Tornado Cash appears in 107 of more than 200 on-chain money laundering investigations, far ahead of other crypto privacy tools

New research compiled by the crypto analyst known as WazzCrypto suggests that privacy infrastructure shows up often in money laundering cases, but not evenly. Tornado Cash dominates the sample, which matters for PSPs and compliance teams because “privacy protocol” is not one bucket in practice: some tools are showing up far more often than others.

1. Tornado Cash appeared in 107 investigations across more than 200 on-chain investigations conducted in 2025 and 2026. That put it well ahead of the rest of the field and made it the most frequently identified privacy protocol in the dataset.
2. Railgun ranked second with 18 investigations, followed by NEAR Intents with eight. The gap is large enough to matter operationally: Tornado Cash was linked to more than five times as many investigations as Railgun.
3. WazzCrypto’s ranking also included Wasabi/WabiSabi CoinJoin with seven investigations, CoinJoin with five, unnamed privacy protocols and Umbra with two each, and Hinkal, SilentSwap, Monero (XMR), and shielded Zcash with one investigation each.
4. The key point in the data is not just that privacy tools appear in laundering cases, but that they are used to obscure transaction flows by making blockchain activity harder to trace between addresses. Railgun, for example, uses zero-knowledge (zk) cryptography to hide details including the sender, recipient, token type, and amount, and it also has a Private-Proofs-of-Innocence (PPoI) system intended to show deposited funds are not tied to specified lists of suspicious transactions or actors.
5. There is an important limitation in the research: the data measure how often each protocol appeared in the investigated cases, not how much illicit money each one processed. For PSPs, that distinction matters because frequency in case files is not the same thing as transaction volume or exposure.