Crypto privacy protocols are increasingly appearing in money laundering investigations, with data from on-chain analysis revealing significant disparities in their prevalence.
According to research compiled from more than 200 on-chain investigations conducted in 2025 and 2026, Tornado Cash emerged as the dominant privacy protocol in these cases. The protocol appeared in 107 investigations, substantially ahead of other privacy-focused tools.
Railgun ranked second with 18 investigations, followed by NEAR Intents with eight. Other protocols appeared far less frequently: Wasabi/WabiSabi CoinJoin was linked to seven investigations, CoinJoin to five, and Unnamed privacy protocols and Umbra each to two. Hinkal, SilentSwap, Monero, and shielded Zcash each featured in one investigation.
Privacy protocols function by obscuring the traceability of blockchain transactions. Railgun, for instance, uses zero-knowledge cryptography to conceal details including the sender, recipient, token type, and transaction amount. The protocol also incorporates a Private-Proofs-of-Innocence system designed to allow users to demonstrate that deposited funds are not connected to flagged suspicious transactions or actors.
Researchers cautioned that the frequency data should not be interpreted as indicating the volume of illicit funds processed through each protocol. The investigation counted how often each privacy tool appeared in cases examined, not the total amount of illicit cryptocurrency involved. Additional research is needed to provide a more complete assessment of privacy protocol usage in illicit activity.
