Helix: The Bitcoin Mixer Built Into Darknet Withdrawals

In the Helix money laundering case, the Financial Crimes Enforcement Network assessed a $60 million civil penalty against the bitcoin mixer’s operator for Bank Secrecy Act violations. Its civil assessment described over $311 million in transactions without appropriate customer or transaction checks. Helix built connections to darknet markets while leaving suspicious activity reporting out of its operation. Someone inside an exchange, wallet service or payment business may recognize that split between the customers a business works to attract and the controls it chooses to leave out.

Helix operated from 2014 through 2017, conducting over 1,225,000 customer transactions, according to the civil assessment. In its account of the criminal case, the Justice Department reported that the operator pleaded guilty to money laundering conspiracy on August 18, 2021. It described a service with much of its money coming from or going to darknet drug markets. The operator kept a percentage of the transactions as fees.

How Helix Moved Bitcoin

Helix accepted customers’ bitcoin and sent different bitcoin to their chosen destination, using accounts it held at other exchanges along the way. FinCEN’s statement of facts describes a business that controlled the movement of the money and charged for obscuring its source or owner.

The service grew out of Grams, a darknet search engine run by the same operator. Grams helped users find illicit goods, including narcotics, illegal firearms and stolen personal information. Helix supplied the money-moving service alongside the search business.

For customers with a Grams account, the process began with bitcoin sent to an associated wallet. A withdrawal form recorded the amount, destination address and an optional time delay. Helix then sent the deposit to one of its accounts at an exchange, drew bitcoin from a different account and routed that bitcoin through another address to the customer’s destination, less its fee.

Helix Light offered a version that required no Grams account. It used the same underlying arrangement of exchange accounts and replacement bitcoin. Taking the account out of the customer’s experience left the operator’s role in moving the money intact.

That exchange connection matters to an insider. As FinCEN’s 2019 guidance on cryptocurrency business models explains, a hosted wallet provider can control customer value, and transfers on an internal ledger need not each appear on a public blockchain. The exchange’s account records can answer questions about control and customer identity that the public transfer alone leaves open.

Darknet Withdrawals Built to Work With Helix

The Justice Department’s account of the criminal case says Helix’s API let darknet markets build the mixer directly into their bitcoin withdrawal systems. The operator also customized Helix features to work with significant markets. Those were business and engineering decisions about whom the service would support.

The Financial Crimes Enforcement Network’s civil findings make the relationship concrete. AlphaBay recommended a bitcoin tumbler to its customers and embedded a link to Helix. The agency identified 191,988 direct bitcoin transactions worth $27,066,798 between Helix and AlphaBay. Across its analysis, Helix addresses interacted directly with 39 darknet marketplaces and other illicit markets.

The appeal of an easy withdrawal path fits a broader finding in the Wharton Initiative on Financial Policy and Regulation’s 2024 paper, Anti-Money Laundering: Opportunities for Improvement. The paper explains that laundering channels compete on the volume they can move, the risk of detection, simplicity, cost and speed. Its argument for concentrating enforcement on weak points is blunt:

Helix shows why ease of use belongs in that analysis. The market could connect its withdrawals to the mixer, and the mixer adapted its service to the market. A product feature helped deliver the customers whose transactions the operator was supposed to examine.

The Customer Records Helix Promised to Erase

The Financial Crimes Enforcement Network found that Helix failed to collect and verify customer names, addresses and other identifying information. The service also advertised deletion of the limited information it did hold. Its operator’s own words, reproduced in the assessment, explain what customers were being offered:

Deletion was a selling point. FinCEN found that the policy made compliance with the Bank Secrecy Act impossible. The same service that recorded a destination and withdrawal instructions offered to erase the customer’s trail afterward.

The failures extended across the business. FinCEN found no anti-money laundering program, no designated compliance officer, no anti-money laundering training for employees and no independent testing. It also found that Helix failed to conduct appropriate suspicious activity monitoring and filed no suspicious activity reports during the corresponding period.

The cost choice was just as clear. FinCEN found that Helix earned substantial administrator fees from its activity while spending no resources on Bank Secrecy Act compliance. The business took the fees and left the work of identifying suspicious activity to others. The public lost potentially critical information that could help investigators detect crime.

What FinCEN Found in the Helix Case

FinCEN’s civil assessment found willful failures to register, maintain an effective anti-money laundering program and report suspicious activity.

The statement of facts identified at least 2,464 instances in which the operator failed to file a suspicious activity report for Helix transactions. The missing reports covered transfers with darknet markets, other unregistered mixers and BTC-e, an unregistered exchange. The agency also found transactions with Iran-affiliated accounts without appropriate scrutiny.

FinCEN also found that the operator actively helped cybercriminals circumvent controls at U.S. cryptocurrency exchanges. It described public advertising on darknet-market forums, customer service and feedback used to seek out and facilitate high-risk transactions. The business had ways to hear from its customers. It chose to use them to improve the service those customers wanted.

The assessment also covered the operator’s participation in Coin Ninja’s failure to register as a money services business. Its DropBit service let customers send and receive bitcoin through text messages or Twitter handles. FinCEN found that the operator advertised DropBit as a way around know-your-customer procedures. The pitch extended beyond a darknet mixer to a phone-based payment service.

The Evidence Behind a Bitcoin Transfer

A transaction hash can show that bitcoin moved. Exchange ledgers, wallet-control records and customer communications can help explain whose money moved, who directed it and what the business knew. For a Helix-style service, the relationship between those records is the point.

The withdrawal instructions connect a customer request to a destination. Exchange accounts show where the service placed the incoming bitcoin and obtained the outgoing bitcoin. Marketplace integration decisions explain how the business brought that traffic in. Customer-service exchanges and deletion policies can reveal how it responded to the customers it attracted. We examine those connections with insiders who understand how the service actually worked.

Samourai offers a useful comparison in the Justice Department’s account of its criminal case. Its operators pleaded guilty to conspiring to operate a money transmitting business knowingly transmitting criminal proceeds. Whirlpool coordinated bitcoin exchanges, while Ricochet added intermediate transfers. Those product functions, like Helix’s withdrawal integration, make the service’s design relevant to understanding how the money moved.

Who Investigates Money Laundering in the USA?

The IRS Criminal Investigation Cyber Crimes Unit and the FBI Washington Field Office investigated the Helix criminal case. The investigation was coordinated with the Financial Crimes Enforcement Network, which pursued the parallel civil action. The government described investigators tracing tens of millions of dollars from darknet markets to Helix.

Can a Whistleblower Report Money Laundering?

Yes. FinCEN’s whistleblower program can pay for information about money laundering. If you know how a service brought in illicit business, bypassed customer checks or suppressed scrutiny of its transfers, our whistleblower experts can assess that knowledge with you and identify money laundering whistleblower lawyers for the case.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Helix’s civil case arose under the Bank Secrecy Act, which has a separate whistleblower program. Speak to our whistleblower experts about the evidence you hold and the award questions behind your case.

You Know Why the Service Was Built That Way

If you saw a mixer courting darknet markets or an exchange making room for that business, talk with our whistleblower experts about what happened inside. We build the case around your understanding of the transfers and the decisions behind them, bring in money laundering whistleblower lawyers who understand cryptocurrency services, and stay alongside you through the case.