arrivals returned to Ethereum, half within 32 seconds.
Behind these addresses is a single coordinated operation, and it skews the figures below:
At first glance, mixer users seem to skip trading and lending and send funds straight to other networks. Most of that bridging actually comes from the coordinated operation described above.
A mixer pools funds from many users, breaking the visible link between deposit and withdrawal. Users deposit fixed amounts called notes. Layer 2 networks like Arbitrum, Optimism, and zkSync run on Ethereum and offer faster, cheaper transactions. Bridges move funds between these networks and Ethereum.
One Operator, Thousands of Addresses
The pattern appears abruptly. In the two weeks before, no new recipients followed this routine. From the week of 6 July, three in four new recipients of Tornado Cash withdrawals on Ethereum fit this pattern.
We treat these addresses as one, so we call whoever runs them the operator. We don't know who is behind it or whether the funds are illicit, and we make no claim either way.
Out and Back
The route forms a loop. Most funds arrive from other blockchains, pass through the mixer, cross to a layer 2, and return to Ethereum.
Roughly 60% of the ETH came in via cross-chain swaps, almost all from Bitcoin through THORChain and some from Solana through Mayan. The rest came from Ethereum addresses created only to pass the money on.
At least 15,585 ETH went in, mostly in 0.1, 1, and 10 ETH notes, from 1,914 addresses that made the deposits. Each was a new address used for its first deposit. The money went out to 11,723 new addresses, each with one withdrawal. The same public relayers (services that pay transaction fees on a user's behalf) that serve everyone else paid the fees.
Each address then sent everything to Arbitrum, Optimism, or zkSync, totalling 17,053 ETH. For almost all, this was their only transaction. On Arbitrum and Optimism, nearly all funds went straight back to Ethereum. On zkSync, funds left more slowly through a cross-chain liquidity provider and, in the cases we checked, also landed back on Ethereum.
Most of the money that came back from Arbitrum went to an exchange. Within five transfers, 95% reached deposit addresses our data labels as KuCoin (labels as of 30 September 2026).
What Gives It Away
A mixer cannot hide the habits of an operation that repeats the same moves thousands of times. Deposits and withdrawals rise and fall together, about an hour apart. Everything points to two ends of the same operation: every deposit used the same unusual fee setting. In the smallest pool, other users hadn't deposited enough since June to cover the withdrawals, so the operator must have been funding its own. The mixer still hides which deposit paid which withdrawal.
None of this appears in a single transaction. The pattern emerges only when you view thousands of addresses across networks, with the services they touch labelled. That is the view Chainlabs’ data is built to give.
Still Running
Through September, about a third of addresses receiving Tornado Cash withdrawals on Ethereum still followed the same pattern, at roughly an eighth of August's ETH volume, now only via Arbitrum.
In late August, the route changed. On Arbitrum, funds pass through one more address and a cross-chain aggregator before returning to Ethereum. From mid-September, a single address took a 1% cut on nearly every transfer.
The new route ends where the old one did: back on Ethereum, combined, and into deposit addresses labelled KuCoin in our data (labels as of 1 October 2026), many of them the same addresses as in August.
The Picture Without the Operator
Set that operation aside and the picture changes:
About a quarter of recipients bridge (24.8%), and about one in six use a DEX, lending market, or another DeFi protocol within 30 days (15.5%).
One mixer still stands out. Even without that operation, recipients of Tornado Cash withdrawals bridge about 2.5 times as often as they use a DEX, lending market, or another DeFi protocol. For Railgun and Privacy Pools, bridging and DeFi use are about equal.
Who's Behind the Number?
Part I showed that ranking DeFi by assets held misses what protocols actually do. Here in Part II, the same problem shows up inside a single statistic: one busy operator can look like a market-wide trend until you break the figure down.
For anyone reading crypto data, whether an analyst, a compliance team, or a journalist, the lesson is to identify the actor behind a pattern before drawing conclusions about the market.
Method and Limits
- Scope: Ethereum mixer withdrawals and recipient activity from 26 June to 10 September 2026, using public chain data and Chainlabs labels. The "Still Running" section extends this analysis to 30 September.
- Labels: ours, dated 30 September 2026 (1 October for the September route). "Labelled X in our data" describes our attribution, not a finding about the entity.
- Distance: by the time the money reached deposit addresses labelled KuCoin in our data, it was typically seven transfers past the mixer, including two across chains and four after returning to Ethereum.
- Deposit total: a floor. We identified the depositing addresses through the operator's collection sweeps on 30 and 31 August, so we don't count later or unswept deposits. That is why the ETH that went in (at least 15,585) is below the ETH bridged (17,053).
- Partly observed: we checked the zkSync leg in a sample.
- Tornado Cash: removed from the US sanctions list in March 2025.
Looking Ahead
In our next and final instalment, we follow scam proceeds and funds stolen in exploits as they move through DeFi protocols, alongside darknet-shop payments crossing chains through swap services.
The Shape of DeFi is a three-part series built on Chainlabs' internal taxonomy. Figures come from the Chainlabs catalogue and labels as of 30 September 2026.
Research & Data: Martín Jofré & Guillaume Donnet
Editorial: Scott Mallen
FAQ
Where do funds go after leaving a mixer on Ethereum?
Across all the withdrawals analysed, after setting aside a single large operation, about a quarter of recipients bridged, and about one in six used a DEX, lending market, or another DeFi protocol within 30 days.
Why did so many mixer withdrawals go to bridges?
Mostly because of one operation. Starting the week of 6 July, three in four new recipients of Tornado Cash withdrawals on Ethereum belonged to it, and most sent their funds to a layer 2 network within a minute.
Can a mixer hide an operation like this?
Not fully. A mixer breaks the link between a deposit and a withdrawal, but repeated timing, identical behaviour, and shared collection addresses still show up across thousands of transactions.
Is the operation still running?
Yes. Through September, about a third of the addresses receiving Tornado Cash withdrawals on Ethereum still followed the pattern, at roughly an eighth of the August ETH volume, now only through Arbitrum.