What Happened
On March 9, 2026, Treasury Secretary Scott Bessent submitted a 32-page report to Congress titled 'Innovative Technologies to Counter Illicit Finance Involving Digital Assets.' The report was required under Section 9 of the GENIUS Act, signed in July 2025, and arrived roughly seven weeks past its deadline. Treasury reviewed more than 220 public comments in preparing it.
The headline finding for Bitcoin holders: the report explicitly states that 'lawful users of digital assets may leverage mixers to enable financial privacy when transacting through public blockchains.' Treasury gave concrete examples: individuals protecting personal wealth, shielding business payments, keeping charitable donations off a public ledger, and maintaining spending privacy as digital assets become more common for everyday transactions. This is the first time the department has put that language in a formal congressional filing.
The same report also recommended that Congress create a 'hold law' giving regulated institutions safe harbor to temporarily freeze suspicious digital assets during brief investigations, and proposed a new sixth special measure under Section 311 of the PATRIOT Act that would allow Treasury to restrict certain digital asset transfers. Privacy acknowledgment and expanded surveillance infrastructure arrived in the same document.
Why This Matters and What It Doesn't Change
The policy shift is real, but it doesn't mean much in practice without understanding what it replaced. Treasury sanctioned Tornado Cash in 2022. A federal appeals court ruled that decision overstepped OFAC's authority. Immutable smart contracts don't constitute 'property' under sanctions law, and the sanctions were lifted in March 2025. But in August 2025, a Manhattan jury convicted Tornado Cash co-founder Roman Storm of operating an unlicensed money transmitter. The jury deadlocked on the more serious money laundering and sanctions charges. Storm awaits sentencing. The DOJ has since signaled softer enforcement, stating that writing code without criminal intent shouldn't trigger prosecution under the money transmitter statute. None of that is final.
What the Treasury report does is put the privacy argument into the federal record from the executive branch. That matters for future litigation, for how banks treat Bitcoin privacy tool users, and for how the broader regulatory environment develops. It doesn't create a safe harbor for individuals. It doesn't immunize any specific tool. And it came with a $1.6 billion disclosure: since May 2020, that much in deposits from mixing services has flowed into crypto bridges, with over $900 million tied to a single bridge linked to North Korean laundering operations.
What Actually Survived
The enforcement environment has reshaped the available toolkit significantly. Centralized custodial mixers have been the primary target. In November 2025, Europol's Operation Olympia took down Cryptomixer, seizing servers in Switzerland and roughly EUR 25 million in Bitcoin. The service had mixed over EUR 1.3 billion since 2016 and was heavily used by ransomware groups and dark-web markets. Bitcoin Fog's operator was convicted in the U.S. earlier. The pattern is consistent: EU law enforcement treats large custodial mixers as crime infrastructure, and the analytical tools available to investigators have improved significantly since the early days of Bitcoin mixing, particularly when users interact with KYC exchanges before or after mixing. Criminals have adapted by routing through DeFi bridges and decentralized exchange swaps instead, and Treasury's own report flags those bridge flows as already under active analysis.
The distinction Treasury drew matters practically. Custodial mixers are treated as money services businesses, required to register with FinCEN, implement AML programs, and respond to law enforcement requests. Non-custodial, protocol-level tools such as CoinJoin operate differently. What remains functional for individual holders: Wasabi Wallet routes all traffic over Tor by default, keeps keys non-custodial, and charges 0.3% with a fee waiver for amounts under 0.01 BTC. Sparrow Wallet's Whirlpool integration uses fixed-denomination pools with multiple remix rounds. PayJoin and STONEWALL-style constructions make ordinary payments look like joins, adding entropy without a separate mixing step. These are protocol-level tools where no operator holds your funds and no server can be seized to reconstruct your history.
The fundamentals carry more weight than any single tool. Address reuse is the most common privacy failure: every time you reuse a Bitcoin address, you link transactions together and reduce your anonymity set. Running your own node means your transaction data doesn't pass through a third party's server. Buying Bitcoin through non-KYC channels such as peer-to-peer markets or Bitcoin ATMs with cash keeps your identity off exchange records at the point of acquisition. None of this is exotic. It's the baseline that mixers are supposed to supplement, not replace.
What This Means for You
The Treasury report is not permission to use mixing tools carelessly. It's a signal that the regulatory environment is maturing, slowly and inconsistently, toward treating financial privacy as a legitimate interest rather than presumptive evidence of crime. That's meaningful for the long term. For your posture today, it changes less than the headlines suggest. The report is explicit: even after mixing, interacting with custodial services, exchanges, or fiat rails can still trigger heightened scrutiny, suspicious activity reports, or de-risking. The 'mix once, then go straight to a KYC exchange' flow is the pattern most likely to be reconstructed through clustering, timing analysis, and exchange data.
Build your privacy from the ground up rather than relying on a single tool. No address reuse, ever. Run your own node or use one you trust. Buy without KYC where you can. Use CoinJoin through Wasabi or Sparrow as a standard practice for coins you hold long-term, not as a one-time cleanup. If you're using Tor, keep it consistent. Using it only for sensitive transactions creates a pattern that's more revealing than using it always.
Understand your own threat model before layering on complexity. Most Bitcoin holders face KYC exposure, address reuse, and exchange custodianship as their primary privacy risks. Those are fixed with basic hygiene and self-custody. The mixer question is relevant for holders who have already addressed those fundamentals and are thinking about the next layer of on-chain privacy.
What to Watch
Roman Storm's sentencing is the next inflection point for U.S. privacy tool jurisprudence. If the DOJ's softer enforcement language translates to a lighter sentence, or if the remaining charges are dropped, it will clarify developer liability significantly. Watch also for whether Congress acts on Treasury's 'hold law' recommendation. That proposal would give exchanges new authority to freeze funds without a court order, which has direct implications for how any privacy-adjacent Bitcoin activity gets treated by U.S.-regulated platforms.