What a mixer actually does
A mixer (or “tumbler”) accepts deposits into a shared pool and lets users withdraw the same denomination later to a different address. Because many people deposit and withdraw the same fixed amount, there is no on-chain arrow saying “this withdrawal came from that deposit.”
That is a genuine break in the trail. Anyone who claims to deterministically “de-mix” a well-used pool is overselling. What responsible analysis produces are leads — ranked candidates, not proof.
Signals that survive the mix
Timing and behavior leak information. A withdrawal minutes after a matching-denomination deposit, address reuse across deposit and withdrawal, a shared relayer, or a distinctive gas-payment pattern can all narrow the candidate set.
Recupero surfaces these as low-confidence demixing leads — explicitly labeled as probabilistic and never followed automatically as if they were a confirmed hop. They are a starting point for a human investigator, not a verdict.
The honest posture
When funds enter a sanctioned or high-risk mixer, the correct forensic statement is often “funds entered the mixer and became unrecoverable through on-chain tracing alone,” not a fabricated downstream address. Overstating certainty here is how investigations get discredited in court.